Help us shape the future of Go! Take the 2026 Go Developer Survey

platformmcp

package
v0.0.0-...-0370dea Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 1, 2026 License: AGPL-3.0 Imports: 202 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	AccessReadsConnectionLimitName   = "platform-mcp-access-reads-connection"
	AccessReadsOrganizationLimitName = "platform-mcp-access-reads-organization"

	AccessReadQueriesPerConnectionPerMinute   = 30
	AccessReadQueriesPerOrganizationPerMinute = 300
)
View Source 
const (
	ChatRiskWithFindings    = "with_findings"
	ChatRiskWithoutFindings = "without_findings"
)

Risk presence filters a listing may narrow to. Empty means no filter.

View Source 
const (
	DeploymentRedeployConnectionLimitName       = "platform_mcp_deployment_redeploy_connection"
	DeploymentRedeployOrganizationLimitName     = "platform_mcp_deployment_redeploy_organization"
	DeploymentRedeploysPerConnectionPerMinute   = 2
	DeploymentRedeploysPerOrganizationPerMinute = 10
)
View Source 
const (
	DiagnosticsConnectionLimitName   = "platform-mcp-diagnostics-connection"
	DiagnosticsOrganizationLimitName = "platform-mcp-diagnostics-organization"
)
View Source 
const (
	SensitiveDiagnosticsConnectionLimitName   = "platform-mcp-sensitive-diagnostics-connection"
	SensitiveDiagnosticsOrganizationLimitName = "platform-mcp-sensitive-diagnostics-organization"
	DrilldownRowsLimitName                    = "platform-mcp-drilldown-rows"
	DrilldownMetricQueriesLimitName           = "platform-mcp-drilldown-metric-queries"
)
View Source 
const (
	SubjectStateActive         = "active"
	SubjectStateInactive       = "inactive"
	SubjectStateNoObservations = "no_observations"
)

Subject state categories. Closed vocabulary, assigned server-side: a category is the whole answer, so there is no count to reconstruct an individual's activity pattern from.

View Source 
const (
	MCPConnectionStateActive                  = "active"
	MCPConnectionStateNotConnected            = "not_connected"
	MCPConnectionStateReauthorizationRequired = "reauthorization_required"
	MCPConnectionStateSetupRequired           = "setup_required"
	MCPConnectionStateNotApplicable           = "not_applicable"

	// MCPConnectionReasonPermissionRequired marks a member who lacks
	// mcp:connect on the server, so no sign-in can make it usable.
	MCPConnectionReasonPermissionRequired = "permission_required"

	// MCPConnectionReasonIdentityChaining marks an active connection served by
	// a usable identity chaining credential rather than an interactive one.
	MCPConnectionReasonIdentityChaining = "identity_chaining"
)
View Source 
const (
	ConnectionAuthStateNotConnected            = "not_connected"
	ConnectionAuthStateActive                  = "active"
	ConnectionAuthStateReauthorizationRequired = "reauthorization_required"
)
View Source 
const (
	CatalogConnectionLimitName         = "platform-mcp-catalog-connection"
	CatalogOrganizationLimitName       = "platform-mcp-catalog-organization"
	RegistrationConnectionLimitName    = "platform-mcp-registration-connection"
	RegistrationOrganizationLimitName  = "platform-mcp-registration-organization"
	HandoffConnectionLimitName         = "platform-mcp-handoff-connection"
	HandoffOrganizationLimitName       = "platform-mcp-handoff-organization"
	SetupConnectionLimitName           = "platform-mcp-setup-connection"
	SetupOrganizationLimitName         = "platform-mcp-setup-organization"
	RepairConnectionLimitName          = "platform-mcp-repair-connection"
	RepairOrganizationLimitName        = "platform-mcp-repair-organization"
	DocsConnectionLimitName            = "platform-mcp-docs-connection"
	DocsOrganizationLimitName          = "platform-mcp-docs-organization"
	SkillsConnectionLimitName          = "platform-mcp-skills-connection"
	SkillsOrganizationLimitName        = "platform-mcp-skills-organization"
	LifecycleConnectionLimitName       = "platform-mcp-lifecycle-connection"
	LifecycleOrganizationLimitName     = "platform-mcp-lifecycle-organization"
	SessionRecallConnectionLimitName   = "platform-mcp-session-recall-connection"
	SessionRecallOrganizationLimitName = "platform-mcp-session-recall-organization"
	RiskMutationConnectionLimitName    = "platform-mcp-risk-mutation-connection"
	RiskMutationOrganizationLimitName  = "platform-mcp-risk-mutation-organization"
	ReviewRequestConnectionLimitName   = "platform-mcp-review-request-connection"
	ReviewRequestOrganizationLimitName = "platform-mcp-review-request-organization"
)
View Source 
const (
	PluginAssignmentMutationConnectionLimitName   = "platform-mcp-plugin-assignment-mutation-connection"
	PluginAssignmentMutationOrganizationLimitName = "platform-mcp-plugin-assignment-mutation-organization"
	PluginMetadataMutationConnectionLimitName     = "platform-mcp-plugin-metadata-mutation-connection"
	PluginMetadataMutationOrganizationLimitName   = "platform-mcp-plugin-metadata-mutation-organization"
	AccessRoleMutationConnectionLimitName         = "platform-mcp-access-role-mutation-connection"
	AccessRoleMutationOrganizationLimitName       = "platform-mcp-access-role-mutation-organization"
	ShadowAccessDecisionConnectionLimitName       = "platform-mcp-shadow-access-decision-connection"
	ShadowAccessDecisionOrganizationLimitName     = "platform-mcp-shadow-access-decision-organization"
	ToolExposureReadConnectionLimitName           = "platform-mcp-tool-exposure-read-connection"
	ToolExposureReadOrganizationLimitName         = "platform-mcp-tool-exposure-read-organization"
	ToolExposureMutationConnectionLimitName       = "platform-mcp-tool-exposure-mutation-connection"
	ToolExposureMutationOrganizationLimitName     = "platform-mcp-tool-exposure-mutation-organization"
	DataExportToggleConnectionLimitName           = "platform-mcp-data-export-toggle-connection"
	DataExportToggleOrganizationLimitName         = "platform-mcp-data-export-toggle-organization"
	PluginRepublishConnectionLimitName            = "platform-mcp-plugin-republish-connection"
	PluginRepublishOrganizationLimitName          = "platform-mcp-plugin-republish-organization"
	ProjectMutationConnectionLimitName            = "platform-mcp-project-mutation-connection"
	ProjectMutationOrganizationLimitName          = "platform-mcp-project-mutation-organization"
	GatewayMutationConnectionLimitName            = "platform-mcp-gateway-mutation-connection"
	GatewayMutationOrganizationLimitName          = "platform-mcp-gateway-mutation-organization"
)
View Source 
const (
	// DocsQueriesPerConnectionPerMinute allows iterative documentation research
	// over the bounded in-process corpus without throttling ordinary reading.
	DocsQueriesPerConnectionPerMinute = 120

	// DocsQueriesPerOrganizationPerMinute leaves room for concurrent researchers
	// while retaining a ceiling on repeated in-process retrieval.
	DocsQueriesPerOrganizationPerMinute = 1200

	// SkillsOperationsPerConnectionPerMinute leaves room for reviewing dozens of
	// suggestions, including the reads and approvals sharing this allowance.
	SkillsOperationsPerConnectionPerMinute = 120

	// SkillsOperationsPerOrganizationPerMinute allows multiple connections to
	// review skills concurrently while retaining an organization-wide ceiling.
	SkillsOperationsPerOrganizationPerMinute = 1200

	// LifecycleOperationsPerConnectionPerMinute supports read/change/read across
	// several servers. The moderate ceiling also bounds client-admission writes.
	LifecycleOperationsPerConnectionPerMinute = 30

	// LifecycleOperationsPerOrganizationPerMinute leaves room for concurrent
	// administrators without removing the shared metadata/admission ceiling.
	LifecycleOperationsPerOrganizationPerMinute = 300

	// DiagnosticQueriesPer* bound the summary reads: the project overview and
	// the per-MCP diagnosis. They are generous because an administrator
	// investigating an incident legitimately makes many of them in a short
	// burst, and each one is a bounded aggregate that names no subject.
	DiagnosticQueriesPerConnectionPerMinute   = 60
	DiagnosticQueriesPerOrganizationPerMinute = 600

	// SensitiveDiagnosticQueriesPer* bound the drill-downs. They are metered
	// separately and lower than the summaries because they reach row-level
	// occurrences and, in one case, an individual: a caller must not be able to
	// fund them by spending the summary allowance.
	SensitiveDiagnosticQueriesPerConnectionPerMinute   = 30
	SensitiveDiagnosticQueriesPerOrganizationPerMinute = 300

	// RiskMutationsPer* bound all risk policy and exclusion writes together.
	// Keeping one shared budget prevents a caller from multiplying the permitted
	// write rate by alternating between mutation tools.
	RiskMutationsPerConnectionPerMinute   = 5
	RiskMutationsPerOrganizationPerMinute = 50

	// PluginAssignmentMutationsPerConnectionPerMinute supports rolling out
	// assignments across dozens of plugins while bounding access-affecting writes.
	PluginAssignmentMutationsPerConnectionPerMinute = 30

	// PluginAssignmentMutationsPerOrganizationPerMinute allows concurrent
	// administrators to manage assignments under an organization-wide ceiling.
	PluginAssignmentMutationsPerOrganizationPerMinute = 300

	// AccessRoleMutationsPerConnectionPerMinute supports creating, updating and
	// assigning roles in one bulk administration workflow.
	AccessRoleMutationsPerConnectionPerMinute = 30

	// AccessRoleMutationsPerOrganizationPerMinute bounds access-role changes
	// across concurrent administrators independently of other mutation budgets.
	AccessRoleMutationsPerOrganizationPerMinute = 300

	ShadowAccessDecisionsPerConnectionPerMinute   = 5
	ShadowAccessDecisionsPerOrganizationPerMinute = 50
	ReviewRequestsPerConnectionPerMinute          = 5
	ReviewRequestsPerOrganizationPerMinute        = 50

	// PluginMetadataMutationsPer* bound creating and renaming plugins together
	// on their own allowance. This is what stops a conversational create loop;
	// there is no separate cap on how many plugins a project holds, because the
	// dashboard has none and the two paths must refuse the same requests.
	PluginMetadataMutationsPerConnectionPerMinute   = 5
	PluginMetadataMutationsPerOrganizationPerMinute = 50

	// ToolExposureReadsPerConnectionPerMinute allows paging through bounded
	// project tool definitions without spending the separate mutation allowance.
	ToolExposureReadsPerConnectionPerMinute = 120

	// ToolExposureReadsPerOrganizationPerMinute supports concurrent tool
	// inventory inspection while retaining an organization-wide read ceiling.
	ToolExposureReadsPerOrganizationPerMinute = 1200

	// ToolExposureMutationsPer* bound adding and removing a server's tools on
	// their own allowance. Both tools share it, so alternating between them
	// cannot multiply the permitted write rate: each allowed call takes the
	// toolset row lock, appends a version, and republishes every plugin
	// carrying the server.
	ToolExposureMutationsPerConnectionPerMinute   = 5
	ToolExposureMutationsPerOrganizationPerMinute = 50

	// GatewayMutationsPer* bound creating gateways and setting their members
	// on one allowance, so alternating between the two cannot multiply the
	// write rate. Each allowed call locks the gateway and may republish every
	// plugin carrying it.
	GatewayMutationsPerConnectionPerMinute   = 5
	GatewayMutationsPerOrganizationPerMinute = 50

	// DataExportTogglesPer* bound pausing and resuming data export routes on
	// their own allowance. Both tools share it, so alternating between them
	// cannot multiply the permitted write rate. A person handling an incident
	// pauses a handful of routes, never dozens a minute; each allowed call
	// takes the route row lock and writes an audit entry.
	DataExportTogglesPerConnectionPerMinute   = 5
	DataExportTogglesPerOrganizationPerMinute = 50

	// PluginRepublishesPer* bound republish_plugin on its own allowance. Each
	// allowed call can regenerate every package in a project, so it is metered
	// like the other package-affecting writes rather than like a read.
	PluginRepublishesPerConnectionPerMinute   = 5
	PluginRepublishesPerOrganizationPerMinute = 50

	// ProjectMutationsPer* bound creating and renaming projects on their own
	// allowance, shared by both tools so alternating between them cannot
	// multiply the write rate. A person sets up a handful of projects at a
	// time; a loop creating them by the dozen is a runaway agent, and every
	// created project is a row an administrator has to delete by hand.
	ProjectMutationsPerConnectionPerMinute   = 5
	ProjectMutationsPerOrganizationPerMinute = 50

	// DrilldownRowsPerConnectionPerWindow and
	// DrilldownMetricQueriesPerConnectionPerWindow are the second cap the
	// drill-downs carry, over DrilldownVolumeWindow. A per-minute call budget
	// alone does not bound how much a caller can accumulate: paging steadily
	// under the call rate still walks an entire window's occurrences. These
	// meter the volume rather than the calls.
	DrilldownRowsPerConnectionPerWindow          = 1000
	DrilldownMetricQueriesPerConnectionPerWindow = 20

	// SessionRecallsPer* bound session recall and captured chat search and reads.
	// These reads share a separate, lower allowance because they return
	// transcript content; metadata and aggregate reads cannot fund them.
	SessionRecallsPerConnectionPerMinute   = 10
	SessionRecallsPerOrganizationPerMinute = 100
)
View Source 
const (
	// PluginRepublishEnqueued means a publish of the project's packages was
	// requested. It has not necessarily landed yet.
	PluginRepublishEnqueued = "enqueued"
	// PluginRepublishAlreadyCurrent means the plugin's stored package inputs
	// already matched, so nothing was requested.
	PluginRepublishAlreadyCurrent = "already_current"
)

Republish outcomes.

View Source 
const (
	PluginsConnectionLimitName   = "platform-mcp-plugins-connection"
	PluginsOrganizationLimitName = "platform-mcp-plugins-organization"
)
View Source 
const (
	// PluginQueriesPerConnectionPerMinute supports paging and inspecting dozens
	// of plugins without spending the separate assignment mutation allowance.
	PluginQueriesPerConnectionPerMinute = 120

	// PluginQueriesPerOrganizationPerMinute leaves room for concurrent inventory
	// inspection while bounding the aggregate rate of PostgreSQL reads.
	PluginQueriesPerOrganizationPerMinute = 1200
)
View Source 
const (
	// PluginPublicationPublished means the project's package repository holds a
	// published package for this plugin.
	PluginPublicationPublished = "published"
	// PluginPublicationUnpublished means the project has a package repository
	// but nothing published for this plugin yet.
	PluginPublicationUnpublished = "unpublished"
	// PluginPublicationNoRepository means the project has no package repository
	// connected, so no plugin in it can be published at all.
	PluginPublicationNoRepository = "no_repository"
)

Plugin publication states.

View Source 
const (
	ForcedReadinessProbeLimit      = "platform-mcp-forced-readiness-probe"
	ForcedReadinessProbesPerMinute = 3
)
View Source 
const (
	RiskFindingsConnectionLimitName   = "platform-mcp-risk-findings-connection"
	RiskFindingsOrganizationLimitName = "platform-mcp-risk-findings-organization"
	// Findings expose row-level metadata, so use the sensitive-read allowance
	// without spending the diagnostics or risk-mutation buckets.
	RiskFindingsQueriesPerConnectionPerMinute   = SensitiveDiagnosticQueriesPerConnectionPerMinute
	RiskFindingsQueriesPerOrganizationPerMinute = SensitiveDiagnosticQueriesPerOrganizationPerMinute
)
View Source 
const (
	Path         = "/platform-mcp"
	TokenType    = "Bearer"
	MaxBodyBytes = 64 << 10
)
View Source 
const (
	AutomaticClientRegistrationDCR  = "dynamic_client_registration"
	AutomaticClientRegistrationCIMD = "client_id_metadata_document"
	AutomaticClientRegistrationNone = "none"
)

Automatic client registration paths reported by inspect_mcp_candidate.

View Source 
const (
	DistributionAdmissionNotApplicable  = "not_applicable"
	DistributionAdmissionNotDistributed = "not_distributed"
	DistributionAdmissionEmptyAudience  = "empty_audience"
	DistributionAdmissionNotRequired    = "not_required"
	DistributionAdmissionCovered        = "covered"
	DistributionAdmissionRepairRequired = "repair_required"
	DistributionAdmissionUnavailable    = "unavailable"
)
View Source 
const (
	SkillInsightsSortEstimatedMinutesSaved = "estimated_minutes_saved"
	SkillInsightsSortEfficacy              = "efficacy"
	SkillInsightsSortActivations           = "activations"
	SkillInsightsSortSessionCost           = "session_cost"
)
View Source 
const (
	SubjectIdentityEmail    = "email"
	SubjectIdentityExternal = "external"
	SubjectIdentityUser     = "user"
)

Identity kinds carried inside a user reference. Telemetry records a person under one of three different columns, and the value alone does not say which: filtering an external user id as though it were an email matches nothing and reports an active person as inactive. The minting side states the column, so the reading side can filter the right one.

View Source 
const (
	ToolCallOutcomeSuccess = "success"
	ToolCallOutcomeFailure = "failure"
	ToolCallOutcomeBlocked = "blocked"
	ToolCallOutcomePending = "pending"
)

Tool-call outcomes a search may narrow to. They are the trace-level outcomes the Tool Logs page filters on, spelled the way a result row reports them.

View Source 
const (
	UserTypeInternal = "internal"
	UserTypeExternal = "external"
)

User types a search may be asked about. They are the two identity columns telemetry attributes a person under: an organization's own people, keyed by email, and the end users of hosted MCP servers, keyed by external user id.

View Source 
const AssistantClientID = "gram-project-assistant"

AssistantClientID names the acting client on assistant-originated calls, so telemetry and audit can tell an assistant-driven change from an external client's.

View Source 
const DefaultDiagnosticWindow = DiagnosticWindowLastDay

DefaultDiagnosticWindow is what an unspecified window resolves to when a tool states no narrower default.

View Source 
const DrilldownVolumeWindow = 10 * time.Minute

DrilldownVolumeWindow is the interval the drill-down volume caps refill over.

View Source 
const GetMCPToolPagingNote = "" /* 353-byte string literal not displayed */

GetMCPToolPagingNote is shared by every surface that serves get_mcp, so the paging contract reads the same wherever an agent meets it.

View Source 
const ProviderAuthorizationClientCredential = "client_credential"

ProviderAuthorizationClientCredential is the Absence of an identity whose authorization is the credential a self remote session client holds for itself. No subject grant exists, so the client and its issuer identify it, and a replaced credential is the same authorization.

View Source 
const ProviderAuthorizationIdentityChaining = "identity_chaining"

ProviderAuthorizationIdentityChaining is the absence recorded when a usable chained credential, not an interactive session, authorizes the caller.

View Source 
const ReadinessEvidenceIdentityChainingActive = "identity_chaining_active"

ReadinessEvidenceIdentityChainingActive marks an upstream with no interactive session that the caller reaches through a usable chained credential, one the provider already issued.

View Source 
const ReadinessEvidenceIdentityChainingConfigured = "identity_chaining_configured"

ReadinessEvidenceIdentityChainingConfigured marks an upstream with no interactive session that identity chaining is configured to serve. It is configuration evidence only: the provider has not answered.

View Source 
const StaleWatermarkThreshold = 5 * time.Minute

StaleWatermarkThreshold is how far behind the observation watermark may fall before a diagnostic reports itself stale. Telemetry reaches the read model through batched ingestion, so a small lag is normal; beyond this the answer is old enough that a caller acting on it could be reasoning about a system state that has already changed.

View Source 
const SubjectReferenceTTL = 10 * time.Minute

SubjectReferenceTTL bounds how long an opaque reference stays usable. A reference is a handle for one investigation, not a durable identifier: a short life keeps it from accumulating in a caller's notes or being replayed against a later session.

View Source 
const SubjectSuppressionThreshold = 5

SubjectSuppressionThreshold is the smallest subject count a diagnostic will state exactly. Below it the count itself identifies: "one active user in this project last hour" names a person to anyone who knows the team.

Variables

View Source 
var (
	ErrAccessReferenceNotFound = errors.New("platform mcp access reference not found")
	ErrAccessMCPNotFound       = errors.New("platform mcp access target not found")
	ErrAccessQueryRequired     = errors.New("platform mcp access member filter required")
)
View Source 
var (
	ErrAccessRoleMutationUnavailable = errors.New("platform mcp access role mutations unavailable")
	ErrAccessRoleMutationInvalid     = errors.New("invalid platform mcp access role mutation")
	ErrAccessRoleMutationNotFound    = errors.New("platform mcp access role mutation target not found")
	ErrAccessRoleMutationConflict    = errors.New("platform mcp access role mutation conflict")
)
View Source 
var (
	// ErrAnalyticsNotEnabled marks a read for an organization that has
	// Explore switched off.
	ErrAnalyticsNotEnabled = errors.New("platform mcp analytics not enabled")
	// ErrAnalyticsInvalid marks a read that does not name one exact project.
	ErrAnalyticsInvalid = errors.New("invalid platform mcp analytics read")
	// ErrAnalyticsDatasetRestricted marks a read of a dataset the caller may
	// not read although they can read its project, such as one only
	// organization administrators may read.
	ErrAnalyticsDatasetRestricted = errors.New("platform mcp analytics dataset restricted")
)
View Source 
var (
	ErrCatalogUnavailable = errors.New("platform mcp catalog unavailable")
	ErrCatalogRejected    = errors.New("platform mcp catalog candidate rejected")
)
View Source 
var (
	ErrIdentityProviderAttachmentUnavailable = errors.New("platform mcp identity provider attachment unavailable")
	ErrIdentityProviderAttachmentUnsupported = errors.New("platform mcp identity provider attachment unsupported")
	ErrIdentityProviderAttachmentConflict    = errors.New("platform mcp identity provider attachment conflict")
)
View Source 
var (
	ErrClientAdmissionInvalid     = errors.New("invalid platform mcp client admission request")
	ErrClientAdmissionUnavailable = errors.New("platform mcp client admission unavailable")
)
View Source 
var (
	ErrMCPConnectionMutationInvalid  = errors.New("invalid MCP connection mutation")
	ErrMCPConnectionMutationConflict = errors.New("MCP connection settings changed")
	ErrMCPConnectionMutationMissing  = errors.New("MCP connection target not found")
)
View Source 
var (
	ErrMCPConnectionSettingsInvalid  = errors.New("invalid MCP connection settings target")
	ErrMCPConnectionSettingsNotFound = errors.New("MCP connection settings target not found")
)
View Source 
var (
	ErrDataExportToggleInvalid  = errors.New("invalid data export pause or resume request")
	ErrDataExportToggleMissing  = errors.New("data export route not found")
	ErrDataExportToggleRefused  = errors.New("data export route cannot be resumed")
	ErrDataExportToggleConflict = errors.New("data export pause or resume idempotency conflict")
)
View Source 
var (
	// ErrDeviceCoverageInvalid marks an argument the caller can correct, kept
	// apart from ErrDeviceCoverageUnavailable so a typo is not read as the
	// feature being off.
	ErrDeviceCoverageInvalid     = errors.New("invalid platform mcp device coverage request")
	ErrDeviceCoverageUnavailable = errors.New("platform mcp device coverage unavailable")
)
View Source 
var (
	ErrDirectRemoteRejected    = errors.New("direct remote MCP URL rejected")
	ErrDirectRemoteUnavailable = errors.New("direct remote MCP inspection unavailable")
)
View Source 
var (
	ErrDistributionInvalid                = errors.New("invalid platform mcp distribution input")
	ErrDistributionConflict               = errors.New("platform mcp distribution version conflict")
	ErrDistributionNotReady               = errors.New("platform mcp distribution requires fresh readiness")
	ErrDistributionDefaultAbsent          = errors.New("platform mcp distribution requires an existing default plugin")
	ErrDistributionTargetUnavailable      = errors.New("platform mcp distribution target is unavailable")
	ErrDistributionBlockedPendingApproval = errors.New("platform mcp distribution blocked by Shadow MCP approval enforcement")
	ErrDistributionAdmissionUnavailable   = errors.New("platform mcp distribution admission unavailable")
	ErrDistributionMCPNotFound            = errors.New("platform mcp distribution mcp server not found")
)
View Source 
var (
	ErrFeedbackInvalid     = errors.New("invalid platform mcp feedback")
	ErrFeedbackConflict    = errors.New("platform mcp feedback idempotency conflict")
	ErrFeedbackRateLimited = errors.New("platform mcp feedback rate limited")
	ErrFeedbackUnavailable = errors.New("platform mcp feedback unavailable")
	ErrFeedbackForbidden   = errors.New("platform mcp feedback connection is no longer active")
)
View Source 
var (
	ErrGatewayInvalid  = errors.New("invalid platform mcp gateway request")
	ErrGatewayMissing  = errors.New("platform mcp gateway target not found")
	ErrGatewayRefused  = errors.New("platform mcp gateway member refused")
	ErrGatewayConflict = errors.New("platform mcp gateway conflict")
)
View Source 
var (
	ErrSetupHandoffInvalid = errors.New("invalid platform mcp setup handoff")
	ErrReadinessInvalid    = errors.New("invalid platform mcp readiness")
)
View Source 
var (
	ErrLifecycleVisibilityInvalid     = errors.New("invalid platform mcp visibility update")
	ErrLifecycleVisibilityUnavailable = errors.New("platform mcp visibility is unavailable for this target")
)
View Source 
var (
	ErrMCPToolExposureInvalid  = errors.New("invalid MCP tool exposure request")
	ErrMCPToolExposureConflict = errors.New("MCP tool list changed")
	ErrMCPToolExposureMissing  = errors.New("MCP tool exposure target not found")
	// ErrMCPToolExposureShared marks a tool list shared too widely to change
	// from here. It is deliberately not ErrMCPToolExposureConflict: a conflict
	// tells the caller to re-read and repeat, and the shipped skill does
	// exactly that, which for these two refusals would be an instruction to
	// loop forever on a request that can never succeed.
	ErrMCPToolExposureShared = errors.New("MCP tool list is shared beyond this change's reach")
	ErrToolInventoryCursor   = errors.New("invalid platform mcp tool inventory cursor")
)
View Source 
var (
	ErrOperationRateLimited       = errors.New("platform mcp operation rate limited")
	ErrOperationBudgetUnavailable = errors.New("platform mcp operation budget unavailable")
)
View Source 
var (
	ErrPluginAssignmentMutationUnavailable = errors.New("platform mcp plugin assignment mutations unavailable")
	ErrPluginAssignmentMutationInvalid     = errors.New("invalid platform mcp plugin assignment mutation")
	ErrPluginAssignmentMutationNotFound    = errors.New("platform mcp plugin assignment not found")
	ErrPluginAssignmentMutationConflict    = errors.New("platform mcp plugin assignment mutation conflict")
)
View Source 
var (
	ErrPluginMetadataMutationUnavailable = errors.New("platform mcp plugin metadata mutations unavailable")
	ErrPluginMetadataMutationInvalid     = errors.New("invalid platform mcp plugin metadata mutation")
	ErrPluginMetadataMutationConflict    = errors.New("platform mcp plugin metadata mutation conflict")
)
View Source 
var (
	ErrPluginRepublishInvalid       = errors.New("invalid platform mcp plugin republish")
	ErrPluginRepublishUnavailable   = errors.New("platform mcp plugin republish unavailable")
	ErrPluginRepublishNotConfigured = errors.New("platform mcp plugin publishing not configured")
	ErrPluginRepublishConflict      = errors.New("platform mcp plugin republish conflict")
)
View Source 
var (
	// ErrPluginProjectNotFound is a project this principal may not read, or one
	// that does not exist. The two are deliberately one answer: distinguishing
	// them tells a caller which project ids exist in other organizations.
	ErrPluginProjectNotFound = errors.New("platform mcp plugin project not found")
	// ErrPluginNotFound is a named plugin that matches nothing in the project.
	ErrPluginNotFound = errors.New("platform mcp plugin not found")
	// ErrPluginAmbiguous is a name matching more than one plugin. It is never
	// resolved by picking one, and never by falling back to the default plugin.
	ErrPluginAmbiguous = errors.New("platform mcp plugin target ambiguous")
	// ErrPluginCursorInvalid is a page cursor that was not issued for this
	// principal, project, and listing.
	ErrPluginCursorInvalid = errors.New("invalid platform MCP plugin cursor")
)
View Source 
var (
	ErrProjectLifecycleInvalid  = errors.New("invalid project lifecycle request")
	ErrProjectLifecycleConflict = errors.New("project lifecycle conflict")
	ErrProjectLifecycleMissing  = errors.New("project lifecycle target not found")
)
View Source 
var (
	ErrProviderAdapterUnavailable  = errors.New("platform mcp provider adapter unavailable")
	ErrSetupHandoffReissueRequired = errors.New("platform mcp setup handoff reissue required")
)
View Source 
var (
	ErrReadinessRateLimited          = errors.New("platform mcp readiness probe rate limited")
	ErrReadinessRegistrationNotFound = errors.New("platform mcp readiness registration not found")
)
View Source 
var (
	ErrRegistrationConflict = errors.New("platform mcp registration idempotency conflict")
	ErrRegistrationInvalid  = errors.New("invalid platform mcp registration input")
	ErrTargetIneligible     = errors.New("platform mcp registration target is ineligible")
)
View Source 
var (
	ErrRiskMutationUnavailable = errors.New("platform mcp risk mutations unavailable")
	ErrRiskMutationInvalid     = errors.New("invalid platform mcp risk mutation")
	ErrRiskMutationNotFound    = errors.New("platform mcp risk mutation target not found")
	ErrRiskMutationConflict    = errors.New("platform mcp risk mutation conflict")
)
View Source 
var (
	ErrRiskReadInvalid  = errors.New("invalid platform mcp risk read")
	ErrRiskReadNotFound = errors.New("platform mcp risk resource not found")
)
View Source 
var (
	ErrUnauthorized = errors.New("platform mcp unauthorized")
	ErrForbidden    = errors.New("platform mcp forbidden")
	ErrUnavailable  = errors.New("platform mcp unavailable")
)
View Source 
var (
	// ErrShadowAIInvalid marks an argument the caller can correct itself, such
	// as a category outside the scan library's vocabulary. It is kept apart
	// from ErrShadowAIUnavailable so a mistyped argument is not reported as the
	// whole feature being switched off: the caller should fix the argument and
	// retry, not conclude Shadow AI is unavailable to this organization.
	ErrShadowAIInvalid     = errors.New("invalid platform mcp shadow ai request")
	ErrShadowAIUnavailable = errors.New("platform mcp shadow ai unavailable")
)
View Source 
var (
	ErrShadowDecisionInvalid     = errors.New("invalid platform mcp shadow access decision")
	ErrShadowDecisionNotFound    = errors.New("platform mcp shadow access decision target not found")
	ErrShadowDecisionUnavailable = errors.New("platform mcp shadow access decisions unavailable")
)
View Source 
var (
	ErrShadowInventoryInvalid     = errors.New("invalid platform mcp shadow inventory request")
	ErrShadowInventoryNotFound    = errors.New("platform mcp shadow inventory target not found")
	ErrShadowInventoryUnavailable = errors.New("platform mcp shadow inventory unavailable")
)
View Source 
var (
	// ErrSkillMCPTargetNotFound is an exact MCP server or gateway that does
	// not exist in the named project. It is never softened into another
	// surface.
	ErrSkillMCPTargetNotFound = errors.New("platform mcp skill link target not found")
	// ErrSkillMCPTargetAmbiguous is a name matching more than one MCP server
	// or gateway.
	ErrSkillMCPTargetAmbiguous = errors.New("platform mcp skill link target ambiguous")
	// ErrSkillLinkNotConfirmed is a link write whose result the post-write
	// read could not find.
	ErrSkillLinkNotConfirmed = errors.New("platform mcp skill link not visible after write")
)
View Source 
var (
	// ErrSkillsUnavailable is the kill switch and the missing-dependency path:
	// the capability is off for this organization, or this deployment composed
	// no skills service.
	ErrSkillsUnavailable = errors.New("platform mcp skills unavailable")
	// ErrSkillTargetNotFound is an exact target that does not exist in the
	// named project. It is never softened into the default plugin: distributing
	// a skill somewhere the caller did not name is the one outcome authoring
	// safety depends on not happening.
	ErrSkillTargetNotFound = errors.New("platform mcp skill distribution target not found")
	// ErrSkillTargetAmbiguous is a target name matching more than one plugin or
	// assistant. Picking one would be a coin flip the caller cannot see.
	ErrSkillTargetAmbiguous = errors.New("platform mcp skill distribution target ambiguous")
	// ErrSkillContentTooLarge is a manifest over the reviewed ceiling.
	ErrSkillContentTooLarge = errors.New("platform mcp skill content too large")
)
View Source 
var (
	ErrDataExportConfirmationRequired = errors.New("data export creation requires confirmation")
	ErrDataExportInvalidInput         = errors.New("invalid data export input")
	ErrDataExportRouteConflict        = errors.New("a data export route already exists for this source")
)
View Source 
var ErrAnalyticsDefinitionNotFound = errors.New("signal definition not captured")

ErrAnalyticsDefinitionNotFound identifies an unavailable historical snapshot.

View Source 
var ErrCatalogConfigurationRejected = fmt.Errorf("platform mcp catalog configuration rejected")
View Source 
var ErrCatalogCursorInvalid = errors.New("invalid platform mcp catalog cursor")
View Source 
var ErrChatListInvalid = errors.New("invalid platform mcp chat list")

ErrChatListInvalid is returned for a filter outside the closed sets, a malformed selector, or a source label that cannot be matched safely.

View Source 
var (
	// ErrDashboardsNotEnabled marks a call for an organization that has
	// Explore switched off.
	ErrDashboardsNotEnabled = errors.New("platform mcp dashboards not enabled")
)
View Source 
var ErrDefaultProjectNotFound = errors.New("platform mcp default project not found")

ErrDefaultProjectNotFound is a ProjectScopeDefaultable call that named no project in an organization that has no default project.

View Source 
var ErrDiagnosticWindowInvalid = fmt.Errorf("window must be one of %s, %s, %s, %s",
	DiagnosticWindowLastHour, DiagnosticWindowLastDay, DiagnosticWindowLastWeek, DiagnosticWindowLastMonth)

ErrDiagnosticWindowInvalid is returned for a window outside the closed set.

View Source 
var ErrDiagnosticWindowTooLong = errors.New("window is longer than this tool allows")

ErrDiagnosticWindowTooLong is returned for a window this tool will not look back over. It is refused rather than clamped for the same reason an unknown window is: a caller must never be told about a different interval than the one it asked for.

View Source 
var ErrDiagnosticsTargetNotFound = errors.New("platform mcp diagnostics target not found")
View Source 
var ErrDistributionVersionTokenInvalid = errors.New("invalid platform mcp distribution version token")
View Source 
var ErrInstallTargetNotFound = errors.New("install target not found")
View Source 
var ErrInventoryCursorInvalid = errors.New("invalid platform MCP inventory cursor")
View Source 
var ErrInvitationRequiresSSO = errors.New("invitation requires signing in with SSO")

ErrInvitationRequiresSSO refuses to join an organization whose SSO connection covers the invitee's email when the user did not sign in through it.

View Source 
var ErrLifecycleMetadataInvalid = errors.New("invalid platform mcp metadata update")
View Source 
var ErrMemberMCPStatusTargetNotFound = errors.New("member MCP status target not found")
View Source 
var ErrOnboardingInvalid = errors.New("invalid platform mcp onboarding input")
View Source 
var ErrOrganizationGatewayActivityUnavailable = errors.New("platform mcp organization gateway activity unavailable")

ErrOrganizationGatewayActivityUnavailable marks a deployment that cannot serve the read, kept apart from authorization and budget refusals.

View Source 
var ErrRegistrationUnavailable = errors.New("platform mcp catalog registration unavailable")
View Source 
var ErrRiskCursorInvalid = errors.New("invalid platform mcp risk cursor")
View Source 
var ErrSetupGuideUnavailable = errors.New("platform mcp setup guide unavailable")

ErrSetupGuideUnavailable is returned instead of setup content that is too far past its revalidation date to stand behind. Callers surface it as the guide_unavailable code with the guide's canonical links, so the model hands the reader a trusted source rather than inventing steps.

View Source 
var ErrShadowDecisionConflict = errors.New("platform mcp shadow decision conflict")
View Source 
var ErrSubjectReferenceNotFound = errors.New("platform mcp subject reference not found")

ErrSubjectReferenceNotFound is what an unknown, expired, cross-generation, or cross-organization reference resolves to. It is deliberately a single not-found rather than a set of distinguishable failures: telling a caller that a reference is "expired" rather than "unknown" confirms the reference once existed, which is itself information about another organization.

View Source 
var ErrToolCallSearchInvalid = errors.New("platform mcp tool call search input invalid")

ErrToolCallSearchInvalid is returned for an input this surface refuses.

View Source 
var ErrToolNotFound = errors.New("platform mcp tool not found for this audience")

ErrToolNotFound reports a tool that is not admitted to the requested audience.

View Source 
var ErrUserSearchInvalid = errors.New("platform mcp user search input invalid")

ErrUserSearchInvalid is returned for an input this surface refuses.

View Source 
var ErrWidgetsNotEnabled = errors.New("platform mcp widgets not enabled")

ErrWidgetsNotEnabled marks a call for an organization that has Explore switched off.

View Source 
var ErrWorkflowRunInvalid = errors.New("invalid platform mcp workflow run report")

ErrWorkflowRunInvalid reports a report the tool contract rejects before anything is emitted.

Functions

func AttachManagement 

func AttachManagement(mux goahttp.Muxer, service *ManagementService)

func ContextWithPrincipal 

func ContextWithPrincipal(ctx context.Context, principal Principal) context.Context

ContextWithPrincipal binds an acting identity to a context so tool handlers read it with PrincipalFromContext. Exported for the assistant adapter, which calls handlers directly rather than through the MCP transport.

func FormatSubjectIdentity 

func FormatSubjectIdentity(identityKind, identifier string) string

FormatSubjectIdentity builds the value a user reference carries. Summary tools mint references through this so the kind travels with the identifier.

func IsReadinessMCPErrorResponse 

func IsReadinessMCPErrorResponse(err error) bool

IsReadinessMCPErrorResponse reports whether an SDK error preserves a well-formed server-authored JSON-RPC error. Provider adapters use it to avoid treating a valid error response as malformed protocol data.

func ProviderAuthorizationAbsence 

func ProviderAuthorizationAbsence(authorization remotesessions.ResolvedAuthorization) string

ProviderAuthorizationAbsence is the Absence for a resolved authorization: none for a subject's grant, ProviderAuthorizationClientCredential for a self client's own credential.

func ProviderAuthorizationFingerprint 

func ProviderAuthorizationFingerprint(identity ProviderAuthorizationIdentity) (string, error)

ProviderAuthorizationFingerprint returns an opaque value suitable for readiness persistence. It intentionally excludes access and refresh tokens.

func SetupResourceURI 

func SetupResourceURI(provider, intent string) string

SetupResourceURI is the stable address of one reviewed guide. It is exported because a corpus builder must produce exactly these URIs — they are a public contract with every MCP client that has one bookmarked.

func ValidateSetupResource 

func ValidateSetupResource(resource SetupResource) error

ValidateSetupResource reports why a resource is not servable. A corpus builder gets the reason so a malformed guide fails the build it came from, rather than disappearing from the corpus at registration time.

