Directories
¶
| Path | Synopsis |
|---|---|
|
Package authz models the authenticated caller (a Principal) and the authorization decisions made about it.
|
Package authz models the authenticated caller (a Principal) and the authorization decisions made about it. |
|
Package ccguard turns a Legant delegation token into a policy decision for every tool call Claude Code makes — Read, Write, Edit, Bash, WebFetch and MCP tools alike — enforced OFFLINE from the signed token.
|
Package ccguard turns a Legant delegation token into a policy decision for every tool call Claude Code makes — Read, Write, Edit, Bash, WebFetch and MCP tools alike — enforced OFFLINE from the signed token. |
|
Package delegation implements the core authorization primitives that make Legant an agent-identity layer rather than a generic OIDC server:
|
Package delegation implements the core authorization primitives that make Legant an agent-identity layer rather than a generic OIDC server: |
|
chains
Package chains is the database adapter for delegation grants: it hydrates a stored delegation into the pure delegation.Grant the signer mints from, and records the consent that authorizes a root delegation.
|
Package chains is the database adapter for delegation grants: it hydrates a stored delegation into the pure delegation.Grant the signer mints from, and records the consent that authorizes a root delegation. |
|
Package grants turns Legant's delegated authority into a declarative, version-controllable file.
|
Package grants turns Legant's delegated authority into a declarative, version-controllable file. |
|
Package keystore is the single source of signing material for Legant.
|
Package keystore is the single source of signing material for Legant. |
|
Package live is an in-process pub/sub hub for real-time activity events that feed the /admin/live console: every gateway tool-call decision, token mint, and revocation is published here and fanned out to connected SSE clients.
|
Package live is an in-process pub/sub hub for real-time activity events that feed the /admin/live console: every gateway tool-call decision, token mint, and revocation is published here and fanned out to connected SSE clients. |
|
Package mcpauth implements the MCP / OAuth 2.1 authorization surface: RFC 8707 resource indicators, RFC 9728 protected-resource metadata, and the RFC 6750/9728 WWW-Authenticate challenges resource servers return.
|
Package mcpauth implements the MCP / OAuth 2.1 authorization surface: RFC 8707 resource indicators, RFC 9728 protected-resource metadata, and the RFC 6750/9728 WWW-Authenticate challenges resource servers return. |
|
Package mcpgw is the MCP auth-gateway: a reverse proxy that enforces per-tool delegation in front of MCP servers.
|
Package mcpgw is the MCP auth-gateway: a reverse proxy that enforces per-tool delegation in front of MCP servers. |
|
Package metrics is a small, dependency-free Prometheus metrics registry.
|
Package metrics is a small, dependency-free Prometheus metrics registry. |
|
Package retention implements data-retention pruning for Legant's operational tables.
|
Package retention implements data-retention pruning for Legant's operational tables. |
|
Package revocation records every composite (sub/act) delegation token minted by the token-exchange endpoint and lets it be revoked before expiry.
|
Package revocation records every composite (sub/act) delegation token minted by the token-exchange endpoint and lets it be revoked before expiry. |
|
Package safehttp provides an HTTP client hardened against SSRF, for fetching attacker-influenced URLs (CIMD documents, JWKS, MCP upstreams).
|
Package safehttp provides an HTTP client hardened against SSRF, for fetching attacker-influenced URLs (CIMD documents, JWKS, MCP upstreams). |
|
Package testsupport provides shared helpers for integration tests that need a real Postgres database.
|
Package testsupport provides shared helpers for integration tests that need a real Postgres database. |
Click to show internal directories.
Click to hide internal directories.