Types

type AIScanTargetSummary 

type AIScanTargetSummary struct {
	TargetID    string `json:"target_id"`
	DisplayName string `json:"display_name"`
	Category    string `json:"category"`
	// Origin is default for a target Speakeasy ships or organization for one
	// this organization added. Everything listed is probed for either way.
	Origin string `json:"origin"`
	// Blockable reports whether the target publishes a client ID metadata
	// document, which is the only thing a gateway block can be enforced
	// through.
	Blockable bool `json:"blockable"`
	// State is the enforcement verdict: allowed, blocked or unreviewed. A
	// target that is not blockable always reads unreviewed, whatever was
	// recorded about it.
	State string `json:"state"`
	// Decision is the organization's effective decision behind state:
	// unreviewed, approved or blocked.
	Decision string `json:"decision"`
	// Rationale is why the decision was made, when an admin gave a reason.
	Rationale string `json:"rationale,omitempty"`
}

type AccessMember 

type AccessMember struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Reference      string   `json:"reference"`
	Version        string   `json:"version"`
}

type AccessReadService 

type AccessReadService struct {
	// contains filtered or unexported fields
}

AccessReadService projects the access service's local role/member authority into privacy-safe Platform MCP reads. It never contacts WorkOS or a configured MCP and never accepts raw role, member, principal, or grant identifiers.

func NewAccessReadService 

func NewAccessReadService(logger *slog.Logger, db *pgxpool.Pool, budget OperationBudget, keyMaterial string) *AccessReadService

func (*AccessReadService) GetMCPAccess 

func (s *AccessReadService) GetMCPAccess(ctx context.Context, principal Principal, input GetMCPAccessInput) (GetMCPAccessOutput, error)

func (*AccessReadService) GetMemberMCPAccess 

func (s *AccessReadService) GetMemberMCPAccess(ctx context.Context, principal Principal, input GetMemberMCPAccessInput) (GetMemberMCPAccessOutput, error)

func (*AccessReadService) ListMembers 

func (s *AccessReadService) ListMembers(ctx context.Context, principal Principal, input ListAccessMembersInput) (ListAccessMembersOutput, error)

func (*AccessReadService) ListMyMCPAccess 

func (s *AccessReadService) ListMyMCPAccess(ctx context.Context, principal Principal) (GetMemberMCPAccessOutput, error)

func (*AccessReadService) ListRoles 

func (s *AccessReadService) ListRoles(ctx context.Context, principal Principal) (ListAccessRolesOutput, error)

func (*AccessReadService) WithDirectoryReview 

func (s *AccessReadService) WithDirectoryReview(backend DirectoryReviewBackend) *AccessReadService

WithDirectoryReview composes the review tools over the access service.

type AccessRole 

type AccessRole struct {
	Name             string                      `json:"name"`
	Type             string                      `json:"type"`
	MemberCount      SubjectCount                `json:"member_count"`
	MCPAccess        MCPConnectSummary           `json:"mcp_access"`
	DirectorySources []AccessRoleDirectorySource `` /* 177-byte string literal not displayed */
	Reference        string                      `json:"reference"`
	Version          string                      `json:"version"`
}

type AccessRoleAssignmentMember 

type AccessRoleAssignmentMember struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Version        string   `json:"version"`
}

type AccessRoleAssignmentReceiptResult 

type AccessRoleAssignmentReceiptResult struct {
	MaskedIdentity string   `json:"masked_identity"`
	Roles          []string `json:"roles"`
	Version        string   `json:"version"`
	AssignedRole   string   `json:"assigned_role"`
	ResultCategory string   `json:"result_category"`
	Reconciliation string   `json:"reconciliation"`
}

type AccessRoleAssignmentReceiptStore 

type AccessRoleAssignmentReceiptStore struct {
	// contains filtered or unexported fields
}

func NewAccessRoleAssignmentReceiptStore 

func NewAccessRoleAssignmentReceiptStore(db *pgxpool.Pool) *AccessRoleAssignmentReceiptStore

func (*AccessRoleAssignmentReceiptStore) Execute 

func (s *AccessRoleAssignmentReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedAccessRoleAssignment, charge func(context.Context) error, mutate AccessRoleAssignmentTransaction) (OperationReceipt, error)

type AccessRoleAssignmentRule 

type AccessRoleAssignmentRule struct {
	AllTools    bool   `` /* 143-byte string literal not displayed */
	Tool        string `json:"tool,omitempty" jsonschema:"exact named tool restriction; when disposition is also present both restrictions apply"`
	Disposition string `` /* 158-byte string literal not displayed */
}

type AccessRoleAssignmentService 

type AccessRoleAssignmentService struct {
	// contains filtered or unexported fields
}

func NewAccessRoleAssignmentService 

func NewAccessRoleAssignmentService(roles *AccessRoleMutationService) (*AccessRoleAssignmentService, error)

func (*AccessRoleAssignmentService) Assign 

func (s *AccessRoleAssignmentService) Assign(ctx context.Context, principal Principal, input AssignMCPAccessRoleInput) (AssignMCPAccessRoleOutput, error)

type AccessRoleAssignmentTransaction 

type AccessRoleAssignmentTransaction func(context.Context, pgx.Tx) (AccessRoleAssignmentReceiptResult, error)

type AccessRoleDirectorySource 

type AccessRoleDirectorySource struct {
	Kind           string       `json:"kind" jsonschema:"group or attribute"`
	Group          string       `json:"group,omitempty" jsonschema:"directory group name, for a group source"`
	AttributeKey   string       `json:"attribute_key,omitempty" jsonschema:"directory attribute, for an attribute source"`
	AttributeValue string       `json:"attribute_value,omitempty" jsonschema:"directory attribute value, for an attribute source"`
	Removed        bool         `` /* 130-byte string literal not displayed */
	MatchedUsers   SubjectCount `json:"matched_users" jsonschema:"directory users the source matches today, signed in or not; small counts are withheld"`
}

AccessRoleDirectorySource is one directory group or attribute value mapped to a role. Under directory sync it explains where the role's members come from; it is changed on the identity provider page of the dashboard.

type AccessRoleMutationBackend 

type AccessRoleMutationBackend interface {
	MutationReady() bool
	GetRoleByIDTx(context.Context, pgx.Tx, string, string) (*accessgen.Role, error)
	CreateRoleTx(context.Context, pgx.Tx, string, string, access.RoleAuditActor, *accessgen.CreateRolePayload) (access.RoleCreateResult, access.RoleReconciliation, error)
	UpdateRoleTx(context.Context, pgx.Tx, string, string, access.RoleAuditActor, *accessgen.UpdateRolePayload) (access.RoleUpdateResult, access.RoleReconciliation, error)
	AddMemberRoleTx(context.Context, pgx.Tx, string, string, string, access.RoleAuditActor, access.MemberRoleValidation) (access.MemberRoleAddResult, access.MemberRoleReconciliation, error)
	CurrentMemberRoleReconciliationTx(context.Context, pgx.Tx, string, string) (access.MemberRoleReconciliation, error)
	ReconcileRoleIdentity(context.Context, string, string, string, string, bool)
	ReconcileRoleDelivery(context.Context, access.RoleReconciliation)
	ReconcileMemberRoles(context.Context, access.MemberRoleReconciliation)
}

AccessRoleMutationBackend matches the transaction-scoped access manager API.

type AccessRoleMutationError 

type AccessRoleMutationError struct {
	Code    string
	Message string
	Cause   error
}

AccessRoleMutationError is safe to return through Platform MCP. It never includes a role ID, principal, grant selector, or configured MCP ID.

func (*AccessRoleMutationError) Error 

func (e *AccessRoleMutationError) Error() string

func (*AccessRoleMutationError) Unwrap 

func (e *AccessRoleMutationError) Unwrap() error

type AccessRoleMutationReceiptResult 

type AccessRoleMutationReceiptResult struct {
	RoleID         string            `json:"role_id"`
	RoleSlug       string            `json:"role_slug"`
	Name           string            `json:"name"`
	Description    string            `json:"description,omitempty"`
	Version        string            `json:"version"`
	MCPAccess      MCPConnectSummary `json:"mcp_access"`
	ResultCategory string            `json:"result_category"`
	Reconciliation string            `json:"reconciliation"`
}

type AccessRoleMutationReceiptStore 

type AccessRoleMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewAccessRoleMutationReceiptStore 

func NewAccessRoleMutationReceiptStore(db *pgxpool.Pool) *AccessRoleMutationReceiptStore

func (*AccessRoleMutationReceiptStore) ExecuteCreate 

func (s *AccessRoleMutationReceiptStore) ExecuteCreate(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedCreateMCPAccessRole, charge func(context.Context) error, mutate AccessRoleMutationTransaction) (OperationReceipt, error)

func (*AccessRoleMutationReceiptStore) ExecuteUpdate 

func (s *AccessRoleMutationReceiptStore) ExecuteUpdate(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedUpdateMCPAccessRole, charge func(context.Context) error, mutate AccessRoleMutationTransaction) (OperationReceipt, error)

type AccessRoleMutationService 

type AccessRoleMutationService struct {
	// contains filtered or unexported fields
}

func NewAccessRoleMutationService 

func NewAccessRoleMutationService(reads *AccessReadService, flags feature.Provider, budget OperationBudget, keyMaterial string, backend AccessRoleMutationBackend) (*AccessRoleMutationService, error)

func (*AccessRoleMutationService) ChooseHeadlessCallerCredential 

func (s *AccessRoleMutationService) ChooseHeadlessCallerCredential(ctx context.Context, principal Principal, input ChooseMCPHeadlessCallerCredentialInput) (ChooseMCPHeadlessCallerCredentialOutput, error)

ChooseHeadlessCallerCredential previews or changes the credential one headless caller's sessions use on one server: an app or workload that signs in without a browser and so cannot pick on the consent screen. A change replaces only this server's choice, through the same write the dashboard uses, and grants nothing: each issuance checks the caller may use it.

func (*AccessRoleMutationService) ConfigureInference 

func (s *AccessRoleMutationService) ConfigureInference(ctx context.Context, principal Principal, input ConfigureInferenceAccessRoleInput) (ConfigureInferenceAccessRoleOutput, error)

func (*AccessRoleMutationService) Create 

func (s *AccessRoleMutationService) Create(ctx context.Context, principal Principal, input CreateMCPAccessRoleInput) (CreateMCPAccessRoleOutput, error)

func (*AccessRoleMutationService) OfferUpstreamCredential 

func (s *AccessRoleMutationService) OfferUpstreamCredential(ctx context.Context, principal Principal, input OfferMCPUpstreamCredentialInput) (OfferMCPUpstreamCredentialOutput, error)

OfferUpstreamCredential lets one more server offer an existing upstream credential, through the same write the dashboard uses. It grants nobody permission to use the credential or access to the server.

func (*AccessRoleMutationService) SetRoleAuthClientAccess 

func (s *AccessRoleMutationService) SetRoleAuthClientAccess(ctx context.Context, principal Principal, input SetMCPRoleAuthClientAccessInput) (SetMCPRoleAuthClientAccessOutput, error)

SetRoleAuthClientAccess writes the role's own Use or Blocked rule on one shared credential the server offers, through the same save the auth client audience editor uses.

func (*AccessRoleMutationService) Update 

func (s *AccessRoleMutationService) Update(ctx context.Context, principal Principal, input UpdateMCPAccessRoleInput) (UpdateMCPAccessRoleOutput, error)

func (*AccessRoleMutationService) WithAuthClientAudit 

func (s *AccessRoleMutationService) WithAuthClientAudit(auditLogger *audit.Logger) *AccessRoleMutationService

WithAuthClientAudit lets role mutations change which shared credentials a role may use. Without it the tool reports unavailable.

type AccessRoleMutationSummary 

type AccessRoleMutationSummary struct {
	Name        string            `json:"name"`
	Description string            `json:"description,omitempty"`
	Reference   string            `json:"reference"`
	Version     string            `json:"version"`
	MCPAccess   MCPConnectSummary `json:"mcp_access"`
}

type AccessRoleMutationTransaction 

type AccessRoleMutationTransaction func(context.Context, pgx.Tx) (AccessRoleMutationReceiptResult, error)

type ActingSurface 

type ActingSurface string

ActingSurface names the surface a call arrives through. Audit has to be able to tell an agent-driven change from a dashboard change made by the same user, and reviewing a runaway agent's burst of activity depends on it. 

const (
	// SurfacePlatformMCP is the OAuth-authenticated Platform MCP endpoint.
	SurfacePlatformMCP ActingSurface = contextvalues.ActingSurfacePlatformMCP
	// SurfaceProjectAssistant is the project assistant runtime, which acts
	// under assistant identity and holds no OAuth connection.
	SurfaceProjectAssistant ActingSurface = "project_assistant"
	// SurfaceDashboard is an authenticated dashboard session completing work a
	// Platform MCP flow started, such as a provider setup handoff.
	SurfaceDashboard ActingSurface = "dashboard"
)

type AddSkillVersionInput 

type AddSkillVersionInput struct {
	ProjectSlug             string
	SkillID                 string
	Content                 string
	ExpectedLatestVersionID string
}

AddSkillVersionInput carries the full replacement manifest plus the version the caller believes is current. Versions are immutable, so a correction is another version rather than an edit of one.

type AddSkillVersionToolInput 

type AddSkillVersionToolInput struct {
	ProjectSlug             string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID                 string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	Content                 string `` /* 139-byte string literal not displayed */
	ExpectedLatestVersionID string `` /* 167-byte string literal not displayed */
}

type AnalyticsColumn 

type AnalyticsColumn struct {
	Name string `json:"name"`
	// Kind is time, dimension or measure.
	Kind string `json:"kind"`
}

AnalyticsColumn is one result column.

type AnalyticsDataset 

type AnalyticsDataset struct {
	Name string `json:"name"`
	// Kind is event or metric.
	Kind string `json:"kind"`
	// Grain is what one row represents, as a noun.
	Grain       string `json:"grain"`
	Description string `json:"description"`
	// MaxTimeRangeDays is the longest window a query may span.
	MaxTimeRangeDays int              `json:"max_time_range_days"`
	Fields           []AnalyticsField `json:"fields"`
}

AnalyticsDataset is a dataset and the fields it exposes.

type AnalyticsDimensionValue 

type AnalyticsDimensionValue struct {
	Value string `json:"value"`
	Count int64  `json:"count"`
	// Present distinguishes absent signal labels from present empty values.
	Present *bool `json:"present,omitempty"`
}

AnalyticsDimensionValue is one value and how many rows carry it.

type AnalyticsEngine 

type AnalyticsEngine interface {
	Catalog() *analytics.Catalog
	Query(ctx context.Context, tenant analytics.Tenant, req analytics.Request) (*analytics.QueryResult, error)
	Values(ctx context.Context, tenant analytics.Tenant, req analytics.ValuesRequest) ([]analytics.DimensionValue, error)
	DescribeSignals(ctx context.Context, tenant analytics.Tenant) (*analytics.SignalCatalog, error)
	ReadSignalDefinition(ctx context.Context, tenant analytics.Tenant, sensorID, hash string) (*analytics.SignalDefinition, error)
	SignalFindings(ctx context.Context, tenant analytics.Tenant, window analytics.Window, request analytics.SignalFindingsRequest, access analytics.ConversationAccess) (*analytics.SignalFindings, error)
}

AnalyticsEngine is the query path the analytics tools answer through: the same catalog, compiler and runner as the analytics RPC.

type AnalyticsField 

type AnalyticsField struct {
	Name string `json:"name"`
	// Type is string, int64 or float64.
	Type string `json:"type"`
	// Role is dimension or measure.
	Role string `json:"role"`
	// Default marks a field of the query the dataset opens on.
	Default bool `json:"default"`
	// Unit of a measure, when it has one.
	Unit string `json:"unit,omitempty"`
	// Operators a dimension admits in a filter.
	Operators []string `json:"operators,omitempty"`
	// Aggregations the field admits: ops over a measure, count_distinct over
	// a dimension.
	Aggregations []string `json:"aggregations,omitempty"`
	// Description is set when the catalog has more to say than the name.
	Description string `json:"description,omitempty"`
	// Lookup is the map this dimension reads through, if any.
	Lookup *AnalyticsLookup `json:"lookup,omitempty"`
}

AnalyticsField is one queryable field of a dataset.

type AnalyticsFilter 

type AnalyticsFilter struct {
	Field    string   `json:"field"`
	Operator string   `json:"operator"`
	Values   []string `json:"values"`
}

AnalyticsFilter is a predicate on a dimension. All filters are ANDed.

type AnalyticsLimits 

type AnalyticsLimits struct {
	MaxDimensions      int `json:"max_dimensions"`
	MaxFilterValues    int `json:"max_filter_values"`
	DefaultLimit       int `json:"default_limit"`
	MaxLimit           int `json:"max_limit"`
	MaxRowsLimit       int `json:"max_rows_limit"`
	DefaultValuesLimit int `json:"default_values_limit"`
	MaxValuesLimit     int `json:"max_values_limit"`
}

AnalyticsLimits restates the compiler's guardrails so a caller can stay inside them.

type AnalyticsLookup 

type AnalyticsLookup struct {
	Name        string `json:"name"`
	Description string `json:"description"`
}

AnalyticsLookup is a per-project map a dimension reads through at query time.

type AnalyticsMeasure 

type AnalyticsMeasure struct {
	Op    string `json:"op"`
	Field string `json:"field,omitempty"`
	Alias string `json:"alias,omitempty"`
}

AnalyticsMeasure is an op over a field, or count alone.

type AnalyticsOrderBy 

type AnalyticsOrderBy struct {
	Measure   string `json:"measure"`
	Direction string `json:"direction,omitempty"`
}

AnalyticsOrderBy sorts a grouped result by one of its measures.

type AnalyticsProject 

type AnalyticsProject struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

AnalyticsProject is the project a result was read for.

type AnalyticsService 

type AnalyticsService struct {
	// contains filtered or unexported fields
}

AnalyticsService serves the analytics catalog, values and queries to the Platform MCP.

func NewAnalyticsService 

func NewAnalyticsService(logger *slog.Logger, engine AnalyticsEngine, flags feature.Provider, organizations OrganizationSlugResolver, projects ProjectReadResolver, budget OperationBudget, signalFeatures analytics.SignalFeatures) *AnalyticsService

NewAnalyticsService returns nil without a logger, an engine, an organization resolver or a project reader, so the tools are served as stubs.

func (*AnalyticsService) Definition 

func (s *AnalyticsService) Definition(ctx context.Context, principal Principal, input GetSignalDefinitionInput) (GetSignalDefinitionOutput, error)

func (*AnalyticsService) Describe 

func (s *AnalyticsService) Describe(ctx context.Context, principal Principal, input DescribeAnalyticsCatalogInput) (DescribeAnalyticsCatalogOutput, error)

Describe serves the catalog to a caller who may read the named project.

func (*AnalyticsService) FindSignalSessions 

func (s *AnalyticsService) FindSignalSessions(ctx context.Context, principal Principal, input FindSignalSessionsInput) (FindSignalSessionsOutput, error)

func (*AnalyticsService) Query 

func (s *AnalyticsService) Query(ctx context.Context, principal Principal, input RunAnalyticsQueryInput) (RunAnalyticsQueryOutput, error)

Query runs one query for a caller who may read the named project.

func (*AnalyticsService) Values 

func (s *AnalyticsService) Values(ctx context.Context, principal Principal, input ListAnalyticsDimensionValuesInput) (ListAnalyticsDimensionValuesOutput, error)

Values lists what a dimension holds, read the way a filter will match it.

func (*AnalyticsService) WithConversationAccess 

func (s *AnalyticsService) WithConversationAccess(access analytics.ConversationAccess) *AnalyticsService

WithConversationAccess applies the underlying chat gate to requested evidence.

type ApproveSkillSuggestionInput 

type ApproveSkillSuggestionInput struct {
	// ProjectSlug is the project that owns the suggestion.
	ProjectSlug string

	// SuggestionID is the suggestion being approved.
	SuggestionID string

	// ChangeIDs are the reviewed changes to take. Naming every change takes the
	// whole suggestion; a change proposed after the review is never taken
	// implicitly, because it is not in the list.
	ChangeIDs []string

	// Content is a complete edited SKILL.md recorded in place of the proposed
	// changes, for a reviewer who corrected the suggestion before taking it.
	Content string
}

ApproveSkillSuggestionInput names exactly what a reviewer is taking from one suggestion. Either ChangeIDs or Content is set, never both.

type ApproveSkillSuggestionOutput 

type ApproveSkillSuggestionOutput struct {
	ProjectSlug string                  `json:"project_slug"`
	Outcome     SkillSuggestionOutcome  `json:"outcome"`
	Skill       SkillSummary            `json:"skill"`
	Version     *SkillVersionSummary    `json:"version,omitempty"`
	Remaining   *SkillSuggestionSummary `json:"remaining_suggestion,omitempty"`
	NextAction  string                  `json:"next_action"`
}

type ApproveSkillSuggestionToolInput 

type ApproveSkillSuggestionToolInput struct {
	ProjectSlug  string   `json:"project_slug" jsonschema:"explicit project slug that owns the suggestion"`
	SuggestionID string   `json:"suggestion_id" jsonschema:"suggestion ID returned by list_skill_suggestions"`
	ChangeIDs    []string `` /* 203-byte string literal not displayed */
	Content      string   `` /* 225-byte string literal not displayed */
	Confirmed    bool     `json:"confirmed" jsonschema:"set true only after the user explicitly confirms recording this new version of this exact skill"`
}

type AssignMCPAccessRoleInput 

type AssignMCPAccessRoleInput struct {
	ProjectID           string `json:"project_id" jsonschema:"explicit project ID for the access workflow"`
	MemberReference     string `json:"member_reference" jsonschema:"opaque member reference returned by list_access_members"`
	RoleReference       string `json:"role_reference" jsonschema:"opaque custom role reference returned by list_access_roles or get_mcp_access"`
	ExpectedVersion     string `json:"expected_version" jsonschema:"opaque member role version returned by list_access_members immediately before this write"`
	MCPID               string `json:"mcp_id,omitempty" jsonschema:"required for new assignments: exact configured MCP selected from get_mcp_access"`
	ExpectedRoleVersion string `` /* 149-byte string literal not displayed */
	IdempotencyKey      string `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact assignment"`
	Confirmed           bool   `` /* 139-byte string literal not displayed */
}

type AssignMCPAccessRoleOutput 

type AssignMCPAccessRoleOutput struct {
	Member         AccessRoleAssignmentMember `` /* 143-byte string literal not displayed */
	SnapshotScope  string                     `json:"snapshot_scope" jsonschema:"assignment_commit: this response describes the committed operation, not current access"`
	AssignedRole   string                     `json:"assigned_role"`
	ResultCategory string                     `json:"result_category"`
	Reconciliation string                     `` /* 280-byte string literal not displayed */
	Receipt        RiskMutationToolReceipt    `json:"receipt"`
}

type AssistantIdentityManagement 

type AssistantIdentityManagement interface {
	UpgradeAssistantIdentity(context.Context, *genassistants.UpgradeAssistantIdentityPayload) (*types.Assistant, error)
}

AssistantIdentityManagement deliberately calls the same authorized endpoint as the dashboard, not the lower-level identity binding primitives.

type AssistantIdentityService 

type AssistantIdentityService struct {
	// contains filtered or unexported fields
}

AssistantIdentityService backs upgrade_assistant_workload_identity.

func NewAssistantIdentityService 

func NewAssistantIdentityService(management AssistantIdentityManagement, projects *PostgresReader) *AssistantIdentityService

NewAssistantIdentityService resolves the named project through the same inventory read the other project-scoped tools use.

type AssistantUpstreamCredentialOption 

type AssistantUpstreamCredentialOption struct {
	AuthClientID string `json:"auth_client_id"`
	Name         string `json:"name"`
	ClientType   string `json:"client_type"`
}

type AssistantUpstreamCredentialProfile 

type AssistantUpstreamCredentialProfile struct {
	TriggerInstanceID string                              `json:"trigger_instance_id"`
	TriggerName       string                              `json:"trigger_name"`
	ExecutionContext  string                              `json:"execution_context"`
	Version           int64                               `json:"version"`
	Servers           []AssistantUpstreamCredentialServer `json:"servers"`
}

type AssistantUpstreamCredentialServer 

type AssistantUpstreamCredentialServer struct {
	McpServerID  string                              `json:"mcp_server_id"`
	Chosen       bool                                `json:"chosen"`
	AuthClientID string                              `json:"auth_client_id,omitempty"`
	Source       string                              `json:"source,omitempty"`
	GapReason    string                              `json:"gap_reason,omitempty"`
	Options      []AssistantUpstreamCredentialOption `json:"options"`
	// NoAuthAllowed reports that no_auth can be chosen for the server.
	NoAuthAllowed bool `json:"no_auth_allowed"`
}

type AttachPlatformMCPIdentityProviderToolInput 

type AttachPlatformMCPIdentityProviderToolInput struct {
	ProjectSlug    string `` /* 213-byte string literal not displayed */
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Confirmed      bool   `` /* 221-byte string literal not displayed */
}

type AttachPlatformMCPIdentityProviderToolOutput 

type AttachPlatformMCPIdentityProviderToolOutput struct {
	ProjectSlug      string `json:"project_slug"`
	RegistrationID   string `json:"registration_id"`
	Attached         bool   `json:"attached"`
	ProviderURL      string `json:"provider_url,omitempty"`
	NextAction       string `json:"next_action"`
	Message          string `json:"message"`
	AuthorizationURL string `json:"authorization_url,omitempty"`
}

type Audience 

type Audience string

Audience names a surface a tool may be served to.

Membership is declared per tool rather than per catalogue. The two surfaces differ in identity, targeting, and safety, so a tool built for one is not automatically fit for the other: admitting a capability to the assistant is a deliberate act a reviewer can see in the diff, not a consequence of adding it to Platform MCP. 

const (
	// AudienceExternal is the OAuth-authenticated /platform-mcp endpoint.
	AudienceExternal Audience = "external"
	// AudienceAssistant is a project's managed assistant, which acts under
	// assistant identity rather than an external user's OAuth connection.
	AudienceAssistant Audience = "assistant"
)

type Authenticator 

type Authenticator interface {
	Authenticate(ctx context.Context, token string) (Principal, error)
}

type Authorizer 

type Authorizer interface {
	PrepareExternalContext(ctx context.Context, principal Principal) (context.Context, error)
	AuthorizeExternalCall(ctx context.Context, principal Principal, policy ExternalAuthorization) error
	RequireLiveMembership(ctx context.Context, principal Principal) error
	RequireLiveOrgAdmin(ctx context.Context, principal Principal) error
}

Authorizer admits an authenticated organization member and enforces the explicit policy declared by each external tool or resource.

type BrowserIdentity 

type BrowserIdentity interface {
	BuildAuthorizationURL(ctx context.Context, params identity.AuthorizationURLParams) (*url.URL, error)
	ExchangeCodeForTokens(ctx context.Context, code string) (*identity.IDPUserInfo, error)
	CompleteIDPLogin(ctx context.Context, idpUser *identity.IDPUserInfo, opts identity.IDPLoginOptions) (identity.IDPLoginResult, error)
}

BrowserIdentity resolves a real Speakeasy user from the product identity provider.

type CandidateInspection 

type CandidateInspection struct {
	// SupportsDCR is advertised dynamic registration support for a reviewed catalogue entry.
	SupportsDCR *bool `` /* 190-byte string literal not displayed */
	// SupportsCIMD is advertised compatible metadata-document support for a reviewed catalogue entry.
	SupportsCIMD *bool `` /* 177-byte string literal not displayed */
	// AuthSetup is the reviewed catalogue setup classification; unknown is not manual setup.
	AuthSetup string `` /* 154-byte string literal not displayed */

	ProviderKey            string                      `json:"provider_key,omitempty"`
	CatalogRef             string                      `json:"catalog_ref,omitempty"`
	CanonicalURL           string                      `json:"canonical_url,omitempty"`
	Name                   string                      `json:"name,omitempty"`
	Description            string                      `json:"description,omitempty"`
	Version                string                      `json:"version,omitempty"`
	Transport              string                      `json:"transport"`
	ToolNames              []string                    `json:"tool_names"`
	ToolCount              int                         `json:"tool_count"`
	Configuration          []CatalogConfigurationField `json:"configuration,omitempty"`
	RequiresDashboardSetup bool                        `json:"requires_dashboard_setup"`
	Trust                  string                      `json:"trust"`
	Authentication         string                      `json:"authentication,omitempty"`
	OAuthDiscovery         string                      `json:"oauth_discovery,omitempty"`
	// AutomaticClientRegistration is set only for a direct remote URL that
	// requires sign-in.
	AutomaticClientRegistration string         `` /* 374-byte string literal not displayed */
	SetupIntent                 string         `json:"setup_intent,omitempty"`
	SetupCategory               SetupCategory  `json:"setup_category,omitempty"`
	Actions                     []RepairAction `json:"actions,omitempty"`
}

CandidateInspection is the safe common projection for reviewed and direct candidate paths. Direct remote URLs are always marked unreviewed and never enter the reviewed catalogue.

type CanonicalIdentityGate 

type CanonicalIdentityGate interface {
	CanonicalOrgFor(ctx context.Context, orgID string) string
}

CanonicalIdentityGate keeps Platform MCP user grouping under the same rollout switch as the dashboard telemetry APIs.

type CapabilityChecker 

type CapabilityChecker interface {
	IsFeatureEnabled(ctx context.Context, organizationID string, feature productfeatures.Feature) (bool, error)
	IsFeatureEnabledUncached(ctx context.Context, organizationID string, feature productfeatures.Feature) (bool, error)
}

CapabilityChecker is the durable organization capability boundary. Platform MCP checks bypass the shared 15-minute product-feature cache so revocation is visible on the next request, comfortably within the 60-second requirement.

type Catalog 

type Catalog interface {
	Search(ctx context.Context, query string) ([]CatalogCandidate, error)
	Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)
}

type CatalogCandidate 

type CatalogCandidate struct {
	// ProviderKey is a server-issued opaque registry-source identity. It is not a
	// provider credential, remote URL, or client-supplied provider configuration.
	ProviderKey string `json:"provider_key"`
	CatalogRef  string `json:"catalog_ref"`
	Name        string `json:"name"`
	Description string `json:"description"`
	Version     string `json:"version"`
	// ToolCount is left out when the catalogue does not know the tool count, so
	// it never reads as a server with no tools.
	ToolCount   int    `json:"tool_count,omitempty" jsonschema:"number of tools the server offers; absent when not known"`
	SetupIntent string `json:"setup_intent"`
	// SupportsDCR is advertised dynamic client registration support.
	SupportsDCR bool `json:"supports_dcr"`
	// SupportsCIMD is advertised compatible client metadata document support.
	SupportsCIMD bool `json:"supports_cimd"`
	// AuthSetup distinguishes unknown capability evidence from required manual setup.
	AuthSetup string `` /* 375-byte string literal not displayed */
}

type CatalogConfigurationField 

type CatalogConfigurationField struct {
	Key         string   `json:"key"`
	Kind        string   `json:"kind"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	Required    bool     `json:"required"`
	Secret      bool     `json:"secret"`
	Default     string   `json:"default,omitempty"`
	Choices     []string `json:"choices,omitempty"`
}

type CatalogConfigurationValues 

type CatalogConfigurationValues map[string]string

CatalogConfigurationValues contains values supplied by an agent for one inspected catalogue entry. Its keys must be the server-issued field keys from CatalogDetails.Configuration. Secret values are rejected before they can be persisted, hashed, logged, or returned from a Platform MCP tool.

type CatalogDescriptor 

type CatalogDescriptor struct {
	ProviderKey      string
	Registry         externalmcp.Registry
	CanonicalRef     string
	AllowedRemoteURL string
	SetupIntent      string
}

CatalogDescriptor binds a Platform catalogue source to a server-owned registry. CanonicalRef and AllowedRemoteURL are optional only for a registry-wide source: the exact entry and remote are then revalidated on every inspection. Existing reviewed descriptors keep pinning both values for a narrower provider contract.

func BrowserCatalogDescriptor 

func BrowserCatalogDescriptor(registry externalmcp.Registry) CatalogDescriptor

BrowserCatalogDescriptor maps one configured browser-catalogue registry to a stable opaque Platform MCP source identity. The registry row and its endpoint remain server-owned; callers only receive this identity after a search result.

type CatalogDescriptorLoader 

type CatalogDescriptorLoader func(ctx context.Context) ([]CatalogDescriptor, error)

type CatalogDetails 

type CatalogDetails struct {
	CatalogCandidate
	Transport              string                      `json:"transport"`
	ToolNames              []string                    `json:"tool_names"`
	Configuration          []CatalogConfigurationField `json:"configuration"`
	RequiresDashboardSetup bool                        `json:"requires_dashboard_setup"`
	// contains filtered or unexported fields
}

type CatalogIdentityProviderAttachment 

type CatalogIdentityProviderAttachment interface {
	Attach(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogIdentityProviderAttachmentResult, error)
}

CatalogIdentityProviderAttachment attaches the one OAuth provider advertised by a persisted reviewed Remote MCP source. It is a server-owned boundary: neither the tool caller nor the browser supplies a client id, client secret, OAuth code, token, or other credential.

type CatalogIdentityProviderAttachmentResult 

type CatalogIdentityProviderAttachmentResult struct {
	Attached    bool
	ProviderURL string
}

CatalogIdentityProviderAttachmentResult contains only non-secret provider context for the agent. Provider URLs are safe to return; client secrets, tokens, passwords, and OAuth codes are never represented here.

type CatalogIdentityProviderAttachmentService 

type CatalogIdentityProviderAttachmentService struct {
	// contains filtered or unexported fields
}

func NewCatalogIdentityProviderAttachmentService 

func NewCatalogIdentityProviderAttachmentService(logger *slog.Logger, meterProvider metric.MeterProvider, db *pgxpool.Pool, identity *remotesessions.IdentityCommitter, policy *guardian.Policy, serverURL *url.URL) *CatalogIdentityProviderAttachmentService

func (*CatalogIdentityProviderAttachmentService) Attach 

func (s *CatalogIdentityProviderAttachmentService) Attach(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogIdentityProviderAttachmentResult, error)

Attach discovers the exact provider advertised by the lifecycle-owned Remote MCP source, creates a project-owned remote-session issuer/client when needed, and binds it to the registration's existing user-session issuer. It is safe to retry after a successful call: the existing matching binding is reused.

type CatalogReadinessProber 

type CatalogReadinessProber interface {
	ProbeCatalogReadiness(ctx context.Context, principal Principal, projectID, registrationID, remoteMCPServerID, userSessionIssuerID, connectionID, generation uuid.UUID) (ProviderReadinessProbeResult, error)
}

CatalogReadinessProber verifies a browser-catalogue registration through the same persisted Remote MCP source and remote-session authorization used at normal runtime. Its inputs come exclusively from a lifecycle-owned registration, never from an MCP caller.

type CatalogRegistrationGate 

type CatalogRegistrationGate struct {
	// contains filtered or unexported fields
}

CatalogRegistrationGate ensures mutations require the main Platform MCP capability and an explicit project slug. Dashboard visibility is not checked: an enabled organization may use the MCP through manual setup alone.

func NewCatalogRegistrationGate 

func NewCatalogRegistrationGate(platform Gate) *CatalogRegistrationGate

func (*CatalogRegistrationGate) Enabled 

func (g *CatalogRegistrationGate) Enabled(ctx context.Context, organizationID, projectSlug string) (bool, error)

func (*CatalogRegistrationGate) EnabledOrganization 

func (g *CatalogRegistrationGate) EnabledOrganization(ctx context.Context, organizationID string) (bool, error)

EnabledOrganization checks the same durable entitlement as a mutation without accepting a project selector. Read-only direct inspection needs this gate before it can perform user-directed egress.

type CatalogRegistrationGateChecker 

type CatalogRegistrationGateChecker interface {
	Enabled(ctx context.Context, organizationID, projectSlug string) (bool, error)
	EnabledOrganization(ctx context.Context, organizationID string) (bool, error)
}

type CatalogRegistrationRequest 

type CatalogRegistrationRequest struct {
	ProjectSlug       string
	SourceKind        string
	CatalogProvider   string
	CatalogReference  string
	ConfigurationHash string
	IdempotencyKey    string
	InputHash         string
}

CatalogRegistrationRequest is the normalized desired state behind one register_catalog_mcp call. The caller resolves catalog details before passing this value to persistence; display metadata is deliberately not identity.

type ChangeMCPToolsInput 

type ChangeMCPToolsInput struct {
	ProjectID       string   `json:"project_id" jsonschema:"project ID that owns the MCP server"`
	MCPID           string   `json:"mcp_id" jsonschema:"exact MCP server ID from find_mcp or get_mcp"`
	ToolURNs        []string `json:"tool_urns" jsonschema:"exact tool URNs from list_project_tools"`
	ExpectedVersion string   `json:"expected_version" jsonschema:"exposure_version from the page that completes the latest get_mcp read of this server"`
	IdempotencyKey  string   `json:"idempotency_key" jsonschema:"caller-chosen key that makes a retry of this exact change safe"`
	Confirmed       bool     `json:"confirmed" jsonschema:"true only after the user confirmed this exact server and tool list"`
}

type ChangeRiskPolicyAudienceReceiptResult 

type ChangeRiskPolicyAudienceReceiptResult struct{ UpdateRiskPolicyReceiptResult }

type ChatMessage 

type ChatMessage struct {
	MessageID string `json:"message_id"`

	Sequence int64 `json:"sequence"`

	CreatedAt time.Time `json:"created_at"`

	Role string `json:"role"`

	Source string `json:"source,omitempty"`

	UserID string `json:"user_id,omitempty"`

	// Participants holds at most five recorded participant snapshots.
	Participants []ChatParticipant `json:"participants"`

	Generation int32 `json:"generation"`

	// Text is the redacted message, including tool calls and stored payload.
	Text string `json:"text"`

	// Truncated reports shortened text or a field too large to return.
	Truncated bool `json:"truncated"`
}

ChatMessage is one captured message in a read window.

type ChatMessageHit 

type ChatMessageHit struct {
	ChatID string `json:"chat_id"`

	ChatTitle string `json:"chat_title"`

	OwnerUserID string `json:"owner_user_id,omitempty"`

	MessageID string `json:"message_id"`

	Sequence int64 `json:"sequence"`

	CreatedAt time.Time `json:"created_at"`

	Role string `json:"role"`

	Source string `json:"source,omitempty"`

	// UserID is the message's recorded internal user, when captured.
	UserID string `json:"user_id,omitempty"`

	// Generation distinguishes stored versions of a compacted or edited
	// conversation.
	Generation int32 `json:"generation"`

	// Text is a redacted snippet around the match.
	Text string `json:"text"`

	// Truncated reports a shortened snippet or a field too large to return.
	Truncated bool `json:"truncated"`
}

ChatMessageHit is one matching captured message.

type ChatMetadataService 

type ChatMetadataService struct {
	// contains filtered or unexported fields
}

ChatMetadataService serves list_chats: one project's conversations reduced to when they were active, how long they ran, which app produced them, whether risk analysis found anything, and a masked participant. It never reads chat_messages, so no path through it can return what was said.

func NewChatMetadataService 

func NewChatMetadataService(db *pgxpool.Pool, findings *chatfindings.Reader, budget OperationBudget, keyMaterial string) *ChatMetadataService

NewChatMetadataService composes the listing. A nil database or findings reader, an invalid budget, or missing key material leaves the service nil, which registers the unavailable stub rather than a tool that always fails.

func (*ChatMetadataService) List 

func (s *ChatMetadataService) List(ctx context.Context, principal Principal, input ListChatsInput) (ListChatsOutput, error)

type ChatParticipant 

type ChatParticipant struct {
	Provider string `json:"provider"`

	ProviderUserID string `json:"provider_user_id"`

	UserID string `json:"user_id,omitempty"`

	DisplayName string `json:"display_name,omitempty"`
}

ChatParticipant is a participant snapshot recorded on a message.

type ChatSearchService 

type ChatSearchService struct {
	// contains filtered or unexported fields
}

ChatSearchService searches and reads captured chat messages under an explicit transcript grant. It never inherits the metadata listing's org-admin bypass.

func NewChatSearchService 

func NewChatSearchService(db *pgxpool.Pool, engine *authz.Engine, auditLogger *audit.Logger, budget OperationBudget, keyMaterial string) *ChatSearchService

NewChatSearchService composes the external-only transcript tools. Missing dependencies leave stable unavailable tools registered on the server.

func (*ChatSearchService) Read 

func (s *ChatSearchService) Read(ctx context.Context, principal Principal, input ReadChatInput) (ReadChatOutput, error)

Read checks the project and chat again; search results never grant access.

func (*ChatSearchService) Search 

func (s *ChatSearchService) Search(ctx context.Context, principal Principal, input SearchChatsInput) (SearchChatsOutput, error)

Search returns one keyset page of matching messages. SQL matches raw stored text; a hit whose redacted text no longer shows the query is dropped, but the page still advances past it so hidden matches never stall a cursor.

type ChatSummary 

type ChatSummary struct {
	ChatID            string `json:"chat_id"`
	CreatedAt         string `json:"created_at"`
	LastMessageAt     string `json:"last_message_at"`
	MessageCount      int    `json:"message_count"`
	RiskFindingsCount int    `json:"risk_findings_count"`
	// Source is the observed chat source label, such as a coding agent's name.
	Source string `json:"source,omitempty"`
	// Client is the originating client the capture pipeline recorded.
	Client string `json:"client,omitempty"`
	// AccountType is the team or personal classification of the AI account
	// that produced the chat, when one is linked.
	AccountType string `json:"account_type,omitempty"`
	// AssistantID and AssistantName identify the administrator-configured
	// assistant behind the chat, when it was an assistant thread: the one the
	// listing was narrowed to, otherwise the most recently active.
	AssistantID   string `json:"assistant_id,omitempty"`
	AssistantName string `json:"assistant_name,omitempty"`
	// AgentID and AgentName identify the agent principal that produced the
	// chat, recorded from the authenticated actor at capture. A channel session
	// has no assistant record, so these are the only actor it reports. An agent
	// is a non-human principal, like an assistant, so naming it crosses no
	// person-reference boundary: the human participants of such a session stay
	// masked here exactly as they do for every other chat. AgentName is absent
	// when the agent has since been deleted, leaving AgentID reported alone.
	AgentID        string `json:"agent_id,omitempty"`
	AgentName      string `json:"agent_name,omitempty"`
	MaskedIdentity string `json:"masked_identity,omitempty"`
	// UserReference narrows a follow-up list_chats call to the same person. It
	// is minted only for identities the listing can filter on.
	UserReference string `json:"user_reference,omitempty"`
}

ChatSummary is one chat reduced to what an investigation needs. It carries no title, no message content, no tool payloads, and no raw identity; the identity is masked and the reference is short-lived.

type ChooseAssistantUpstreamCredentialInput 

type ChooseAssistantUpstreamCredentialInput struct {
	ProjectID         string `json:"project_id" jsonschema:"exact project UUID; never inferred"`
	AssistantID       string `json:"assistant_id" jsonschema:"exact assistant UUID"`
	TriggerInstanceID string `json:"trigger_instance_id,omitempty" jsonschema:"root trigger UUID from a preview; required with confirmed:true"`
	ExecutionContext  string `` /* 157-byte string literal not displayed */
	McpServerID       string `json:"mcp_server_id,omitempty" jsonschema:"MCP server UUID from a preview; required with confirmed:true"`
	AuthClientID      string `json:"auth_client_id,omitempty" jsonschema:"one of the server's options from a preview"`
	NoAuth            bool   `json:"no_auth,omitempty" jsonschema:"use no upstream authentication, for a server that needs none"`
	Automatic         bool   `json:"automatic,omitempty" jsonschema:"remove the choice so the next turn makes it from the server's configuration"`
	ExpectedVersion   *int64 `` /* 158-byte string literal not displayed */
	Confirmed         bool   `` /* 158-byte string literal not displayed */
}

type ChooseAssistantUpstreamCredentialOutput 

type ChooseAssistantUpstreamCredentialOutput struct {
	ProjectID   string                               `json:"project_id"`
	AssistantID string                               `json:"assistant_id"`
	Profiles    []AssistantUpstreamCredentialProfile `json:"profiles"`
}

type ChooseMCPHeadlessCallerCredentialInput 

type ChooseMCPHeadlessCallerCredentialInput struct {
	ProjectID           string `json:"project_id" jsonschema:"explicit project ID that owns the configured MCP"`
	MCPID               string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp"`
	UserSessionClientID string `` /* 157-byte string literal not displayed */
	WorkloadIssuerID    string `json:"workload_issuer_id,omitempty" jsonschema:"the workload issuer of a workload caller"`
	WorkloadSubject     string `json:"workload_subject,omitempty" jsonschema:"the exact workload subject of a workload caller"`
	AuthClientID        string `` /* 144-byte string literal not displayed */
	NoAuth              bool   `json:"no_auth,omitempty" jsonschema:"use no upstream authentication, for a server that needs none"`
	Remove              bool   `json:"remove,omitempty" jsonschema:"remove the caller's choice for this server"`
	Name                string `json:"name,omitempty" jsonschema:"name for a caller that has no profile yet"`
	Confirmed           bool   `` /* 167-byte string literal not displayed */
}

type ChooseMCPHeadlessCallerCredentialOutput 

type ChooseMCPHeadlessCallerCredentialOutput struct {
	UpstreamAuthentication *MCPUpstreamAuthentication `json:"upstream_authentication" jsonschema:"the credentials the server offers"`
	Callers                []MCPHeadlessCallerChoice  `` /* 140-byte string literal not displayed */
}

type ClientAdmission 

type ClientAdmission struct {
	Mode             string
	AllowedModes     []string
	CustomClientURLs []string
}

ClientAdmission is the CIMD admission state of one registered MCP's session issuer. Mode is always the EFFECTIVE mode: an issuer that never had one set reports the resolved default, matching what the dashboard shows.

type ClientAdmissionService 

type ClientAdmissionService struct {
	// contains filtered or unexported fields
}

ClientAdmissionService reads and writes the CIMD admission policy of the session issuer a Platform MCP registration owns. It is the tool-surface equivalent of MCP Server -> Settings -> Authentication, and writes the same audit event the management API writes for the same change.

Nothing here is connection-scoped: a registration is resolved through the connection-tolerant lifecycle lookup, and the write is attributed to the caller's real user.

func NewClientAdmissionService 

func NewClientAdmissionService(db *pgxpool.Pool, auditLogger *audit.Logger) *ClientAdmissionService

func (*ClientAdmissionService) Get 

func (s *ClientAdmissionService) Get(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (ClientAdmission, error)

func (*ClientAdmissionService) Set 

func (s *ClientAdmissionService) Set(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, mode string) (ClientAdmission, error)

Set writes one admission mode. The caller is responsible for having obtained explicit user confirmation: this changes which MCP clients may authorize against the registered server, and ModeDisabled additionally withdraws the advertised CIMD support from the issuer's RFC 8414 metadata.

type CodeModeAvailability 

type CodeModeAvailability func(ctx context.Context, organizationID string) bool

CodeModeAvailability reports whether an organization can use Code Mode now: the code runtime is available and the organization has the entitlement.

type CompareSkillVersionsInput 

type CompareSkillVersionsInput struct {
	ProjectSlug string
	SkillID     string
	Window      string
}

CompareSkillVersionsInput compares the versions of one named skill.

type CompareSkillVersionsOutput 

type CompareSkillVersionsOutput struct {
	ProjectSlug string       `json:"project_slug"`
	Envelope    DataEnvelope `json:"data"`

	SkillID          string `json:"skill_id"`
	SkillName        string `json:"skill_name"`
	SkillDisplayName string `json:"skill_display_name"`

	// Metrics totals every version below, so the skill's own figures match what
	// list_skill_insights reports for it.
	Metrics SkillInsightMetrics `json:"metrics"`

	Versions []SkillVersionInsight `json:"versions"`

	// ScoresAvailable is false when no session in the window was scored.
	ScoresAvailable bool `json:"scores_available"`

	// CostAttribution says how full_session_cost_usd was counted.
	CostAttribution string `json:"cost_attribution"`

	// ScoreCoverage says which sessions the score and saved-time figures cover.
	ScoreCoverage string `json:"score_coverage"`

	// Truncated is true when the skill holds more versions than were compared.
	Truncated bool `json:"truncated"`
}

CompareSkillVersionsOutput is one skill's versions measured against each other, newest first.

type CompareSkillVersionsToolInput 

type CompareSkillVersionsToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID     string `json:"skill_id" jsonschema:"the skill whose versions to compare, by ID as returned by list_skills"`
	Window      string `json:"window,omitempty" jsonschema:"how far back to look: 1h, 24h, 7d, or 30d (default and maximum)"`
}

type ConfigureInferenceAccessRoleInput 

type ConfigureInferenceAccessRoleInput struct {
	ProjectID       string `json:"project_id" jsonschema:"explicit project ID for admission and receipt scope; grant scope is controlled by all_projects"`
	AllProjects     bool   `` /* 171-byte string literal not displayed */
	RoleReference   string `json:"role_reference" jsonschema:"fresh opaque custom role reference from list_access_roles"`
	ExpectedVersion string `json:"expected_version" jsonschema:"version from the fresh role read"`
	Enabled         bool   `json:"enabled" jsonschema:"true adds the selected inference grant; false removes only that exact grant, not other scopes"`
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"stable unique key for this exact mutation and retries"`
	Confirmed       bool   `` /* 162-byte string literal not displayed */
}

type ConfigureInferenceAccessRoleOutput 

type ConfigureInferenceAccessRoleOutput struct {
	Role              AccessRoleMutationSummary `json:"role" jsonschema:"historical committed role snapshot; read roles again before another change"`
	ProjectID         string                    `json:"project_id"`
	Scope             string                    `json:"scope"`
	AllProjects       bool                      `json:"all_projects"`
	ExactGrantPresent bool                      `` /* 179-byte string literal not displayed */
	Receipt           RiskMutationToolReceipt   `json:"receipt"`
}

type ContinueSessionInput 

type ContinueSessionInput struct {
	SessionID string `json:"session_id" jsonschema:"the session to recall — a session id from list_my_sessions"`
}

type ContinueSessionOutput 

type ContinueSessionOutput struct {
	Digest          string   `json:"digest"`
	SourceSessionID string   `json:"source_session_id"`
	ChatID          string   `json:"chat_id"`
	NotCarriedOver  []string `json:"not_carried_over"`
	Notes           []string `json:"notes"`
}

ContinueSessionOutput carries the digest plus its fidelity as structured fields; fidelity is never folded into the markdown prose.

type CreateDataExportInput 

type CreateDataExportInput struct {
	ProjectID     string `json:"project_id,omitempty" jsonschema:"project ID that will export telemetry; supply exactly one project selector"`
	ProjectSlug   string `json:"project_slug,omitempty" jsonschema:"project slug that will export telemetry; supply exactly one project selector"`
	Name          string `json:"name" jsonschema:"display name for the OTEL destination"`
	EndpointURL   string `json:"endpoint_url" jsonschema:"HTTP or HTTPS OTEL collector endpoint without credentials, query parameters, or fragments"`
	DataSource    string `json:"data_source" jsonschema:"data to export: product_telemetry, risk_findings, or tool_call_logs"`
	SensitiveData string `json:"sensitive_data,omitempty" jsonschema:"whether sensitive fields are included: exclude (default) or include"`
	Enabled       *bool  `json:"enabled,omitempty" jsonschema:"whether delivery starts immediately; defaults to true"`
	Confirmed     bool   `` /* 151-byte string literal not displayed */
}

type CreateDataExportOutput 

type CreateDataExportOutput struct {
	Destination   DataExportDestination `json:"destination"`
	Route         DataExportRoute       `json:"route"`
	ManagementURL string                `json:"management_url"`
}

type CreateGatewayInput 

type CreateGatewayInput struct {
	ProjectID string   `json:"project_id" jsonschema:"ID of the project the gateway belongs to; every member must be in it"`
	Name      string   `json:"name" jsonschema:"display name for the gateway, at most 100 characters"`
	MCPIDs    []string `` /* 162-byte string literal not displayed */
}

type CreateMCPAccessRoleInput 

type CreateMCPAccessRoleInput struct {
	ProjectID      string              `json:"project_id" jsonschema:"explicit project ID that owns every configured MCP in rules"`
	Name           string              `json:"name" jsonschema:"display name for the new custom role"`
	Description    string              `json:"description,omitempty" jsonschema:"optional description for the new custom role"`
	Rules          []MCPAccessRoleRule `` /* 141-byte string literal not displayed */
	IdempotencyKey string              `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed      bool                `json:"confirmed" jsonschema:"set true only after the user confirms this exact project, role, and MCP access delta"`
}

type CreateMCPAccessRoleOutput 

type CreateMCPAccessRoleOutput struct {
	Role           AccessRoleMutationSummary `json:"role"`
	Reconciliation string                    `` /* 227-byte string literal not displayed */
	Receipt        RiskMutationToolReceipt   `json:"receipt"`
}

type CreateMCPFromFunctionsInput 

type CreateMCPFromFunctionsInput struct {
	ProjectID      string   `json:"project_id" jsonschema:"project ID the new MCP server belongs to"`
	Name           string   `json:"name" jsonschema:"display name for the new MCP server; at most 60 characters"`
	ToolURNs       []string `json:"tool_urns" jsonschema:"exact function tool URNs from list_project_tools; at most 50"`
	IdempotencyKey string   `json:"idempotency_key" jsonschema:"caller-chosen key that makes a retry of this exact creation safe"`
	Confirmed      bool     `json:"confirmed" jsonschema:"true only after the user confirmed this exact project, name, and tool list"`
}

CreateMCPFromFunctionsInput authors a new hosted MCP server whose tools are tools a project's functions already produced.

type CreateMCPFromFunctionsOutput 

type CreateMCPFromFunctionsOutput struct {
	Outcome string `json:"outcome"`
	MCPID   string `json:"mcp_id"`
	MCPName string `json:"mcp_name"`
	MCPSlug string `json:"mcp_slug"`
	// Visibility is the server record's own visibility, which is private.
	Visibility string `json:"visibility"`
	// AddedToDefaultPlugin reports what the creation actually did, read from
	// the attach itself: true when the new tool list joined the project's
	// Default plugin, which happens to an organization's first server exactly
	// as it does from the dashboard. Everyone holding the Default plugin then
	// receives it. False means the server reaches nobody until it is put into
	// a plugin.
	AddedToDefaultPlugin bool `json:"added_to_default_plugin"`
	// PublicationRequested is true when a refresh of the plugins people hold
	// was actually requested — durably or best effort — for that membership
	// change. It says a refresh was asked for, not that people have it yet.
	PublicationRequested bool `json:"publication_requested"`
	// Exposure is a fresh read taken after the commit, so a caller reports the
	// committed tool list rather than the one it asked for.
	Exposure      *MCPToolExposure `json:"exposure,omitempty"`
	SnapshotScope string           `json:"snapshot_scope"`
	// PublicationRequest and PublishSignal detail how that refresh was asked
	// for; both stay at their not-requested values when nothing joined a
	// plugin.
	PublicationRequest string `json:"publication_request"`
	PublishSignal      string `json:"publish_signal"`
	// IndexSignal has the meaning it has on add_tools_to_mcp: whether the
	// tool-search index rebuild the new tool list needs was scheduled.
	IndexSignal string                  `json:"index_signal"`
	Receipt     RiskMutationToolReceipt `json:"receipt"`
}

CreateMCPFromFunctionsOutput reports the server that now exists. A refusal is returned as an error result and never as this struct.

type CreatePluginInput 

type CreatePluginInput struct {
	ProjectID       string `json:"project_id" jsonschema:"explicit project ID the plugin is created in"`
	Name            string `json:"name" jsonschema:"administrator-facing plugin name; at most 256 bytes"`
	Slug            string `` /* 228-byte string literal not displayed */
	Description     string `json:"description,omitempty" jsonschema:"optional plugin description; at most 1024 bytes"`
	AutoSyncEnabled *bool  `` /* 218-byte string literal not displayed */
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact creation"`
	Confirmed       bool   `` /* 130-byte string literal not displayed */
}

type CreateProjectInput 

type CreateProjectInput struct {
	Name           string `` /* 140-byte string literal not displayed */
	IdempotencyKey string `` /* 250-byte string literal not displayed */
	Confirmed      bool   `` /* 173-byte string literal not displayed */
}

type CreateRiskExclusionReceiptResult 

type CreateRiskExclusionReceiptResult struct {
	Project         RiskMutationReceiptProject  `json:"project"`
	Exclusion       RiskExclusionReceiptSummary `json:"exclusion"`
	Version         string                      `json:"version"`
	MatchedExisting bool                        `json:"matched_existing"`
	ResultCategory  string                      `json:"result_category"`
	Reconciliation  string                      `json:"reconciliation"`
}

type CreateRiskExclusionToolOutput 

type CreateRiskExclusionToolOutput struct {
	CreateRiskExclusionReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type CreateRiskPolicyReceiptResult 

type CreateRiskPolicyReceiptResult struct {
	Project         RiskMutationReceiptProject `json:"project"`
	Policy          RiskPolicyReceiptSummary   `json:"policy"`
	Version         string                     `json:"version"`
	MatchedExisting bool                       `json:"matched_existing"`
	ResultCategory  string                     `json:"result_category"`
}

type CreateRiskPolicyToolOutput 

type CreateRiskPolicyToolOutput struct {
	CreateRiskPolicyReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type CreateSkillInput 

type CreateSkillInput struct {
	ProjectSlug string
	Content     string
}

type CreateSkillToolInput 

type CreateSkillToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that will own the skill"`
	Content     string `json:"content" jsonschema:"the complete SKILL.md, including YAML frontmatter and instructions; at most 65536 UTF-8 bytes"`
}

type CredentialCodec 

type CredentialCodec struct {
	// contains filtered or unexported fields
}

CredentialCodec makes Platform MCP credentials opaque while preserving a verified organization routing hint for organization-scoped persistence queries.

func NewCredentialCodec 

func NewCredentialCodec(encryptionClient *encryption.Client) (*CredentialCodec, error)

func (*CredentialCodec) Issue 

func (c *CredentialCodec) Issue(kind credentialKind, organizationID, resource string) (string, error)

Issue mints an opaque credential bound to organizationID and resource.

func (*CredentialCodec) OrganizationID 

func (c *CredentialCodec) OrganizationID(kind credentialKind, credential string) (string, error)

type DashboardAuthorization 

type DashboardAuthorization struct {
	// URL is the MCP server's Inspect page, which owns the visible
	// Connect/Authorize action.
	URL string

	// ServerName is the MCP server's display name, which may be empty.
	ServerName string

	Logo template.URL
}

DashboardAuthorization is where a user signs in to an MCP server's upstream provider after it is attached.

type DashboardSessionAuthenticator 

type DashboardSessionAuthenticator interface {
	AuthenticateWithCookie(ctx context.Context) (context.Context, error)
}

type DashboardSetupHTTP 

type DashboardSetupHTTP struct {
	// contains filtered or unexported fields
}

func NewDashboardSetupHTTP 

func NewDashboardSetupHTTP(starter DashboardSetupStarter, sessionManager DashboardSessionAuthenticator) *DashboardSetupHTTP

func (*DashboardSetupHTTP) Attach 

func (s *DashboardSetupHTTP) Attach(mux interface {
	Handle(string, string, http.HandlerFunc)
})

func (*DashboardSetupHTTP) Handler 

func (s *DashboardSetupHTTP) Handler() http.Handler

type DashboardSetupService 

type DashboardSetupService struct {
	// contains filtered or unexported fields
}

func NewDashboardSetupService 

func NewDashboardSetupService(store *RegistrationStore, gate CatalogRegistrationGateChecker, authorizer Authorizer, adapters *ProviderAdapters, setupBudget OperationBudget) *DashboardSetupService

func (*DashboardSetupService) StartDashboardSetup 

func (s *DashboardSetupService) StartDashboardSetup(ctx context.Context, userID, organizationID, handoff string) (ProviderSetupResult, error)

type DashboardSetupStarter 

type DashboardSetupStarter interface {
	StartDashboardSetup(ctx context.Context, userID, organizationID, handoff string) (ProviderSetupResult, error)
}

type DashboardsService 

type DashboardsService struct {
	// contains filtered or unexported fields
}

DashboardsService serves a project's dashboards to the Platform MCP through the dashboards service, which stays the source of truth for authorization, validation and audit. Only external users are admitted: the audit names a user.

func NewDashboardsService 

func NewDashboardsService(logger *slog.Logger, management *dashboards.Service, projects *PostgresReader, engine *authz.Engine, flags feature.Provider, organizations OrganizationSlugResolver, key string) *DashboardsService

NewDashboardsService returns nil when a dependency is missing, so the tools are served as stubs.

func (*DashboardsService) Get 

func (s *DashboardsService) Get(ctx context.Context, principal Principal, input getDashboardInput) (dashboardView, error)

Get reads one dashboard, by id or built-in slug.

func (*DashboardsService) List 

func (s *DashboardsService) List(ctx context.Context, principal Principal, input listDashboardsInput) (listDashboardsOutput, error)

List lists the project's dashboards and the Speakeasy-built ones.

type DataEnvelope 

type DataEnvelope struct {
	QueriedAt   string    `json:"queried_at"`
	DataThrough string    `json:"data_through,omitempty"`
	Freshness   Freshness `json:"freshness"`
	// NoObservations states positively that the scope produced nothing in the
	// window. Freshness alone cannot carry this: "unavailable" describes the
	// pipeline, and a caller must not read either as evidence of health.
	NoObservations bool           `json:"no_observations"`
	ResolvedWindow ResolvedWindow `json:"resolved_window"`
}

DataEnvelope accompanies every diagnostic result. It says when the answer was computed, how far the underlying observations reach, and whether that is current enough to act on.

type DataExportDestination 

type DataExportDestination struct {
	ID            string             `json:"id"`
	ProjectID     string             `json:"project_id"`
	ProjectName   string             `json:"project_name"`
	ProjectSlug   string             `json:"project_slug"`
	Name          string             `json:"name"`
	Type          string             `json:"type"`
	EndpointURL   string             `json:"endpoint_url"`
	SensitiveData string             `json:"sensitive_data"`
	Headers       []DataExportHeader `json:"headers"`
}

type DataExportHeader 

type DataExportHeader struct {
	Name     string `json:"name"`
	HasValue bool   `json:"has_value"`
}

type DataExportReadService 

type DataExportReadService struct {
	// contains filtered or unexported fields
}

DataExportReadService owns the dependencies needed to project data export configuration without exposing stored header values.

type DataExportRoute 

type DataExportRoute struct {
	ID            string `json:"id"`
	ProjectID     string `json:"project_id"`
	ProjectName   string `json:"project_name"`
	ProjectSlug   string `json:"project_slug"`
	DataSource    string `json:"data_source"`
	Enabled       bool   `json:"enabled"`
	DestinationID string `json:"destination_id,omitempty"`
}

type DataExportRouteToggleService 

type DataExportRouteToggleService struct {
	// contains filtered or unexported fields
}

DataExportRouteToggleService pauses and resumes one data export route. It writes through dataexports.RouteEnabledCore, which changes the enabled flag and nothing else.

func NewDataExportRouteToggleService 

func NewDataExportRouteToggleService(logger *slog.Logger, db *pgxpool.Pool, core *dataexports.RouteEnabledCore, admin Authorizer, changes OperationBudget) (*DataExportRouteToggleService, error)

func (*DataExportRouteToggleService) Pause 

func (s *DataExportRouteToggleService) Pause(ctx context.Context, principal Principal, input ToggleDataExportRouteInput) (ToggleDataExportRouteOutput, error)

func (*DataExportRouteToggleService) Resume 

func (s *DataExportRouteToggleService) Resume(ctx context.Context, principal Principal, input ResumeDataExportRouteInput) (ToggleDataExportRouteOutput, error)

type DataExportToggleError 

type DataExportToggleError struct {
	Code    string
	Message string
	Cause   error
}

DataExportToggleError is safe to map into a tool refusal: its message names what the caller can do next and never carries database detail.

func (*DataExportToggleError) Error 

func (e *DataExportToggleError) Error() string

func (*DataExportToggleError) Unwrap 

func (e *DataExportToggleError) Unwrap() error

type DecideShadowMCPAccessInput 

type DecideShadowMCPAccessInput struct {
	ProjectID          string   `json:"project_id" jsonschema:"explicit project ID used to inspect the Shadow MCP target"`
	TargetReference    string   `` /* 135-byte string literal not displayed */
	Decision           string   `json:"decision" jsonschema:"decision to enforce: allow or deny"`
	Rationale          string   `json:"rationale" jsonschema:"bounded reason for the decision; required and stored in the audit trail"`
	AudienceReferences []string `` /* 227-byte string literal not displayed */
	ExpectedVersion    string   `json:"expected_version" jsonschema:"opaque decision version returned by get_shadow_mcp_review immediately before this write"`
	IdempotencyKey     string   `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact decision"`
	Confirmed          bool     `` /* 129-byte string literal not displayed */
}

type DecideShadowMCPAccessOutput 

type DecideShadowMCPAccessOutput struct {
	Decision    string                    `json:"decision"`
	Audiences   []ShadowDecisionAudience  `json:"audiences"`
	State       *GetShadowMCPReviewOutput `json:"state,omitempty"`
	StateStatus string                    `json:"state_status"`
	Receipt     RiskMutationToolReceipt   `json:"receipt"`
}

type DeploymentRedeployManagement 

type DeploymentRedeployManagement interface {
	GetDeployment(context.Context, *gendeployments.GetDeploymentPayload) (*gendeployments.GetDeploymentResult, error)
	PrepareRedeploy(context.Context, pgx.Tx, *gendeployments.RedeployPayload) (*types.Deployment, error)
	DispatchRedeploy(context.Context, string, uuid.UUID) (*gendeployments.RedeployResult, error)
}

DeploymentRedeployManagement shares authorization, cloning, audit, and processing with the dashboard. Only the transaction boundary differs: the clone and its Platform MCP receipt must commit together before processing.

type DeploymentRedeployPreview 

type DeploymentRedeployPreview struct {
	ProjectID          string `json:"project_id"`
	SourceDeploymentID string `json:"source_deployment_id"`
	ActiveDeploymentID string `json:"active_deployment_id"`
	SourceStatus       string `json:"source_status"`
	OpenAPIAssets      int    `json:"openapi_assets"`
	FunctionAssets     int    `json:"function_assets"`
	Packages           int    `json:"packages"`
	ExternalMCPs       int    `json:"external_mcps"`
	Scope              string `json:"scope"`
}

type DeploymentRedeployService 

type DeploymentRedeployService struct {
	// contains filtered or unexported fields
}

func NewDeploymentRedeployService 

func NewDeploymentRedeployService(db *pgxpool.Pool, management DeploymentRedeployManagement, projects *PostgresReader, budget OperationBudget) *DeploymentRedeployService

func (*DeploymentRedeployService) Redeploy 

func (s *DeploymentRedeployService) Redeploy(ctx context.Context, principal Principal, input RedeployDeploymentInput) (RedeployDeploymentOutput, error)

type DescribeAnalyticsCatalogInput 

type DescribeAnalyticsCatalogInput struct {
	ProjectID string `json:"project_id"`
}

DescribeAnalyticsCatalogInput names the project the rollout flag and project:read are checked against; the catalog is the same for every project.

type DescribeAnalyticsCatalogOutput 

type DescribeAnalyticsCatalogOutput struct {
	Project  AnalyticsProject   `json:"project"`
	Datasets []AnalyticsDataset `json:"datasets"`
	// Grains are the time bucket widths a grouped query may use.
	Grains []string        `json:"grains"`
	Limits AnalyticsLimits `json:"limits"`
	// SignalMetrics is the entitled semantic contract, with current names and scopes.
	SignalMetrics *analytics.SignalCatalog `json:"signal_metrics,omitempty"`
}

DescribeAnalyticsCatalogOutput is the catalog every query is written in.

type DescribeToolsInput 

type DescribeToolsInput struct {
	Server string   `json:"server" jsonschema:"Server slug from list_my_servers"`
	Tools  []string `` /* 137-byte string literal not displayed */
}

DescribeToolsInput names one server and, optionally, the tools to fetch schemas for.

type DescribeToolsOutput 

type DescribeToolsOutput struct {
	Server   string          `json:"server"`
	Tools    []DescribedTool `json:"tools"`
	NotFound []string        `json:"not_found,omitempty"`
}

DescribeToolsOutput is a server's tools.

type DescribedTool 

type DescribedTool struct {
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
	// InputSchema is set only for tools named in the request.
	InputSchema any `json:"input_schema,omitempty"`
}

DescribedTool is one tool on a server.

type Descriptor 

type Descriptor struct {
	Name        string
	Title       string
	Description string
	Annotations *mcp.ToolAnnotations
	Meta        ToolMeta
	InputSchema []byte
	// contains filtered or unexported fields
}

Descriptor is one registered tool, reachable either through the MCP server or by direct call.

The direct path exists for surfaces that speak Go rather than MCP. Going through a second in-process MCP server instead would re-encode every call, and would flatten a refusal into an ordinary result on the way back.

func (Descriptor) Invoke 

func (d Descriptor) Invoke(ctx context.Context, arguments json.RawMessage) (any, error)

Invoke calls the tool directly. The caller must have bound an authorized principal to the context with ContextWithPrincipal.

type DeviceCoverageOutput 

type DeviceCoverageOutput struct {
	TotalDevices int64 `json:"total_devices"`
	// ActiveWindowMinutes is how recent an agent's sign of life must be for
	// its device to count as running the agent.
	ActiveWindowMinutes int `json:"active_window_minutes"`
	// Attestation is device when every active device was matched by its own
	// hardware serial, or user when some only prove their assigned user runs
	// the agent somewhere.
	Attestation string `json:"attestation"`
	AgentActive int64  `json:"agent_active"`
	// AgentActiveDeviceAttested counts the agent_active devices backed by
	// their own agent, matched by serial, rather than their user's.
	AgentActiveDeviceAttested int64 `json:"agent_active_device_attested"`
	AgentStale                int64 `json:"agent_stale"`
	AgentOtherDevice          int64 `json:"agent_other_device"`
	NoAgent                   int64 `json:"no_agent"`
	NoEmail                   int64 `json:"no_email"`
	UnresolvedEmail           int64 `json:"unresolved_email"`
	Missing                   int64 `json:"missing"`
	// The policy counts split agent_active by whether the device enforces the
	// policy last served to it.
	PolicyAttested    int64 `json:"policy_attested"`
	PolicyOutdated    int64 `json:"policy_outdated"`
	PolicyUnreported  int64 `json:"policy_unreported"`
	EnforcementHalted int64 `json:"enforcement_halted"`
	// UnmanagedAgentUsers run the agent but have no device in the inventory.
	UnmanagedAgentUsers int64 `json:"unmanaged_agent_users"`
}

type DeviceCoverageService 

type DeviceCoverageService struct {
	// contains filtered or unexported fields
}

DeviceCoverageService serves the MDM coverage reads: how much of the fleet runs the agent, and whether each device enforces the policy it was served. Organization-scoped, like the dashboard's Device Agent pages.

func NewDeviceCoverageService 

func NewDeviceCoverageService(reader deviceCoverageReader, authorizer deviceCoverageAuthorizer, budget OperationBudget) *DeviceCoverageService

func (*DeviceCoverageService) GetCoverage 

func (s *DeviceCoverageService) GetCoverage(ctx context.Context, principal Principal, input GetDeviceCoverageInput) (DeviceCoverageOutput, error)

func (*DeviceCoverageService) ListManagedDevices 

func (s *DeviceCoverageService) ListManagedDevices(ctx context.Context, principal Principal, input ListManagedDevicesInput) (ListManagedDevicesOutput, error)

type DiagnosticWindow 

type DiagnosticWindow string

DiagnosticWindow is the closed set of windows a diagnostic may be asked for. Callers name a window rather than supplying timestamps: an open time grammar is a query language, and this surface deliberately has none.

Each tool additionally caps how far back it will look, because the cost of a read is not the same for a summary and for a row-level drill-down. 

const (
	DiagnosticWindowLastHour  DiagnosticWindow = "1h"
	DiagnosticWindowLastDay   DiagnosticWindow = "24h"
	DiagnosticWindowLastWeek  DiagnosticWindow = "7d"
	DiagnosticWindowLastMonth DiagnosticWindow = "30d"
)

type DiagnosticsProjectReader 

type DiagnosticsProjectReader interface {
	ResolveProjectRead(ctx context.Context, principal Principal, input FindMCPInput) (ResolvedProject, error)
	ResolveProjectLogRead(ctx context.Context, principal Principal, input FindMCPInput) (ResolvedProject, error)
	GetMCPForDiagnostics(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)
}

DiagnosticsProjectReader keeps delegated project authorization explicit without coupling diagnostics to one Reader implementation.

type DiagnosticsReader 

type DiagnosticsReader interface {
	Reader
	DiagnosticsProjectReader
}

DiagnosticsReader is the complete read contract diagnostics needs. Keeping the authorization seam explicit avoids silently accepting a Reader implementation that cannot enforce project:read.

type DiagnosticsService 

type DiagnosticsService struct {
	// contains filtered or unexported fields
}

DiagnosticsService answers the two overview-first questions: what is this project doing, and why is this one MCP not working.

func NewDiagnosticsService 

func NewDiagnosticsService(db *pgxpool.Pool, telemetry DiagnosticsTelemetryReader, sessionCapture FeatureChecker, reader DiagnosticsReader, readiness *ReadinessService, budget OperationBudget) *DiagnosticsService

NewDiagnosticsService composes the overview-first entry points. The bounded drill-down tools are attached separately by WithDrilldown, so a deployment that cannot mint subject references serves the overview and withholds the row-level reads rather than serving them unbound.

func (*DiagnosticsService) GetMCPDiagnostics 

func (s *DiagnosticsService) GetMCPDiagnostics(ctx context.Context, principal Principal, input GetMCPDiagnosticsInput) (GetMCPDiagnosticsOutput, error)

func (*DiagnosticsService) GetProjectOverview 

func (s *DiagnosticsService) GetProjectOverview(ctx context.Context, principal Principal, input GetProjectOverviewInput) (GetProjectOverviewOutput, error)

func (*DiagnosticsService) GetToolUsageSummary 

func (s *DiagnosticsService) GetToolUsageSummary(ctx context.Context, principal Principal, input GetToolUsageSummaryInput) (GetToolUsageSummaryOutput, error)

func (*DiagnosticsService) GetUserMCPStatus 

func (s *DiagnosticsService) GetUserMCPStatus(ctx context.Context, principal Principal, input GetUserMCPStatusInput) (GetUserMCPStatusOutput, error)

func (*DiagnosticsService) GetUserMetricsSummary 

func (s *DiagnosticsService) GetUserMetricsSummary(ctx context.Context, principal Principal, input GetUserMetricsSummaryInput) (GetUserMetricsSummaryOutput, error)

func (*DiagnosticsService) GetUserSkillStatus 

func (s *DiagnosticsService) GetUserSkillStatus(ctx context.Context, principal Principal, input GetUserSkillStatusInput) (GetUserSkillStatusOutput, error)

func (*DiagnosticsService) ListAttributeKeys 

func (s *DiagnosticsService) ListAttributeKeys(ctx context.Context, principal Principal, input ListAttributeKeysInput) (ListAttributeKeysOutput, error)

func (*DiagnosticsService) ListMCPUsageUsers 

func (s *DiagnosticsService) ListMCPUsageUsers(ctx context.Context, principal Principal, input ListMCPUsageUsersInput) (ListMCPUsageUsersOutput, error)

func (*DiagnosticsService) ListSkillUsageUsers 

func (s *DiagnosticsService) ListSkillUsageUsers(ctx context.Context, principal Principal, input ListSkillUsageUsersInput) (ListSkillUsageUsersOutput, error)

func (*DiagnosticsService) QueryMCPEvents 

func (s *DiagnosticsService) QueryMCPEvents(ctx context.Context, principal Principal, input QueryMCPEventsInput) (QueryMCPEventsOutput, error)

func (*DiagnosticsService) QueryMCPMetrics 

func (s *DiagnosticsService) QueryMCPMetrics(ctx context.Context, principal Principal, input QueryMCPMetricsInput) (QueryMCPMetricsOutput, error)

func (*DiagnosticsService) QueryMCPTraces 

func (s *DiagnosticsService) QueryMCPTraces(ctx context.Context, principal Principal, input QueryMCPTracesInput) (QueryMCPTracesOutput, error)

func (*DiagnosticsService) QuerySkillUsage 

func (s *DiagnosticsService) QuerySkillUsage(ctx context.Context, principal Principal, input QuerySkillUsageInput) (QuerySkillUsageOutput, error)

func (*DiagnosticsService) SearchToolCalls 

func (s *DiagnosticsService) SearchToolCalls(ctx context.Context, principal Principal, input SearchToolCallsInput) (SearchToolCallsOutput, error)

func (*DiagnosticsService) SearchUsers 

func (s *DiagnosticsService) SearchUsers(ctx context.Context, principal Principal, input SearchUsersInput) (SearchUsersOutput, error)

func (*DiagnosticsService) WithCanonicalIdentityGate 

func (s *DiagnosticsService) WithCanonicalIdentityGate(gate CanonicalIdentityGate) *DiagnosticsService

WithCanonicalIdentityGate applies the telemetry service's rollout-aware identity folding to user attribution without making the ClickHouse repository responsible for feature flags.

func (*DiagnosticsService) WithDrilldown 

func (s *DiagnosticsService) WithDrilldown(drilldown DrilldownTelemetryReader, referenceKeyMaterial string, sensitiveBudget OperationBudget, volume DrilldownVolumeBudget, auditor DrilldownAuditor) *DiagnosticsService

WithDrilldown attaches the bounded drill-down reads. Reference key material is required: without it a trace or subject handle could not be bound to the caller's organization and session, and the tools stay unavailable rather than returning unbound identifiers.

func (*DiagnosticsService) WithToolCallSearch 

func (s *DiagnosticsService) WithToolCallSearch(search ToolCallSearchReader) *DiagnosticsService

WithToolCallSearch attaches the project-wide tool-call search and attribute key discovery. They also require the drill-down composition (reference codec, sensitive budget, volume cap, auditor) because a search page carries masked identities and person references exactly as list_mcp_usage_users does.

func (*DiagnosticsService) WithToolUsageBreakdown 

func (s *DiagnosticsService) WithToolUsageBreakdown(reader ToolUsageBreakdownReader) *DiagnosticsService

WithToolUsageBreakdown attaches the per-target-type usage summary. A nil reader keeps get_tool_usage_summary registered as its unavailable stub.

func (*DiagnosticsService) WithUserSearch 

func (s *DiagnosticsService) WithUserSearch(reader UserSearchReader) *DiagnosticsService

WithUserSearch attaches the project-wide people search and the per-person summary. They also require the drill-down composition (reference codec, sensitive budget, volume cap, auditor) because every page carries masked identities and person references exactly as list_mcp_usage_users does.

type DiagnosticsTelemetryReader 

type DiagnosticsTelemetryReader interface {
	GetMCPOutcomeBreakdown(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams) ([]telemetryrepo.MCPOutcomeBreakdownRow, error)
	GetTelemetryWatermark(ctx context.Context, arg telemetryrepo.GetTelemetryWatermarkParams) (int64, error)
	GetOverviewSummary(ctx context.Context, arg telemetryrepo.GetOverviewSummaryParams) (*telemetryrepo.OverviewSummary, error)
	GetActiveCounts(ctx context.Context, arg telemetryrepo.GetActiveCountsParams) (*telemetryrepo.ActiveCounts, error)
	GetUnifiedActiveServerCount(ctx context.Context, arg telemetryrepo.GetTopServersParams) (uint64, error)
	GetTopServers(ctx context.Context, arg telemetryrepo.GetTopServersParams) ([]telemetryrepo.TopServer, error)
	GetSkillsSummary(ctx context.Context, arg telemetryrepo.GetSkillsSummaryParams) ([]telemetryrepo.SkillSummaryRow, error)
	GetSkillBreakdown(ctx context.Context, arg telemetryrepo.GetSkillBreakdownParams) ([]telemetryrepo.SkillBreakdownRow, error)
}

DiagnosticsTelemetryReader is the Speakeasy-owned telemetry this surface reads. It is deliberately two bounded aggregate queries: there is no query grammar here and no way to reach a raw row.

type DirectRemoteInspection 

type DirectRemoteInspection struct {
	CanonicalURL           string   `json:"canonical_url"`
	Transport              string   `json:"transport"`
	ToolNames              []string `json:"tool_names"`
	ToolCount              int      `json:"tool_count"`
	Authentication         string   `json:"authentication"`
	OAuthDiscovery         string   `json:"oauth_discovery"`
	Trust                  string   `json:"trust"`
	RequiresDashboardSetup bool     `json:"requires_dashboard_setup"`

	// ServerName is the upstream's own serverInfo.name from initialize, as the
	// upstream sent it. It is empty when initialize did not succeed. It is
	// untrusted and left out of inspection results. Registration passes it
	// through directRemoteServerName before using it as the default display
	// name, which is then shown like any name the caller could have chosen.
	ServerName string `json:"-"`
	// AttachmentSupported reports that attach_platform_mcp_identity_provider
	// can obtain a client from the discovered provider on its own. A dynamic
	// registration endpoint only the dashboard's automatic setup can use leaves
	// it false.
	AttachmentSupported bool `json:"-"`
}

DirectRemoteInspection is the bounded, non-secret projection of a direct user-supplied remote MCP. It deliberately contains no response headers, response body, OAuth metadata, credentials, or schemas.

type DirectRemoteInspector 

type DirectRemoteInspector interface {
	Inspect(ctx context.Context, rawURL string) (DirectRemoteInspection, error)
}

DirectRemoteInspector is the boundary shared by candidate inspection and registration. Registration must call it again; an earlier tool result is never admission evidence.

type DirectoryReviewBackend 

type DirectoryReviewBackend interface {
	ListDirectoryReviewItems(context.Context, *accessgen.ListDirectoryReviewItemsPayload) (*accessgen.ListDirectoryReviewItemsResult, error)
	ResolveDirectoryReviewItem(context.Context, *accessgen.ResolveDirectoryReviewItemPayload) (*accessgen.ResolveDirectoryReviewItemResult, error)
}

DirectoryReviewBackend is the access service's review API. The tools call it under the caller's own auth context, so the live org:admin check, the transaction-time re-reads, version checks and audit are the dashboard's.

type DirectoryReviewCreatedRole 

type DirectoryReviewCreatedRole struct {
	RoleURN string `json:"role_urn"`
	Name    string `json:"name"`
}

type DirectoryReviewItemSummary 

type DirectoryReviewItemSummary struct {
	ItemID           string                        `json:"item_id"`
	Kind             string                        `json:"kind" jsonschema:"new_group, new_attribute_value or source_missing"`
	Occurrence       int32                         `json:"occurrence"`
	RaisedAt         string                        `json:"raised_at"`
	Source           DirectoryReviewSource         `json:"source"`
	DirectoryPeople  int64                         `json:"directory_people" jsonschema:"live directory profiles matching the source; not organization members"`
	ExistingRoleURNs []string                      `json:"existing_role_urns"`
	ProposedRoles    []DirectoryReviewProposedRole `json:"proposed_roles"`
	Version          string                        `json:"version" jsonschema:"send back with resolve_directory_review_item to approve"`
}

type DirectoryReviewMappedRole 

type DirectoryReviewMappedRole struct {
	RoleURN string `json:"role_urn"`
}

type DirectoryReviewProposedRole 

type DirectoryReviewProposedRole struct {
	Action  string `json:"action" jsonschema:"reuse an existing role or create a new one"`
	Name    string `json:"name"`
	RoleURN string `json:"role_urn,omitempty"`
}

type DirectoryReviewRoleChoice 

type DirectoryReviewRoleChoice struct {
	RoleURN    string `json:"role_urn,omitempty" jsonschema:"principal URN of an existing role, from proposed_roles or list_access_roles"`
	CreateName string `json:"create_name,omitempty" jsonschema:"name of a new role to create with no grants"`
}

type DirectoryReviewSource 

type DirectoryReviewSource struct {
	Kind             string `json:"kind" jsonschema:"group or attribute"`
	Name             string `json:"name" jsonschema:"the group name, or key=value for an attribute value"`
	DirectoryGroupID string `json:"directory_group_id,omitempty"`
	AttributeKey     string `json:"attribute_key,omitempty"`
	AttributeValue   string `json:"attribute_value,omitempty"`
}

type DiscoveryConfig 

type DiscoveryConfig struct {
	// Flags resolves FlagPlatformMCPDiscoveryMode.
	Flags feature.Provider
	// CodeExecutor runs execute programs. Nil keeps Code Mode unavailable.
	CodeExecutor codemode.Executor
	// CodeModeAvailable reports whether an organization can use Code Mode
	// now. Nil keeps Code Mode unavailable.
	CodeModeAvailable CodeModeAvailability
}

DiscoveryConfig supplies what choosing and serving the small surface needs. A zero config serves every caller the full catalogue.

type DismissSkillSuggestionInput 

type DismissSkillSuggestionInput struct {
	// ProjectSlug is the project that owns the suggestion.
	ProjectSlug string

	// SuggestionID is the suggestion being dismissed.
	SuggestionID string
}

type DismissSkillSuggestionOutput 

type DismissSkillSuggestionOutput struct {
	ProjectSlug string                 `json:"project_slug"`
	Suggestion  SkillSuggestionSummary `json:"suggestion"`
}

type DismissSkillSuggestionToolInput 

type DismissSkillSuggestionToolInput struct {
	ProjectSlug  string `json:"project_slug" jsonschema:"explicit project slug that owns the suggestion"`
	SuggestionID string `json:"suggestion_id" jsonschema:"suggestion ID returned by list_skill_suggestions"`
	Confirmed    bool   `json:"confirmed" jsonschema:"set true only after the user explicitly confirms discarding this suggestion"`
}

type DistributeMCPToolInput 

type DistributeMCPToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug selected by the user"`
	MCPID       string `` /* 128-byte string literal not displayed */
	Plugin      string `` /* 144-byte string literal not displayed */
}

type DistributeMCPToolOutput 

type DistributeMCPToolOutput struct {
	ProjectSlug      string `json:"project_slug"`
	MCPID            string `json:"mcp_id"`
	MCPServer        string `json:"mcp_server"`
	Plugin           string `json:"plugin"`
	Attached         bool   `json:"attached"`
	PublicationState string `json:"publication_state"`
	// AwaitingManualSync is true when authoritative evidence shows pending
	// changes in a plugin whose auto sync is off. Unknown evidence never confirms delivery.
	AwaitingManualSync bool               `json:"awaiting_manual_sync"`
	ShadowMCP          *ShadowMCPStanding `json:"shadow_mcp,omitempty"`
	Message            string             `json:"message"`
}

type DistributeSkillInput 

type DistributeSkillInput struct {
	ProjectSlug string
	SkillID     string
	Plugin      string
	Assistant   string
}

DistributeSkillInput names exactly one target. Plugin and assistant names are resolved to exactly one existing target in the named project or refused.

type DistributeSkillOutput 

type DistributeSkillOutput struct {
	ProjectSlug       string      `json:"project_slug"`
	SkillID           string      `json:"skill_id"`
	SkillName         string      `json:"skill_name"`
	Target            SkillTarget `json:"target"`
	DistributionID    string      `json:"distribution_id"`
	ResolvedVersionID string      `json:"resolved_version_id"`
	Message           string      `json:"message"`
}

type DistributeSkillToolInput 

type DistributeSkillToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that owns both the skill and the target"`
	SkillID     string `json:"skill_id" jsonschema:"skill ID returned by list_skills or create_skill"`
	Plugin      string `` /* 176-byte string literal not displayed */
	Assistant   string `` /* 142-byte string literal not displayed */
}

type Distribution 

type Distribution struct {
	// State is the recorded lifecycle state: attached or removed.
	State string

	// Version is the distribution version this result reflects.
	Version int64

	// AttachmentLive is whether the plugin currently carries the MCP.
	AttachmentLive bool

	// PublicationState is how far the package publication got.
	PublicationState string

	// Plugin is the name of the plugin the caller's target resolved to, echoed
	// so a caller sees where its distribution landed rather than inferring it.
	Plugin string

	// ShadowMCP is the server's standing with the project's Shadow MCP policy
	// after the write, for a user-supplied URL. Nil for reviewed catalogue
	// servers and when no reader is wired.
	ShadowMCP *ShadowMCPStanding

	// MCPServer is the name of the MCP server the distribution acted on, echoed
	// so a caller sees which server it shared rather than inferring it.
	MCPServer string

	// AwaitingManualSync is whether the plugin's change waits for a manual
	// sync: its auto sync is off and its package is not current. Automatic
	// publishes, this flow's included, then keep what it was last published
	// with, so the change reaches people only after someone syncs by hand.
	AwaitingManualSync bool
}

Distribution is the bounded state used by management and MCP tool adapters. Version is internal to the application service; external adapters must turn it into a server-issued opaque token before returning it to callers.

type DistributionAdmission 

type DistributionAdmission struct {
	State                 string                          `json:"state"`
	MissingAudienceCounts admission.MissingAudienceCounts `json:"missing_audience_counts"`
	CheckedAt             string                          `json:"checked_at"`
	Complete              bool                            `json:"complete"`
}

type DistributionInput 

type DistributionInput struct {
	// ProjectSlug is the explicit project the distribution acts in.
	ProjectSlug string

	// MCPServerID names the MCP server distributed, by the ID find_mcp reports.
	// Nil selects the server the caller's active onboarding workflow last
	// selected, which is what the dashboard's onboarding flow acts on.
	MCPServerID uuid.UUID

	// Plugin names an exact existing plugin by id, slug, or name. Empty selects
	// the project's default plugin, which is what the dashboard's own
	// "add to Default plugin" action asks for; the agent-facing tools require a
	// named target so a mistyped plugin is refused rather than silently
	// redirected.
	Plugin string

	// ExpectedVersion is the distribution version the caller read before
	// writing.
	ExpectedVersion int64
}

DistributionInput identifies the project selected by its slug, the MCP server distributed, and the plugin inside the project that receives it.

type DistributionService 

type DistributionService struct {
	// contains filtered or unexported fields
}

DistributionService changes only the selected workflow's attachment to the existing Default plugin. plugin_servers remains the attachment authority; platform_mcp_distributions records the caller-bound lifecycle projection.

func NewDistributionService 

func NewDistributionService(db *pgxpool.Pool, auditLogger *audit.Logger, attach ExistingPluginAttacher, publish ProjectPublisher, plugins PluginTargetResolver) *DistributionService

func (*DistributionService) Current 

func (s *DistributionService) Current(ctx context.Context, principal Principal, projectSlug string, mcpServerID uuid.UUID, targetPlugin string) (Distribution, error)

Current returns the selected workflow target's live attachment state and its last persisted version. It does not require readiness, so dashboard resume can safely project the state before offering a mutation.

func (*DistributionService) Distribute 

func (s *DistributionService) Distribute(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

func (*DistributionService) DistributeForOnboarding 

func (s *DistributionService) DistributeForOnboarding(ctx context.Context, principal Principal, projectSlug string, mcpServerID uuid.UUID, targetPlugin string) (Distribution, error)

DistributeForOnboarding delegates to the same explicit-project distribution path used by the dashboard. The caller names a server added through setup in that project; it cannot target an arbitrary server or create a Default plugin.

func (*DistributionService) Remove 

func (s *DistributionService) Remove(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

func (*DistributionService) RepairPublication 

func (s *DistributionService) RepairPublication(ctx context.Context, principal Principal, input DistributionInput) (Distribution, error)

RepairPublication replays the same post-commit desired-state publication without changing the attachment or distribution version.

func (*DistributionService) Target 

func (s *DistributionService) Target(ctx context.Context, principal Principal, projectSlug string, mcpServerID uuid.UUID) (DistributionTarget, error)

Target resolves the MCP server a distribution would act on without writing anything, so a caller can check that exact server's readiness first.

func (*DistributionService) WithAdministratorAuthorization 

func (s *DistributionService) WithAdministratorAuthorization(engine *authz.Engine) *DistributionService

WithAdministratorAuthorization lets a distribution by an organization administrator stand as the Shadow MCP approval for its audience. Without it, a block policy refuses every uncovered direct-remote server.

func (*DistributionService) WithDistributionAdmission 

func (s *DistributionService) WithDistributionAdmission(guard *admission.Guard) *DistributionService

func (*DistributionService) WithManualSyncEvidence 

func (s *DistributionService) WithManualSyncEvidence(evidence ManualSyncEvidence) *DistributionService

WithManualSyncEvidence reports a plugin whose auto sync is off as waiting for a manual sync only while its publication evidence says its package is not current. Without readable evidence, waiting cannot be confirmed.

func (*DistributionService) WithShadowMCPStanding 

func (s *DistributionService) WithShadowMCPStanding(reads distributionAdmissionReader, links ShadowMCPReviewLinker) *DistributionService

WithShadowMCPStanding lets a committed distribution report where the server now stands with the project's Shadow MCP policy, and where to see it.

type DistributionTarget 

type DistributionTarget struct {
	ProjectSlug    string
	RegistrationID uuid.UUID
	MCPServerName  string
}

DistributionTarget is the MCP server a distribution acts on and the setup registration that carries its readiness evidence.

type DocsExcerpt 

type DocsExcerpt struct {
	URI          string   `json:"uri"`
	Title        string   `json:"title"`
	Heading      string   `json:"heading,omitempty"`
	Excerpt      string   `json:"excerpt"`
	Source       string   `json:"source"`
	Owner        string   `json:"owner,omitempty"`
	ObservedAt   string   `json:"observed_at,omitempty"`
	RevalidateBy string   `json:"revalidate_by,omitempty"`
	Stale        bool     `json:"stale,omitempty"`
	Links        []string `json:"links,omitempty"`
	// DocsURL is the guide's published page, for a reader who wants to open it
	// rather than have it quoted.
	DocsURL string `json:"docs_url,omitempty"`
}

DocsExcerpt is one cited passage. Every field except Excerpt is the citation: a reader must be able to see what the passage is, where it came from, how old it is, and where to verify it — without a second call.

type DocsIndex 

type DocsIndex interface {
	Search(ctx context.Context, query string, limit int) ([]DocsExcerpt, error)
}

DocsIndex is the provider-neutral retrieval boundary. The public tool is defined by this interface, not by whatever indexes behind it: a vendor search backend is one possible implementation and never a runtime dependency or a public surface.

Implementations retrieve only from reviewed, allowlisted, pinned content. Live web or provider retrieval is not a permitted implementation.

type DrilldownAuditor 

type DrilldownAuditor interface {
	RecordUserMCPStatusRead(ctx context.Context, principal Principal, projectID, mcpID, maskedIdentity, window string) error
	RecordUsageAttributionRead(ctx context.Context, principal Principal, projectID, targetKind, target, maskedIdentity, window string) error
}

DrilldownAuditor records the one drill-down that answers about a person. It is an interface so the diagnostics service depends on the recording, not on the audit logger's transaction handling.

func NewPostgresDrilldownAuditor 

func NewPostgresDrilldownAuditor(db *pgxpool.Pool) DrilldownAuditor

NewPostgresDrilldownAuditor records the sensitive drill-down against the shared audit log.

type DrilldownTelemetryReader 

type DrilldownTelemetryReader interface {
	GetMCPToolOutcomeBreakdown(ctx context.Context, arg telemetryrepo.GetMCPToolOutcomeBreakdownParams) ([]telemetryrepo.MCPToolOutcomeBreakdownRow, error)
	ListMCPTraceReferences(ctx context.Context, arg telemetryrepo.ListMCPTraceReferencesParams) ([]telemetryrepo.MCPTraceReferenceRow, error)
	ListMCPUsageUsers(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams) ([]telemetryrepo.MCPUsageUserRow, error)
	ListMCPUsageUserTools(ctx context.Context, arg telemetryrepo.GetMCPOutcomeBreakdownParams, identityKind, identifier string) ([]telemetryrepo.MCPUsageUserToolRow, error)
}

DrilldownTelemetryReader is the additional telemetry the bounded drill-down tools read. It stays separate from DiagnosticsTelemetryReader so the overview-first entry points cannot accidentally acquire row-level reads.

type DrilldownVolumeBudget 

type DrilldownVolumeBudget struct {
	Rows          Limiter
	MetricQueries Limiter
}

DrilldownVolumeBudget is the second cap on the drill-down tools. It is keyed on the connection alone: it exists to stop one caller from walking a window row by row, which an organization-wide bucket would not catch until every other connection had already been starved.

func (DrilldownVolumeBudget) AllowMetricQuery 

func (b DrilldownVolumeBudget) AllowMetricQuery(ctx context.Context, principal Principal) error

AllowMetricQuery charges one metric query.

func (DrilldownVolumeBudget) AllowRows 

func (b DrilldownVolumeBudget) AllowRows(ctx context.Context, principal Principal, n int) error

AllowRows charges n rows or spans. A connection-less principal is not metered here: it holds no connection key to charge, and the per-call organization budget already bounds it.

type DynamicRegistryCatalog 

type DynamicRegistryCatalog struct {
	// contains filtered or unexported fields
}

func NewDynamicRegistryCatalog 

func NewDynamicRegistryCatalog(client *externalmcp.RegistryClient, load CatalogDescriptorLoader) *DynamicRegistryCatalog

func NewDynamicRegistryCatalogSources 

func NewDynamicRegistryCatalogSources(load RegistryCatalogSourceLoader) *DynamicRegistryCatalog

func (*DynamicRegistryCatalog) Inspect 

func (c *DynamicRegistryCatalog) Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)

func (*DynamicRegistryCatalog) InspectIdentity 

func (c *DynamicRegistryCatalog) InspectIdentity(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)

func (*DynamicRegistryCatalog) Search 

func (c *DynamicRegistryCatalog) Search(ctx context.Context, query string) ([]CatalogCandidate, error)

func (*DynamicRegistryCatalog) WithIdentityService 

func (c *DynamicRegistryCatalog) WithIdentityService(service *externalmcp.CatalogService) *DynamicRegistryCatalog

WithIdentityService keeps continuation independent of the currently selected source. Only callers with an authorized receipt or registration use this path.

type EventFeedReadService 

type EventFeedReadService struct {
	// contains filtered or unexported fields
}

EventFeedReadService owns the Event Feed reader, the org Logs gate, and the trusted dashboard URL.

type EventFeedReader 

type EventFeedReader interface {
	ListEventLog(ctx context.Context, arg chrepo.ListEventLogParams) ([]chrepo.EventLogRow, error)
}

EventFeedReader is the org-scoped Event Feed page read used by Platform MCP. It returns the merged log/span list; this tool never surfaces attributes.

type ExecuteToolInput 

type ExecuteToolInput struct {
	Server    string         `json:"server" jsonschema:"Server slug from list_my_servers"`
	Tool      string         `json:"tool" jsonschema:"Tool name from describe_tools"`
	Arguments map[string]any `json:"arguments,omitempty" jsonschema:"Arguments matching the tool's input_schema from describe_tools"`
}

ExecuteToolInput calls one tool on one server.

type ExecuteToolOutput 

type ExecuteToolOutput struct {
	Server            string `json:"server"`
	Tool              string `json:"tool"`
	IsError           bool   `json:"is_error"`
	Content           []any  `json:"content"`
	StructuredContent any    `json:"structured_content,omitempty"`
}

ExecuteToolOutput is the server's answer, passed through unchanged.

type ExistingPluginAttacher 

type ExistingPluginAttacher func(ctx context.Context, tx pgx.Tx, authCtx *contextvalues.AuthContext, organizationID string, projectID, pluginID, mcpServerID uuid.UUID, displayName string) (uuid.UUID, bool, error)

ExistingPluginAttacher delegates attachment to the Plugins package. Keeping this narrow adapter outside platformmcp avoids an import cycle: the plugin publisher already consumes Platform MCP package-admission policy.

type ExternalAuthorization 

type ExternalAuthorization string

ExternalAuthorization names the call-time authority required by the external OAuth surface. It is independent from audience membership: members see one stable catalogue, then authorization decides whether each call may run. 

const (
	// ExternalAuthorizationMember relies on live membership established while
	// preparing the external request. The handler must enforce any narrower
	// resource, ownership, or domain policy it needs.
	ExternalAuthorizationMember   ExternalAuthorization = "member"
	ExternalAuthorizationOrgAdmin ExternalAuthorization = "org_admin"
)

type ExternalAuthorizationError 

type ExternalAuthorizationError struct {
	RequiredScope    string
	RequestAccessURL string
	// contains filtered or unexported fields
}

ExternalAuthorizationError is safe to return to an MCP client. It names the actual failed check and a dashboard request path, but never includes the caller's grants, tool arguments, credentials, or undisclosed resource names.

func (*ExternalAuthorizationError) Error 

func (e *ExternalAuthorizationError) Error() string

func (*ExternalAuthorizationError) Unwrap 

func (e *ExternalAuthorizationError) Unwrap() error

type FailedServer 

type FailedServer struct {
	Server string `json:"server"`
	Reason string `json:"reason"`
}

FailedServer is a server whose tools could not be searched.

type Fault 

type Fault string

Fault is where a diagnosed problem lives. The set is closed and the values are the only vocabulary a caller receives. 

const (
	// FaultNone is a server with no evidence of a problem in the window.
	FaultNone Fault = "none"
	// FaultGramConfiguration is a problem in how the MCP is configured in Speakeasy:
	// missing or expired authorization, incomplete required configuration.
	FaultGramConfiguration Fault = "gram_configuration"
	// FaultProvider is a problem upstream of Speakeasy — the provider the MCP
	// fronts is failing or unreachable.
	FaultProvider Fault = "provider"
	// FaultClient is a problem in the calling MCP client: malformed or rejected
	// requests that never became a provider call. The wire value says
	// "mcp_client" rather than "client" so a reader cannot mistake it for the
	// OAuth client, which is a different thing this same package registers.
	FaultClient Fault = "mcp_client"
	// FaultIndeterminate is the honest answer when the evidence does not
	// separate the candidates. It is always preferred over a guess.
	FaultIndeterminate Fault = "indeterminate"
)

type FaultAttribution 

type FaultAttribution struct {
	Fault Fault `json:"fault"`
	// Reason names the single rule that decided this attribution.
	Reason string `json:"reason"`
	// ReadinessExonerates records whether a fresh, ready server-side readiness
	// result was available. When true, Speakeasy-side configuration and the provider
	// are both known good as of that check.
	ReadinessExonerates bool `json:"readiness_exonerates"`
	// Scope says whether the failure pattern is confined to this server or
	// present across the organization; an organization-wide pattern points away
	// from this server's own configuration.
	Scope FaultScope `json:"scope"`
}

FaultAttribution is a diagnosis and the evidence it rests on. Reasons are server-authored codes from a closed set, never provider or client text.

type FaultScope 

type FaultScope string

FaultScope is the server-computed answer to "is this only happening here?". 

const (
	FaultScopeServerSpecific   FaultScope = "server_specific"
	FaultScopeOrganizationWide FaultScope = "organization_wide"
	// FaultScopeUnknown is returned when the organization-wide comparison had
	// too little traffic to say either way.
	FaultScopeUnknown FaultScope = "unknown"
)

type FeatureChecker 

type FeatureChecker func(ctx context.Context, organizationID string) (bool, error)

FeatureChecker answers whether an organization has a product feature enabled. It mirrors the telemetry service's checker so both surfaces resolve the organization's metrics mode from the same source.

type FeatureSkillsGate 

type FeatureSkillsGate struct {
	// contains filtered or unexported fields
}

FeatureSkillsGate evaluates the skills-over-mcp rollout flag the way the hosted and assistant surfaces do: by organization id, with the organization's slug as its PostHog group, from locally cached definitions only, failing closed. A slug lookup failure degrades to id-only evaluation.

func NewFeatureSkillsGate 

func NewFeatureSkillsGate(logger *slog.Logger, features feature.Provider, slugs OrganizationSlugResolver) *FeatureSkillsGate

func (*FeatureSkillsGate) SkillsEnabled 

func (g *FeatureSkillsGate) SkillsEnabled(ctx context.Context, organizationID string) bool

type FeedbackInput 

type FeedbackInput struct {
	Category        string
	Rating          *int
	Success         *bool
	ToolName        string
	FailureCategory string
	Note            string
	IdempotencyKey  string
}

type FeedbackResult 

type FeedbackResult struct {
	TrackingID    string
	DeliveryState string
	ExpiresAt     time.Time
	Replayed      bool
}

type FeedbackService 

type FeedbackService struct {
	// contains filtered or unexported fields
}

FeedbackService stores a local, bounded feedback record. Delivery stays queued: this slice deliberately does not compose an external feedback destination.

func NewFeedbackService 

func NewFeedbackService(db *pgxpool.Pool) *FeedbackService

func (*FeedbackService) Submit 

func (s *FeedbackService) Submit(ctx context.Context, principal Principal, input FeedbackInput) (FeedbackResult, error)

type FindMCPInput 

type FindMCPInput struct {
	// At most one project selector may be supplied. Without a selector, an
	// unfiltered list uses the organization's Default project; a query searches
	// the organization. The assistant policy injects project_id and removes both
	// selectors from its model-visible schema.
	ProjectID   string `` /* 130-byte string literal not displayed */
	ProjectSlug string `` /* 134-byte string literal not displayed */
	Query       string `` /* 140-byte string literal not displayed */
	Cursor      string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous unfiltered find_mcp result"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum number of MCPs to return; server clamps this to 100"`
	Readiness   string `json:"readiness,omitempty" jsonschema:"optional persisted readiness state filter"`
}

type FindMCPOutput 

type FindMCPOutput struct {
	MCPs       []MCP  `json:"mcps"`
	NextCursor string `json:"next_cursor,omitempty"`
}

type FindSignalSessionsInput 

type FindSignalSessionsInput struct {
	// ProjectID is the exact project to inspect.
	ProjectID string `json:"project_id"`
	// From is the inclusive source-time boundary.
	From string `json:"from"`
	// To is the exclusive source-time boundary.
	To string `json:"to"`
	// SignalQuery is the shared measured predicate, without group_by.
	SignalQuery signalquery.Request `json:"signal_query"`
	// Peer optionally selects a second predicate for co-occurrence.
	Peer *signalquery.Selection `json:"peer,omitempty"`
	// ComparePrevious asks for an adjacent equal-duration window.
	ComparePrevious bool `json:"compare_previous"`
	// Evidence includes only references permitted by underlying chat access.
	Evidence bool `json:"evidence"`
}

FindSignalSessionsInput selects an explicit project and observed cohort.

type FindSignalSessionsOutput 

type FindSignalSessionsOutput struct {
	// Project is the exact authorized project.
	Project AnalyticsProject `json:"project"`
	// Findings preserves counts, caveats and permitted reference coordinates.
	Findings *analytics.SignalFindings `json:"findings"`
}

FindSignalSessionsOutput contains one authorized project's exploratory findings.

type FoundTool 

type FoundTool struct {
	Server      string `json:"server"`
	Tool        string `json:"tool"`
	Description string `json:"description,omitempty"`
	InputSchema any    `json:"input_schema,omitempty"`
}

FoundTool is one ranked tool, ready to pass to execute_tool.

type Freshness 

type Freshness string

Freshness qualifies every diagnostic result. It is deliberately reported beside the data rather than folded into it: an empty result is FreshnessNoObservations, which is the absence of evidence and never evidence of health. 

const (
	// FreshnessCurrent means the watermark is within StaleWatermarkThreshold of
	// the read, or already past the end of the window.
	FreshnessCurrent Freshness = "current"
	FreshnessStale   Freshness = "stale"
	// FreshnessUnavailable means the scope holds no observations at all. It is
	// paired with DataEnvelope.NoObservations, which says the same thing
	// positively: a caller must not read either as "nothing went wrong".
	FreshnessUnavailable Freshness = "unavailable"
)

type Gate 

type Gate interface {
	Enabled(ctx context.Context, organizationID string) (bool, error)
}

type Gateway 

type Gateway struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	Visibility string `json:"visibility"`
	// NetworkAccess is public_only, dual, or private_only.
	NetworkAccess string `json:"network_access"`
	// AddressSlugs are the gateway's platform addresses; it is served at
	// /mcp/<slug> on the organization's MCP host. Custom-domain addresses are
	// listed by get_mcp_connection_settings.
	AddressSlugs []string        `json:"address_slugs"`
	Members      []GatewayMember `json:"members"`
}

Gateway is one gateway as stored.

type GatewayError 

type GatewayError struct {
	Code    string
	Message string
	// Members names every requested server that cannot join, so the caller
	// can drop or fix them all in one retry.
	Members []GatewayMemberRefusal
	Cause   error
}

GatewayError is safe to map into a tool refusal: Message is written for the administrator and never carries database detail.

func (*GatewayError) Error 

func (e *GatewayError) Error() string

func (*GatewayError) Unwrap 

func (e *GatewayError) Unwrap() error

type GatewayMember 

type GatewayMember struct {
	MCPID string `json:"mcp_id"`
	Name  string `json:"name,omitempty"`
	Slug  string `json:"slug,omitempty"`
}

GatewayMember is one server behind a gateway. Its tools are served as <slug>--<tool name>.

type GatewayMemberRefusal 

type GatewayMemberRefusal struct {
	MCPID string `json:"mcp_id"`
	// Reason is one of not_in_project, no_address, unproxied, built_in,
	// hosted_toolset_server, duplicate_backend, shadow_review_required, or
	// approval_check_unavailable.
	Reason  string `json:"reason"`
	Message string `json:"message"`
}

GatewayMemberRefusal is one server that cannot be a member of the gateway.

type GatewayOutput 

type GatewayOutput struct {
	// Outcome is "created", "updated", or "unchanged" when the gateway already
	// had exactly the requested members in that order.
	Outcome string `json:"outcome"`
	// Gateway is a fresh read taken after the commit when SnapshotScope is
	// "fresh_read_after_commit".
	Gateway       *Gateway `json:"gateway,omitempty"`
	SnapshotScope string   `json:"snapshot_scope"`
	// GatewayID is set even when the fresh read failed.
	GatewayID string   `json:"gateway_id"`
	Added     []string `json:"added_mcp_ids,omitempty"`
	Removed   []string `json:"removed_mcp_ids,omitempty"`
}

GatewayOutput reports one committed gateway write. A refusal is returned as an error result and never as this struct.

type GatewayProxy 

type GatewayProxy interface {
	CallPlatformGatewayTool(ctx context.Context, organizationID, userID, tool string, arguments json.RawMessage) (json.RawMessage, error)
}

GatewayProxy answers one organization gateway tool for the Platform MCP caller bound to ctx and returns the tools/call result object. The MCP service implements it; it is an interface because that package imports this one.

type GatewayProxyService 

type GatewayProxyService struct {
	// contains filtered or unexported fields
}

GatewayProxyService answers list_my_servers, describe_tools and execute_tool.

func (*GatewayProxyService) DescribeTools 

func (s *GatewayProxyService) DescribeTools(ctx context.Context, principal Principal, input DescribeToolsInput) (DescribeToolsOutput, error)

DescribeTools lists a server's tools, with input schemas for the named ones.

func (*GatewayProxyService) ExecuteTool 

func (s *GatewayProxyService) ExecuteTool(ctx context.Context, principal Principal, input ExecuteToolInput) (ExecuteToolOutput, error)

ExecuteTool calls one tool and returns the server's answer, errors included.

func (*GatewayProxyService) ListMyServers 

func (s *GatewayProxyService) ListMyServers(ctx context.Context, principal Principal) (ListMyServersOutput, error)

ListMyServers lists the servers the caller can reach.

func (*GatewayProxyService) SearchMyTools 

func (s *GatewayProxyService) SearchMyTools(ctx context.Context, principal Principal, input SearchMyToolsInput) (SearchMyToolsOutput, error)

SearchMyTools ranks tools across every server the caller can use.

type GatewayService 

type GatewayService struct {
	// contains filtered or unexported fields
}

GatewayService creates gateways and sets their members through the same core the gateway management API uses, so an agent can make exactly the gateways the dashboard can.

func NewGatewayService 

func NewGatewayService(logger *slog.Logger, db *pgxpool.Pool, auditLogger *audit.Logger, engine *authz.Engine, admin Authorizer, guard *admission.Guard, endpoints MCPConnectionEndpointWriter, publication plugins.PublicationRequests, publisher plugins.PluginPublishSignaler, changes OperationBudget) (*GatewayService, error)

func (*GatewayService) CreateGateway 

func (s *GatewayService) CreateGateway(ctx context.Context, principal Principal, input CreateGatewayInput) (GatewayOutput, error)

CreateGateway creates a private gateway with a default platform address and the requested members, all in one transaction. If any requested server cannot join, nothing is created and every such server is named.

func (*GatewayService) SetGatewayMembers 

func (s *GatewayService) SetGatewayMembers(ctx context.Context, principal Principal, input SetGatewayMembersInput) (GatewayOutput, error)

SetGatewayMembers replaces a gateway's members with exactly the requested list, in order, in one transaction. If any newly requested server cannot join, nothing changes and every such server is named.

type GatewaySessionManagement 

type GatewaySessionManagement interface {
	ListGatewaySessions(context.Context, *gatewaygen.ListGatewaySessionsPayload) (*gatewaygen.GatewaySessionsResult, error)
}

GatewaySessionManagement shares the dashboard's tenant checks, resource matching, filtering, and cursor contract. No mutations are exposed.

type GatewaySessionSummary 

type GatewaySessionSummary struct {
	// ID identifies the authorization record, not a bearer credential.
	ID string `json:"id"`
	// SubjectType distinguishes people, agents, API keys, and workloads.
	SubjectType string `json:"subject_type"`
	// CreatedAt is the authorization's creation time.
	CreatedAt string `json:"created_at"`
	// LastUsedAt is approximate; omission means unknown, not never.
	LastUsedAt *string `json:"last_used_at,omitempty"`
	// AuthorizationExpiresAt is the inbound authorization deadline.
	AuthorizationExpiresAt string `json:"authorization_expires_at"`
	// AccessExpiresAt is separate from the authorization deadline.
	AccessExpiresAt string `json:"access_expires_at"`
	// RevokedAt marks an explicitly revoked authorization.
	RevokedAt *string `json:"revoked_at,omitempty"`
	// UpstreamAccounts counts configured upstream accounts, not usage.
	UpstreamAccounts int `json:"upstream_accounts"`
}

GatewaySessionSummary contains operational metadata, never subject identities, client-controlled names, workload claims, token identifiers, or credentials.

type GetDeviceCoverageInput 

type GetDeviceCoverageInput struct {
	Provider string `json:"provider,omitempty" jsonschema:"one MDM provider, e.g. jamf or intune; omit for every connected inventory"`
}

type GetInboundEMATrustOutput 

type GetInboundEMATrustOutput struct {
	// OrganizationID is the caller's organization.
	OrganizationID string `json:"organization_id"`

	// Issuers are the organization-level user session issuers.
	Issuers []InboundEMAIssuer `json:"issuers"`

	// Truncated reports more issuers than were listed.
	Truncated bool `json:"truncated"`

	// Directory reports the directory sync users resolve through.
	Directory InboundEMADirectory `json:"directory"`

	// PresetClients are the clients an issuer in presets mode admits.
	PresetClients []InboundEMAClient `` /* 189-byte string literal not displayed */

	// NextStep is the next safe action.
	NextStep string `json:"next_step"`
}

GetInboundEMATrustOutput is the organization's inbound enterprise-managed authorization configuration.

type GetMCPAccessInput 

type GetMCPAccessInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the configured MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp"`
}

type GetMCPAccessOutput 

type GetMCPAccessOutput struct {
	ProjectID string            `json:"project_id"`
	MCP       MCPAccessTarget   `json:"mcp"`
	Roles     []MCPRoleCoverage `json:"roles"`
	// SharedAuthClientRoles lists roles with a rule on a shared credential
	// the server offers, whether or not they can enter the server.
	SharedAuthClientRoles []MCPRoleSharedAuthClients `json:"shared_auth_client_roles"`
	ExpiresAt             string                     `json:"expires_at"`
}

type GetMCPClientAdmissionToolInput 

type GetMCPClientAdmissionToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
}

type GetMCPConnectionSettingsInput 

type GetMCPConnectionSettingsInput struct {
	ProjectID  string                          `json:"project_id" jsonschema:"project ID that owns the target"`
	TargetKind MCPConnectionSettingsTargetKind `json:"target_kind" jsonschema:"exact target type: mcp_server or gateway"`
	TargetID   string                          `json:"target_id" jsonschema:"ID of the exact MCP server or gateway"`
}

type GetMCPDiagnosticsInput 

type GetMCPDiagnosticsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h (default) or 24h"`
}

GetMCPDiagnosticsInput names one configured MCP, using the same identity find_mcp and get_mcp return.

type GetMCPDiagnosticsOutput 

type GetMCPDiagnosticsOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	Readiness MCPDiagnosticsReadiness `json:"readiness"`
	Outcomes  MCPOutcomeSummary       `json:"outcomes"`
	// OrganizationOutcomes is the same summary across the organization's
	// projects. It is what makes the scope check answerable server-side.
	OrganizationOutcomes MCPOutcomeSummary `json:"organization_outcomes"`
	// OrganizationOutcomesPartial reports that the comparison did not cover every
	// organization project because RBAC filtered the list or maxOverviewProjects
	// truncated it. When true, attribution scope remains unknown.
	OrganizationOutcomesPartial bool                `json:"organization_outcomes_partial"`
	Clients                     []MCPClientEvidence `json:"clients"`
	ClientsTruncated            bool                `json:"clients_truncated"`
	Attribution                 FaultAttribution    `json:"attribution"`
}

type GetMCPInput 

type GetMCPInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID"`
	// ToolCursor continues a paged tool_exposure read. The other fields of
	// the result are re-read in full on every page.
	ToolCursor string `` /* 148-byte string literal not displayed */
}

type GetMCPReadinessToolInput 

type GetMCPReadinessToolInput struct {
	ProjectSlug    string `` /* 213-byte string literal not displayed */
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Force          bool   `` /* 185-byte string literal not displayed */
}

type GetMCPReadinessToolOutput 

type GetMCPReadinessToolOutput struct {
	ProjectSlug    string         `json:"project_slug"`
	RegistrationID string         `json:"registration_id"`
	State          ReadinessState `json:"state"`
	EvidenceCode   string         `json:"evidence_code,omitempty"`
	SetupCategory  SetupCategory  `json:"setup_category,omitempty"`
	Freshness      string         `json:"freshness"`
	CheckedAt      string         `json:"checked_at,omitempty"`
	ExpiresAt      string         `json:"expires_at,omitempty"`
	Actions        []RepairAction `json:"actions"`
}

type GetMCPRepairPlanToolInput 

type GetMCPRepairPlanToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
}

type GetMCPRepairPlanToolOutput 

type GetMCPRepairPlanToolOutput struct {
	ProjectSlug    string         `json:"project_slug"`
	RegistrationID string         `json:"registration_id"`
	State          ReadinessState `json:"state"`
	SetupCategory  SetupCategory  `json:"setup_category,omitempty"`
	Freshness      string         `json:"freshness"`
	Actions        []RepairAction `json:"actions"`
}

type GetMemberMCPAccessInput 

type GetMemberMCPAccessInput struct {
	MemberReference string `json:"member_reference" jsonschema:"opaque member reference returned by list_access_members"`
}

type GetMemberMCPAccessOutput 

type GetMemberMCPAccessOutput struct {
	Servers   []MemberMCPAccessRow `json:"servers"`
	Truncated bool                 `json:"truncated"`
}

type GetMyInstallInstructionsInput 

type GetMyInstallInstructionsInput struct {
	ProjectID string `` /* 199-byte string literal not displayed */
	Plugin    string `json:"plugin,omitempty" jsonschema:"exact assigned plugin ID, slug, or name"`
	MCPID     string `json:"mcp_id,omitempty" jsonschema:"exact configured MCP ID"`
	// RegistrationID names a server added through setup without a find_mcp
	// read, which the ChatGPT catalogue does not have.
	RegistrationID string                 `json:"registration_id,omitempty" jsonschema:"or the registration ID setup returned"`
	ClientFamily   OnboardingClientFamily `json:"client_family" jsonschema:"client receiving the installation guidance"`
}

type GetMyInstallInstructionsOutput 

type GetMyInstallInstructionsOutput struct {
	TargetKind   string                 `json:"target_kind"`
	TargetName   string                 `json:"target_name"`
	ClientFamily OnboardingClientFamily `json:"client_family"`
	Supported    bool                   `json:"supported"`
	Instructions []InstallInstruction   `json:"instructions"`
	Fallback     string                 `json:"fallback,omitempty"`
}

type GetMyMCPAccessOutput 

type GetMyMCPAccessOutput struct {
	ProjectID        string `json:"project_id"`
	MCPID            string `json:"mcp_id"`
	MCPName          string `json:"mcp_name"`
	CanRead          bool   `json:"can_read"`
	CanConnect       bool   `json:"can_connect"`
	RequiredScope    string `json:"required_scope,omitempty"`
	RequestAccessURL string `json:"request_access_url,omitempty"`
	NextAction       string `json:"next_action"`
}

type GetMyMCPConnectionStatusOutput 

type GetMyMCPConnectionStatusOutput struct {
	ProjectID        string `json:"project_id"`
	MCPID            string `json:"mcp_id"`
	MCPName          string `json:"mcp_name"`
	State            string `json:"state"`
	Reason           string `json:"reason,omitempty"`
	RequiredScope    string `json:"required_scope,omitempty"`
	RequestAccessURL string `json:"request_access_url,omitempty"`
	ConnectionURL    string `json:"connection_url,omitempty"`
	NextAction       string `json:"next_action"`
}

type GetMyMCPReviewRequestInput 

type GetMyMCPReviewRequestInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID returned by list_projects"`
	RequestID string `json:"request_id" jsonschema:"request ID returned by request_mcp_review"`
}

type GetMyMCPReviewRequestOutput 

type GetMyMCPReviewRequestOutput struct {
	ProjectID string `json:"project_id"`
	mcpapproval.PlatformRequesterReview
	ReviewURL string `json:"review_url,omitempty"`
}

type GetMyMCPStatusInput 

type GetMyMCPStatusInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID that owns the MCP server"`
	MCPID     string `json:"mcp_id" jsonschema:"exact configured MCP server ID"`
}

type GetMyOrganizationGatewayOutput 

type GetMyOrganizationGatewayOutput struct {
	// Available reports whether the organization is served a gateway.
	Available bool `json:"available"`

	// URL is the gateway's MCP URL, set only when Available.
	URL string `json:"url,omitempty"`

	// UnavailableReason is no_organization_issuer,
	// multiple_organization_issuers, custom_domain_only, turned_off, or
	// organization_disabled, set only when not Available.
	UnavailableReason string `json:"unavailable_reason,omitempty"`

	// NextAction tells the caller what to do with the answer.
	NextAction string `json:"next_action"`
}

GetMyOrganizationGatewayOutput is the caller's organization gateway, or why there is none.

type GetMyProjectGatewayInput 

type GetMyProjectGatewayInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"Exact slug of a project in your organization; required, with no default project fallback"`
}

GetMyProjectGatewayInput selects one exact project in the caller's organization.

type GetNetworkIngressOutput 

type GetNetworkIngressOutput struct {
	// Entitled reports whether private networking is switched on for the
	// organization. Without it no MCP can leave public_only.
	Entitled   bool `json:"entitled"`
	Configured bool `json:"configured"`
	// ReadyForPrivateAccess mirrors the dashboard: a supported provider with an
	// enabled, online ingress and an observed private DNS name. It is a
	// precondition for dual or private_only, not proof that any client can reach
	// the tailnet.
	ReadyForPrivateAccess bool                   `json:"ready_for_private_access"`
	Ingress               *NetworkIngressSummary `json:"ingress,omitempty"`
	NextAction            string                 `json:"next_action"`
	SetupURL              string                 `json:"setup_url"`
}

type GetOrganizationGatewayActivityInput 

type GetOrganizationGatewayActivityInput struct {
	Window string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), 7d, or 30d"`
}

type GetOrganizationGatewayActivityOutput 

type GetOrganizationGatewayActivityOutput struct {
	Envelope        DataEnvelope                 `json:"data"`
	DispatchedCalls int64                        `json:"dispatched_calls"`
	FailedCalls     int64                        `json:"failed_calls"`
	Discovery       OrganizationGatewayDiscovery `json:"discovery"`
	TopServers      []OrganizationGatewayServer  `json:"top_servers"`
}

GetOrganizationGatewayActivityOutput carries no users, clients, or tokens: it answers how much the gateway is used and where it fails.

type GetPluginInput 

type GetPluginInput struct {
	ProjectID        string `json:"project_id" jsonschema:"project ID that owns the plugin"`
	Plugin           string `json:"plugin" jsonschema:"exact plugin ID, slug, or name as returned by list_plugins"`
	MembershipLimit  int    `json:"membership_limit,omitempty" jsonschema:"maximum MCP memberships to return; server clamps this to 100"`
	MembershipCursor string `json:"membership_cursor,omitempty" jsonschema:"opaque membership cursor from a previous get_plugin result"`
}

type GetPluginOutput 

type GetPluginOutput struct {
	// ProjectID echoes the project the plugin belongs to.
	ProjectID string `json:"project_id"`

	// Plugin is the resolved plugin's inventory projection.
	Plugin Plugin `json:"plugin"`

	// Servers is the MCP servers the plugin carries.
	Servers []PluginServer `json:"servers"`

	// Skills is the skills the plugin carries.
	Skills []PluginSkill `json:"skills"`

	// PublicationEvidence is admin-only. It compares the current package inputs
	// with stored publish fingerprints; installed clients are not inspected.
	PublicationEvidence *PluginPublicationEvidence `json:"publication_evidence,omitempty"`

	// AssignmentVersion is an opaque optimistic-concurrency token over the
	// plugin identity and its complete canonical assignment set. It remains
	// valid until that state changes; a future write must also use unexpired
	// assignment references from the same or a fresher read.
	AssignmentVersion string `json:"assignment_version,omitempty"`

	// Assignments are the current assignment targets that can be named without
	// exposing an individual identity or stale internal principal. Member reads
	// omit this administrative field entirely.
	Assignments []PluginAssignmentOption `json:"assignments,omitempty"`

	// AssignmentDetailsComplete is false when at least one current assignment
	// cannot be safely represented as a reviewed role or directory target.
	AssignmentDetailsComplete *bool `json:"assignment_details_complete,omitempty"`

	// AssignmentsTruncated is true when more than 100 current assignments can be
	// represented and the returned list is only a prefix.
	AssignmentsTruncated *bool `json:"assignments_truncated,omitempty"`

	// ReferencesExpireAt applies to every assignment reference in this result.
	ReferencesExpireAt string `json:"references_expire_at,omitempty"`

	// Truncated preserves the legacy bounded member/skill projection. For
	// administrative MCP memberships use MembershipNextCursor to continue.
	Truncated bool `json:"truncated"`

	// MembershipNextCursor continues the complete administrative MCP membership
	// list. It is independent of the legacy skill and assignment truncation.
	MembershipNextCursor string `json:"membership_next_cursor,omitempty"`

	// MembershipVersion changes when the complete live MCP membership set changes.
	MembershipVersion string `json:"membership_version,omitempty"`
}

type GetProjectOverviewInput 

type GetProjectOverviewInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to summarize"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), 7d, or 30d"`
}

GetProjectOverviewInput asks for one project's activity. It carries no filters: the overview is the entry point, and narrowing happens through the drill-down tools once it has identified something to look at.

type GetProjectOverviewOutput 

type GetProjectOverviewOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`
	// MetricsMode is the organization's metrics mode, resolved server-side. It
	// is reported because it changes what ActiveUsers counts: chat participants
	// under "session", tool-call actors under "tool_call".
	MetricsMode     string                  `json:"metrics_mode"`
	ToolCalls       int64                   `json:"tool_calls"`
	FailedToolCalls int64                   `json:"failed_tool_calls"`
	ActiveServers   int64                   `json:"active_servers"`
	ActiveUsers     SubjectCount            `json:"active_users"`
	TopServers      []ProjectOverviewServer `json:"top_servers"`
}

GetProjectOverviewOutput is the Platform subset of the project overview: the activity and failure shape of a project, aggregated server-side.

It carries no users, no clients, no tokens, and no cost. Those are either personal data this surface does not project or a billing concern that does not belong in a diagnostic.

type GetRiskAnalysisStatusInput 

type GetRiskAnalysisStatusInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
}

type GetRiskAnalysisStatusOutput 

type GetRiskAnalysisStatusOutput struct {
	Project RiskProject `json:"project"`
	// State is one of never, idle or running.
	State string `json:"state"`
	// RunningSince is when the in-flight analysis started. Set only when running.
	RunningSince string `json:"running_since,omitempty"`
	// LastRunStartedAt is when the most recent finished analysis began. Set only when idle.
	LastRunStartedAt string `json:"last_run_started_at,omitempty"`
	// LastRunAt is when the most recent analysis finished. Set only when idle.
	LastRunAt string `json:"last_run_at,omitempty"`
	// LastRunOutcome is how the most recent finished analysis ended. Set only when idle.
	LastRunOutcome string `json:"last_run_outcome,omitempty"`
	// Explanation is one or two plain sentences an administrator can act on.
	Explanation string `json:"explanation"`
}

type GetRiskPolicyInput 

type GetRiskPolicyInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	PolicyID    string `json:"policy_id"`
}

type GetRiskPolicyOutput 

type GetRiskPolicyOutput struct {
	Project            RiskProject      `json:"project"`
	CatalogVersion     string           `json:"catalog_version"`
	CatalogFingerprint string           `json:"catalog_fingerprint"`
	Policy             RiskPolicyDetail `json:"policy"`
}

type GetRiskRuleBreakdownInput 

type GetRiskRuleBreakdownInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Category    string `json:"category"`
	From        string `json:"from,omitempty"`
	To          string `json:"to,omitempty"`
}

type GetRiskRuleBreakdownOutput 

type GetRiskRuleBreakdownOutput struct {
	Project     RiskProject     `json:"project"`
	Category    string          `json:"category"`
	From        string          `json:"from"`
	To          string          `json:"to"`
	Rules       []RiskRuleCount `json:"rules"`
	Total       int64           `json:"total"`
	Truncated   bool            `json:"truncated"`
	Limitations string          `json:"limitations"`
}

type GetSetupHandoffToolInput 

type GetSetupHandoffToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp"`
	ProviderKey    string `json:"provider_key" jsonschema:"reviewed provider key returned by register_catalog_mcp"`
	CatalogRef     string `json:"catalog_ref" jsonschema:"reviewed catalog reference returned by register_catalog_mcp"`
}

type GetSetupHandoffToolOutput 

type GetSetupHandoffToolOutput struct {
	ProjectID      string `json:"project_id"`
	RegistrationID string `json:"registration_id"`
	ProviderKey    string `json:"provider_key"`
	CatalogRef     string `json:"catalog_ref"`
	SetupURL       string `json:"setup_url"`
	Intent         string `json:"intent"`
	Handoff        string `json:"handoff,omitempty"`
	ExpiresAt      string `json:"expires_at,omitempty"`
}

type GetShadowMCPReviewInput 

type GetShadowMCPReviewInput struct {
	ProjectID       string `json:"project_id" jsonschema:"explicit project ID used to list this target"`
	TargetReference string `json:"target_reference" jsonschema:"short-lived opaque target reference returned by list_shadow_mcp_inventory"`
}

type GetShadowMCPReviewOutput 

type GetShadowMCPReviewOutput struct {
	Project               RiskProject              `json:"project"`
	Target                ShadowMCPTargetSummary   `json:"target"`
	Evidence              ShadowMCPEvidenceSummary `json:"evidence"`
	DistributionAdmission *DistributionAdmission   `json:"distribution_admission,omitempty"`
}

type GetSignalDefinitionInput 

type GetSignalDefinitionInput struct {
	// ProjectID is the exact project to inspect.
	ProjectID string `json:"project_id"`

	// SensorID is the contributing sensor.
	SensorID string `json:"sensor_id"`

	// DefinitionHash is the reading's semantic fingerprint.
	DefinitionHash string `json:"definition_hash"`
}

GetSignalDefinitionInput names a fingerprint returned by a measured result.

type GetSignalDefinitionOutput 

type GetSignalDefinitionOutput struct {
	// Project is the authorized project.
	Project AnalyticsProject `json:"project"`

	// Definition retains the question, options and context that were evaluated.
	Definition *analytics.SignalDefinition `json:"definition"`
}

GetSignalDefinitionOutput includes scoped immutable measurement evidence.

type GetSkillInput 

type GetSkillInput struct {
	ProjectSlug    string
	SkillID        string
	IncludeContent bool
}

GetSkillInput reads one skill. Manifest content is opt-in rather than default so a caller that wanted a name and a version id does not pay 64 KiB for it.

type GetSkillOutput 

type GetSkillOutput struct {
	ProjectSlug   string               `json:"project_slug"`
	Skill         SkillSummary         `json:"skill"`
	LatestVersion *SkillVersionSummary `json:"latest_version,omitempty"`
	Distributed   bool                 `json:"distributed"`
}

type GetSkillToolInput 

type GetSkillToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	IncludeContent bool   `` /* 142-byte string literal not displayed */
}

type GetToolUsageSummaryInput 

type GetToolUsageSummaryInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to summarize"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h, 7d (default), or 30d"`
}

GetToolUsageSummaryInput asks for one project's usage mix. It carries no target filter: the summary answers "how much of our usage is X" for every target type at once, and narrowing to one server is what the diagnostics and drill-down tools are for.

type GetToolUsageSummaryOutput 

type GetToolUsageSummaryOutput struct {
	ProjectID        string       `json:"project_id"`
	Envelope         DataEnvelope `json:"data"`
	ToolCalls        int64        `json:"tool_calls"`
	FailedToolCalls  int64        `json:"failed_tool_calls"`
	BlockedToolCalls int64        `json:"blocked_tool_calls"`
	UniqueTools      int64        `json:"unique_tools"`
	// UsageByTarget holds one entry per target type, always in the same order
	// and always complete.
	UsageByTarget []ToolUsageByTargetType `json:"usage_by_target"`
	// TargetsTruncated reports that the window held more distinct targets than
	// the per-target read returns, so the buckets sum to less than tool_calls.
	TargetsTruncated bool `json:"targets_truncated"`
}

GetToolUsageSummaryOutput is the Platform subset of the tool usage summary: how a project's tool calls divide between hosted MCP, tunneled MCP, gateways, shadow MCP, local tools, and skills. It carries no users, no clients, and no cost.

type GetUserMCPStatusInput 

type GetUserMCPStatusInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	// SubjectReference is an expiring, session-bound handle returned in the
	// optional rows of a summary tool. It cannot be searched, joined,
	// refreshed, or constructed.
	SubjectReference string `` /* 127-byte string literal not displayed */
	Window           string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

GetUserMCPStatusInput names one subject and one MCP. The subject is given as an opaque reference minted by a summary tool, never as an email, account id, or name: the caller asks about someone it was shown, not about someone it can describe.

type GetUserMCPStatusOutput 

type GetUserMCPStatusOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	// MaskedIdentity is enough to recognize a subject already known to the
	// administrator and not enough to learn one. It is never a raw identifier.
	MaskedIdentity string `json:"masked_identity"`
	// Activity is a state category rather than a count, so a caller cannot
	// assemble an activity profile from repeated calls.
	Activity       string              `json:"activity"`
	Tools          []SubjectToolStatus `json:"tools"`
	ToolsTruncated bool                `json:"tools_truncated"`
	// Unavailable is retained for compatibility. The call-level reader scopes
	// every MCP model by its configured id, so it is never set.
	Unavailable bool `json:"unavailable"`
}

type GetUserMetricsSummaryInput 

type GetUserMetricsSummaryInput struct {
	ProjectID     string `json:"project_id" jsonschema:"project ID to summarize"`
	UserReference string `` /* 144-byte string literal not displayed */
	Window        string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h, 7d (default), or 30d"`
	MCPID         string `` /* 186-byte string literal not displayed */
}

GetUserMetricsSummaryInput names one person by a reference a summary tool minted, never by an email, account id, or name: the caller asks about someone it was shown, not about someone it can describe.

type GetUserMetricsSummaryOutput 

type GetUserMetricsSummaryOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`

	// MaskedIdentity is enough to recognize a subject already known to the
	// administrator and not enough to learn one. It is never a raw identifier.
	MaskedIdentity string `json:"masked_identity"`
	Activity       string `json:"activity"`
	FirstSeenAt    string `json:"first_seen_at,omitempty"`
	LastSeenAt     string `json:"last_seen_at,omitempty"`

	ToolCalls       int64 `json:"tool_calls"`
	FailedToolCalls int64 `json:"failed_tool_calls"`
	// FailureRate is computed server-side and rounded to four decimal places.
	// Zero calls yields zero rather than an undefined ratio.
	FailureRate float64 `json:"failure_rate"`
	// ActiveServers counts the distinct servers the person's tools name, as
	// UserMetricsTool.Server derives them. Tools that name no server do not
	// count.
	ActiveServers  int64             `json:"active_servers"`
	TopTools       []UserMetricsTool `json:"top_tools"`
	ToolsTruncated bool              `json:"tools_truncated"`
}

GetUserMetricsSummaryOutput is one person's activity over the window, in the shape the managed assistant's summary tool returned, without the raw identity. Tokens and cost are deliberately absent: they are a billing concern that does not belong in a diagnostic about a person.

type GetUserSkillStatusInput 

type GetUserSkillStatusInput struct {
	ProjectID        string `json:"project_id" jsonschema:"project ID that owns the skill"`
	SkillName        string `json:"skill_name" jsonschema:"exact canonical skill name returned by query_skill_usage"`
	SubjectReference string `json:"subject_reference" jsonschema:"opaque subject reference returned by list_skill_usage_users"`
	Window           string `` /* 126-byte string literal not displayed */
}

type GetUserSkillStatusOutput 

type GetUserSkillStatusOutput struct {
	ProjectID      string       `json:"project_id"`
	SkillName      string       `json:"skill_name"`
	Envelope       DataEnvelope `json:"data"`
	MaskedIdentity string       `json:"masked_identity"`
	Activity       string       `json:"activity"`
	Errors         string       `json:"errors"`
}

type GetWorkloadAssertionReuseInput 

type GetWorkloadAssertionReuseInput struct {
	ProjectID string `` /* 147-byte string literal not displayed */
	IssuerID  string `json:"issuer_id" jsonschema:"exact organization-tier workload issuer UUID; never a name or URL"`
}

type GetXAAReadinessInput 

type GetXAAReadinessInput struct {
	ProjectID   string `json:"project_id" jsonschema:"exact project ID that owns the MCP server"`
	MCPServerID string `json:"mcp_server_id" jsonschema:"exact MCP server ID, not a Platform MCP registration or legacy toolset ID"`
}

type GetXAAReadinessOutput 

type GetXAAReadinessOutput struct {
	ProjectID           string  `json:"project_id"`
	MCPServerID         string  `json:"mcp_server_id"`
	State               string  `` /* 579-byte string literal not displayed */
	Pending             bool    `json:"pending"`
	NotApplicableReason *string `json:"not_applicable_reason,omitempty"`
	BrokenReason        *string `json:"broken_reason,omitempty"`
	ObservedResult      *string `json:"observed_result,omitempty"`
	ObservedAt          *string `json:"observed_at,omitempty"`
	// Absent when this deployment cannot inspect identity chaining.
	IdentityChaining     *XAAIdentityChaining `json:"identity_chaining,omitempty"`
	OktaSignIn           *OktaSignInStatus    `` /* 130-byte string literal not displayed */
	FederatedCallbackURL *string              `` /* 145-byte string literal not displayed */
}

Deliberately omit organization totals, other servers, provider app IDs, client IDs, scopes, URLs and administrator-entered labels from List. Okta sign-in carries only the public values Okta must be given.

type GuardianDirectRemoteInspector 

type GuardianDirectRemoteInspector struct {
	// contains filtered or unexported fields
}

GuardianDirectRemoteInspector canonicalizes, validates, and probes one direct remote MCP using Guardian before every network hop. It supports both JSON and SSE responses to Streamable HTTP POST requests; standalone SSE is intentionally not an admission path.

func NewGuardianDirectRemoteInspector 

func NewGuardianDirectRemoteInspector(policy *guardian.Policy) *GuardianDirectRemoteInspector

func (*GuardianDirectRemoteInspector) Inspect 

func (s *GuardianDirectRemoteInspector) Inspect(ctx context.Context, rawURL string) (DirectRemoteInspection, error)

type IdentityChainingGovernor 

type IdentityChainingGovernor interface {
	Serves(ctx context.Context, req identitychaining.Request) (uuid.UUID, bool)
	HasUsableCredential(ctx context.Context, req identitychaining.Request) bool
	ProviderOrder(ctx context.Context, req identitychaining.Request) (remotesessions.EMAProviderOrder, bool, error)
}

IdentityChainingGovernor answers identity chaining configuration questions from stored state and read-only resource metadata discovery. It never acquires a token.

type IdentityChainingReadiness 

type IdentityChainingReadiness struct {
	State                 ReadinessState
	EvidenceCode          string
	Absence               string
	RemoteSessionIssuerID uuid.UUID
}

IdentityChainingReadiness is readiness for a direct remote upstream the caller has no interactive session for, judged as the MCP runtime does.

func ResolveIdentityChainingReadiness 

func ResolveIdentityChainingReadiness(ctx context.Context, governor IdentityChainingGovernor, organizationID, userID string, projectID, userSessionIssuerID uuid.UUID, upstreamResource string) (IdentityChainingReadiness, bool)

ResolveIdentityChainingReadiness reports ready when the caller holds a usable chained credential, and needs-authorization with configuration evidence when chaining serves the upstream without one. ok is false when chaining does not serve it.

type InboundEMAClient 

type InboundEMAClient struct {
	// Name is the client's name.
	Name string `json:"name"`

	// ClientID is the client ID metadata document URL the client presents.
	ClientID string `json:"client_id" jsonschema:"the client ID at the resource to configure in the identity provider for this client"`
}

InboundEMAClient is a preset MCP client.

type InboundEMADirectory 

type InboundEMADirectory struct {
	// ResolvableDirectoryUsers counts active directory users linked, or
	// matched by email, to a live member, as ID-JAG user resolution requires.
	ResolvableDirectoryUsers int64 `json:"resolvable_directory_users"`

	// Synced is true when at least one directory user can be resolved.
	Synced bool `` /* 178-byte string literal not displayed */
}

InboundEMADirectory reports whether ID-JAG users can be resolved.

type InboundEMAIdentityProvider 

type InboundEMAIdentityProvider struct {
	// RemoteSessionIssuerID is the identity provider record, empty in a
	// preview that would create one.
	RemoteSessionIssuerID string `json:"remote_session_issuer_id,omitempty"`

	// IssuerURL is the identity provider's issuer, the iss of its ID-JAGs.
	IssuerURL string `json:"issuer_url"`

	// KeySetURL is where Speakeasy fetches the keys that verify ID-JAGs.
	KeySetURL string `json:"key_set_url,omitempty"`

	// Name is the record's display name.
	Name string `json:"name,omitempty"`

	// Tier is organization or platform.
	Tier string `json:"tier,omitempty" jsonschema:"organization for a record this organization owns; platform for a Speakeasy catalog record"`
}

InboundEMAIdentityProvider is an identity provider an issuer trusts, or would trust, for inbound enterprise-managed authorization.

type InboundEMAIssuer 

type InboundEMAIssuer struct {
	// UserSessionIssuerID is the organization-level user session issuer.
	UserSessionIssuerID string `json:"user_session_issuer_id"`

	// Slug is the issuer's slug.
	Slug string `json:"slug"`

	// AuthorizationServerMode is shared or endpoint.
	AuthorizationServerMode string `json:"authorization_server_mode"`

	// Audience is what to configure as Speakeasy's audience in the identity
	// provider, set for a shared authorization server.
	Audience string `` /* 157-byte string literal not displayed */

	// AudienceNote explains a missing Audience.
	AudienceNote string `json:"audience_note,omitempty"`

	// TrustedIdentityProvider is the identity provider ID-JAGs are accepted
	// from; absent when inbound enterprise-managed authorization is off.
	TrustedIdentityProvider *InboundEMAIdentityProvider `json:"trusted_identity_provider,omitempty"`

	// TrustedIdentityProviderUnavailable reports that the issuer trusts an
	// identity provider whose record could not be read.
	TrustedIdentityProviderUnavailable bool `` /* 327-byte string literal not displayed */

	// FederatedBrowserSignIn reports that interactive sign-in also goes
	// through the trusted identity provider, so the trust cannot be removed here.
	FederatedBrowserSignIn bool `json:"federated_browser_sign_in"`

	// ClientIDMetadataAdmissionMode is the issuer's effective client ID
	// metadata document admission mode: disabled, presets, or open.
	ClientIDMetadataAdmissionMode string `` /* 331-byte string literal not displayed */

	// CustomClientURLs are the client ID metadata document URLs this issuer
	// admits beyond the presets, listed in presets mode only.
	CustomClientURLs []string `` /* 141-byte string literal not displayed */

	// CustomClientURLsTruncated reports more custom URLs than were listed.
	CustomClientURLsTruncated bool `json:"custom_client_urls_truncated" jsonschema:"true when the issuer admits more custom URLs than custom_client_urls lists"`

	// CustomClientURLsUnavailable reports that the custom URLs could not be read.
	CustomClientURLsUnavailable bool `` /* 180-byte string literal not displayed */

	// OrganizationGatewayURL is the organization gateway, set when it signs
	// users in through this issuer.
	OrganizationGatewayURL string `json:"organization_gateway_url,omitempty"`

	// OrganizationGatewayURLUnavailable reports that the organization gateway
	// could not be read after a saved change.
	OrganizationGatewayURLUnavailable bool `` /* 234-byte string literal not displayed */
}

InboundEMAIssuer is one organization-level user session issuer's inbound enterprise-managed authorization state.

type InboundEMARemoteIssuerManagement 

type InboundEMARemoteIssuerManagement interface {
	FetchIssuerMetadata(context.Context, *orgremotegen.FetchIssuerMetadataPayload) (*types.RemoteSessionIssuerDraft, error)
	GetIssuerDuplicatePreflight(context.Context, *orgremotegen.GetIssuerDuplicatePreflightPayload) (*types.RemoteSessionIssuerDuplicatePreflight, error)
	GetIssuer(context.Context, *orgremotegen.GetIssuerPayload) (*types.RemoteSessionIssuer, error)
	CreateIssuer(context.Context, *orgremotegen.CreateIssuerPayload) (*types.RemoteSessionIssuer, error)
}

InboundEMARemoteIssuerManagement is the organization remote session issuer management API: metadata discovery, duplicate lookup, reads and creation.

type InboundEMATrustRefusalError 

type InboundEMATrustRefusalError struct {
	// Code is a stable machine-readable refusal code.
	Code string `json:"code"`

	// Message says what was refused and the next safe action.
	Message string `json:"message"`
}

InboundEMATrustRefusalError is a bounded, readable refusal.

func (*InboundEMATrustRefusalError) Error 

func (e *InboundEMATrustRefusalError) Error() string

type InboundEMATrustService 

type InboundEMATrustService struct {
	// contains filtered or unexported fields
}

InboundEMATrustService configures which identity provider an organization-level issuer accepts ID-JAGs from, through the management API.

func (*InboundEMATrustService) Get 

func (s *InboundEMATrustService) Get(ctx context.Context, principal Principal) (GetInboundEMATrustOutput, error)

func (*InboundEMATrustService) Trust 

func (s *InboundEMATrustService) Trust(ctx context.Context, principal Principal, input TrustInboundEMAIdentityProviderInput) (TrustInboundEMAIdentityProviderOutput, error)

func (*InboundEMATrustService) Untrust 

func (s *InboundEMATrustService) Untrust(ctx context.Context, principal Principal, input UntrustInboundEMAIdentityProviderInput) (UntrustInboundEMAIdentityProviderOutput, error)

type InboundEMAUserIssuerManagement 

type InboundEMAUserIssuerManagement interface {
	ListIssuers(context.Context, *orgusergen.ListIssuersPayload) (*orgusergen.ListOrganizationUserSessionIssuersResult, error)
	GetIssuer(context.Context, *orgusergen.GetIssuerPayload) (*types.UserSessionIssuer, error)
	UpdateIssuerIfTrusting(ctx context.Context, payload *orgusergen.UpdateIssuerPayload, expectedTrustedRemoteSessionIssuerID string) (*types.UserSessionIssuer, error)
}

InboundEMAUserIssuerManagement is the organization user session issuer management API. Calling it keeps its authorization, validation, locking and audit for every trust change.

type InspectCatalogCandidateInput 

type InspectCatalogCandidateInput struct {
	ProviderKey string `` /* 152-byte string literal not displayed */
	CatalogRef  string `` /* 158-byte string literal not displayed */
	RemoteURL   string `` /* 258-byte string literal not displayed */
}

type InstallInstruction 

type InstallInstruction struct {
	Title       string `json:"title"`
	Description string `json:"description"`
	URL         string `json:"url,omitempty"`
	// Snippet is a command or config the user can paste as-is. It never
	// carries a credential: sign-in happens in the browser.
	Snippet string `json:"snippet,omitempty" jsonschema:"command or configuration to paste as-is, shown verbatim in a code block"`
}

type InternalSessionIssuerStatus 

type InternalSessionIssuerStatus struct {
	OrganizationID string                       `json:"organization_id"`
	State          internalsessionissuers.State `` /* 130-byte string literal not displayed */
	Issuer         string                       `json:"issuer,omitempty" jsonschema:"issuer URI to register with a supported service; it never changes"`
	CanEnable      bool                         `json:"can_enable" jsonschema:"whether an organization administrator can enable the issuer in this deployment"`
	NextStep       string                       `json:"next_step"`
}

InternalSessionIssuerStatus is public setup information, never signing material.

type IssueSetupHandoffInput 

type IssueSetupHandoffInput struct {
	ProjectSlug    string
	RegistrationID string
	ProviderKey    string
	CatalogRef     string
}

type IssuedSetupHandoff 

type IssuedSetupHandoff struct {
	SetupHandoff
	Value string
}

type JWTAuthenticator 

type JWTAuthenticator struct {
	// contains filtered or unexported fields
}

JWTAuthenticator validates Platform MCP access tokens. A token is accepted only on the platform origin it was minted for: its issuer and audience must equal the resource of the origin the request arrived on (RFC 8707), so a token minted on one platform host is rejected on another.

func NewJWTAuthenticator 

func NewJWTAuthenticator(signer *sessiontokens.Signer, db *pgxpool.Pool, encryptionClient *encryption.Client, baseURL *url.URL) (*JWTAuthenticator, error)

func (*JWTAuthenticator) Authenticate 

func (a *JWTAuthenticator) Authenticate(ctx context.Context, token string) (Principal, error)

type Lifecycle 

type Lifecycle struct {
	DefaultProjectID     string
	MarketplacePublished bool
	Connections          []LifecycleConnection
}

Lifecycle is the safe management projection for the active organization. It deliberately excludes OAuth client, subject, token, JTI, and session values.

type LifecycleConnection 

type LifecycleConnection struct {
	ID             string
	AuthorizedAt   *time.Time
	ReauthorizedAt *time.Time
	Ready          bool
}

type LifecycleEvent 

type LifecycleEvent struct {
	Operation string
	Phase     string
	Outcome   string
	State     ReadinessState
}

type LifecycleMetadataService 

type LifecycleMetadataService struct {
	// contains filtered or unexported fields
}

LifecycleMetadataService updates the display metadata of a complete Platform-owned MCP registration. It shares the narrow mcpservers transaction command used by dashboard updates, but never selects or changes plugin attachments.

func NewLifecycleMetadataService 

func NewLifecycleMetadataService(db *pgxpool.Pool, updater LifecycleMetadataUpdater, keyMaterial string) (*LifecycleMetadataService, error)

func (*LifecycleMetadataService) Update 

func (s *LifecycleMetadataService) Update(ctx context.Context, principal Principal, input UpdateMCPMetadataInput) (UpdateMCPMetadataResult, error)

type LifecycleMetadataUpdate 

type LifecycleMetadataUpdate struct {
	OrganizationID string
	ProjectID      uuid.UUID
	ActorUserID    string
	ServerID       uuid.UUID
	Name           string
}

type LifecycleMetadataUpdater 

type LifecycleMetadataUpdater func(ctx context.Context, tx pgx.Tx, existing mcpserversrepo.McpServer, input LifecycleMetadataUpdate) (mcpserversrepo.McpServer, error)

LifecycleMetadataUpdater is supplied by server composition so Platform MCP invokes the same narrow mcpservers command as the dashboard without importing the dashboard package back into this boundary.

type LifecycleTelemetry 

type LifecycleTelemetry interface {
	Record(ctx context.Context, event LifecycleEvent)
}

func NewLifecycleTelemetry 

func NewLifecycleTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) LifecycleTelemetry

type LifecycleVisibilityLocker 

type LifecycleVisibilityLocker func(context.Context, pgx.Tx, string, uuid.UUID, uuid.UUID) error

LifecycleVisibilityLocker is composed from mcpservers to preserve its domain -> root endpoint -> MCP server lock order before the Platform service locks the target server.

type LifecycleVisibilityService 

type LifecycleVisibilityService struct {
	// contains filtered or unexported fields
}

func NewLifecycleVisibilityService 

func NewLifecycleVisibilityService(db *pgxpool.Pool, auditLogger *audit.Logger, locker LifecycleVisibilityLocker, updater LifecycleVisibilityUpdater, publisher ProjectPublisher, reconcile func(context.Context, []uuid.UUID) error, readiness *ReadinessService, keyMaterial string) (*LifecycleVisibilityService, error)

func (*LifecycleVisibilityService) Disable 

func (s *LifecycleVisibilityService) Disable(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*LifecycleVisibilityService) Enable 

func (s *LifecycleVisibilityService) Enable(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*LifecycleVisibilityService) WithAdministratorAuthorization 

func (s *LifecycleVisibilityService) WithAdministratorAuthorization(engine *authz.Engine) *LifecycleVisibilityService

WithAdministratorAuthorization lets an organization administrator's re-enabling of a server added by URL stand as the Shadow MCP approval for the audiences it reaches again.

func (*LifecycleVisibilityService) WithDistributionAdmission 

func (s *LifecycleVisibilityService) WithDistributionAdmission(guard *admission.Guard) *LifecycleVisibilityService

type LifecycleVisibilityUpdate 

type LifecycleVisibilityUpdate struct {
	OrganizationID string
	ProjectID      uuid.UUID
	ActorUserID    string
	ServerID       uuid.UUID
	Visibility     string
}

type LifecycleVisibilityUpdateResult 

type LifecycleVisibilityUpdateResult struct {
	Server               mcpserversrepo.McpServer
	ClearedRootDomainIDs []uuid.UUID
}

type LifecycleVisibilityUpdater 

type LifecycleVisibilityUpdater func(context.Context, pgx.Tx, mcpserversrepo.McpServer, LifecycleVisibilityUpdate) (LifecycleVisibilityUpdateResult, error)

LifecycleVisibilityUpdater is composed from mcpservers so Platform MCP uses the same transactional visibility/audit primitive as the dashboard while intentionally bypassing dashboard-only attach-to-Default behavior.

type Limiter 

type Limiter interface {
	Allow(ctx context.Context, key string) (ratelimit.Result, error)
	// AllowN charges n units at once. A volume cap meters rows or spans rather
	// than calls, and charging them one at a time would let a page that cannot
	// be afforded in full be paid for halfway.
	AllowN(ctx context.Context, key string, n int) (ratelimit.Result, error)
}

Limiter is the narrow Platform MCP boundary around Speakeasy's shared rate limiter. It lets unit tests deterministically model an allowance, a throttle, or a backing-store failure without depending on Redis.

type LinkSkillToMCPInput 

type LinkSkillToMCPInput struct {
	ProjectSlug     string
	SkillID         string
	TargetKind      string
	MCPServer       string
	Gateway         string
	PinnedVersionID string
	IdempotencyKey  string
}

LinkSkillToMCPInput names one skill and exactly one MCP surface to serve it.

type LinkSkillToMCPOutput 

type LinkSkillToMCPOutput struct {
	ProjectSlug string              `json:"project_slug"`
	Link        SkillMCPLinkSummary `json:"link"`
	Message     string              `json:"message"`
}

LinkSkillToMCPOutput is the receipt for a link, read back after the write.

type LinkSkillToMCPToolInput 

type LinkSkillToMCPToolInput struct {
	ProjectSlug     string `json:"project_slug" jsonschema:"explicit project slug that owns both the skill and the MCP server or gateway"`
	SkillID         string `json:"skill_id" jsonschema:"skill ID returned by list_skills or create_skill"`
	TargetKind      string `` /* 140-byte string literal not displayed */
	MCPServer       string `` /* 166-byte string literal not displayed */
	Gateway         string `` /* 158-byte string literal not displayed */
	PinnedVersionID string `` /* 204-byte string literal not displayed */
	Confirmed       bool   `json:"confirmed" jsonschema:"set true only after the user explicitly confirms serving this skill from this exact MCP surface"`
	IdempotencyKey  string `` /* 129-byte string literal not displayed */
}

type ListAIScanLibraryInput 

type ListAIScanLibraryInput struct {
	Category string `json:"category,omitempty" jsonschema:"narrow to one kind of target: harness, assistant or local_model; omit for all three"`
}

type ListAIScanLibraryOutput 

type ListAIScanLibraryOutput struct {
	// LibraryVersion is what agents echo back once they have this list.
	LibraryVersion int64                 `json:"library_version"`
	Targets        []AIScanTargetSummary `json:"targets"`
}

type ListAccessMembersInput 

type ListAccessMembersInput struct {
	Query         string `json:"query,omitempty" jsonschema:"identity text to search for; required unless role_reference is supplied"`
	RoleReference string `json:"role_reference,omitempty" jsonschema:"opaque role reference returned by list_access_roles"`
	Limit         int    `json:"limit,omitempty" jsonschema:"maximum number of matching members to return; server clamps this to 50"`
}

type ListAccessMembersOutput 

type ListAccessMembersOutput struct {
	Members      []AccessMember `json:"members"`
	TotalMatches SubjectCount   `json:"total_matches"`
	Suppressed   bool           `json:"suppressed"`
	Truncated    bool           `json:"truncated"`

	// ExactEmailMatch reports that the cohort was smaller than five and the
	// single member returned is the one whose complete email equals the query.
	ExactEmailMatch bool   `json:"exact_email_match"`
	ExpiresAt       string `json:"expires_at,omitempty"`
}

type ListAccessRolesOutput 

type ListAccessRolesOutput struct {
	Roles     []AccessRole `json:"roles"`
	ExpiresAt string       `json:"expires_at"`
}

type ListAnalyticsDimensionValuesInput 

type ListAnalyticsDimensionValuesInput struct {
	ProjectID string `json:"project_id"`
	Dataset   string `json:"dataset"`
	Dimension string `json:"dimension"`
	From      string `json:"from"`
	To        string `json:"to"`
	Limit     int    `json:"limit,omitempty"`
	// SignalScope is required for dataset signals.
	SignalScope *signalquery.Scope `json:"signal_scope,omitempty"`
	// Attribute selects an exact label key with dimension=attribute.
	Attribute string `json:"attribute,omitempty"`
}

ListAnalyticsDimensionValuesInput asks what one dimension holds in a window.

type ListAnalyticsDimensionValuesOutput 

type ListAnalyticsDimensionValuesOutput struct {
	Project   AnalyticsProject          `json:"project"`
	Dataset   string                    `json:"dataset"`
	Dimension string                    `json:"dimension"`
	Values    []AnalyticsDimensionValue `json:"values"`
}

ListAnalyticsDimensionValuesOutput lists a dimension's values, most frequent first.

type ListAttributeKeysInput 

type ListAttributeKeysInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to inspect"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h, 7d (default), or 30d"`
}

ListAttributeKeysInput asks which attribute keys one project's telemetry carried in a window, so a caller can choose filters before searching.

type ListAttributeKeysOutput 

type ListAttributeKeysOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`
	// CustomKeys are the @-prefixed attributes the project's own integrations
	// attached; every operator is allowed on them. Capped at
	// maxAttributeKeysPerKind, so this is not necessarily every custom key the
	// window carried — see Truncated.
	CustomKeys []string `json:"custom_keys"`
	// SystemKeys are the platform-recorded attributes that may be filtered on.
	// Keys that carry tool content, keys that carry an HTTP header, and keys
	// that identify a person are withheld here because a search refuses them:
	// one person's calls are narrowed to with user_reference, which records the
	// attribution read. Capped the same way as CustomKeys.
	SystemKeys []string `json:"system_keys"`
	// Truncated states that at least one kind held more than
	// maxAttributeKeysPerKind keys and was cut. It is the only signal that a
	// key's absence from the lists above does not mean the project never
	// recorded it, so the tool description points a caller at it.
	Truncated bool `json:"truncated"`
}

type ListChatsInput 

type ListChatsInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Window      string `json:"window,omitempty"`
	Risk        string `json:"risk,omitempty"`
	Source      string `json:"source,omitempty"`
	AssistantID string `json:"assistant_id,omitempty"`

	// AgentID keeps only sessions attributed to this exact agent.
	AgentID string `json:"agent_id,omitempty"`

	UserReference string `json:"user_reference,omitempty"`
	Limit         int    `json:"limit,omitempty"`
	Cursor        string `json:"cursor,omitempty"`
}

ListChatsInput narrows one project's chats. Every filter is optional; an empty listing returns the chats active in the last week.

type ListChatsOutput 

type ListChatsOutput struct {
	Project      RiskProject   `json:"project"`
	Envelope     DataEnvelope  `json:"data"`
	Chats        []ChatSummary `json:"chats"`
	TotalMatches int           `json:"total_matches"`
	NextCursor   string        `json:"next_cursor,omitempty"`
	Limitations  string        `json:"limitations"`
}

type ListDataExportsInput 

type ListDataExportsInput struct {
	ProjectID   string `json:"project_id,omitempty" jsonschema:"optional project ID; omit both project selectors to list the organization's exports"`
	ProjectSlug string `` /* 128-byte string literal not displayed */
	Limit       int    `` /* 133-byte string literal not displayed */
}

type ListDataExportsOutput 

type ListDataExportsOutput struct {
	Destinations  []DataExportDestination `json:"destinations"`
	Routes        []DataExportRoute       `json:"routes"`
	ManagementURL string                  `json:"management_url"`
	Truncated     bool                    `json:"truncated"`
}

type ListDirectoryReviewItemsOutput 

type ListDirectoryReviewItemsOutput struct {
	Items []DirectoryReviewItemSummary `json:"items"`
}

type ListGatewaySessionsInput 

type ListGatewaySessionsInput struct {
	// Scope makes organization-wide reads an explicit choice.
	Scope string `json:"scope" jsonschema:"organization or gateway; gateway requires gateway_id"`
	// GatewayID names an exact project gateway in the caller's organization.
	GatewayID *string `json:"gateway_id,omitempty" jsonschema:"exact project gateway UUID; omit for organization scope"`
	// Search is supplied by the caller, never inferred from returned identities.
	Search *string `` /* 153-byte string literal not displayed */
	// ServerID restricts configured upstream associations, not historical usage.
	ServerID *string `json:"server_id,omitempty" jsonschema:"exact member server UUID"`
	// ProviderID restricts the upstream provider.
	ProviderID *string `json:"provider_id,omitempty" jsonschema:"exact upstream provider issuer UUID"`
	// Status defaults to active.
	Status string `json:"status,omitempty" jsonschema:"active, expired, revoked, or all; defaults to active"`
	// CreatedAfter is an inclusive RFC3339 timestamp.
	CreatedAfter *string `json:"created_after,omitempty" jsonschema:"inclusive creation timestamp in RFC3339 format"`
	// CreatedBefore is an exclusive RFC3339 timestamp.
	CreatedBefore *string `json:"created_before,omitempty" jsonschema:"exclusive creation timestamp in RFC3339 format"`
	// Sort defaults to newest.
	Sort string `json:"sort,omitempty" jsonschema:"newest, oldest, last_used, or expiry"`
	// Cursor must be reused only with identical filters and ordering.
	Cursor *string `json:"cursor,omitempty" jsonschema:"next_cursor from the previous page; reuse only with identical filters and ordering"`
	// Limit bounds one page, default 50 and maximum 100.
	Limit int `json:"limit,omitempty" jsonschema:"page size from 1 to 100; omit for the default of 50"`
}

ListGatewaySessionsInput selects one gateway without using a working project.

type ListGatewaySessionsOutput 

type ListGatewaySessionsOutput struct {
	// Items contains authorized records for the requested organization or gateway scope.
	Items []GatewaySessionSummary `json:"items"`
	// NextCursor continues this exact query, when another page exists.
	NextCursor *string `json:"next_cursor,omitempty"`
}

ListGatewaySessionsOutput is a bounded, privacy-preserving authorization page.

type ListMCPUsageUsersInput 

type ListMCPUsageUsersInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type ListMCPUsageUsersOutput 

type ListMCPUsageUsersOutput struct {
	ProjectID string         `json:"project_id"`
	MCPID     string         `json:"mcp_id"`
	Envelope  DataEnvelope   `json:"data"`
	Users     []MCPUsageUser `json:"users"`
	Truncated bool           `json:"truncated"`
}

type ListManagedDevicesInput 

type ListManagedDevicesInput struct {
	Provider       string `json:"provider,omitempty" jsonschema:"one MDM provider, e.g. jamf or kandji; omit for every connected inventory"`
	CoverageBucket string `` /* 178-byte string literal not displayed */
	PolicyState    string `` /* 131-byte string literal not displayed */
	UserEmail      string `json:"user_email,omitempty" jsonschema:"only devices assigned to this email, matched case-insensitively"`
	Cursor         string `json:"cursor,omitempty" jsonschema:"next_cursor from the previous page"`
	Limit          int    `json:"limit,omitempty" jsonschema:"page size, 1 to 100; defaults to 50"`
}

type ListManagedDevicesOutput 

type ListManagedDevicesOutput struct {
	Devices    []ManagedDeviceSummary `json:"devices"`
	NextCursor string                 `json:"next_cursor,omitempty"`
}

type ListMyServersOutput 

type ListMyServersOutput struct {
	Servers []MyServer `json:"servers"`
	// Hidden are servers the caller hid from their gateway; their tools are
	// not served until shown again at ConnectURL.
	Hidden     []MyServer `json:"hidden,omitempty"`
	ConnectURL string     `json:"connect_url,omitempty"`
	Note       string     `json:"note,omitempty"`
}

ListMyServersOutput lists the servers the caller can use.

type ListMySessionsInput 

type ListMySessionsInput struct {
	Limit int `json:"limit,omitempty" jsonschema:"maximum number of sessions to return; server clamps this to 100"`
}

type ListMySessionsOutput 

type ListMySessionsOutput struct {
	Sessions []RecallableSession `json:"sessions"`
}

type ListOrganizationEventsInput 

type ListOrganizationEventsInput struct {
	Limit  int    `json:"limit,omitempty" jsonschema:"maximum events to return; defaults to 20 and is capped at 50"`
	Window string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), or 7d"`
	Kind   string `json:"kind,omitempty" jsonschema:"optional signal kind filter: log or span"`
}

type ListOrganizationEventsOutput 

type ListOrganizationEventsOutput struct {
	Window       ResolvedWindow      `json:"window"`
	Events       []OrganizationEvent `json:"events"`
	More         bool                `json:"more"`
	EventFeedURL string              `json:"event_feed_url"`
}

type ListPluginAssignmentsInput 

type ListPluginAssignmentsInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID whose plugin assignment targets to list"`
}

type ListPluginAssignmentsOutput 

type ListPluginAssignmentsOutput struct {
	ProjectID          string                   `json:"project_id"`
	Assignments        []PluginAssignmentOption `json:"assignments"`
	ReferencesExpireAt string                   `json:"references_expire_at,omitempty"`
	Truncated          bool                     `json:"truncated"`
}

type ListPluginsInput 

type ListPluginsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID whose plugins to list"`
	Limit     int    `json:"limit,omitempty" jsonschema:"maximum number of plugins to return; server clamps this to 50"`
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor from a previous list_plugins result"`
}

type ListPluginsOutput 

type ListPluginsOutput struct {
	// ProjectID echoes the project the plugins belong to.
	ProjectID string `json:"project_id"`

	// Plugins is one page of the project's plugins.
	Plugins []Plugin `json:"plugins"`

	// NextCursor is the cursor for the next page, empty when this page is the
	// last one.
	NextCursor string `json:"next_cursor,omitempty"`
}

type ListProjectToolsInput 

type ListProjectToolsInput struct {
	ProjectID  string `json:"project_id" jsonschema:"project ID whose tools to list"`
	Query      string `json:"query,omitempty" jsonschema:"optional match on tool name, tool URN, or source slug"`
	SourceKind string `json:"source_kind,omitempty" jsonschema:"optional source filter: function or openapi"`
	Cursor     string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous list_project_tools result"`
	Limit      int    `json:"limit,omitempty" jsonschema:"maximum number of tools to return; server clamps this to 100"`
}

type ListProjectToolsOutput 

type ListProjectToolsOutput struct {
	ProjectID string `json:"project_id"`
	// DeploymentID is the deployment these tools were generated by. A tool
	// pushed after that deployment finished appears only once the new
	// deployment completes.
	DeploymentID string        `json:"deployment_id,omitempty"`
	Tools        []ProjectTool `json:"tools"`
	NextCursor   string        `json:"next_cursor,omitempty"`
}

type ListProjectsInput 

type ListProjectsInput struct {
	Limit int `json:"limit,omitempty" jsonschema:"maximum number of projects to return; server clamps this to 100"`
}

type ListProjectsOutput 

type ListProjectsOutput struct {
	Projects  []Project `json:"projects"`
	Truncated bool      `json:"truncated"`
	// contains filtered or unexported fields
}

type ListRecentToolCallsInput 

type ListRecentToolCallsInput struct {
	ProjectID   string `json:"project_id,omitempty" jsonschema:"project ID to inspect; supply exactly one project selector"`
	ProjectSlug string `json:"project_slug,omitempty" jsonschema:"project slug to inspect; supply exactly one project selector"`
	Window      string `json:"window,omitempty" jsonschema:"observation window: 1h (default) or 24h"`
	Outcome     string `json:"outcome,omitempty" jsonschema:"optional outcome filter: success, error, blocked, or pending"`
	// AgentID selects only calls attributed to this authenticated agent.
	AgentID string `` /* 144-byte string literal not displayed */

	Limit int `json:"limit,omitempty" jsonschema:"maximum calls to return; defaults to 10 and is capped at 50"`
}

type ListRecentToolCallsOutput 

type ListRecentToolCallsOutput struct {
	ProjectID   string           `json:"project_id"`
	ProjectName string           `json:"project_name"`
	ProjectSlug string           `json:"project_slug"`
	Window      ResolvedWindow   `json:"window"`
	Calls       []RecentToolCall `json:"calls"`
	More        bool             `json:"more"`
	ToolLogsURL string           `json:"tool_logs_url"`
}

type ListRiskExclusionsInput 

type ListRiskExclusionsInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	PolicyID    string `json:"policy_id,omitempty"`
	Cursor      string `json:"cursor,omitempty"`
	Limit       int    `json:"limit,omitempty"`
}

type ListRiskExclusionsOutput 

type ListRiskExclusionsOutput struct {
	Project            RiskProject            `json:"project"`
	CatalogVersion     string                 `json:"catalog_version"`
	CatalogFingerprint string                 `json:"catalog_fingerprint"`
	Exclusions         []RiskExclusionSummary `json:"exclusions"`
	NextCursor         string                 `json:"next_cursor,omitempty"`
}

type ListRiskFindingPageInput 

type ListRiskFindingPageInput struct {
	ProjectID    string `json:"project_id,omitempty"`
	ProjectSlug  string `json:"project_slug,omitempty"`
	From         string `json:"from,omitempty"`
	To           string `json:"to,omitempty"`
	PolicyID     string `json:"policy_id,omitempty"`
	ChatID       string `json:"chat_id,omitempty"`
	MCPServerID  string `json:"mcp_server_id,omitempty"`
	Category     string `json:"category,omitempty"`
	RuleID       string `json:"rule_id,omitempty"`
	UserID       string `json:"user_id,omitempty"`
	AssistantID  string `json:"assistant_id,omitempty"`
	NonAssistant bool   `json:"non_assistant,omitempty"`
	UniqueMatch  bool   `json:"unique_match,omitempty"`
	ResultID     string `json:"result_id,omitempty"`
	ExecutionID  string `json:"execution_id,omitempty"`
	Cursor       string `json:"cursor,omitempty"`
	Limit        int    `json:"limit,omitempty"`
}

type ListRiskFindingPageOutput 

type ListRiskFindingPageOutput struct {
	Project     RiskProject   `json:"project"`
	Findings    []RiskFinding `json:"findings"`
	NextCursor  string        `json:"next_cursor,omitempty"`
	Limitations string        `json:"limitations"`
}

type ListRiskFindingsByChatInput 

type ListRiskFindingsByChatInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Cursor      string `json:"cursor,omitempty"`
	Limit       int    `json:"limit,omitempty"`
}

type ListRiskFindingsByChatOutput 

type ListRiskFindingsByChatOutput struct {
	Project     RiskProject              `json:"project"`
	Chats       []RiskFindingChatSummary `json:"chats"`
	NextCursor  string                   `json:"next_cursor,omitempty"`
	Limitations string                   `json:"limitations"`
}

type ListRiskFindingsInput 

type ListRiskFindingsInput struct {
	ProjectID   string   `json:"project_id,omitempty"`
	ProjectSlug string   `json:"project_slug,omitempty"`
	From        string   `json:"from,omitempty"`
	To          string   `json:"to,omitempty"`
	Severity    string   `json:"severity,omitempty"`
	GroupBy     []string `json:"group_by,omitempty"`
}

type ListRiskFindingsOutput 

type ListRiskFindingsOutput struct {
	Project     RiskProject     `json:"project"`
	From        string          `json:"from"`
	To          string          `json:"to"`
	Severity    string          `json:"severity"`
	Groups      []WatchdogAlert `json:"groups"`
	TotalCount  uint64          `json:"total_count"`
	TotalAlerts int             `json:"total_alerts"`
	Truncated   bool            `json:"truncated"`
	Limitations string          `json:"limitations"`
}

type ListRiskPoliciesInput 

type ListRiskPoliciesInput struct {
	ProjectID   string `json:"project_id,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Cursor      string `json:"cursor,omitempty"`
	Limit       int    `json:"limit,omitempty"`
}

type ListRiskPoliciesOutput 

type ListRiskPoliciesOutput struct {
	Project            RiskProject         `json:"project"`
	CatalogVersion     string              `json:"catalog_version"`
	CatalogFingerprint string              `json:"catalog_fingerprint"`
	Policies           []RiskPolicySummary `json:"policies"`
	NextCursor         string              `json:"next_cursor,omitempty"`
}

type ListRiskPresetsInput 

type ListRiskPresetsInput struct{}

type ListRiskPresetsOutput 

type ListRiskPresetsOutput struct {
	Presets []RiskPresetSummary `json:"presets"`
}

type ListShadowAIInventoryInput 

type ListShadowAIInventoryInput struct {
	Category string `json:"category,omitempty" jsonschema:"narrow to one kind of tool: harness, assistant or local_model; omit for all three"`
}

type ListShadowAIInventoryOutput 

type ListShadowAIInventoryOutput struct {
	Tools []ShadowAIToolSummary `json:"tools"`
}

type ListShadowMCPInventoryInput 

type ListShadowMCPInventoryInput struct {
	ProjectID string `json:"project_id" jsonschema:"explicit project ID returned by list_projects"`
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by the preceding list_shadow_mcp_inventory page"`
	Limit     int    `json:"limit,omitempty" jsonschema:"maximum targets to return; server clamps this to 50"`
}

type ListShadowMCPInventoryOutput 

type ListShadowMCPInventoryOutput struct {
	Project    RiskProject              `json:"project"`
	Targets    []ShadowMCPTargetSummary `json:"targets"`
	NextCursor string                   `json:"next_cursor,omitempty"`
}

type ListSkillDistributionsInput 

type ListSkillDistributionsInput struct {
	ProjectSlug string
	SkillID     string
	Plugin      string
	Cursor      string
	Limit       int
}

ListSkillDistributionsInput narrows the listing. A plugin is named on the same terms distribute_skill accepts — id, slug, or exact name — and is resolved to exactly one plugin or refused, so a filter never silently matches a plugin the caller did not mean.

type ListSkillDistributionsOutput 

type ListSkillDistributionsOutput struct {
	ProjectSlug   string                     `json:"project_slug"`
	Distributions []SkillDistributionSummary `json:"distributions"`
	NextCursor    string                     `json:"next_cursor,omitempty"`

	// ServedBy is the MCP surfaces that serve the listed skill — or every
	// skill in the project when none is named — over MCP, from the skill's
	// live links. It is read on the first page only, and is empty when
	// serving skills over MCP is off for the organization.
	ServedBy []SkillMCPLinkSummary `json:"served_by"`

	// ServedByTruncated is true when more links exist than ServedBy holds.
	ServedByTruncated bool `json:"served_by_truncated,omitempty"`
}

type ListSkillDistributionsToolInput 

type ListSkillDistributionsToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug whose skill distributions to list"`
	SkillID     string `` /* 133-byte string literal not displayed */
	Plugin      string `` /* 173-byte string literal not displayed */
	Cursor      string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skill_distributions call"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum distributions to return; defaults to 20 and is capped at 50"`
}

type ListSkillFeedbackInput 

type ListSkillFeedbackInput struct {
	ProjectSlug string
	SkillID     string
	Cursor      string
	Limit       int
}

type ListSkillFeedbackOutput 

type ListSkillFeedbackOutput struct {
	ProjectSlug string                       `json:"project_slug"`
	SkillID     string                       `json:"skill_id"`
	Counts      SkillFeedbackCounts          `json:"counts"`
	Metrics     SkillFeedbackMetrics         `json:"metrics"`
	Timeline    []SkillFeedbackTimelinePoint `json:"timeline"`
	Feedback    []SkillFeedbackSummary       `json:"feedback"`
	NextCursor  string                       `json:"next_cursor,omitempty"`
}

type ListSkillFeedbackToolInput 

type ListSkillFeedbackToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID     string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	Cursor      string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skill_feedback call"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum feedback records to return; defaults to 20 and is capped at 50"`
}

type ListSkillInsightsInput 

type ListSkillInsightsInput struct {
	ProjectSlug string
	Window      string
	SortBy      string
	Limit       int
}

ListSkillInsightsInput ranks the skills of one project.

type ListSkillInsightsOutput 

type ListSkillInsightsOutput struct {
	ProjectSlug string       `json:"project_slug"`
	Envelope    DataEnvelope `json:"data"`

	// SortBy echoes the ranking key applied, including the default.
	SortBy string `json:"sort_by"`

	// ScoresAvailable is false when no session in the window was scored, in
	// which case every efficacy block is absent and sorting by an efficacy key
	// falls back to name order.
	ScoresAvailable bool `json:"scores_available"`

	// CostAttribution says how full_session_cost_usd was counted.
	CostAttribution string `json:"cost_attribution"`

	// ScoreCoverage says which sessions the score and saved-time figures cover.
	ScoreCoverage string `json:"score_coverage"`

	Skills []SkillInsight `json:"skills"`

	// Truncated is true when the project holds more skills than were ranked,
	// either because the registry page filled or because the ranking was cut at
	// the requested limit.
	Truncated bool `json:"truncated"`
}

ListSkillInsightsOutput is one project's skills ranked by what they returned. It names skills by registry ID; it never names a person or a session.

type ListSkillInsightsToolInput 

type ListSkillInsightsToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug whose skills to rank"`
	Window      string `json:"window,omitempty" jsonschema:"how far back to look: 1h, 24h, 7d, or 30d (default and maximum)"`
	SortBy      string `` /* 131-byte string literal not displayed */
	Limit       int    `json:"limit,omitempty" jsonschema:"how many skills to return; defaults to 10 and is capped at 20"`
}

type ListSkillSuggestionFeedbackInput 

type ListSkillSuggestionFeedbackInput struct {
	ProjectSlug string
	ChangeID    string
	Limit       int
}

type ListSkillSuggestionFeedbackOutput 

type ListSkillSuggestionFeedbackOutput struct {
	ProjectSlug string                 `json:"project_slug"`
	ChangeID    string                 `json:"change_id"`
	Feedback    []SkillFeedbackSummary `json:"feedback"`
}

type ListSkillSuggestionFeedbackToolInput 

type ListSkillSuggestionFeedbackToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug that owns the suggestion"`
	ChangeID    string `json:"change_id" jsonschema:"change ID returned inside list_skill_suggestions"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum linked feedback records to return; defaults to 20 and is capped at 50"`
}

type ListSkillSuggestionsInput 

type ListSkillSuggestionsInput struct {
	ProjectSlug            string
	SkillID                string
	IncludeProposedContent bool

	// OmitDiffs leaves each change's proposed diff out, for triaging the queue
	// from rationale and evidence counts before reading any change in full.
	OmitDiffs bool

	Cursor string
	Limit  int
}

type ListSkillSuggestionsOutput 

type ListSkillSuggestionsOutput struct {
	ProjectSlug    string                   `json:"project_slug"`
	Suggestions    []SkillSuggestionSummary `json:"suggestions"`
	TotalOpenCount int64                    `json:"total_open_count"`
	NextCursor     string                   `json:"next_cursor,omitempty"`
}

type ListSkillSuggestionsToolInput 

type ListSkillSuggestionsToolInput struct {
	ProjectSlug            string `json:"project_slug" jsonschema:"explicit project slug whose open suggestions to review"`
	SkillID                string `` /* 127-byte string literal not displayed */
	IncludeProposedContent bool   `` /* 145-byte string literal not displayed */
	OmitDiffs              bool   `` /* 273-byte string literal not displayed */
	Cursor                 string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skill_suggestions call"`
	Limit                  int    `json:"limit,omitempty" jsonschema:"maximum suggestions to return; defaults to 20 and is capped at 50"`
}

type ListSkillUsageUsersInput 

type ListSkillUsageUsersInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the skill"`
	SkillName string `json:"skill_name" jsonschema:"exact canonical skill name returned by query_skill_usage"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type ListSkillUsageUsersOutput 

type ListSkillUsageUsersOutput struct {
	ProjectID string           `json:"project_id"`
	SkillName string           `json:"skill_name"`
	Envelope  DataEnvelope     `json:"data"`
	Users     []SkillUsageUser `json:"users"`
	Truncated bool             `json:"truncated"`
}

type ListSkillVersionsInput 

type ListSkillVersionsInput struct {
	ProjectSlug    string
	SkillID        string
	IncludeContent bool
	Cursor         string
	Limit          int
}

type ListSkillVersionsOutput 

type ListSkillVersionsOutput struct {
	ProjectSlug string                `json:"project_slug"`
	SkillID     string                `json:"skill_id"`
	Versions    []SkillVersionSummary `json:"versions"`
	NextCursor  string                `json:"next_cursor,omitempty"`
}

type ListSkillVersionsToolInput 

type ListSkillVersionsToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	IncludeContent bool   `` /* 136-byte string literal not displayed */
	Cursor         string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skill_versions call"`
	Limit          int    `json:"limit,omitempty" jsonschema:"maximum versions to return; defaults to 50 and is capped at 100"`
}

type ListSkillsInput 

type ListSkillsInput struct {
	ProjectSlug string
	Search      string
	Cursor      string
	Limit       int
}

ListSkillsInput names the project whose registry to read.

type ListSkillsOutput 

type ListSkillsOutput struct {
	ProjectSlug string         `json:"project_slug"`
	Skills      []SkillSummary `json:"skills"`
	TotalCount  int64          `json:"total_count"`
	NextCursor  string         `json:"next_cursor,omitempty"`
}

type ListSkillsToolInput 

type ListSkillsToolInput struct {
	ProjectSlug string `json:"project_slug" jsonschema:"explicit project slug whose skill registry to list"`
	Search      string `json:"search,omitempty" jsonschema:"optional case-insensitive search over skill names and summaries"`
	Cursor      string `json:"cursor,omitempty" jsonschema:"pagination cursor returned by a previous list_skills call"`
	Limit       int    `json:"limit,omitempty" jsonschema:"maximum skills to return; defaults to 50 and is capped at 100"`
}

type LiveOrgAdminAuthorizer 

type LiveOrgAdminAuthorizer struct {
	// contains filtered or unexported fields
}

func NewLiveOrgAdminAuthorizer 

func NewLiveOrgAdminAuthorizer(db *pgxpool.Pool, engine *authz.Engine) *LiveOrgAdminAuthorizer

func (*LiveOrgAdminAuthorizer) AuthorizeExternalCall 

func (a *LiveOrgAdminAuthorizer) AuthorizeExternalCall(ctx context.Context, principal Principal, policy ExternalAuthorization) error

func (*LiveOrgAdminAuthorizer) HasLiveOrgAdmin 

func (a *LiveOrgAdminAuthorizer) HasLiveOrgAdmin(ctx context.Context, principal Principal) (bool, error)

HasLiveOrgAdmin checks current membership and grants without recording a denied access challenge. Use it only for capability-shaped presentation; an attempted admin operation must still call RequireLiveOrgAdmin.

func (*LiveOrgAdminAuthorizer) PrepareExternalContext 

func (a *LiveOrgAdminAuthorizer) PrepareExternalContext(ctx context.Context, principal Principal) (context.Context, error)

PrepareExternalContext verifies live membership, binds a trusted user context, and resolves current grants once for this external request.

func (*LiveOrgAdminAuthorizer) RequireLiveMembership 

func (a *LiveOrgAdminAuthorizer) RequireLiveMembership(ctx context.Context, principal Principal) error

func (*LiveOrgAdminAuthorizer) RequireLiveOrgAdmin 

func (a *LiveOrgAdminAuthorizer) RequireLiveOrgAdmin(ctx context.Context, principal Principal) error

func (*LiveOrgAdminAuthorizer) WithDashboardURL 

func (a *LiveOrgAdminAuthorizer) WithDashboardURL(dashboardURL *url.URL) *LiveOrgAdminAuthorizer

func (*LiveOrgAdminAuthorizer) WithServerURL 

func (a *LiveOrgAdminAuthorizer) WithServerURL(serverURL *url.URL) *LiveOrgAdminAuthorizer

WithServerURL sets the configured server URL, which tells an extra platform host apart from the canonical one when building request-access links.

type LiveOrganizationSelector 

type LiveOrganizationSelector struct {
	// contains filtered or unexported fields
}

LiveOrganizationSelector returns active organization memberships. Per-call RBAC determines what the user may do after connecting.

func NewLiveOrganizationSelector 

func NewLiveOrganizationSelector(db *pgxpool.Pool, authorizer Authorizer) *LiveOrganizationSelector

func (*LiveOrganizationSelector) EligibleOrganizations 

func (s *LiveOrganizationSelector) EligibleOrganizations(ctx context.Context, userID string) ([]OrganizationOption, error)

type MCP 

type MCP struct {
	ID          string `json:"id"`
	ProjectID   string `json:"project_id"`
	ProjectName string `json:"project_name,omitempty"`
	ProjectSlug string `json:"project_slug,omitempty"`
	Name        string `json:"name,omitempty"`
	Slug        string `json:"slug,omitempty"`
	Version     string `json:"version,omitempty"`
	Visibility  string `json:"visibility"`

	// EffectiveEnabled is true only for recognized enabled visibility values.
	EffectiveEnabled bool `json:"effective_enabled" jsonschema:"true only when enabled_state is enabled; false may mean disabled or unknown"`

	// EnabledState distinguishes confirmed disabled servers from unknown visibility.
	EnabledState string `` /* 145-byte string literal not displayed */

	Model         string            `json:"model"`
	BackendKind   MCPBackendKind    `json:"backend_kind"`
	UpstreamURL   string            `json:"upstream_url,omitempty"`
	Source        MCPSource         `json:"source"`
	Registration  *MCPRegistration  `json:"registration,omitempty"`
	Readiness     MCPReadiness      `json:"readiness"`
	Distributions []MCPDistribution `json:"distributions"`
	Operations    []string          `json:"operations"`
	DashboardPath string            `json:"dashboard_path,omitempty"`

	// ToolExposure is the tool list this server puts in front of people, and
	// the version token add_tools_to_mcp and remove_tools_from_mcp take back.
	// It is filled in by get_mcp only. find_mcp leaves it absent, and absent
	// means "not read here" — never "this server exposes nothing". It is also
	// absent on a server whose tools come from an upstream rather than from
	// this project.
	ToolExposure *MCPToolExposure `json:"tool_exposure,omitempty"`
}

type MCPAccessRoleRule 

type MCPAccessRoleRule struct {
	MCPID       string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp for the explicit project"`
	Tool        string `json:"tool,omitempty" jsonschema:"optional exact tool name currently returned by get_mcp_access"`
	Disposition string `json:"disposition,omitempty" jsonschema:"optional closed tool disposition: read_only, destructive, idempotent, or open_world"`
}

MCPAccessRoleRule is a caller-facing request for one server-generated mcp:connect selector. MCPID must be a configured MCP returned for the explicit project. Tool, when present, is accepted only from an enumerable current catalog. Disposition is a closed annotation class, never an open selector.

type MCPAccessTarget 

type MCPAccessTarget struct {
	ID                   string          `json:"id"`
	Name                 string          `json:"name"`
	Backend              string          `json:"backend"`
	Visibility           string          `json:"visibility"`
	AuthorizationMode    string          `json:"authorization_mode"`
	AuthorizationSurface string          `json:"authorization_surface"`
	AccessSummary        string          `json:"access_summary"`
	ToolCatalog          string          `json:"tool_catalog"`
	Tools                []MCPAccessTool `json:"tools"`
	ToolsTruncated       bool            `json:"tools_truncated"`
}

type MCPAccessTool 

type MCPAccessTool struct {
	Name        string `json:"name"`
	Disposition string `json:"disposition,omitempty"`
}

type MCPBackendKind 

type MCPBackendKind string
const (
	MCPBackendHosted    MCPBackendKind = "hosted"
	MCPBackendRemote    MCPBackendKind = "remote"
	MCPBackendTunneled  MCPBackendKind = "tunneled"
	MCPBackendUnproxied MCPBackendKind = "unproxied"
	// MCPBackendBuiltin is a server Speakeasy serves itself, such as the
	// approvals server agents call request_approval on.
	MCPBackendBuiltin MCPBackendKind = "built_in"
	MCPBackendLegacy  MCPBackendKind = "legacy"
)

type MCPClientAdmissionToolOutput 

type MCPClientAdmissionToolOutput struct {
	ProjectSlug      string   `json:"project_slug"`
	RegistrationID   string   `json:"registration_id"`
	Mode             string   `json:"mode"`
	AllowedModes     []string `json:"allowed_modes"`
	CustomClientURLs []string `json:"custom_client_urls"`
	Message          string   `json:"message"`
}

type MCPClientEvidence 

type MCPClientEvidence struct {
	Client   string `json:"client"`
	Calls    int64  `json:"calls"`
	Failures int64  `json:"failures"`
}

MCPClientEvidence is what one client reported about its own calls. The name is self-reported by that client and is evidence, not a dimension: nothing in this surface lets a caller filter or group by it.

type MCPConnectSummary 

type MCPConnectSummary struct {
	AllServers              bool     `json:"all_servers"`
	ProjectRules            int      `json:"project_rules"`
	ServerRules             int      `json:"server_rules"`
	ToolRules               int      `json:"tool_rules"`
	DispositionRules        []string `json:"disposition_rules"`
	BlockedServers          bool     `json:"blocked_servers"`
	BlockedProjectRules     int      `json:"blocked_project_rules"`
	BlockedServerRules      int      `json:"blocked_server_rules"`
	BlockedToolRules        int      `json:"blocked_tool_rules"`
	BlockedDispositionRules []string `json:"blocked_disposition_rules"`
}

type MCPConnectionEndpoint 

type MCPConnectionEndpoint struct {
	ID             string `json:"id"`
	Slug           string `json:"slug"`
	CustomDomainID string `json:"custom_domain_id,omitempty"`
	Domain         string `json:"domain,omitempty"`
	IsDomainRoot   bool   `json:"is_domain_root"`
}

type MCPConnectionEndpointWriter 

type MCPConnectionEndpointWriter interface {
	CreateMcpEndpointInTransaction(context.Context, pgx.Tx, mcpendpoints.CreateMcpEndpointInTransactionInput) (*types.McpEndpoint, error)
	UpdateMcpEndpointAddressInTransaction(context.Context, pgx.Tx, mcpendpoints.UpdateMcpEndpointAddressInput) (*types.McpEndpoint, []uuid.UUID, error)
}

type MCPConnectionIngress 

type MCPConnectionIngress struct {
	Enabled        bool   `json:"enabled"`
	NamespaceKind  string `json:"namespace_kind"`
	Hostname       string `json:"hostname"`
	CustomDomainID string `json:"custom_domain_id,omitempty"`
	Status         string `json:"status"`
	DNSName        string `json:"dns_name,omitempty"`
}

type MCPConnectionMutationOutput 

type MCPConnectionMutationOutput struct {
	Settings           *MCPConnectionSettings  `json:"settings,omitempty"`
	SnapshotScope      string                  `json:"snapshot_scope"`
	PublicationRequest string                  `json:"publication_request"`
	PublishSignal      string                  `json:"publish_signal"`
	Receipt            RiskMutationToolReceipt `json:"receipt"`
}

type MCPConnectionMutationPreview 

type MCPConnectionMutationPreview struct {
	ProjectID         string                          `json:"project_id"`
	TargetKind        MCPConnectionSettingsTargetKind `json:"target_kind"`
	TargetID          string                          `json:"target_id"`
	Name              string                          `json:"name"`
	Version           string                          `json:"version"`
	Change            string                          `json:"change"`
	EndpointBefore    *MCPConnectionEndpoint          `json:"endpoint_before,omitempty"`
	EndpointAfter     *MCPConnectionEndpoint          `json:"endpoint_after,omitempty"`
	NetworkModeBefore string                          `json:"network_mode_before"`
	NetworkModeAfter  string                          `json:"network_mode_after"`
	Endpoints         []MCPConnectionEndpoint         `json:"endpoints"`
	Ingress           *MCPConnectionIngress           `json:"ingress,omitempty"`
	PluginMemberships []MCPConnectionPluginMembership `json:"plugin_memberships"`
}

MCPConnectionMutationPreview is what an unconfirmed call reports: the current settings and the exact change a confirmed call with the same input would make. Nothing is written for it.

type MCPConnectionMutationService 

type MCPConnectionMutationService struct {
	// contains filtered or unexported fields
}

func NewMCPConnectionMutationService 

func NewMCPConnectionMutationService(db *pgxpool.Pool, settings *MCPConnectionSettingsService, endpoints MCPConnectionEndpointWriter, auditLogger *audit.Logger, authorizer *authz.Engine, eligibility networkaccess.EligibilityChecker, publication plugins.PublicationRequests, publisher plugins.PluginPublishSignaler) (*MCPConnectionMutationService, error)

func (*MCPConnectionMutationService) SetAddress 

func (s *MCPConnectionMutationService) SetAddress(ctx context.Context, principal Principal, input SetMCPAddressInput) (MCPConnectionMutationOutput, error)

func (*MCPConnectionMutationService) SetNetworkAccess 

func (s *MCPConnectionMutationService) SetNetworkAccess(ctx context.Context, principal Principal, input SetMCPNetworkAccessInput) (MCPConnectionMutationOutput, error)

func (*MCPConnectionMutationService) WithCustomDomainReconcile 

func (s *MCPConnectionMutationService) WithCustomDomainReconcile(reconcile func(context.Context, []uuid.UUID) error) *MCPConnectionMutationService

WithCustomDomainReconcile sets how custom domains whose root a mutation cleared are reconciled after commit.

type MCPConnectionPluginMembership 

type MCPConnectionPluginMembership struct {
	ID          string `json:"id"`
	PluginID    string `json:"plugin_id"`
	PluginSlug  string `json:"plugin_slug"`
	DisplayName string `json:"display_name"`
	Policy      string `json:"policy"`
	SortOrder   int32  `json:"sort_order"`
}

type MCPConnectionSettings 

type MCPConnectionSettings struct {
	// DiscoveryMode is a gateway's stored default discovery mode. A connection
	// records the default at consent and keeps it until it reconnects.
	DiscoveryMode string `json:"discovery_mode,omitempty"`

	// EffectiveDiscoveryMode is the mode the gateway default serves now: a
	// stored code_mode serves progressive while Code Mode is unavailable to
	// the organization or the gateway does not require sign-in, and a mode
	// this build does not support serves progressive.
	EffectiveDiscoveryMode string `json:"effective_discovery_mode,omitempty"`

	// CodeModeAvailable reports, for a gateway, whether the code runtime is
	// available and the organization has Code Mode.
	CodeModeAvailable *bool `json:"code_mode_available,omitempty"`

	ProjectID   string                          `json:"project_id"`
	TargetKind  MCPConnectionSettingsTargetKind `json:"target_kind"`
	TargetID    string                          `json:"target_id"`
	Name        string                          `json:"name"`
	Visibility  string                          `json:"visibility"`
	NetworkMode string                          `json:"network_mode"`
	Version     string                          `json:"version"`
	Endpoints   []MCPConnectionEndpoint         `json:"endpoints"`
	// LegacyPlatformSlug is an older Speakeasy-hosted address of a hosted server: its custom-domain alias, which the
	// Speakeasy domain also serves.
	LegacyPlatformSlug string                          `json:"legacy_platform_slug,omitempty"`
	Ingress            *MCPConnectionIngress           `json:"ingress,omitempty"`
	PluginMemberships  []MCPConnectionPluginMembership `json:"plugin_memberships"`
	// UpstreamAuthentication is set for MCP servers, not gateways.
	UpstreamAuthentication *MCPUpstreamAuthentication `json:"upstream_authentication,omitempty"`
}

type MCPConnectionSettingsService 

type MCPConnectionSettingsService struct {
	// contains filtered or unexported fields
}

func NewMCPConnectionSettingsService 

func NewMCPConnectionSettingsService(db platformrepo.DBTX) *MCPConnectionSettingsService

func (*MCPConnectionSettingsService) Get 

func (s *MCPConnectionSettingsService) Get(ctx context.Context, principal Principal, input GetMCPConnectionSettingsInput) (MCPConnectionSettings, error)

func (*MCPConnectionSettingsService) GetInTx 

func (s *MCPConnectionSettingsService) GetInTx(ctx context.Context, tx pgx.Tx, principal Principal, input GetMCPConnectionSettingsInput) (MCPConnectionSettings, error)

GetInTx returns the settings snapshot through the caller transaction. Version covers network mode and endpoint IDs, slugs, and domain IDs. It deliberately excludes ingress observations, domain names, membership, and root selection.

func (*MCPConnectionSettingsService) WithCodeModeAvailability 

func (s *MCPConnectionSettingsService) WithCodeModeAvailability(check CodeModeAvailability) *MCPConnectionSettingsService

WithCodeModeAvailability lets gateway settings report the discovery mode the gateway actually serves.

type MCPConnectionSettingsTargetKind 

type MCPConnectionSettingsTargetKind string
const (
	MCPConnectionSettingsMCPServer MCPConnectionSettingsTargetKind = "mcp_server"
	MCPConnectionSettingsGateway   MCPConnectionSettingsTargetKind = "gateway"
)

type MCPDiagnosticsReadiness 

type MCPDiagnosticsReadiness struct {
	State         string         `json:"state"`
	EvidenceCode  string         `json:"evidence_code,omitempty"`
	SetupCategory SetupCategory  `json:"setup_category,omitempty"`
	Freshness     string         `json:"freshness"`
	CheckedAt     string         `json:"checked_at,omitempty"`
	Actions       []RepairAction `json:"actions"`
}

MCPDiagnosticsReadiness is the latest server-side readiness result, with the freshness that decides whether it can exonerate anything.

type MCPDistribution 

type MCPDistribution struct {
	// PluginID identifies the plugin carrying this MCP.
	PluginID string `json:"plugin_id"`

	// PluginName is the plugin's display name, so naming the plugin needs no
	// separate list_plugins call.
	PluginName string `json:"plugin_name"`

	// PluginSlug is the plugin's stable slug, the value to pass back to a tool
	// that takes a plugin by slug.
	PluginSlug string `json:"plugin_slug"`

	// State is the lifecycle state of a membership this flow created. It is
	// always present and empty for a membership created elsewhere, which has
	// no lifecycle record; empty means unknown, never "not attached".
	State string `json:"state"`

	// PublicationState reports whether that membership has been published. It
	// is always present and empty on the same terms as State, and empty never
	// means "unpublished".
	PublicationState string `json:"publication_state"`
}

type MCPFromFunctionsPreview 

type MCPFromFunctionsPreview struct {
	Name string `json:"name"`
	// ToolsetSlug is the exact slug of the tool list behind the new server.
	// It is unique in the project, so a name whose slug is taken is refused.
	ToolsetSlug string `json:"toolset_slug"`
	// MCPSlugPrefix is the exact start of the new server's slug. A short
	// suffix from the server's own identifier is added at creation, so it
	// cannot be shown here; the result reports the full slug.
	MCPSlugPrefix string `json:"mcp_slug_prefix"`
	// WouldJoinDefaultPlugin is true when the organization has no MCP server
	// enabled yet, so this one would be its first: it then joins the project's
	// Default plugin on creation and everyone holding that plugin receives it.
	// It is read now and can change before the confirmed call; the result's
	// added_to_default_plugin is what actually happened.
	WouldJoinDefaultPlugin bool `json:"would_join_default_plugin"`
}

MCPFromFunctionsPreview is what an unconfirmed create_mcp_from_functions call reports: the slugs the confirmed call will create for this exact name.

type MCPHeadlessCallerChoice 

type MCPHeadlessCallerChoice struct {
	// ProfileID is empty for a registered app that has no profile yet.
	ProfileID           string `json:"profile_id,omitempty"`
	Name                string `json:"name"`
	UserSessionClientID string `json:"user_session_client_id,omitempty"`
	WorkloadIssuerID    string `json:"workload_issuer_id,omitempty"`
	WorkloadSubject     string `json:"workload_subject,omitempty"`
	// Chosen reports that the caller has a choice for this server; without
	// one, its sessions take the server's only ready credential or must name
	// one.
	Chosen       bool   `json:"chosen"`
	AuthClientID string `json:"auth_client_id,omitempty"`
	NoAuth       bool   `json:"no_auth"`
}

type MCPMatchingPlugin 

type MCPMatchingPlugin struct {
	PluginID string `json:"plugin_id"`
	Name     string `json:"name"`
	Slug     string `json:"slug"`
}

type MCPNetworkRouteSummary 

type MCPNetworkRouteSummary struct {
	Requests   uint64 `json:"requests"`
	LastSeenAt string `json:"last_seen_at,omitempty"`
}

type MCPNetworkTrafficInput 

type MCPNetworkTrafficInput struct {
	ProjectID  string `json:"project_id" jsonschema:"exact project ID"`
	TargetKind string `json:"target_kind" jsonschema:"mcp or gateway"`
	TargetID   string `json:"target_id" jsonschema:"exact MCP server or gateway ID"`
	Window     string `json:"window,omitempty" jsonschema:"24h or 7d (default)"`
}

type MCPNetworkTrafficOutput 

type MCPNetworkTrafficOutput struct {
	ProjectID  string                 `json:"project_id"`
	TargetKind string                 `json:"target_kind"`
	TargetID   string                 `json:"target_id"`
	Window     string                 `json:"window"`
	From       string                 `json:"from"`
	To         string                 `json:"to"`
	Public     MCPNetworkRouteSummary `json:"public"`
	Private    MCPNetworkRouteSummary `json:"private"`
	Caveat     string                 `json:"caveat"`
}

type MCPNetworkTrafficReader 

type MCPNetworkTrafficReader interface {
	GetMCPNetworkTraffic(context.Context, telemetryrepo.GetMCPNetworkTrafficParams) ([]telemetryrepo.MCPNetworkTrafficRow, error)
}

type MCPOutcomeSummary 

type MCPOutcomeSummary struct {
	Total        int64 `json:"total"`
	Success      int64 `json:"success"`
	Unauthorized int64 `json:"unauthorized"`
	ClientError  int64 `json:"client_error"`
	ServerError  int64 `json:"server_error"`
	Failed       int64 `json:"failed"`
	Blocked      int64 `json:"blocked"`
	Unknown      int64 `json:"unknown"`
}

MCPOutcomeSummary is a server's calls in the window, already summed per outcome class. There is no per-bucket series: an external MCP client has no scratch compute to add one up with.

type MCPReadiness 

type MCPReadiness struct {
	State     string `json:"state"`
	CheckedAt string `json:"checked_at,omitempty"`
	ExpiresAt string `json:"expires_at,omitempty"`
}

type MCPRegistration 

type MCPRegistration struct {
	ID                 string `json:"id"`
	Status             string `json:"status"`
	ComponentsComplete bool   `json:"components_complete"`
}

type MCPReviewProjectResolver 

type MCPReviewProjectResolver interface {
	ResolveReviewProject(ctx context.Context, principal Principal, projectID string) (ResolvedProject, error)
}

type MCPReviewRequestService 

type MCPReviewRequestService interface {
	CreatePlatformRequest(ctx context.Context, organizationID string, projectID uuid.UUID, userID, targetKind, target, note string) (*gen.ApprovalRequestSummary, error)
	ReadPlatformRequesterReview(ctx context.Context, input mcpapproval.PlatformRequesterReviewInput) (mcpapproval.PlatformRequesterReview, error)
}

type MCPRoleAuthClientAccess 

type MCPRoleAuthClientAccess struct {
	AuthClientID string `json:"auth_client_id"`
	Name         string `json:"name"`
	ClientType   string `json:"client_type"`
	Access       string `json:"access" jsonschema:"allowed, blocked (a block outranks the grant), or not_granted"`
}

MCPRoleAuthClientAccess reports one role's permission to use one shared auth client. Personal clients are omitted: each member uses only their own connection, so a role-level answer would mislead.

type MCPRoleCoverage 

type MCPRoleCoverage struct {
	MatchingPlugins     []MCPMatchingPlugin        `` /* 150-byte string literal not displayed */
	Name                string                     `json:"name"`
	Type                string                     `json:"type"`
	MemberCount         SubjectCount               `json:"member_count"`
	Reference           string                     `json:"reference"`
	Version             string                     `json:"version"`
	CanEnterServer      bool                       `json:"can_enter_server"`
	KnownToolAccess     string                     `json:"known_tool_access"`
	AllowedKnownTools   []string                   `json:"allowed_known_tools"`
	DispositionRules    []string                   `json:"disposition_rules"`
	BlockedDispositions []string                   `json:"blocked_dispositions"`
	UnevaluatedGrants   bool                       `json:"unevaluated_grants"`
	AssignmentRules     []AccessRoleAssignmentRule `` /* 171-byte string literal not displayed */
	AssignmentEligible  bool                       `` /* 180-byte string literal not displayed */
}

type MCPRoleSharedAuthClients 

type MCPRoleSharedAuthClients struct {
	Name              string                    `json:"name"`
	Reference         string                    `json:"reference" jsonschema:"opaque role reference for set_mcp_role_auth_client_access"`
	AuthClients       []MCPRoleAuthClientAccess `json:"auth_clients" jsonschema:"whether this role may use each shared credential the server offers in this project"`
	UnevaluatedGrants bool                      `` /* 142-byte string literal not displayed */
}

MCPRoleSharedAuthClients reports one role's permission to use the shared credentials a server offers. It is separate from entering the server, so it is reported whatever the server's visibility.

type MCPSource 

type MCPSource struct {
	Kind      string `json:"kind"`
	Provider  string `json:"provider,omitempty"`
	Reference string `json:"reference,omitempty"`
}

type MCPToolEvents 

type MCPToolEvents struct {
	ToolName string            `json:"tool_name"`
	Outcomes MCPOutcomeSummary `json:"outcomes"`
}

MCPToolEvents is one tool's calls in the window, already summed per outcome.

type MCPToolExposure 

type MCPToolExposure struct {
	ToolsetID   string `json:"toolset_id"`
	ToolsetSlug string `json:"toolset_slug"`
	// ExposureVersion identifies the complete tool list, never one page of
	// it. add_tools_to_mcp and remove_tools_from_mcp take it back and refuse a
	// change computed against a list that has since moved on. It is present
	// only on the page that completes the read — a single-page list, or the
	// last page of a paged one — so a change cannot be confirmed against a
	// list the caller has seen only part of.
	ExposureVersion string `json:"exposure_version,omitempty"`
	// ToolCount is the size of the complete list, not of this page.
	ToolCount int `json:"tool_count"`
	// ToolURNs is this page of the list, in URN order.
	ToolURNs []string `json:"tool_urns"`
	// Truncated is true when more pages follow; NextToolCursor continues it.
	Truncated bool `json:"truncated"`
	// NextToolCursor is passed back to get_mcp as tool_cursor for the next
	// page. Every page of one read describes the same committed list: a page
	// requested after the list changed is refused rather than stitched onto
	// pages of the old one.
	NextToolCursor string `json:"next_tool_cursor,omitempty"`
	// SharedWithOther counts the other MCP servers offering this same tool
	// list. The list lives on the toolset behind the server, so those servers
	// are aliases for it and a change moves all of them. It is a count rather
	// than a list of servers: the number is what a caller needs in order to
	// warn, and naming servers would report them to a caller admitted only on
	// this one.
	SharedWithOther int `json:"shared_with_other_servers"`
}

MCPToolExposure is the tool list one hosted MCP server currently exposes. It is present on get_mcp and absent from find_mcp: a list result reports which servers exist, not what each one exposes, and an empty list there would read as "exposes nothing" rather than "not read".

type MCPToolExposureError 

type MCPToolExposureError struct {
	Code         string
	Message      string
	UnknownTools []string
	// Preview is set only on create_mcp_from_functions' confirmation_required
	// refusal, so the caller confirms the slugs the code will actually create.
	Preview *MCPFromFunctionsPreview
	Cause   error
}

MCPToolExposureError is safe to map into a tool refusal. UnknownTools names the exact tools that were refused, so a caller never has to guess which part of its batch was rejected and never sees a partially applied batch.

func (*MCPToolExposureError) Error 

func (e *MCPToolExposureError) Error() string

func (*MCPToolExposureError) Unwrap 

func (e *MCPToolExposureError) Unwrap() error

type MCPToolExposureMutationOutput 

type MCPToolExposureMutationOutput struct {
	// RemovedPluginIDs names plugins whose automatic membership this edit removed.
	RemovedPluginIDs []string `json:"removed_plugin_ids,omitempty"`
	Outcome          string   `json:"outcome"`
	Applied          []string `json:"applied"`
	Unchanged        []string `json:"unchanged"`
	// Exposure is a fresh read taken after the commit, so a caller reports the
	// committed list rather than the one it asked for. It is the first page of
	// that list; a longer list continues through get_mcp's tool_cursor.
	Exposure      *MCPToolExposure `json:"exposure,omitempty"`
	SnapshotScope string           `json:"snapshot_scope"`
	// Distributions names the plugins that carry this server. Changing the
	// tool list requests publication for those plugins; removed memberships are
	// reported separately in RemovedPluginIDs.
	Distributions      []MCPDistribution `json:"distributions"`
	PublicationRequest string            `json:"publication_request"`
	// PublishSignal reports the best-effort publish signal sent after the
	// commit, when the publication request was not already durably enqueued.
	//   not_requested         — no signal was needed
	//   best_effort_requested — the publish was signalled
	//   unavailable           — nothing could signal on this deployment, or a
	//                           replay could not check the retry allowance
	//   request_failed        — signalling was attempted and failed
	//   rate_limited          — a replay of a committed change found the
	//                           allowance spent, so it did not signal again
	PublishSignal string `json:"publish_signal"`
	// IndexSignal reports whether the tool-search index rebuild this change
	// needs was scheduled. It matters beyond bookkeeping: a dynamic-mode server
	// refuses tools/list outright while its current version has no index, so
	// anything other than "requested" or "not_required" means the server may
	// not be able to list its tools until the periodic sweep reaches it.
	//   requested      — rebuild scheduled
	//   not_required   — this version needs no index (it exposes no tools, or
	//                    nothing serves it from the index), and dynamic mode
	//                    serves it without one
	//   unavailable    — nothing could schedule a rebuild on this deployment,
	//                    or a replay could not check the retry allowance
	//   request_failed — scheduling was attempted and failed
	//   rate_limited   — a replay of a committed change found the allowance
	//                    spent, so the rebuild was not scheduled again
	IndexSignal string                  `json:"index_signal"`
	Receipt     RiskMutationToolReceipt `json:"receipt"`
}

MCPToolExposureMutationOutput lets a caller tell four outcomes apart: applied (Outcome "applied"), a no-op because every named tool was already in the requested state (Outcome "no_op"), a partial batch (Outcome "applied" with a non-empty Unchanged), and a refusal, which is returned as an error result and never as this struct.

type MCPToolExposureService 

type MCPToolExposureService struct {
	// contains filtered or unexported fields
}

MCPToolExposureService reads what a project can expose and what one server exposes, and applies incremental changes to the latter.

func NewMCPToolExposureService 

func NewMCPToolExposureService(logger *slog.Logger, db *pgxpool.Pool, auditLogger *audit.Logger, engine *authz.Engine, admin Authorizer, cursorKeyMaterial string, publication plugins.PublicationRequests, publisher plugins.PluginPublishSignaler, reads, changes OperationBudget) (*MCPToolExposureService, error)

func (*MCPToolExposureService) AddTools 

func (s *MCPToolExposureService) AddTools(ctx context.Context, principal Principal, input ChangeMCPToolsInput) (MCPToolExposureMutationOutput, error)

func (*MCPToolExposureService) CreateMCPFromFunctions 

func (s *MCPToolExposureService) CreateMCPFromFunctions(ctx context.Context, principal Principal, input CreateMCPFromFunctionsInput) (CreateMCPFromFunctionsOutput, error)

CreateMCPFromFunctions creates the toolset and the server record in front of it in one transaction, through the same two cores the dashboard's createToolset and createMcpServer calls run, then schedules the search index the new tool list needs. A retry with the same idempotency key returns the stored result and never creates a second server.

func (*MCPToolExposureService) Exposure 

func (s *MCPToolExposureService) Exposure(ctx context.Context, principal Principal, projectID, mcpID uuid.UUID) (MCPToolExposure, error)

Exposure reads the first page of one hosted MCP server's tool list. It returns ErrMCPToolExposureMissing when the server has no Speakeasy toolset behind it: a remote, tunneled, or unproxied server's tools come from its upstream.

func (*MCPToolExposureService) ExposurePage 

func (s *MCPToolExposureService) ExposurePage(ctx context.Context, principal Principal, projectID, mcpID uuid.UUID, cursor string) (MCPToolExposure, error)

ExposurePage reads one page of a server's tool list; an empty cursor is the first page. The version is always derived from the complete committed list and is returned only on the page that completes the read.

func (*MCPToolExposureService) ListProjectTools 

func (s *MCPToolExposureService) ListProjectTools(ctx context.Context, principal Principal, project ResolvedProject, input ListProjectToolsInput) (ListProjectToolsOutput, error)

ListProjectTools reports the tools a project's latest completed deployment generated. The caller must already hold project read.

func (*MCPToolExposureService) RemoveTools 

func (s *MCPToolExposureService) RemoveTools(ctx context.Context, principal Principal, input ChangeMCPToolsInput) (MCPToolExposureMutationOutput, error)

func (*MCPToolExposureService) WithIndexing 

func (s *MCPToolExposureService) WithIndexing(index ToolExposureIndexer) *MCPToolExposureService

WithIndexing supplies the post-commit search-index trigger. A deployment without it still serves every tool; its changes just wait for the sweep before a dynamic-mode server can list tools again, so composition logs the absence rather than the tools refusing.

type MCPTraceReference 

type MCPTraceReference struct {
	Reference  string `json:"reference"`
	OccurredAt string `json:"occurred_at"`
	ToolName   string `json:"tool_name,omitempty"`
	Outcome    string `json:"outcome"`
	Client     string `json:"client"`
}

MCPTraceReference is one occurrence, reduced to what an investigation needs: when it happened, which tool, how it ended, and an opaque handle to quote. It carries no arguments, results, bodies, headers, URLs, or identities.

type MCPUpstreamAuthClient 

type MCPUpstreamAuthClient struct {
	ID                    string `json:"id"`
	Name                  string `json:"name"`
	ClientType            string `json:"client_type" jsonschema:"remote_session, service_account, static_credential, pass_through or ema"`
	Enabled               bool   `json:"enabled"`
	Personal              bool   `json:"personal" jsonschema:"each caller uses their own connection; a grant never lets anyone use another user's connection"`
	OtherServerCount      int    `json:"other_server_count" jsonschema:"other servers offering the same client; changing or disabling it changes them too"`
	OfferedOnPublicServer bool   `json:"offered_on_public_server"`
}

MCPUpstreamAuthClient is one way the server authenticates to its upstream. Stored values are never returned.

type MCPUpstreamAuthentication 

type MCPUpstreamAuthentication struct {
	Status               string                  `` /* 202-byte string literal not displayed */
	RequiresUpstreamAuth bool                    `json:"requires_upstream_auth" jsonschema:"true when the server offers at least one enabled client"`
	Clients              []MCPUpstreamAuthClient `json:"clients"`
}

MCPUpstreamAuthentication says whether the server's upstream needs authentication and which clients it offers.

type MCPUsageUser 

type MCPUsageUser struct {
	SubjectReference string `json:"subject_reference"`
	MaskedIdentity   string `json:"masked_identity"`
	Activity         string `json:"activity"`
	Errors           string `json:"errors"`
	Blocked          string `json:"blocked"`
	LastUsedAt       string `json:"last_used_at"`
}

MCPUsageUser is one masked caller with categorical evidence. Exact individual call counts are deliberately absent; aggregate event counts live on the tool breakdown instead.

type ManagedDeviceSummary 

type ManagedDeviceSummary struct {
	Hostname       string `json:"hostname,omitempty"`
	SerialNumber   string `json:"serial_number,omitempty"`
	Provider       string `json:"provider"`
	OSName         string `json:"os_name,omitempty"`
	OSVersion      string `json:"os_version,omitempty"`
	UserEmail      string `json:"user_email,omitempty"`
	CoverageBucket string `json:"coverage_bucket"`
	// PolicyState is set only for agent_active devices.
	PolicyState string `json:"policy_state,omitempty"`
	// ReportAttestation is device when this machine's own agent sent the
	// report behind the fields below, or user when the assigned user's agent
	// did, possibly from another machine.
	ReportAttestation string                     `json:"report_attestation,omitempty"`
	AgentLastSeenAt   string                     `json:"agent_last_seen_at,omitempty"`
	MDMLastCheckInAt  string                     `json:"mdm_last_check_in_at,omitempty"`
	MissingSince      string                     `json:"missing_since,omitempty"`
	ReportedAt        string                     `json:"reported_at,omitempty"`
	AppliedAt         string                     `json:"applied_at,omitempty"`
	AgentVersion      string                     `json:"agent_version,omitempty"`
	EnforcementHalted bool                       `json:"enforcement_halted"`
	BlockedBuild      bool                       `json:"blocked_build"`
	AutoUpdate        string                     `json:"auto_update,omitempty"`
	Tools             []ManagedDeviceToolOutcome `json:"tools,omitempty"`
}

type ManagedDeviceToolOutcome 

type ManagedDeviceToolOutcome struct {
	Tool    string `json:"tool"`
	Outcome string `json:"outcome"`
}

type ManagementService 

type ManagementService struct {
	// contains filtered or unexported fields
}

ManagementService exposes the session-authenticated dashboard projection. It deliberately returns only bounded lifecycle state; setup handoffs, OAuth values, provider material, and internal resource identifiers stay private.

func NewManagementService 

func NewManagementService(logger *slog.Logger, tracerProvider trace.TracerProvider, db *pgxpool.Pool, sessionManager *sessions.Manager, authzEngine *authz.Engine, gate Gate, authorizer Authorizer, mcpURL string, registrations *RegistrationService, readiness *ReadinessService, distributions *DistributionService, versionTokenKey string, catalog Catalog) *ManagementService

func (*ManagementService) APIKeyAuth 

func (s *ManagementService) APIKeyAuth(ctx context.Context, key string, schema *security.APIKeyScheme) (context.Context, error)

func (*ManagementService) DismissOnboarding 

func (s *ManagementService) DismissOnboarding(ctx context.Context, _ *platformmcpgen.DismissOnboardingPayload) error

func (*ManagementService) DistributeOnboardingCandidate 

func (s *ManagementService) DistributeOnboardingCandidate(ctx context.Context, payload *platformmcpgen.DistributeOnboardingCandidatePayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) GetOnboarding 

func (s *ManagementService) GetOnboarding(ctx context.Context, _ *platformmcpgen.GetOnboardingPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecheckOnboardingReadiness 

func (s *ManagementService) RecheckOnboardingReadiness(ctx context.Context, _ *platformmcpgen.RecheckOnboardingReadinessPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecordAgentConfigurationCopied 

func (s *ManagementService) RecordAgentConfigurationCopied(ctx context.Context, _ *platformmcpgen.RecordAgentConfigurationCopiedPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RecordDashboardCtaEvent 

func (s *ManagementService) RecordDashboardCtaEvent(ctx context.Context, payload *platformmcpgen.RecordDashboardCtaEventPayload) error

func (*ManagementService) RecordInstallIntent 

func (s *ManagementService) RecordInstallIntent(ctx context.Context, payload *platformmcpgen.RecordInstallIntentPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RemoveOnboardingDistribution 

func (s *ManagementService) RemoveOnboardingDistribution(ctx context.Context, payload *platformmcpgen.RemoveOnboardingDistributionPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) RepairOnboardingPublication 

func (s *ManagementService) RepairOnboardingPublication(ctx context.Context, payload *platformmcpgen.RepairOnboardingPublicationPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) StartOnboarding 

func (s *ManagementService) StartOnboarding(ctx context.Context, payload *platformmcpgen.StartOnboardingPayload) (*platformmcpgen.PlatformMCPOnboardingState, error)

func (*ManagementService) StartOnboardingSetup 

func (s *ManagementService) StartOnboardingSetup(ctx context.Context, _ *platformmcpgen.StartOnboardingSetupPayload) (*platformmcpgen.PlatformMCPOnboardingSetupHandoff, error)

type ManualSyncEvidence 

type ManualSyncEvidence interface {
	AwaitingManualSync(ctx context.Context, principal Principal, projectID uuid.UUID, pluginSlug string) (awaiting, known bool)
}

ManualSyncEvidence reads whether one plugin's change waits for a manual sync from its publication evidence, the answer get_plugin reports. known is false when that evidence can't be read.

type MarkRiskFindingsFalsePositiveReceiptResult 

type MarkRiskFindingsFalsePositiveReceiptResult struct {
	RiskFindingFalsePositiveReceipt
}

type MarkRiskFindingsFalsePositiveToolOutput 

type MarkRiskFindingsFalsePositiveToolOutput struct {
	MarkRiskFindingsFalsePositiveReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type MemberMCPAccessRow 

type MemberMCPAccessRow struct {
	// Rules explains live grant and block sources without member identifiers.
	Rules []access.MCPAccessRuleSummary `json:"rules"`

	ProjectID         string `json:"project_id"`
	ProjectName       string `json:"project_name"`
	MCPID             string `json:"mcp_id"`
	MCPName           string `json:"mcp_name"`
	Backend           string `json:"backend"`
	Visibility        string `json:"visibility"`
	AuthorizationMode string `json:"authorization_mode"`
	ConnectionAccess  string `` /* 127-byte string literal not displayed */
	CanConnect        bool   `json:"can_connect"`
	ToolAccess        string `json:"tool_access" jsonschema:"effective tool coverage: all, some, or none"`
	CanView           bool   `json:"can_view"`
	CanManage         bool   `json:"can_manage"`
}

type MemberMCPConnectionReader 

type MemberMCPConnectionReader interface {
	ListClients(ctx context.Context, projectID uuid.UUID, organizationID string, userSessionIssuerID uuid.UUID) ([]remotesessions.Client, error)
	RemoteSessionStatuses(ctx context.Context, subject urn.SessionSubject, projectID uuid.UUID, organizationID string, userSessionIssuerID uuid.UUID) (map[uuid.UUID]remotesessions.RemoteSessionState, error)
	ListAuthClientRegistrations(ctx context.Context, projectID uuid.UUID, organizationID string, ids []uuid.UUID) ([]remotesessions.Client, error)
	AuthClientRemoteSessionStatuses(ctx context.Context, subject urn.SessionSubject, projectID uuid.UUID, organizationID string, clientIDs []uuid.UUID) (map[uuid.UUID]remotesessions.RemoteSessionState, error)
}

type MemoryDocsIndex 

type MemoryDocsIndex struct {
	// contains filtered or unexported fields
}

MemoryDocsIndex searches the pinned corpus in process. It holds no network client and no vendor dependency, which is what lets the public tool stay provider-neutral while the corpus is small enough that nothing more is warranted.

func NewMemoryDocsIndex 

func NewMemoryDocsIndex(resources []SetupResource, now func() time.Time) *MemoryDocsIndex

NewMemoryDocsIndex indexes the reviewed corpus by markdown heading. now is injected so freshness is evaluated against a test's clock rather than the wall clock at process start.

func (*MemoryDocsIndex) Search 

func (i *MemoryDocsIndex) Search(ctx context.Context, query string, limit int) ([]DocsExcerpt, error)

Search returns the best-scoring excerpts. Content past its grace window is omitted entirely rather than ranked low: an unreviewed step that loses on score today wins on score tomorrow.

type MyServer 

type MyServer struct {
	Slug   string `` /* 143-byte string literal not displayed */
	Name   string `json:"name,omitempty"`
	Status string `json:"status,omitempty" jsonschema:"available, unavailable, or unknown until a call is made"`
}

MyServer is one MCP server the caller can reach through their organization gateway.

type NetworkIngressStatusService 

type NetworkIngressStatusService struct {
	// contains filtered or unexported fields
}

func (*NetworkIngressStatusService) Get 

func (s *NetworkIngressStatusService) Get(ctx context.Context, principal Principal) (GetNetworkIngressOutput, error)

type NetworkIngressSummary 

type NetworkIngressSummary struct {
	Provider              string `json:"provider"`
	Hostname              string `json:"hostname"`
	NamespaceKind         string `json:"namespace_kind"`
	CustomDomainID        string `json:"custom_domain_id,omitempty"`
	Enabled               bool   `json:"enabled"`
	IdentityRequired      bool   `json:"identity_required"`
	CredentialsConfigured bool   `json:"credentials_configured"`
	Status                string `json:"status"`
	DNSName               string `json:"dns_name,omitempty"`
	LastError             string `json:"last_error,omitempty"`
	HealthCheckedAt       string `json:"health_checked_at,omitempty"`
	ConnectedSince        string `json:"connected_since,omitempty"`
}

type OAuthEvent 

type OAuthEvent struct {
	Operation string
	Outcome   string
	Reason    string
}

type OAuthHTTP 

type OAuthHTTP struct {
	// contains filtered or unexported fields
}

OAuthHTTP serves the Platform MCP-owned authorization server. It deliberately does not import hosted MCP runtime or persistence packages.

The resource, issuer, and access token audience follow the platform origin a request arrives on (the server URL or an extra platform host), so each platform host is its own RFC 8707 resource with its own authorization server metadata. Requests from any other surface use baseURL.

func NewOAuthHTTP 

func NewOAuthHTTP(config OAuthHTTPConfig) (*OAuthHTTP, error)

func (*OAuthHTTP) Attach 

func (s *OAuthHTTP) Attach(mux interface {
	Handle(string, string, http.HandlerFunc)
})

func (*OAuthHTTP) AuthorizationServerHandler 

func (s *OAuthHTTP) AuthorizationServerHandler() http.Handler

func (*OAuthHTTP) AuthorizeHandler 

func (s *OAuthHTTP) AuthorizeHandler() http.Handler

func (*OAuthHTTP) ConnectHandler 

func (s *OAuthHTTP) ConnectHandler() http.Handler

func (*OAuthHTTP) CreateWorkspaceHandler 

func (s *OAuthHTTP) CreateWorkspaceHandler() http.Handler

CreateWorkspaceHandler creates the first organization for a signed-in user who has none, then continues to the consent page for it. A user with a pending invitation is shown the invitation instead.

func (*OAuthHTTP) IDPCallbackHandler 

func (s *OAuthHTTP) IDPCallbackHandler() http.Handler

func (*OAuthHTTP) JoinWorkspaceHandler 

func (s *OAuthHTTP) JoinWorkspaceHandler() http.Handler

JoinWorkspaceHandler accepts a pending invitation for a signed-in user who has no organization, then continues to the consent page for the organization they joined.

func (*OAuthHTTP) OrganizationSelectionHandler 

func (s *OAuthHTTP) OrganizationSelectionHandler() http.Handler

func (*OAuthHTTP) ProtectedResourceHandler 

func (s *OAuthHTTP) ProtectedResourceHandler() http.Handler

func (*OAuthHTTP) ProtectedResourceURL 

func (s *OAuthHTTP) ProtectedResourceURL() string

ProtectedResourceURL is the RFC 9728 metadata URL on the configured base URL, used when a request carries no platform origin.

func (*OAuthHTTP) ProviderSetupCompleteHandler 

func (s *OAuthHTTP) ProviderSetupCompleteHandler() http.Handler

ProviderSetupCompleteHandler is the fixed server-owned landing page after a reviewed remote-session provider callback persists its tokens. It carries no provider identity, tokens, state, or handoff values.

func (*OAuthHTTP) ProviderSetupCompletionURL 

func (s *OAuthHTTP) ProviderSetupCompletionURL() string

ProviderSetupCompletionURL is the only callback landing page accepted for Platform MCP provider authorization. It is server-owned and carries no state.

func (*OAuthHTTP) RegisterHandler 

func (s *OAuthHTTP) RegisterHandler() http.Handler

func (*OAuthHTTP) RevokeHandler 

func (s *OAuthHTTP) RevokeHandler() http.Handler

func (*OAuthHTTP) TokenHandler 

func (s *OAuthHTTP) TokenHandler() http.Handler

type OAuthHTTPConfig 

type OAuthHTTPConfig struct {
	BaseURL       *url.URL
	Environment   string
	Cache         cache.Cache
	Store         platformoauth.Store
	Identity      BrowserIdentity
	Gate          Gate
	Authorizer    Authorizer
	Organizations OrganizationSelector
	Workspaces    WorkspaceProvisioner
	Signer        *sessiontokens.Signer
	Encryption    *encryption.Client
	Telemetry     OAuthTelemetry
	Logger        *slog.Logger
	// GuardianPolicy backs the CIMD document fetcher's SSRF protection.
	// Nil leaves inbound CIMD disabled.
	GuardianPolicy *guardian.Policy
	MeterProvider  metric.MeterProvider
	// IDPCallbackBaseURL is the pinned origin of the identity provider
	// callback. Nil uses BaseURL.
	IDPCallbackBaseURL *url.URL
}

type OAuthTelemetry 

type OAuthTelemetry interface {
	Record(context.Context, OAuthEvent)
	RecordRefreshSuccess(context.Context, time.Duration, time.Duration)
	RecordTerminalTransition(context.Context, platformoauth.ReauthorizationReason)
}

func NewOAuthTelemetry 

func NewOAuthTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) OAuthTelemetry

type OfferMCPUpstreamCredentialInput 

type OfferMCPUpstreamCredentialInput struct {
	ProjectID    string `json:"project_id" jsonschema:"explicit project ID that owns the configured MCP that should offer the credential"`
	MCPID        string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp"`
	AuthClientID string `` /* 126-byte string literal not displayed */
	Confirmed    bool   `` /* 201-byte string literal not displayed */
}

type OfferMCPUpstreamCredentialOutput 

type OfferMCPUpstreamCredentialOutput struct {
	UpstreamAuthentication *MCPUpstreamAuthentication `json:"upstream_authentication" jsonschema:"the server's upstream authentication after the change"`
}

type OktaChecklistStep 

type OktaChecklistStep struct {
	Key       string `json:"key"`
	Title     string `json:"title"`
	Completed *bool  `json:"completed,omitempty" jsonschema:"false when observed not done; omitted when Speakeasy cannot observe the step"`
}

type OktaSignInIssuer 

type OktaSignInIssuer struct {
	ID   string `json:"id"`
	Slug string `json:"slug"`
}

type OktaSignInStatus 

type OktaSignInStatus struct {
	NextStep             string             `` /* 267-byte string literal not displayed */
	NextStepGuidance     string             `json:"next_step_guidance"`
	AgentRecorded        bool               `json:"agent_recorded" jsonschema:"whether the Okta AI agent ID is recorded on the connection"`
	ClientRegistered     bool               `` /* 127-byte string literal not displayed */
	DuplicateClients     int                `` /* 180-byte string literal not displayed */
	ClientReady          bool               `json:"sign_in_client_ready" jsonschema:"whether that client uses a signing key with the scopes sign-in needs"`
	RedirectURI          *string            `json:"redirect_uri,omitempty" jsonschema:"sign-in redirect URI to add to the linked app in Okta"`
	KeyURL               *string            `` /* 171-byte string literal not displayed */
	KeyID                *string            `json:"key_id,omitempty" jsonschema:"kid of the active signing key"`
	PublicJWK            map[string]any     `` /* 212-byte string literal not displayed */
	TrustingIssuers      []OktaSignInIssuer `json:"trusting_issuers" jsonschema:"organization sign-in issuers that trust the agent's sign-in client"`
	StaleTrustingIssuers []OktaSignInIssuer `` /* 149-byte string literal not displayed */
	ChecklistNextStep    *OktaChecklistStep `` /* 179-byte string literal not displayed */
}

type OnboardingClientFamily 

type OnboardingClientFamily string
const (
	OnboardingClientClaudeCode   OnboardingClientFamily = "claude_code"
	OnboardingClientClaudeCowork OnboardingClientFamily = "claude_cowork"
	OnboardingClientCodex        OnboardingClientFamily = "codex"
	OnboardingClientCursor       OnboardingClientFamily = "cursor"
	OnboardingClientOpencode     OnboardingClientFamily = "opencode"
	// Any agent outside the certified set. It has no plugin package, so its
	// walkthrough offers the remote MCP configuration only.
	OnboardingClientOther OnboardingClientFamily = "other"
)

type OnboardingConnection 

type OnboardingConnection struct {
	ID             uuid.UUID
	Generation     uuid.UUID
	AuthorizedAt   *time.Time
	ReauthorizedAt *time.Time
	Ready          bool
}

type OnboardingProjection 

type OnboardingProjection struct {
	Workflow                  *OnboardingWorkflow
	Connections               []OnboardingConnection
	EvidenceConnection        *OnboardingConnection
	ConnectionAuthState       string
	ReauthorizationReason     string
	SelectedProject           *ResolvedProject
	CatalogExplored           bool
	RegistrationSucceeded     bool
	DistributionToolSucceeded bool
	ReadinessVerified         bool
	OrganizationSetupComplete bool
	Stage                     OnboardingStage
}

type OnboardingService 

type OnboardingService struct {
	// contains filtered or unexported fields
}

OnboardingService owns the user- and organization-bound workflow projection consumed by the session-authenticated dashboard. It never stores prompts, provider material, OAuth values, or setup handoffs.

func NewOnboardingService 

func NewOnboardingService(db *pgxpool.Pool) *OnboardingService

func (*OnboardingService) BindRegistration 

func (s *OnboardingService) BindRegistration(ctx context.Context, organizationID, userID string, projectID, registrationID uuid.UUID) (OnboardingProjection, error)

func (*OnboardingService) BindRegistrationForPrincipal 

func (s *OnboardingService) BindRegistrationForPrincipal(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) (OnboardingProjection, error)

BindRegistrationForPrincipal associates an MCP-created registration with the caller's active workflow only when the project and registration were resolved by the same organization-bound principal.

func (*OnboardingService) Dismiss 

func (s *OnboardingService) Dismiss(ctx context.Context, organizationID, userID string) error

func (*OnboardingService) Get 

func (s *OnboardingService) Get(ctx context.Context, organizationID, userID string) (OnboardingProjection, error)

func (*OnboardingService) RecordAgentConfigurationCopied 

func (s *OnboardingService) RecordAgentConfigurationCopied(ctx context.Context, organizationID, userID string) (OnboardingProjection, error)

func (*OnboardingService) RecordCatalogExplored 

func (s *OnboardingService) RecordCatalogExplored(ctx context.Context, principal Principal) error

BindRegistration stores the server-owned selected target on the caller's active workflow. The registration ID remains internal and is never projected to dashboard callers.

func (*OnboardingService) RecordDistributionSucceeded 

func (s *OnboardingService) RecordDistributionSucceeded(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) RecordInstallIntent 

func (s *OnboardingService) RecordInstallIntent(ctx context.Context, organizationID, userID string, client OnboardingClientFamily) (OnboardingProjection, error)

func (*OnboardingService) RecordReadinessVerified 

func (s *OnboardingService) RecordReadinessVerified(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) RecordRegistrationSucceeded 

func (s *OnboardingService) RecordRegistrationSucceeded(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) error

func (*OnboardingService) Start 

func (s *OnboardingService) Start(ctx context.Context, organizationID, userID string, source ...OnboardingSourceSurface) (OnboardingProjection, error)

type OnboardingSourceSurface 

type OnboardingSourceSurface string
const (
	OnboardingSourcePlatformMCPSettings OnboardingSourceSurface = "platform_mcp_settings"
	OnboardingSourceOrganizationSetup   OnboardingSourceSurface = "organization_setup"
	OnboardingSourcePlatformPlugins     OnboardingSourceSurface = "platform_plugins"
	OnboardingSourceSidebarFooter       OnboardingSourceSurface = "sidebar_footer"
	OnboardingSourceSourcesEmpty        OnboardingSourceSurface = "sources_empty"
	OnboardingSourceProjectOverview     OnboardingSourceSurface = "project_overview_zero_data"
	OnboardingSourceOrganizationHome    OnboardingSourceSurface = "organization_home"
)

type OnboardingStage 

type OnboardingStage string
const (
	OnboardingStageNotStarted          OnboardingStage = "not_started"
	OnboardingStageInstallInstructions OnboardingStage = "install_instructions"
	OnboardingStageAuthorized          OnboardingStage = "authorized"
	OnboardingStageConnectionReady     OnboardingStage = "connection_ready"
)

type OnboardingWorkflow 

type OnboardingWorkflow struct {
	ID                         uuid.UUID
	SourceSurface              string
	ClientFamily               OnboardingClientFamily
	AgentConfigurationCopiedAt *time.Time
	Status                     string
	ExpiresAt                  time.Time
	SelectedProjectID          uuid.UUID
	SelectedRegistrationID     uuid.UUID
}

type OperationBudget 

type OperationBudget struct {
	Connection   Limiter
	Organization Limiter
}

OperationBudget applies independently configured connection and organization buckets. Connection is always charged first; a denial prevents the second bucket, mutations, and provider egress.

func (OperationBudget) Allow 

func (b OperationBudget) Allow(ctx context.Context, principal Principal) error

func (OperationBudget) AllowConnectionOrOrganization 

func (b OperationBudget) AllowConnectionOrOrganization(ctx context.Context, principal Principal) error

AllowConnectionOrOrganization charges OAuth calls to both their connection and organization buckets. A connection-less assistant has no connection to charge, so it consumes only the organization allowance.

type OperationBudgets 

type OperationBudgets struct {
	// RiskFindings meters row-level Watchdog reads independently.
	RiskFindings   OperationBudget
	Catalog        OperationBudget
	Registration   OperationBudget
	ReviewRequests OperationBudget
	Handoff        OperationBudget
	SetupStart     OperationBudget
	Repair         OperationBudget
	Docs           OperationBudget
	// Skills meters authoring and distribution together. Reads and writes share
	// one allowance because they are one workflow: a caller reads a skill to
	// obtain the version token its next write needs, and metering the read
	// separately would only let a loop spend twice as much reaching the same
	// write.
	Skills            OperationBudget
	LifecycleMetadata OperationBudget
	// Plugins meters the plugin inventory reads. They are bounded PostgreSQL
	// reads of a project's own plugins, metered separately from diagnostics so
	// an administrator walking the inventory does not spend the allowance the
	// failure diagnosis it leads to will need.
	Plugins OperationBudget
	// AccessReads meters role/member access inspection separately. Member search
	// returns masked personal data and must not be fundable by another read lane.
	AccessReads OperationBudget
	// AccessRoleMutations independently meters custom MCP access-role writes.
	AccessRoleMutations OperationBudget
	// Diagnostics meters the observability reads. They are bounded aggregate
	// queries over Speakeasy-owned telemetry, so the cost being metered is the
	// ClickHouse scan, not an external egress.
	Diagnostics OperationBudget
	// SensitiveDiagnostics meters the bounded drill-downs. It is separate from
	// Diagnostics so exhausting it is not possible by spending the summary
	// allowance, and so it can be tightened on its own.
	SensitiveDiagnostics OperationBudget
	// SensitiveSessionRecall meters continue_session, search_chats and read_chat
	// together on a low allowance for transcript content.
	SensitiveSessionRecall OperationBudget
	// RiskMutations is shared by policy and exclusion writes. Connection-less
	// assistant calls consume only its organization bucket.
	RiskMutations OperationBudget

	// DrilldownVolume meters what the drill-downs return rather than how often
	// they are called: rows and spans against one bucket, metric queries
	// against another, both per connection over DrilldownVolumeWindow.
	DrilldownVolume DrilldownVolumeBudget
}

OperationBudgets groups the independently metered public Platform MCP operations. Every value is injected at composition; no production defaults are assigned here.

func (OperationBudgets) Valid 

func (b OperationBudgets) Valid() bool

type OperationReceipt 

type OperationReceipt struct {
	ID             uuid.UUID
	RegistrationID uuid.NullUUID
	Status         string
	ResultCode     string
	ResultPayload  []byte
	InputHash      string
	ExpiresAt      time.Time
	Replayed       bool
	// AlreadyRegistered is set when this request found the MCP server already
	// fully added to the project, so nothing new was created.
	AlreadyRegistered bool
	// Invalid when the receipt was written by a surface with no OAuth
	// connection. Unwrapping these to a bare uuid.Nil would be read downstream
	// as "connection missing" rather than "no connection applies".
	ConnectionID         uuid.NullUUID
	ConnectionGeneration uuid.NullUUID
}

type OrganizationEvent 

type OrganizationEvent struct {
	OccurredAt  string `json:"occurred_at"`
	Kind        string `json:"kind"`
	Source      string `json:"source"`
	Name        string `json:"name"`
	BodyPreview string `json:"body_preview,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
}

type OrganizationGate 

type OrganizationGate struct {
	// contains filtered or unexported fields
}

OrganizationGate enforces the durable organization-admin entitlement. Any unavailable dependency fails closed.

func NewOrganizationGate 

func NewOrganizationGate(capabilities CapabilityChecker) *OrganizationGate

func (*OrganizationGate) Enabled 

func (g *OrganizationGate) Enabled(ctx context.Context, organizationID string) (bool, error)

type OrganizationGatewayActivityReader 

type OrganizationGatewayActivityReader interface {
	GetOverviewSummary(ctx context.Context, arg telemetryrepo.GetOverviewSummaryParams) (*telemetryrepo.OverviewSummary, error)
	GetMetaMCPServerUsage(ctx context.Context, arg telemetryrepo.GetMetaMCPServerUsageParams) (telemetryrepo.MetaMCPUsage, error)
	GetTelemetryWatermark(ctx context.Context, arg telemetryrepo.GetTelemetryWatermarkParams) (int64, error)
}

OrganizationGatewayActivityReader is the ClickHouse read model the activity read needs: the overview summary and the gateway's discovery funnel and per-server breakdown, scoped to a set of projects.

type OrganizationGatewayActivityService 

type OrganizationGatewayActivityService struct {
	// contains filtered or unexported fields
}

OrganizationGatewayActivityService reports calls dispatched through the organization gateway across every project in the organization, as the dashboard's Organization Gateway Activity tab does.

func NewOrganizationGatewayActivityService 

func NewOrganizationGatewayActivityService(db *pgxpool.Pool, telemetry OrganizationGatewayActivityReader, authorizer deviceCoverageAuthorizer, budget OperationBudget) *OrganizationGatewayActivityService

func (*OrganizationGatewayActivityService) Get 

func (s *OrganizationGatewayActivityService) Get(ctx context.Context, principal Principal, input GetOrganizationGatewayActivityInput) (GetOrganizationGatewayActivityOutput, error)

type OrganizationGatewayDiscovery 

type OrganizationGatewayDiscovery struct {
	ListServers    int64 `json:"list_servers"`
	DescribeServer int64 `json:"describe_server"`
	DescribeTools  int64 `json:"describe_tools"`
}

OrganizationGatewayDiscovery counts the discovery steps agents took before dispatching a call.

type OrganizationGatewayServer 

type OrganizationGatewayServer struct {
	Name       string `json:"name"`
	MCPID      string `json:"mcp_id"`
	ProjectID  string `json:"project_id"`
	ToolCalls  int64  `json:"tool_calls"`
	ErrorCount int64  `json:"error_count"`
}

OrganizationGatewayServer is one MCP server's share of the dispatched calls.

type OrganizationGatewayService 

type OrganizationGatewayService struct {
	// contains filtered or unexported fields
}

OrganizationGatewayService answers get_my_organization_gateway.

func NewOrganizationGatewayService 

func NewOrganizationGatewayService(db *pgxpool.Pool, serverURL *url.URL) *OrganizationGatewayService

NewOrganizationGatewayService returns a service that builds gateway URLs under serverURL.

func (*OrganizationGatewayService) Get 

func (s *OrganizationGatewayService) Get(ctx context.Context, principal Principal) (GetMyOrganizationGatewayOutput, error)

Get returns the principal's organization gateway.

func (*OrganizationGatewayService) GetProject 

func (s *OrganizationGatewayService) GetProject(ctx context.Context, principal Principal, input GetMyProjectGatewayInput) (GetMyOrganizationGatewayOutput, error)

GetProject returns the same organization-authorized connection limited to one live project. Missing, deleted, and foreign projects have the same refusal.

func (*OrganizationGatewayService) WithOrganizationHosts 

func (s *OrganizationGatewayService) WithOrganizationHosts(resolver *orghost.Resolver) *OrganizationGatewayService

WithOrganizationHosts makes gateway URLs use the platform host stored as the organization's default host, the host the dashboard serves it on.

type OrganizationOption 

type OrganizationOption struct {
	ID   string
	Name string
}

type OrganizationSelector 

type OrganizationSelector interface {
	EligibleOrganizations(ctx context.Context, userID string) ([]OrganizationOption, error)
}

type OrganizationSlugResolver 

type OrganizationSlugResolver interface {
	OrganizationSlug(ctx context.Context, organizationID string) (string, error)
}

OrganizationSlugResolver is the narrow organization lookup needed to target the exact-project risk mutation kill switch. It remains separate from the product-feature-only Platform MCP organization gate.

type PlatformContext 

type PlatformContext struct {
	OrganizationID string `json:"organization_id"`
	ConnectionID   string `json:"connection_id"`
	ReadOnly       bool   `json:"read_only"`
	// Overview orients a caller that has only ever seen this server's tool
	// names. The manifest can say what one tool does; only something read at
	// the start of a conversation can say how the pieces relate, which is what
	// keeps a reply from narrating the machinery instead of the outcome.
	Overview             string   `json:"overview"`
	AvailableWorkflows   []string `json:"available_workflows"`
	RequestableWorkflows []string `json:"requestable_workflows"`
}

type Plugin 

type Plugin struct {
	// ID is the plugin id, and is what a distribution target should name to be
	// unambiguous.
	ID string `json:"id"`

	// Name is the administrator-facing plugin name.
	Name string `json:"name"`

	// Slug is the plugin's project-unique slug.
	Slug string `json:"slug"`

	// Description is the plugin's description, absent when it has none.
	Description string `json:"description,omitempty"`

	// IsDefault marks the project's fallback plugin.
	IsDefault bool `json:"is_default"`

	// AutoCreated reports whether this plugin was provisioned automatically.
	AutoCreated bool `json:"auto_created"`

	// ServerCount is how many MCP servers the plugin carries.
	ServerCount int64 `json:"server_count"`

	// SkillCount is how many skills the plugin carries.
	SkillCount int64 `json:"skill_count"`

	// Assignments summarizes who receives the plugin for administrative reads.
	// Member reads omit it entirely rather than returning zero-valued counts that
	// could be mistaken for a complete recipient summary.
	Assignments *PluginAssignmentSummary `json:"assignments,omitempty"`

	// Publication indicates that a package exists, not whether its addresses are current.
	Publication string `json:"publication"`

	// AutoSyncEnabled reports whether the plugin's changes publish to the
	// marketplace on their own. When false they wait until someone syncs by
	// hand, and a plugin never published stays out of the marketplace until
	// then. Member reads omit it.
	AutoSyncEnabled *bool `json:"auto_sync_enabled,omitempty"`

	DistributionAdmission *DistributionAdmission `json:"distribution_admission,omitempty"`
}

Plugin is the inventory projection of one plugin: what it is, how much it carries, who receives it, and whether it has been published.

type PluginAssignmentMutationError 

type PluginAssignmentMutationError struct {
	Code    string
	Message string
	Cause   error
}

func (*PluginAssignmentMutationError) Error 

func (e *PluginAssignmentMutationError) Error() string

func (*PluginAssignmentMutationError) Unwrap 

func (e *PluginAssignmentMutationError) Unwrap() error

type PluginAssignmentMutationPlugin 

type PluginAssignmentMutationPlugin struct {
	ID          string                  `json:"id"`
	Name        string                  `json:"name"`
	Slug        string                  `json:"slug"`
	IsDefault   bool                    `json:"is_default"`
	Assignments PluginAssignmentSummary `json:"assignments"`
	Publication string                  `json:"publication"`
}

type PluginAssignmentMutationReceiptStore 

type PluginAssignmentMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewPluginAssignmentMutationReceiptStore 

func NewPluginAssignmentMutationReceiptStore(db *pgxpool.Pool) *PluginAssignmentMutationReceiptStore

func (*PluginAssignmentMutationReceiptStore) Execute 

func (s *PluginAssignmentMutationReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, idempotencyKey string, normalized normalizedSetPluginAssignments, charge func(context.Context) error, mutate PluginAssignmentMutationTransaction) (OperationReceipt, error)

type PluginAssignmentMutationTransaction 

type PluginAssignmentMutationTransaction func(context.Context, pgx.Tx) (SetPluginAssignmentsReceiptResult, error)

type PluginAssignmentOption 

type PluginAssignmentOption struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`
	Reference   string        `json:"reference"`

	// InstallMode is how the device agent installs the plugin for this
	// audience: required, default or available. Set only on a plugin's current
	// assignments in get_plugin.
	InstallMode string `json:"install_mode,omitempty"`
}

PluginAssignmentOption is one current organization assignment target that can receive a plugin. Reference is encrypted and short-lived; the underlying principal URN never leaves the server. MemberCount is omitted for Everyone.

type PluginAssignmentSummary 

type PluginAssignmentSummary struct {
	// AllMembers is true when the plugin is assigned to every organization
	// member through the wildcard principal.
	AllMembers bool `json:"all_members"`

	// Roles is how many role principals the plugin is assigned to.
	Roles int64 `json:"roles"`

	// Users is how many individual principals the plugin is assigned to.
	Users int64 `json:"users"`
}

PluginAssignmentSummary is who receives a plugin, projected as counts rather than principals. A plugin assignment holds a principal URN that embeds a user id, which this surface must not carry.

type PluginAssignmentSummaryResult 

type PluginAssignmentSummaryResult struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`

	// InstallMode is the audience's stored install mode after the write.
	InstallMode string `json:"install_mode,omitempty"`
}

type PluginLastPublish 

type PluginLastPublish struct {
	// LastRecordedPublishAt is the last publish Speakeasy successfully recorded,
	// as RFC 3339. It is written only after a push succeeds and its keys and
	// fingerprints are saved, so failed attempts and publishes that find
	// nothing to change never move it, and a push whose recording failed is
	// not reflected: it can lag the marketplace. Omitted when no publish has
	// been recorded.
	LastRecordedPublishAt string `json:"last_recorded_publish_at,omitempty"`

	// Unavailable is true when the latest attempt could not be read. The
	// attempt fields below are then omitted; LastRecordedPublishAt is still
	// reported.
	Unavailable bool `json:"unavailable"`

	// State is none, queued, running, retrying, succeeded, or failed. Omitted
	// when Unavailable is true.
	State publishstatus.State `json:"state,omitempty"`

	// RequestedAt is when the latest publish was requested, as RFC 3339.
	RequestedAt string `json:"requested_at,omitempty"`

	// FinishedAt is when the latest publish closed, as RFC 3339. Set only for
	// succeeded and failed.
	FinishedAt string `json:"finished_at,omitempty"`

	// Attempt is the attempt number of an in-flight publish, starting at 1.
	Attempt int32 `json:"attempt,omitempty"`

	// FailureCategory is repository_conflict, timed_out, canceled, or
	// publish_failed. Set for failed, and for retrying to describe the
	// previous attempt.
	FailureCategory publishstatus.FailureCategory `json:"failure_category,omitempty"`

	// FailureMessage is a fixed, non-secret explanation of FailureCategory and
	// the next step: republishing (republish_plugin on an external connection,
	// or the AICP dashboard), or Speakeasy support when republishing cannot
	// help or keeps failing.
	FailureMessage string `json:"failure_message,omitempty"`
}

PluginLastPublish describes the latest change-driven publish of the project's marketplace. Publishing is per project, so every plugin in the project reports the same attempt. It never carries raw failure text, repository details, or credentials.

type PluginMetadataMutationError 

type PluginMetadataMutationError struct {
	Code    string
	Message string

	// Slug is the exact slug an unconfirmed create would give the plugin,
	// computed by the same resolver the create uses. It is set only on the
	// confirmation_required refusal, so an agent shows the user the real
	// install name instead of deriving one itself.
	Slug  string
	Cause error
}

PluginMetadataMutationError is safe to map into a tool refusal.

func (*PluginMetadataMutationError) Error 

func (e *PluginMetadataMutationError) Error() string

func (*PluginMetadataMutationError) Unwrap 

func (e *PluginMetadataMutationError) Unwrap() error

type PluginMetadataMutationOutput 

type PluginMetadataMutationOutput struct {
	PluginMetadataReceiptResult

	// PublishSignal reports whether the best-effort republish was requested
	// after commit. It is "not_requested" on a replay and when the durable
	// publication request already covers the change.
	PublishSignal string                  `json:"publish_signal"`
	Receipt       RiskMutationToolReceipt `json:"receipt"`
}

type PluginMetadataMutationPlugin 

type PluginMetadataMutationPlugin struct {
	ID          string                  `json:"id"`
	Name        string                  `json:"name"`
	Slug        string                  `json:"slug"`
	Description string                  `json:"description,omitempty"`
	IsDefault   bool                    `json:"is_default"`
	ServerCount int64                   `json:"server_count"`
	SkillCount  int64                   `json:"skill_count"`
	Assignments PluginAssignmentSummary `json:"assignments"`
	Publication string                  `json:"publication"`

	// AutoSyncEnabled is absent from results stored before the setting was
	// reported.
	AutoSyncEnabled *bool `json:"auto_sync_enabled,omitempty"`
}

PluginMetadataMutationPlugin is the committed plugin a create, rename, or auto sync change produced, read inside the same transaction that wrote it.

type PluginMetadataReceiptResult 

type PluginMetadataReceiptResult struct {
	ProjectID string                       `json:"project_id"`
	Plugin    PluginMetadataMutationPlugin `json:"plugin"`

	// PreviousName is the plugin's name before a rename. It is absent on a
	// create.
	PreviousName string `json:"previous_name,omitempty"`

	// DeliveredToEveryone reports that a new plugin was assigned to every
	// organization member because it lives in the organization's default
	// project. Elsewhere a new plugin reaches no one until it is assigned.
	DeliveredToEveryone bool `json:"delivered_to_everyone"`

	// PublicationRequest is what requesting a package refresh wrote alongside
	// the change.
	PublicationRequest string `json:"publication_request"`

	// ResultCategory is "created", "renamed", "auto_sync_turned_on", or
	// "auto_sync_turned_off".
	ResultCategory string `json:"result_category"`
}

type PluginPublicationEvidence 

type PluginPublicationEvidence struct {
	NotConfigured bool                       `json:"not_configured"`
	Unavailable   bool                       `json:"unavailable"`
	Fresh         *bool                      `json:"fresh"`
	Packages      []PluginPublicationPackage `json:"packages"`

	// AwaitingManualSync is true when the plugin's auto sync is off and its
	// package is not fresh: its changes publish only when someone syncs by
	// hand, never on their own. The dashboard shows the same plugin as both
	// "Auto sync off" and "Needs syncing".
	AwaitingManualSync bool `json:"awaiting_manual_sync"`

	// LastPublish describes the project marketplace's latest publish attempt
	// and last successful push, which explain why a package is not fresh.
	LastPublish *PluginLastPublish `json:"last_publish,omitempty"`
}

PluginPublicationEvidence describes the package that would be generated now. Fresh is nil when the last published package cannot be checked.

type PluginPublicationPackage 

type PluginPublicationPackage struct {
	ServerName string `json:"server_name"`
	MCPURL     string `json:"mcp_url"`
}

type PluginRef 

type PluginRef struct {
	// ID is the resolved plugin id.
	ID uuid.UUID

	// Name is the resolved plugin name.
	Name string

	// Slug is the resolved plugin slug.
	Slug string

	// IsDefault marks the project's fallback plugin, so a caller can tell that
	// a name happened to resolve to it rather than being sent there implicitly.
	IsDefault bool
}

PluginRef is one resolved plugin. It is echoed back by every distribution so a caller sees which plugin its name resolved to rather than inferring it.

type PluginRepublishError 

type PluginRepublishError struct {
	// Code is the stable refusal code returned to the caller.
	Code string

	// Message tells the agent what happened and what to do next.
	Message string

	// DashboardURL is where the administrator can finish the job, when known.
	DashboardURL string

	// Cause is the sentinel or internal error behind the refusal.
	Cause error
}

PluginRepublishError is a bounded refusal from republish_plugin.

func (*PluginRepublishError) Error 

func (e *PluginRepublishError) Error() string

func (*PluginRepublishError) Unwrap 

func (e *PluginRepublishError) Unwrap() error

type PluginServer 

type PluginServer struct {
	// MembershipID is the exact plugin membership ID. It is present only in
	// administrative plugin reads.
	MembershipID string `json:"membership_id,omitempty"`

	// DisplayName is the name the generated package gives this server.
	DisplayName string `json:"display_name"`

	// Backend is what the entry is backed by: "mcp_server" or "gateway".
	Backend string `json:"backend"`

	// TargetID is the exact typed backend ID. It is present only in
	// administrative plugin reads.
	TargetID string `json:"target_id,omitempty"`

	// MCPSlug is the server's MCP slug, empty when the backing server has no
	// usable endpoint.
	MCPSlug string `json:"mcp_slug,omitempty"`

	// Policy is "required" or "optional" for the installing client.
	Policy string `json:"policy"`

	// Enabled is false when the backing server is disabled, in which case the
	// plugin carries an entry that currently serves nothing.
	Enabled bool `json:"enabled"`
}

PluginServer is one MCP server a plugin carries. It names the server; it does not hand out an endpoint URL.

type PluginSkill 

type PluginSkill struct {
	// Name is the skill name.
	Name string `json:"name"`

	// PinnedVersionID is the version the distribution is pinned to, empty when
	// it follows the skill's latest valid version.
	PinnedVersionID string `json:"pinned_version_id,omitempty"`

	// FollowsLatest is true when no version is pinned, so authoring a new
	// version changes what this plugin ships.
	FollowsLatest bool `json:"follows_latest"`
}

PluginSkill is one skill a plugin carries.

type PluginTargetResolver 

type PluginTargetResolver interface {
	ResolvePlugin(ctx context.Context, principal Principal, projectID uuid.UUID, wanted string) (PluginRef, error)
}

PluginTargetResolver resolves the exact plugin a distribution names. It is the same resolution the plugin inventory tools expose, so a target that list_plugins shows is a target a distribution can name.

type PluginsService 

type PluginsService struct {
	// contains filtered or unexported fields
}

PluginsService answers what plugins a project has and what is inside one, and resolves the exact plugin a distribution names.

func NewPluginsService 

func NewPluginsService(db *pgxpool.Pool, budget OperationBudget, cursorKeyMaterial string) *PluginsService

func (*PluginsService) AwaitingManualSync 

func (s *PluginsService) AwaitingManualSync(ctx context.Context, principal Principal, projectID uuid.UUID, pluginSlug string) (awaiting, known bool)

AwaitingManualSync reports whether one plugin's change waits for a manual sync, from the publication evidence get_plugin reports to administrators. known is false when no evidence reader is composed or it can't answer.

func (*PluginsService) CreatePlugin 

func (s *PluginsService) CreatePlugin(ctx context.Context, principal Principal, input CreatePluginInput) (PluginMetadataMutationOutput, error)

CreatePlugin creates one empty plugin. Every error it returns is a classified refusal; anything unexpected is logged with its cause and reported as temporarily unavailable.

func (*PluginsService) GetAssignedPlugin 

func (s *PluginsService) GetAssignedPlugin(ctx context.Context, principal Principal, input GetPluginInput) (GetPluginOutput, error)

func (*PluginsService) GetMyInstallInstructions 

func (s *PluginsService) GetMyInstallInstructions(ctx context.Context, principal Principal, input GetMyInstallInstructionsInput) (GetMyInstallInstructionsOutput, error)

func (*PluginsService) GetMyMCPAccess 

func (s *PluginsService) GetMyMCPAccess(ctx context.Context, principal Principal, input GetMyMCPStatusInput) (GetMyMCPAccessOutput, error)

func (*PluginsService) GetMyMCPConnectionStatus 

func (s *PluginsService) GetMyMCPConnectionStatus(ctx context.Context, principal Principal, input GetMyMCPStatusInput) (GetMyMCPConnectionStatusOutput, error)

func (*PluginsService) GetPlugin 

func (s *PluginsService) GetPlugin(ctx context.Context, principal Principal, input GetPluginInput) (GetPluginOutput, error)

func (*PluginsService) IsOrganizationAdmin 

func (s *PluginsService) IsOrganizationAdmin(ctx context.Context, principal Principal) (bool, error)

func (*PluginsService) ListAssignedPlugins 

func (s *PluginsService) ListAssignedPlugins(ctx context.Context, principal Principal, input ListPluginsInput) (ListPluginsOutput, error)

func (*PluginsService) ListPluginAssignments 

func (s *PluginsService) ListPluginAssignments(ctx context.Context, principal Principal, input ListPluginAssignmentsInput) (ListPluginAssignmentsOutput, error)

func (*PluginsService) ListPlugins 

func (s *PluginsService) ListPlugins(ctx context.Context, principal Principal, input ListPluginsInput) (ListPluginsOutput, error)

func (*PluginsService) MemberConnectionStatus 

func (s *PluginsService) MemberConnectionStatus(ctx context.Context, principal Principal, grants []authz.Grant, projectID, mcpID uuid.UUID) (GetMyMCPConnectionStatusOutput, error)

MemberConnectionStatus reports the member's sign-in state for one MCP server from grants the caller already loaded, outside the Platform MCP operation budget. The device agent's menu bar reads it for each server in the member's plugins.

func (*PluginsService) RenamePlugin 

func (s *PluginsService) RenamePlugin(ctx context.Context, principal Principal, input RenamePluginInput) (PluginMetadataMutationOutput, error)

RenamePlugin changes one plugin's display name. Every error it returns is a classified refusal; anything unexpected is logged with its cause and reported as temporarily unavailable.

func (*PluginsService) RepublishPlugin 

func (s *PluginsService) RepublishPlugin(ctx context.Context, principal Principal, input RepublishPluginInput) (RepublishPluginOutput, error)

RepublishPlugin requests a manual sync of the project's plugin packages when the named plugin's package is stale, or when a plugin whose auto sync is off has changes waiting. The request goes through the same fingerprint-gated, per-project publish the rollout sweep uses, so it regenerates every plugin in the project and a package whose inputs did not change is left as it is. Like the dashboard's Sync changes, it also publishes the pending changes of plugins whose auto sync is off.

func (*PluginsService) ResolveAssignmentReferences 

func (s *PluginsService) ResolveAssignmentReferences(ctx context.Context, tx pgx.Tx, principal Principal, project ResolvedProject, references []string) ([]string, []PluginAssignmentSummaryResult, error)

ResolveAssignmentReferences decodes current role/directory audience handles for another Platform MCP access workflow without exposing principal URNs.

func (*PluginsService) ResolvePlugin 

func (s *PluginsService) ResolvePlugin(ctx context.Context, principal Principal, projectID uuid.UUID, wanted string) (PluginRef, error)

ResolvePlugin matches one plugin in the project exactly. A name that matches nothing is not_found and a name that matches more than one is ambiguous; neither falls back to the default plugin.

func (*PluginsService) SetPluginAssignments 

func (s *PluginsService) SetPluginAssignments(ctx context.Context, principal Principal, input SetPluginAssignmentsInput) (SetPluginAssignmentsOutput, error)

func (*PluginsService) SetPluginAutoSync 

func (s *PluginsService) SetPluginAutoSync(ctx context.Context, principal Principal, input SetPluginAutoSyncInput) (PluginMetadataMutationOutput, error)

SetPluginAutoSync turns one plugin's auto sync on or off. Every error it returns is a classified refusal; anything unexpected is logged with its cause and reported as temporarily unavailable.

func (*PluginsService) WithAssignmentMutations 

func (s *PluginsService) WithAssignmentMutations(flags feature.Provider, organizations OrganizationSlugResolver, logger *audit.Logger, budget OperationBudget) *PluginsService

WithAssignmentMutations enables the separately gated write half of the plugin service. Inventory reads remain available when any write dependency is absent.

func (*PluginsService) WithAuthClientResolver 

func (s *PluginsService) WithAuthClientResolver(flags feature.Provider) *PluginsService

WithAuthClientResolver reads member connection status as the auth client resolver serves it in organizations where the resolver is enforced.

func (*PluginsService) WithAuthorization 

func (s *PluginsService) WithAuthorization(engine *authz.Engine) *PluginsService

func (*PluginsService) WithAutoSyncGuard 

func (s *PluginsService) WithAutoSyncGuard(guard pluginAutoSyncGuard) *PluginsService

WithAutoSyncGuard enables set_plugin_auto_sync alongside the other metadata writes.

func (*PluginsService) WithDistributionAdmission 

func (s *PluginsService) WithDistributionAdmission(guard *admission.Guard) *PluginsService

func (*PluginsService) WithDistributionAdmissionReads 

func (s *PluginsService) WithDistributionAdmissionReads(read distributionAdmissionReader) *PluginsService

func (*PluginsService) WithIdentityChaining 

func (s *PluginsService) WithIdentityChaining(governor IdentityChainingGovernor) *PluginsService

WithIdentityChaining reports MCP servers that identity chaining serves as active when the caller has no usable interactive session for them. 

func (s *PluginsService) WithInstallLinks(dashboardURL, serverURL *url.URL) *PluginsService

func (*PluginsService) WithMetadataMutations 

func (s *PluginsService) WithMetadataMutations(logger *slog.Logger, core *plugindelivery.PluginMetadataCore, budget OperationBudget) *PluginsService

WithMetadataMutations enables creating and renaming plugins, and turning their auto sync on or off once WithAutoSyncGuard is composed too. The writes go through the same core the plugins management API uses, so both surfaces refuse the same inputs the same way. There is deliberately no creation cap: the dashboard has none, and the operation budget already bounds a runaway create loop. The post-commit publish signal goes through the same publisher WithRepublish composes.

func (*PluginsService) WithOrganizationHosts 

func (s *PluginsService) WithOrganizationHosts(resolver *orghost.Resolver, logger *slog.Logger) *PluginsService

WithOrganizationHosts makes member links use the platform host stored as the organization's default host, the host the dashboard serves it on. logger records failed reads of that host, after which links fall back to the request's platform origin. A nil logger discards those records.

func (*PluginsService) WithPublicationEvidence 

func (s *PluginsService) WithPublicationEvidence(reader publicationEvidenceReader) *PluginsService

func (*PluginsService) WithPublicationRequests 

func (s *PluginsService) WithPublicationRequests(requests plugindelivery.PublicationRequests) *PluginsService

func (*PluginsService) WithPublishStatus 

func (s *PluginsService) WithPublishStatus(describer publishstatus.Describer) *PluginsService

WithPublishStatus supplies the reader for a project's latest publish attempt. Without it, administrators still see freshness and the last push time, with the attempt reported as unavailable.

func (*PluginsService) WithRemoteSessions 

func (s *PluginsService) WithRemoteSessions(remoteSessions *remotesessions.ChallengeManager) *PluginsService

func (*PluginsService) WithRepublish 

func (s *PluginsService) WithRepublish(publication plugindelivery.PublicationRequests, publisher plugindelivery.PluginSyncSignaler, budget OperationBudget) *PluginsService

WithRepublish enables republish_plugin. Publication requests are the durable outbox path; the signaler is the debounced fallback used when emission is disabled. Either one is enough to request a publish.

func (*PluginsService) WithServerRemoval 

func (s *PluginsService) WithServerRemoval(service *plugindelivery.Service) *PluginsService

WithServerRemoval reuses the dashboard service's authorization, atomic audit and publication flow. Content removal never changes server permissions.

type PostgresLifecycleStore 

type PostgresLifecycleStore struct {
	// contains filtered or unexported fields
}

func NewPostgresLifecycleStore 

func NewPostgresLifecycleStore(db *pgxpool.Pool) *PostgresLifecycleStore

func (*PostgresLifecycleStore) GetLifecycle 

func (s *PostgresLifecycleStore) GetLifecycle(ctx context.Context, organizationID string) (Lifecycle, error)

func (*PostgresLifecycleStore) RevokeConnection 

func (s *PostgresLifecycleStore) RevokeConnection(ctx context.Context, organizationID, connectionID string, now time.Time) error

type PostgresNewModelEligibility 

type PostgresNewModelEligibility struct {
	// contains filtered or unexported fields
}

func NewPostgresNewModelEligibility 

func NewPostgresNewModelEligibility(db *pgxpool.Pool) *PostgresNewModelEligibility

func (*PostgresNewModelEligibility) EligibleForPlatformMCP 

func (e *PostgresNewModelEligibility) EligibleForPlatformMCP(ctx context.Context, organizationID string) (bool, error)

type PostgresOAuthStore 

type PostgresOAuthStore struct {
	// contains filtered or unexported fields
}

PostgresOAuthStore persists the Platform MCP-owned OAuth lifecycle. It keeps opaque codes and refresh tokens hashed, and uses transactions for every transition that locks or invalidates a grant/session family.

func NewPostgresOAuthStore 

func NewPostgresOAuthStore(db *pgxpool.Pool) *PostgresOAuthStore

func (*PostgresOAuthStore) AuthorizeConnection 

func (s *PostgresOAuthStore) AuthorizeConnection(ctx context.Context, input platformoauth.AuthorizeConnectionInput) (platformoauth.Connection, error)

func (*PostgresOAuthStore) ConsumeGrant 

func (s *PostgresOAuthStore) ConsumeGrant(ctx context.Context, input platformoauth.ConsumeGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) CreateSession 

func (s *PostgresOAuthStore) CreateSession(ctx context.Context, session platformoauth.Session) error

func (*PostgresOAuthStore) DetectRefreshReuse 

func (s *PostgresOAuthStore) DetectRefreshReuse(ctx context.Context, organizationID, refreshHash string, now time.Time) (bool, error)

func (*PostgresOAuthStore) ExchangeGrant 

func (s *PostgresOAuthStore) ExchangeGrant(ctx context.Context, input platformoauth.ExchangeGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) GetClient 

func (s *PostgresOAuthStore) GetClient(ctx context.Context, clientID string) (platformoauth.Client, error)

func (*PostgresOAuthStore) GetConnection 

func (s *PostgresOAuthStore) GetConnection(ctx context.Context, organizationID, subject, clientID string) (platformoauth.Connection, error)

func (*PostgresOAuthStore) GetSessionByRefreshHash 

func (s *PostgresOAuthStore) GetSessionByRefreshHash(ctx context.Context, organizationID, refreshHash string) (platformoauth.Session, error)

func (*PostgresOAuthStore) IssueGrant 

func (s *PostgresOAuthStore) IssueGrant(ctx context.Context, grant platformoauth.Grant) error

func (*PostgresOAuthStore) MarkAuthorizationLost 

func (s *PostgresOAuthStore) MarkAuthorizationLost(ctx context.Context, organizationID, connectionID, generation string, now time.Time) error

func (*PostgresOAuthStore) PrepareRefresh 

func (s *PostgresOAuthStore) PrepareRefresh(ctx context.Context, input platformoauth.PrepareRefreshInput) (platformoauth.Session, error)

func (*PostgresOAuthStore) RegisterClient 

func (s *PostgresOAuthStore) RegisterClient(ctx context.Context, client platformoauth.Client) error

func (*PostgresOAuthStore) RegisterConnection 

func (s *PostgresOAuthStore) RegisterConnection(ctx context.Context, connection platformoauth.Connection) error

func (*PostgresOAuthStore) RevokeAccessSession 

func (s *PostgresOAuthStore) RevokeAccessSession(ctx context.Context, organizationID, jti, clientID string, now time.Time) (platformoauth.Session, error)

func (*PostgresOAuthStore) RevokeClient 

func (s *PostgresOAuthStore) RevokeClient(ctx context.Context, clientID string, now time.Time) error

func (*PostgresOAuthStore) RevokeConnection 

func (s *PostgresOAuthStore) RevokeConnection(ctx context.Context, organizationID, connectionID string, now time.Time) error

func (*PostgresOAuthStore) RevokeSession 

func (s *PostgresOAuthStore) RevokeSession(ctx context.Context, organizationID, refreshHash, clientID string, now time.Time) (platformoauth.Session, error)

func (*PostgresOAuthStore) RotateConnectionGeneration 

func (s *PostgresOAuthStore) RotateConnectionGeneration(ctx context.Context, organizationID, connectionID, generation string, now time.Time) (platformoauth.Connection, error)

func (*PostgresOAuthStore) RotateSession 

func (s *PostgresOAuthStore) RotateSession(ctx context.Context, input platformoauth.RotateSessionInput) (platformoauth.Session, error)

func (*PostgresOAuthStore) TouchClientCIMDCache 

func (s *PostgresOAuthStore) TouchClientCIMDCache(ctx context.Context, input platformoauth.TouchCIMDCacheInput) (platformoauth.Client, error)

func (*PostgresOAuthStore) UpsertClientFromCIMD 

func (s *PostgresOAuthStore) UpsertClientFromCIMD(ctx context.Context, input platformoauth.UpsertCIMDClientInput) (platformoauth.Client, error)

func (*PostgresOAuthStore) ValidateGrant 

func (s *PostgresOAuthStore) ValidateGrant(ctx context.Context, input platformoauth.ValidateGrantInput) (platformoauth.Grant, error)

func (*PostgresOAuthStore) WithTelemetry 

func (s *PostgresOAuthStore) WithTelemetry(telemetry OAuthTelemetry) *PostgresOAuthStore

type PostgresOrganizationSlugResolver 

type PostgresOrganizationSlugResolver struct {
	// contains filtered or unexported fields
}

func NewPostgresOrganizationSlugResolver 

func NewPostgresOrganizationSlugResolver(db *pgxpool.Pool) *PostgresOrganizationSlugResolver

func (*PostgresOrganizationSlugResolver) OrganizationSlug 

func (r *PostgresOrganizationSlugResolver) OrganizationSlug(ctx context.Context, organizationID string) (string, error)

type PostgresReader 

type PostgresReader struct {
	// contains filtered or unexported fields
}

func NewPostgresReader 

func NewPostgresReader(logger *slog.Logger, db *pgxpool.Pool) *PostgresReader

func (*PostgresReader) CreateDataExport 

func (r *PostgresReader) CreateDataExport(ctx context.Context, principal Principal, input CreateDataExportInput) (CreateDataExportOutput, error)

func (*PostgresReader) FindMCP 

func (r *PostgresReader) FindMCP(ctx context.Context, principal Principal, input FindMCPInput) (FindMCPOutput, error)

func (*PostgresReader) GetMCP 

func (r *PostgresReader) GetMCP(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)

func (*PostgresReader) GetMCPForDiagnostics 

func (r *PostgresReader) GetMCPForDiagnostics(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)

GetMCPForDiagnostics reads one MCP after project:read has been enforced. The diagnostics projection is project-operational data rather than the MCP's configuration, so it deliberately does not require the narrower mcp:read grant used by get_mcp.

func (*PostgresReader) GetMCPNetworkTraffic 

func (r *PostgresReader) GetMCPNetworkTraffic(ctx context.Context, principal Principal, input MCPNetworkTrafficInput) (MCPNetworkTrafficOutput, error)

func (*PostgresReader) ListDataExports 

func (r *PostgresReader) ListDataExports(ctx context.Context, principal Principal, input ListDataExportsInput) (ListDataExportsOutput, error)

func (*PostgresReader) ListOrganizationEvents 

func (r *PostgresReader) ListOrganizationEvents(ctx context.Context, principal Principal, input ListOrganizationEventsInput) (ListOrganizationEventsOutput, error)

func (*PostgresReader) ListProjects 

func (r *PostgresReader) ListProjects(ctx context.Context, principal Principal, input ListProjectsInput) (ListProjectsOutput, error)

func (*PostgresReader) ListRecentToolCalls 

func (r *PostgresReader) ListRecentToolCalls(ctx context.Context, principal Principal, input ListRecentToolCallsInput) (ListRecentToolCallsOutput, error)

func (*PostgresReader) ResolveProjectLogRead 

func (r *PostgresReader) ResolveProjectLogRead(ctx context.Context, principal Principal, input FindMCPInput) (ResolvedProject, error)

ResolveProjectLogRead resolves one exact project under the principal's organization and enforces log:read before callers list that project's individual tool calls. project:read alone does not satisfy it.

func (*PostgresReader) ResolveProjectRead 

func (r *PostgresReader) ResolveProjectRead(ctx context.Context, principal Principal, input FindMCPInput) (ResolvedProject, error)

ResolveProjectRead resolves one exact project under the principal's organization and enforces the existing project:read scope before callers read project-operational data.

func (*PostgresReader) ResolveReviewProject 

func (r *PostgresReader) ResolveReviewProject(ctx context.Context, principal Principal, rawProjectID string) (ResolvedProject, error)

func (*PostgresReader) WithAnalytics 

func (r *PostgresReader) WithAnalytics(service *AnalyticsService) *PostgresReader

WithAnalytics attaches the analytics reads. A nil or incomplete service leaves the three tools served as stubs.

func (*PostgresReader) WithAuthorization 

func (r *PostgresReader) WithAuthorization(engine *authz.Engine) *PostgresReader

func (*PostgresReader) WithChatMetadata 

func (r *PostgresReader) WithChatMetadata(service *ChatMetadataService) *PostgresReader

WithChatMetadata attaches the metadata-only chat listing. A nil or incomplete service leaves list_chats served as a stub.

func (*PostgresReader) WithChatSearch 

func (r *PostgresReader) WithChatSearch(service *ChatSearchService) *PostgresReader

WithChatSearch attaches explicitly authorized transcript search and reads.

func (*PostgresReader) WithCodeModeAvailability 

func (r *PostgresReader) WithCodeModeAvailability(check CodeModeAvailability) *PostgresReader

WithCodeModeAvailability lets gateway connection settings report the discovery mode a gateway serves while Code Mode is unavailable.

func (*PostgresReader) WithDashboards 

func (r *PostgresReader) WithDashboards(service *DashboardsService) *PostgresReader

WithDashboards attaches the dashboard tools. A nil or incomplete service leaves them listed with the same contract, answering unavailable.

func (*PostgresReader) WithDataExportMutations 

func (r *PostgresReader) WithDataExportMutations(auditLogger *audit.Logger, dashboardURL *url.URL) *PostgresReader

WithDataExportMutations enables creation after the read dependencies have been configured. Secret headers remain dashboard-only.

func (*PostgresReader) WithDataExportRouteToggle 

func (r *PostgresReader) WithDataExportRouteToggle(service *DataExportRouteToggleService) *PostgresReader

WithDataExportRouteToggle composes pause and resume. Without it both tools stay in the catalogue as stable refusals rather than disappearing from it.

func (*PostgresReader) WithDataExports 

func (r *PostgresReader) WithDataExports(encryptionClient *encryption.Client, dashboardURL *url.URL) *PostgresReader

WithDataExports enables the safe data export inventory on this reader.

func (*PostgresReader) WithDeploymentRedeploy 

func (r *PostgresReader) WithDeploymentRedeploy(service *DeploymentRedeployService) *PostgresReader

WithDeploymentRedeploy composes project snapshot redeployment; without it the tool retains its contract and returns a bounded unavailable refusal.

func (*PostgresReader) WithDeviceCoverage 

func (r *PostgresReader) WithDeviceCoverage(service *DeviceCoverageService) *PostgresReader

WithDeviceCoverage serves the MDM coverage reads.

func (*PostgresReader) WithGatewayProxy 

func (r *PostgresReader) WithGatewayProxy(proxy GatewayProxy, flags feature.Provider) *PostgresReader

WithGatewayProxy serves the caller's own MCP servers through their organization gateway. Call it after WithOrganizationGateway, whose availability answer the proxy tools share.

func (*PostgresReader) WithGatewaySessions 

func (r *PostgresReader) WithGatewaySessions(service GatewaySessionManagement) *PostgresReader

WithGatewaySessions shares the dashboard gateway connection reads.

func (*PostgresReader) WithGateways 

func (r *PostgresReader) WithGateways(service *GatewayService) *PostgresReader

WithGateways composes gateway creation and membership changes. Without it the tools stay in the catalogue as stable refusals rather than disappearing.

func (*PostgresReader) WithInboundEMATrust 

func (r *PostgresReader) WithInboundEMATrust(users InboundEMAUserIssuerManagement, remote InboundEMARemoteIssuerManagement) *PostgresReader

WithInboundEMATrust adds the inbound enterprise-managed authorization tools.

func (*PostgresReader) WithInternalSessionIssuer 

func (r *PostgresReader) WithInternalSessionIssuer(gate *internalsessionissuers.Gate) *PostgresReader

WithInternalSessionIssuer supplies the issuer state the management API reads.

func (*PostgresReader) WithMCPNetworkTraffic 

func (r *PostgresReader) WithMCPNetworkTraffic(reader MCPNetworkTrafficReader, logsEnabled FeatureChecker) *PostgresReader

func (*PostgresReader) WithNetworkIngressStatus 

func (r *PostgresReader) WithNetworkIngressStatus(dashboardURL *url.URL) *PostgresReader

WithNetworkIngressStatus enables the read-only organization private network ingress summary on this reader.

func (*PostgresReader) WithOrganizationEvents 

func (r *PostgresReader) WithOrganizationEvents(events EventFeedReader, logs FeatureChecker, dashboardURL *url.URL) *PostgresReader

WithOrganizationEvents enables recent organization-scoped Event Feed summaries. A missing Logs checker leaves the live tool unregistered: the dashboard Event Feed is gated on that product feature, and a nil checker cannot enforce it.

func (*PostgresReader) WithOrganizationGateway 

func (r *PostgresReader) WithOrganizationGateway(service *OrganizationGatewayService) *PostgresReader

WithOrganizationGateway serves get_my_organization_gateway.

func (*PostgresReader) WithOrganizationGatewayActivity 

func (r *PostgresReader) WithOrganizationGatewayActivity(service *OrganizationGatewayActivityService) *PostgresReader

WithOrganizationGatewayActivity serves the organization-wide gateway activity read.

func (*PostgresReader) WithProjectLifecycle 

func (r *PostgresReader) WithProjectLifecycle(service *ProjectLifecycleService) *PostgresReader

WithProjectLifecycle composes project creation and renaming. Without it the tools stay in the catalogue as stable refusals rather than disappearing.

func (*PostgresReader) WithRecentToolCalls 

func (r *PostgresReader) WithRecentToolCalls(telemetry RecentToolCallReader, dashboardURL *url.URL) *PostgresReader

WithRecentToolCalls enables recent project-scoped Tool Logs summaries.

func (*PostgresReader) WithReviewRequests 

func (r *PostgresReader) WithReviewRequests(service MCPReviewRequestService, budget OperationBudget) *PostgresReader

func (*PostgresReader) WithRiskAnalysisStatus 

func (r *PostgresReader) WithRiskAnalysisStatus(service *RiskAnalysisStatusService) *PostgresReader

WithRiskAnalysisStatus attaches the Watchdog analysis run-state reads. A nil or incomplete service leaves the tool served as a stub.

func (*PostgresReader) WithRiskFindingList 

func (r *PostgresReader) WithRiskFindingList(service *RiskFindingListService, budget OperationBudget) *PostgresReader

WithRiskFindingList attaches the per-finding reads behind the same required row-level budget as the Watchdog alerts. A missing budget leaves the tools served as stubs.

func (*PostgresReader) WithRiskFindings 

func (r *PostgresReader) WithRiskFindings(service *RiskFindingsService, budget OperationBudget) *PostgresReader

WithRiskFindings attaches privacy-safe Watchdog finding reads behind a required dedicated budget. A missing budget leaves the tool unavailable.

func (*PostgresReader) WithShadowAI 

func (r *PostgresReader) WithShadowAI(service *ShadowAIService) *PostgresReader

func (*PostgresReader) WithShadowDecisions 

func (r *PostgresReader) WithShadowDecisions(service *ShadowDecisionService) *PostgresReader

func (*PostgresReader) WithShadowInventory 

func (r *PostgresReader) WithShadowInventory(service *ShadowInventoryService) *PostgresReader
func (r *PostgresReader) WithShadowMCPReviewLinks(links ShadowMCPReviewLinker) *PostgresReader

WithShadowMCPReviewLinks lets review-request tools return the dashboard page where a request is reviewed.

func (*PostgresReader) WithToolExposure 

func (r *PostgresReader) WithToolExposure(service *MCPToolExposureService) *PostgresReader

WithToolExposure composes the reads and writes that decide which tools a hosted MCP server exposes. Without it the tools stay in the catalogue as stable refusals rather than disappearing from it.

func (*PostgresReader) WithWidgets 

func (r *PostgresReader) WithWidgets(service *WidgetService) *PostgresReader

WithWidgets attaches the widget tools. A nil service leaves them served as stable refusals.

func (*PostgresReader) WithWorkloadAssertionReuse 

func (r *PostgresReader) WithWorkloadAssertionReuse(management WorkloadAssertionReuseManagement) *PostgresReader

func (*PostgresReader) WithXAAIdentityChaining 

func (r *PostgresReader) WithXAAIdentityChaining(governor IdentityChainingGovernor, outbound *url.URL) *PostgresReader

WithXAAIdentityChaining adds identity chaining bindings and the federated sign-in callback to XAA readiness. outbound is the pinned callback origin for clients that recorded none.

func (*PostgresReader) WithXAAReadiness 

func (r *PostgresReader) WithXAAReadiness(connections xaaConnectionsReader, signIn oktaSignInReader, flags feature.Provider) *PostgresReader

WithXAAReadiness reuses the dashboard service's org-admin authorization, MCP visibility filtering and readiness derivation. List itself is not gated, so the agent surface checks the same rollout flag before reading it.

type PostgresReadinessRecorder 

type PostgresReadinessRecorder struct {
	// contains filtered or unexported fields
}

func NewPostgresReadinessRecorder 

func NewPostgresReadinessRecorder(db *pgxpool.Pool) *PostgresReadinessRecorder

func (*PostgresReadinessRecorder) RecordReady 

func (r *PostgresReadinessRecorder) RecordReady(ctx context.Context, principal Principal, _ time.Time) error

type PostgresShadowAILibrary 

type PostgresShadowAILibrary struct {
	// contains filtered or unexported fields
}

PostgresShadowAILibrary reads the library from the agent tables, where Overlay composes it per read — no snapshot to go stale against the defaults.

func NewPostgresShadowAILibrary 

func NewPostgresShadowAILibrary(queries *agentrepo.Queries) *PostgresShadowAILibrary

func (*PostgresShadowAILibrary) LoadLibrary 

func (l *PostgresShadowAILibrary) LoadLibrary(ctx context.Context, organizationID string) (*aitargets.OrganizationList, error)

type PostgresSkillTargets 

type PostgresSkillTargets struct {
	// contains filtered or unexported fields
}

PostgresSkillTargets reads the distribution targets a project actually has.

It reads the tables directly rather than calling the plugins and assistants management services: resolution needs two names and two ids, while those services return whole plugin and assistant records — and the plugins service provisions a missing default plugin as a side effect of listing, which is not something naming a target should do.

func NewPostgresSkillTargets 

func NewPostgresSkillTargets(db *pgxpool.Pool) *PostgresSkillTargets

func (*PostgresSkillTargets) SkillMCPTargets 

func (s *PostgresSkillTargets) SkillMCPTargets(ctx context.Context, organizationID string, projectID uuid.UUID, kind SkillMCPTargetKind, wanted string) ([]SkillMCPTarget, error)

SkillMCPTargets finds the MCP servers or gateways of one kind in one project whose id, slug or name is wanted. The match runs in the database over every live server, so no cap can hide a target the project has.

func (*PostgresSkillTargets) SkillTargets 

func (s *PostgresSkillTargets) SkillTargets(ctx context.Context, organizationID string, projectID uuid.UUID, limitPerKind int) ([]SkillTarget, error)

type Principal 

type Principal struct {
	UserID         string
	OrganizationID string
	ConnectionID   string
	Generation     string
	ClientID       string
	Surface        ActingSurface
}

Principal is the identity a Platform MCP call acts under.

ConnectionID and Generation are empty together for a surface with no OAuth connection, and present together otherwise — the same invariant the connection columns carry in the database.

OrganizationID is always present. UserID is present for every surface that writes, because authorization, idempotency, and audit are keyed on the real user rather than on the connection; that is what makes a connection-less call attributable exactly as well as one with a connection.

func PrincipalFromContext 

func PrincipalFromContext(ctx context.Context) (Principal, bool)

func (Principal) HasConnection 

func (p Principal) HasConnection() bool

HasConnection reports whether this principal claims an OAuth connection.

Either half counts as a claim. A principal presenting one half has an incomplete identity rather than no connection, and must fail strict parsing instead of silently taking the connection-less path — which would record a user-attributed write for a connection the caller could not prove.

type Project 

type Project struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type ProjectCreatePreviewError 

type ProjectCreatePreviewError struct {
	// Name is the display name exactly as it would be stored.
	Name string

	// Slug is the slug the project would get, from the same derivation the
	// confirmed call uses.
	Slug string
}

ProjectCreatePreviewError is the confirmation_required refusal of an unconfirmed create. It carries the exact name and slug the confirmed call would create, so the user confirms the real address rather than an agent's guess at the derivation. Nothing is charged, written, or recorded to produce it.

func (*ProjectCreatePreviewError) Error 

func (e *ProjectCreatePreviewError) Error() string

func (*ProjectCreatePreviewError) Unwrap 

func (e *ProjectCreatePreviewError) Unwrap() error

type ProjectLifecycleError 

type ProjectLifecycleError struct {
	Code    string
	Message string
	Cause   error
}

ProjectLifecycleError is safe to map into a tool refusal: Message is written for the administrator and never carries database detail.

func (*ProjectLifecycleError) Error 

func (e *ProjectLifecycleError) Error() string

func (*ProjectLifecycleError) Unwrap 

func (e *ProjectLifecycleError) Unwrap() error

type ProjectLifecycleService 

type ProjectLifecycleService struct {
	// contains filtered or unexported fields
}

ProjectLifecycleService creates and renames projects for the Platform MCP through the same core the projects management API uses, so an agent can make exactly the projects the dashboard can and no others.

func NewProjectLifecycleService 

func NewProjectLifecycleService(logger *slog.Logger, db *pgxpool.Pool, core *projects.Core, engine *authz.Engine, admin Authorizer, changes OperationBudget) (*ProjectLifecycleService, error)

func (*ProjectLifecycleService) CreateProject 

func (s *ProjectLifecycleService) CreateProject(ctx context.Context, principal Principal, input CreateProjectInput) (ProjectMutationOutput, error)

CreateProject creates an empty project in the caller's organization. The receipt that makes a retry replay is written in the same transaction as the project, against the project it created, because there is no project to key it on beforehand.

func (*ProjectLifecycleService) RenameProject 

func (s *ProjectLifecycleService) RenameProject(ctx context.Context, principal Principal, input RenameProjectInput) (ProjectMutationOutput, error)

RenameProject changes one project's display name. Its slug, and so every dashboard link and API header that addresses the project, stays the same.

type ProjectMutationOutput 

type ProjectMutationOutput struct {
	// Outcome is "created", "renamed", or "unchanged" (a rename to the name the
	// project already had).
	Outcome string `json:"outcome"`

	// Project is a fresh read taken after the commit when SnapshotScope is
	// "fresh_read_after_commit", and the stored result otherwise.
	Project Project `json:"project"`

	// PreviousName is the name a rename replaced. Empty on a create.
	PreviousName string `json:"previous_name,omitempty"`

	// SnapshotScope is "fresh_read_after_commit" when Project was re-read
	// after the write, or "verification_unavailable" when that read failed —
	// for instance because the project was deleted after a replayed create.
	SnapshotScope string `json:"snapshot_scope"`

	Receipt RiskMutationToolReceipt `json:"receipt"`
}

ProjectMutationOutput reports one committed create or rename. A refusal is returned as an error result and never as this struct.

type ProjectOverviewServer 

type ProjectOverviewServer struct {
	// Name is the configured MCP server's name when the reported name resolved
	// to one, and otherwise the name the calling agent used for the server.
	Name string `json:"name"`

	// MCPID is the configured MCP server the calls were attributed to, usable
	// with get_mcp and the diagnostics tools. Empty when no configured server
	// is known by the reported name.
	MCPID string `json:"mcp_id,omitempty"`

	ToolCalls int64 `json:"tool_calls"`
}

ProjectOverviewServer is one MCP server's share of the project's tool calls.

type ProjectOverviewSessionReader 

type ProjectOverviewSessionReader interface {
	GetActiveUserCountByMessages(ctx context.Context, arg chatrepo.GetActiveUserCountByMessagesParams) (int64, error)
}

ProjectOverviewSessionReader is the PostgreSQL side of a session-mode overview. In session mode the active-user count is a count of chat participants, which ClickHouse's tool-call lane cannot answer.

type ProjectPublisher 

type ProjectPublisher func(context.Context, uuid.UUID, string, string) error

ProjectPublisher is a post-commit adapter to the existing plugin publisher. The caller supplies only bounded identity and intent; no provider values or package details cross the Platform MCP boundary.

type ProjectReadResolver 

type ProjectReadResolver interface {
	ResolveProjectRead(ctx context.Context, principal Principal, input FindMCPInput) (ResolvedProject, error)
}

ProjectReadResolver is the project-read boundary the tool listing sits behind. It is declared here rather than taken as a concrete reader so the listing composes from whatever reader a deployment supplies.

type ProjectScope 

type ProjectScope int

ProjectScope declares how a tool obtains the project it acts on. 

const (
	// ProjectScopeNone: the tool does not act on a single project.
	ProjectScopeNone ProjectScope = iota
	// ProjectScopeExplicit: the caller names the project. An external client
	// spans every project in its organization, so it has to say which.
	ProjectScopeExplicit
	// ProjectScopeDefaultable: an external caller may name an exact project or
	// omit both selectors to use the organization's literal default project. The
	// assistant still injects its own exact project and hides the selectors.
	ProjectScopeDefaultable
)

type ProjectTool 

type ProjectTool struct {
	Name string `json:"name"`
	URN  string `json:"urn"`
	// Summary is the tool's own short description, trimmed to keep a page of
	// results readable. It carries no configuration or credential material.
	Summary string `json:"summary,omitempty"`
	// SourceKind is "function" or "openapi": which kind of source produced
	// this tool.
	SourceKind string `json:"source_kind"`
	SourceSlug string `json:"source_slug,omitempty"`
	SourceName string `json:"source_name,omitempty"`
}

ProjectTool is one generated tool definition in a project, named by the stable URN that every exposure call takes.

type ProviderAdapter 

type ProviderAdapter interface {
	ProviderKey() string
	PreflightSetup(ctx context.Context, request ProviderSetupRequest) error
	BeginSetup(ctx context.Context, request ProviderSetupRequest) (ProviderSetupResult, error)
	ProbeReadiness(ctx context.Context, request ProviderReadinessProbeRequest) (ProviderReadinessProbeResult, error)
}

ProviderAdapter is implemented only for a reviewed provider or the local deterministic fixture. The Platform MCP never accepts arbitrary adapters or provider endpoints from an MCP caller.

type ProviderAdapters 

type ProviderAdapters struct {
	// contains filtered or unexported fields
}

func NewProviderAdapters 

func NewProviderAdapters(adapters []ProviderAdapter) *ProviderAdapters

func (*ProviderAdapters) Get 

func (a *ProviderAdapters) Get(providerKey string) (ProviderAdapter, error)

type ProviderAuthorizationIdentity 

type ProviderAuthorizationIdentity struct {
	OrganizationID         string
	Subject                urn.SessionSubject
	RegistrationID         uuid.UUID
	RemoteSessionID        uuid.UUID
	RemoteSessionUpdatedAt time.Time
	RemoteSessionClientID  uuid.UUID
	RemoteSessionIssuerID  uuid.UUID
	Absence                string
}

ProviderAuthorizationIdentity contains the durable, non-secret identity of the shared provider authorization used for one Platform MCP registration.

type ProviderReadinessProbeRequest 

type ProviderReadinessProbeRequest struct {
	UserID              string
	OrganizationID      string
	ProjectID           uuid.UUID
	RegistrationID      uuid.UUID
	UserSessionIssuerID uuid.UUID
	ConnectionID        uuid.UUID
	Generation          uuid.UUID
}

type ProviderReadinessProbeResult 

type ProviderReadinessProbeResult struct {
	AuthorizationIdentity ProviderAuthorizationIdentity
	State                 ReadinessState
	EvidenceCode          string
	CheckedAt             time.Time
	ExpiresAt             time.Time
}

ProviderReadinessProbeResult normalizes the result of authenticated MCP initialize and tools/list negotiation. Adapters return durable authorization identity, never an opaque caller-defined fingerprint, raw protocol bodies, remote URLs, headers, credentials, or tokens.

type ProviderSetupRequest 

type ProviderSetupRequest struct {
	UserID              string
	OrganizationID      string
	ProjectID           uuid.UUID
	RegistrationID      uuid.UUID
	UserSessionIssuerID uuid.UUID
	MCPSlug             string
	ConnectionID        uuid.UUID
	Generation          uuid.UUID
	HandoffID           uuid.UUID
}

ProviderSetupRequest is created from a trusted, lifecycle-validated handoff. It contains identifiers, never a handoff value, OAuth value, provider secret, or remote URL. HandoffID is set only after the handoff is consumed.

type ProviderSetupResult 

type ProviderSetupResult struct {
	AuthorizationURL string
}

ProviderSetupResult carries only transient provider setup state. It must not include a bearer token, provider secret, or readiness fingerprint.

type QueryMCPEventsInput 

type QueryMCPEventsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

QueryMCPEventsInput drills into one MCP's calls by tool. It has no free-text filter and no attribute selector: the only axis is the MCP the overview already named.

type QueryMCPEventsOutput 

type QueryMCPEventsOutput struct {
	ProjectID string          `json:"project_id"`
	MCPID     string          `json:"mcp_id"`
	Envelope  DataEnvelope    `json:"data"`
	Tools     []MCPToolEvents `json:"tools"`
	Truncated bool            `json:"truncated"`
}

type QueryMCPMetricsInput 

type QueryMCPMetricsInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h (default), or 7d"`
}

QueryMCPMetricsInput asks for one MCP's aggregate levels over a window.

type QueryMCPMetricsOutput 

type QueryMCPMetricsOutput struct {
	ProjectID string       `json:"project_id"`
	MCPID     string       `json:"mcp_id"`
	Envelope  DataEnvelope `json:"data"`

	ToolCalls       int64 `json:"tool_calls"`
	FailedToolCalls int64 `json:"failed_tool_calls"`
	// FailureRate is computed server-side and rounded to four decimal places.
	// Zero calls yields zero rather than an undefined ratio.
	FailureRate  float64      `json:"failure_rate"`
	AvgLatencyMs float64      `json:"avg_latency_ms"`
	ActiveUsers  SubjectCount `json:"active_users"`
	// ActiveUsersUnavailable is retained for compatibility. The active-count
	// read scopes a hosted server by its toolset slug and every other model by
	// its configured id, so ActiveUsers is always an answer about this server.
	ActiveUsersUnavailable bool `json:"active_users_unavailable"`
}

QueryMCPMetricsOutput is aggregated to the window it names. There is deliberately no per-bucket series: an external MCP client has no scratch compute, and handing it buckets to sum would be a contract failure.

type QueryMCPTracesInput 

type QueryMCPTracesInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID that owns the MCP"`
	MCPID     string `json:"mcp_id" jsonschema:"configured MCP ID as returned by find_mcp or get_mcp"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
	Outcome   string `` /* 153-byte string literal not displayed */
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous query_mcp_traces result"`
}

QueryMCPTracesInput asks for individual occurrences of a failure class the overview or diagnostics already identified.

type QueryMCPTracesOutput 

type QueryMCPTracesOutput struct {
	ProjectID  string              `json:"project_id"`
	MCPID      string              `json:"mcp_id"`
	Envelope   DataEnvelope        `json:"data"`
	Traces     []MCPTraceReference `json:"traces"`
	NextCursor string              `json:"next_cursor,omitempty"`
}

type QuerySkillUsageInput 

type QuerySkillUsageInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to summarize"`
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h or 24h (default); this tool looks back at most 24h"`
}

type QuerySkillUsageOutput 

type QuerySkillUsageOutput struct {
	ProjectID string       `json:"project_id"`
	Envelope  DataEnvelope `json:"data"`
	Skills    []SkillUsage `json:"skills"`
	Truncated bool         `json:"truncated"`
}

type ReadChatInput 

type ReadChatInput struct {
	ProjectID string `json:"project_id,omitempty"`

	ProjectSlug string `json:"project_slug,omitempty"`

	ChatID string `json:"chat_id"`

	// MessageID anchors the window; empty anchors on the latest message.
	MessageID string `json:"message_id,omitempty"`

	ContextSize *int `json:"context_size,omitempty"`
}

ReadChatInput anchors a small context window on one captured message.

type ReadChatOutput 

type ReadChatOutput struct {
	ChatID string `json:"chat_id"`

	ChatTitle string `json:"chat_title"`

	OwnerUserID string `json:"owner_user_id,omitempty"`

	Messages []ChatMessage `json:"messages"`
}

ReadChatOutput carries capture-sequence messages around the anchor.

type ReadGramDocToolInput 

type ReadGramDocToolInput struct {
	URI string `` /* 181-byte string literal not displayed */
}

type ReadGramDocToolOutput 

type ReadGramDocToolOutput struct {
	URI   string `json:"uri"`
	Title string `json:"title,omitempty"`
	// Text is the full reviewed guide, including its own citation header.
	Text    string `json:"text,omitempty"`
	Code    string `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
	// TrustedLinks are where to send the reader when no guide can be served.
	// Withholding content must not withhold the trail to a reviewed source.
	TrustedLinks []string `json:"trusted_links,omitempty"`
}

type Reader 

type Reader interface {
	ListProjects(ctx context.Context, principal Principal, input ListProjectsInput) (ListProjectsOutput, error)
	FindMCP(ctx context.Context, principal Principal, input FindMCPInput) (FindMCPOutput, error)
	GetMCP(ctx context.Context, principal Principal, input GetMCPInput) (MCP, error)
}

type Readiness 

type Readiness struct {
	ID                   uuid.UUID
	ProjectID            uuid.UUID
	RegistrationID       uuid.UUID
	State                ReadinessState
	EvidenceCode         string
	CheckedAt            time.Time
	ExpiresAt            time.Time
	ConnectionID         uuid.UUID
	ConnectionGeneration uuid.UUID
	Fresh                bool
}

type ReadinessBinding 

type ReadinessBinding struct {
	ProjectID                        uuid.UUID
	RegistrationID                   uuid.UUID
	ProviderAuthorizationFingerprint string
}

type ReadinessRecorder 

type ReadinessRecorder interface {
	RecordReady(ctx context.Context, principal Principal, at time.Time) error
}

ReadinessRecorder persists authenticated discovery completion for a single connection generation. Its input is intentionally the authenticated principal, never an OAuth token or raw MCP message.

type ReadinessService 

type ReadinessService struct {
	// contains filtered or unexported fields
}

func NewReadinessService 

func NewReadinessService(store *RegistrationStore, gate CatalogRegistrationGateChecker, adapters *ProviderAdapters, forceLimiter Limiter, repairBudget OperationBudget, generic ...CatalogReadinessProber) *ReadinessService

func (*ReadinessService) CurrentReadiness 

func (s *ReadinessService) CurrentReadiness(ctx context.Context, principal Principal, projectSlug, registrationID string) (ResolvedProject, Readiness, bool, error)

CurrentReadiness loads existing, generation-bound readiness without probing a provider or consuming a repair budget. It is safe for the dashboard's authoritative projection to call while resuming after a reload.

func (*ReadinessService) GetReadiness 

func (s *ReadinessService) GetReadiness(ctx context.Context, principal Principal, projectSlug, registrationID string, force bool) (ResolvedProject, Readiness, bool, error)

func (*ReadinessService) GetRepairPlan 

func (s *ReadinessService) GetRepairPlan(ctx context.Context, principal Principal, projectSlug, registrationID string) (ResolvedProject, Readiness, bool, error)

func (*ReadinessService) WithTelemetry 

func (s *ReadinessService) WithTelemetry(telemetry LifecycleTelemetry) *ReadinessService

type ReadinessState 

type ReadinessState string
const (
	ReadinessReady                  ReadinessState = "ready"
	ReadinessNeedsProviderSetup     ReadinessState = "needs_provider_setup"
	ReadinessNeedsGramAuthorization ReadinessState = "needs_gram_authorization"
	ReadinessNeedsConfiguration     ReadinessState = "needs_configuration"
	ReadinessAuthFailed             ReadinessState = "auth_failed"
	ReadinessUnreachable            ReadinessState = "unreachable"
	ReadinessUnsupported            ReadinessState = "unsupported"
	ReadinessUnauthorized           ReadinessState = "unauthorized"
	ReadinessGuideUnavailable       ReadinessState = "guide_unavailable"
	ReadinessDegraded               ReadinessState = "degraded"
)

func ClassifyReadinessProbeFailure 

func ClassifyReadinessProbeFailure(err error) (ReadinessState, string)

ClassifyReadinessProbeFailure separates transport failures from invalid MCP responses without exposing the underlying network or protocol error. It is exported for provider adapters in child packages; callers receive only the closed state and evidence code, never the original error.

func ClientCredentialProbeReadiness 

func ClientCredentialProbeReadiness(authorization remotesessions.ResolvedAuthorization, state ReadinessState, evidence string) (ReadinessState, string)

ClientCredentialProbeReadiness keeps a probe the upstream refused from asking the member to sign in when the refused credential is a self client's own: only an administrator repairs it. Any other result passes through.

func ClientCredentialReadiness 

func ClientCredentialReadiness(err error) (state ReadinessState, evidence string, ok bool)

ClientCredentialReadiness classifies a failure to obtain a self client's own credential. Nothing the member authorizes repairs it, so it never asks the member to authorize: an outage is unreachable, anything else needs an administrator. ok is false for any other error.

type RecallRiskFindingReader 

type RecallRiskFindingReader interface {
	ListRiskFindingSpansForRecall(context.Context, chrepo.ListRiskFindingSpansForRecallParams) ([]chrepo.RiskFindingUnmaskRow, error)
}

RecallRiskFindingReader supplies live ClickHouse finding spans for masking.

type RecallableSession 

type RecallableSession struct {
	SessionID   string `json:"session_id"`
	ChatID      string `json:"chat_id"`
	Title       string `json:"title,omitempty"`
	Summary     string `json:"summary,omitempty"`
	ProjectName string `json:"project_name"`
	ProjectSlug string `json:"project_slug"`
	Cwd         string `json:"cwd,omitempty"`
	LastActive  string `json:"last_active"`
}

RecallableSession is one captured session the caller owns — metadata only, never transcript content.

type RecentToolCall 

type RecentToolCall struct {
	OccurredAt string `json:"occurred_at"`
	ToolName   string `json:"tool_name,omitempty"`
	TargetType string `json:"target_type"`
	TargetKind string `json:"target_kind"`
	Target     string `json:"target,omitempty"`
	Outcome    string `json:"outcome"`
	Client     string `json:"client,omitempty"`
	// AgentID is present only for the trusted agent identity in Tool Logs.
	AgentID string `json:"agent_id,omitempty"`
}

type RecentToolCallReadService 

type RecentToolCallReadService struct {
	// contains filtered or unexported fields
}

RecentToolCallReadService owns the summary reader and trusted dashboard URL.

type RecentToolCallReader 

type RecentToolCallReader interface {
	ListToolUsageTraces(ctx context.Context, arg telemetryrepo.ListToolUsageTracesParams) ([]telemetryrepo.ToolUsageTraceSummary, error)
}

RecentToolCallReader is the bounded Tool Logs summary read used by Platform MCP. It intentionally cannot read raw log bodies or attributes.

type RecordWorkflowRunToolInput 

type RecordWorkflowRunToolInput struct {
	Skill       string            `json:"skill" jsonschema:"name of the workflow that ran, for example add-existing-mcp-servers"`
	RunID       string            `json:"run_id" jsonschema:"caller-generated identifier grouping this run's events, at most 128 characters"`
	ProjectSlug string            `json:"project_slug,omitempty" jsonschema:"project slug the run targeted, when the workflow targets one"`
	Client      string            `json:"client,omitempty" jsonschema:"local client the run was driven from, for example claude_code"`
	Items       []WorkflowRunItem `` /* 134-byte string literal not displayed */
}

type RecordWorkflowRunToolOutput 

type RecordWorkflowRunToolOutput struct {
	Recorded bool `json:"recorded"`
}

type RedeployDeploymentInput 

type RedeployDeploymentInput struct {
	ProjectID                  string `json:"project_id" jsonschema:"exact project UUID; never inferred"`
	DeploymentID               string `` /* 146-byte string literal not displayed */
	ExpectedActiveDeploymentID string `` /* 173-byte string literal not displayed */
	IdempotencyKey             string `json:"idempotency_key" jsonschema:"stable key of 1 to 128 characters for this redeployment; reuse unchanged on retries"`
	Confirmed                  bool   `` /* 161-byte string literal not displayed */
}

type RedeployDeploymentOutput 

type RedeployDeploymentOutput struct {
	ProjectID          string `json:"project_id"`
	SourceDeploymentID string `json:"source_deployment_id"`
	DeploymentID       string `json:"deployment_id"`
	Status             string `json:"status"`
	Verified           bool   `` /* 154-byte string literal not displayed */
	Active             *bool  `` /* 128-byte string literal not displayed */
	Processing         string `json:"processing"`
	Replayed           bool   `json:"replayed"`
	DashboardPath      string `json:"dashboard_path"`
}

type RegisterCatalogMCPInput 

type RegisterCatalogMCPInput struct {
	ProjectSlug     string
	ProviderKey     string
	CatalogRef      string
	NonSecretConfig CatalogConfigurationValues
	IdempotencyKey  string
}

type RegisterCatalogMCPResult 

type RegisterCatalogMCPResult struct {
	Project             ResolvedProject
	ProviderKey         string
	CatalogRef          string
	SetupIntent         string
	Receipt             OperationReceipt
	Registration        string
	SecretFieldsPending []CatalogConfigurationField

	// ServerName is the display name the MCP server was added under.
	ServerName string
}

type RegisterCatalogMCPToolInput 

type RegisterCatalogMCPToolInput struct {
	ProjectSlug     string                     `` /* 213-byte string literal not displayed */
	ProviderKey     string                     `json:"provider_key" jsonschema:"server-issued catalogue source identity returned by search_mcp_catalog"`
	CatalogRef      string                     `json:"catalog_ref" jsonschema:"exact catalogue reference returned by search_mcp_catalog"`
	NonSecretConfig CatalogConfigurationValues `` /* 248-byte string literal not displayed */
	IdempotencyKey  string                     `` /* 157-byte string literal not displayed */
}

type RegisterCatalogMCPToolOutput 

type RegisterCatalogMCPToolOutput struct {
	ProjectSlug         string                      `json:"project_slug"`
	ProviderKey         string                      `json:"provider_key"`
	CatalogRef          string                      `json:"catalog_ref"`
	SetupIntent         string                      `json:"setup_intent"`
	ReceiptID           string                      `json:"receipt_id"`
	RegistrationID      string                      `json:"registration_id"`
	Replayed            bool                        `json:"replayed"`
	AlreadyRegistered   bool                        `json:"already_registered"`
	NextAction          string                      `json:"next_action"`
	DashboardSetupURL   string                      `json:"dashboard_setup_url,omitempty"`
	SecretFieldsPending []CatalogConfigurationField `json:"secret_fields_pending,omitempty"`
}

type RegisterRemoteMCPInput 

type RegisterRemoteMCPInput struct {
	ProjectSlug    string
	RemoteURL      string
	DisplayName    string
	IdempotencyKey string
}

type RegisterRemoteMCPResult 

type RegisterRemoteMCPResult struct {
	Project           ResolvedProject
	RemoteURL         string
	Receipt           OperationReceipt
	Registration      string
	NextAction        string
	DashboardSetupURL string
	// AutomaticClientRegistration says how an OAuth client is obtained from the
	// server's provider; empty when the server needs no sign-in.
	AutomaticClientRegistration string

	// ServerName is the display name the MCP server was added under.
	ServerName string
}

type RegisterRemoteMCPToolInput 

type RegisterRemoteMCPToolInput struct {
	ProjectSlug    string `` /* 218-byte string literal not displayed */
	RemoteURL      string `` /* 208-byte string literal not displayed */
	DisplayName    string `` /* 260-byte string literal not displayed */
	IdempotencyKey string `` /* 131-byte string literal not displayed */
}

type RegisterRemoteMCPToolOutput 

type RegisterRemoteMCPToolOutput struct {
	ProjectSlug                 string `json:"project_slug"`
	CanonicalURL                string `json:"canonical_url"`
	ReceiptID                   string `json:"receipt_id"`
	RegistrationID              string `json:"registration_id"`
	Replayed                    bool   `json:"replayed"`
	AlreadyRegistered           bool   `json:"already_registered"`
	AutomaticClientRegistration string `` /* 377-byte string literal not displayed */
	NextAction                  string `json:"next_action"`
	DashboardSetupURL           string `json:"dashboard_setup_url,omitempty"`
}

type Registrar 

type Registrar struct {
	// contains filtered or unexported fields
}

Registrar collects the tools and resources composed for one deployment while registering them with the MCP server, so the external endpoint and any other admitted audience are built from a single pass rather than two lists that can drift.

func (*Registrar) Descriptors 

func (r *Registrar) Descriptors() []Descriptor

Descriptors returns everything registered, before any audience filter.

func (*Registrar) FilterExternalTools 

func (r *Registrar) FilterExternalTools(ctx context.Context, principal Principal, tools []*mcp.Tool) []*mcp.Tool

FilterExternalTools applies caller-specific discovery policy to an already composed tools/list result. This is only a discovery filter: exact resource checks remain in each handler and run again when a listed tool is called. A client with a tool allowlist (see clientToolAllowlist) sees only those tools, intersected with what its grants make discoverable.

func (*Registrar) For 

func (r *Registrar) For(audience Audience) []Descriptor

For returns the descriptors admitted to one audience.

func (*Registrar) ResourceFor 

func (r *Registrar) ResourceFor(audience Audience, uri string) (ResourceDescriptor, bool)

ResourceFor returns one admitted resource by URI. An audience that is not admitted to a resource cannot tell it apart from one that does not exist.

type RegistrationDashboardSetup 

type RegistrationDashboardSetup struct {
	OrganizationSlug string
	MCPServerRoute   string

	// ServerName is the MCP server's display name, which may be empty.
	ServerName string
}

RegistrationDashboardSetup is the persisted, server-owned dashboard target for a registered Remote MCP source. It deliberately contains no upstream URL, OAuth metadata, header value, or other provider material.

type RegistrationPersistence 

type RegistrationPersistence interface {
	FindReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, bool, error)
	ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)
	EligibleCatalogRegistrationTarget(ctx context.Context, organizationID string, project ResolvedProject) (bool, error)
	BeginReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, error)
	ConvergeRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt) (OperationReceipt, error)
	CompleteRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, configuration resolvedCatalogConfiguration) (OperationReceipt, error)
	ResolveRegistrationPendingSecretFields(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, declared []CatalogConfigurationField) ([]CatalogConfigurationField, error)
	ResolveRegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)
	ResolveRegistrationDashboardSetup(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (RegistrationDashboardSetup, error)
	IssueSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, now time.Time) (IssuedSetupHandoff, error)
}

type RegistrationService 

type RegistrationService struct {
	// contains filtered or unexported fields
}

RegistrationService is the handler-facing boundary for one reviewed catalog registration. Catalog identity is validated before persistence, and the normalized input hash is computed here rather than trusted from an MCP caller.

func NewRegistrationService 

func NewRegistrationService(catalog Catalog, gate CatalogRegistrationGateChecker, store RegistrationPersistence) *RegistrationService

func (*RegistrationService) AttachDefaultIdentityProvider 

func (s *RegistrationService) AttachDefaultIdentityProvider(ctx context.Context, principal Principal, projectSlug, registrationID string) (CatalogIdentityProviderAttachmentResult, error)

AttachDefaultIdentityProvider attaches the one OAuth provider advertised by the lifecycle-bound Remote MCP. The caller supplies no provider identity, OAuth configuration, client ID, secret, code, or token.

func (*RegistrationService) DashboardAuthorization 

func (s *RegistrationService) DashboardAuthorization(ctx context.Context, principal Principal, projectSlug, registrationID string) (DashboardAuthorization, error)

DashboardAuthorization returns the Inspect page only after the upstream provider is attached.

func (*RegistrationService) DashboardSetupURL 

func (s *RegistrationService) DashboardSetupURL(ctx context.Context, principal Principal, input IssueSetupHandoffInput) (string, error)

DashboardSetupURL returns the existing Remote MCP server Authentication settings page for a browser-catalogue registration. This is the browser-only fallback for provider attachment; callers cannot provide an endpoint, source, or credential.

func (*RegistrationService) DisableMCP 

func (s *RegistrationService) DisableMCP(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*RegistrationService) EnableMCP 

func (s *RegistrationService) EnableMCP(ctx context.Context, principal Principal, input UpdateMCPVisibilityInput) (UpdateMCPVisibilityResult, error)

func (*RegistrationService) GetClientAdmission 

func (s *RegistrationService) GetClientAdmission(ctx context.Context, principal Principal, projectSlug, registrationID string) (ClientAdmission, error)

func (*RegistrationService) IssueSetupHandoff 

func (s *RegistrationService) IssueSetupHandoff(ctx context.Context, principal Principal, input IssueSetupHandoffInput) (IssuedSetupHandoff, error)

func (*RegistrationService) IssueSetupHandoffForRegistration 

func (s *RegistrationService) IssueSetupHandoffForRegistration(ctx context.Context, principal Principal, projectSlug, registrationID string) (IssuedSetupHandoff, error)

IssueSetupHandoffForRegistration derives the persisted catalogue identity from the exact workflow-bound registration. Dashboard callers never supply a provider key, catalogue reference, endpoint, or credential.

func (*RegistrationService) RegisterCatalogMCP 

func (s *RegistrationService) RegisterCatalogMCP(ctx context.Context, principal Principal, input RegisterCatalogMCPInput) (RegisterCatalogMCPResult, error)

func (*RegistrationService) RegisterRemoteMCP 

func (s *RegistrationService) RegisterRemoteMCP(ctx context.Context, principal Principal, input RegisterRemoteMCPInput) (RegisterRemoteMCPResult, error)

RegisterRemoteMCP re-inspects the exact URL before persistence. An inspection result from an earlier MCP call is deliberately not trusted as admission evidence, and no caller can supply credentials or headers.

func (*RegistrationService) RegistrationCatalogIdentity 

func (s *RegistrationService) RegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)

RegistrationCatalogIdentity resolves the server-owned catalog identity for a lifecycle-bound registration. It keeps management adapters from depending on RegistrationService persistence internals.

func (*RegistrationService) SetClientAdmission 

func (s *RegistrationService) SetClientAdmission(ctx context.Context, principal Principal, projectSlug, registrationID, mode string) (ClientAdmission, error)

SetClientAdmission applies a confirmed admission-mode change. Confirmation is enforced at the tool boundary; this path assumes it and only verifies that the caller may act on the registration.

func (*RegistrationService) UpdateMCPMetadata 

func (s *RegistrationService) UpdateMCPMetadata(ctx context.Context, principal Principal, input UpdateMCPMetadataInput) (UpdateMCPMetadataResult, error)

func (*RegistrationService) WithCardLogos 

func (s *RegistrationService) WithCardLogos(logger *slog.Logger, db *pgxpool.Pool, storage assets.BlobStore) *RegistrationService

WithCardLogos lets result cards show the logo stored for an MCP server. Without it every card shows the server's first letter.

func (*RegistrationService) WithClientAdmission 

func (s *RegistrationService) WithClientAdmission(clientAdmission *ClientAdmissionService) *RegistrationService

WithClientAdmission enables reading and setting the CIMD client admission policy of a registered MCP's session issuer over MCP, which is otherwise reachable only from the dashboard's Authentication settings.

func (*RegistrationService) WithDashboardURL 

func (s *RegistrationService) WithDashboardURL(dashboardURL *url.URL) *RegistrationService

WithDashboardURL supplies the configured dashboard origin used only to build trusted same-origin setup links for persisted registrations.

func (*RegistrationService) WithDirectRemoteInspector 

func (s *RegistrationService) WithDirectRemoteInspector(inspector DirectRemoteInspector) *RegistrationService

WithDirectRemoteInspector enables direct user-supplied remote MCP admission. The inspector is server-composed because it owns Guardian-backed egress.

func (*RegistrationService) WithIdentityProviderAttachment 

func (s *RegistrationService) WithIdentityProviderAttachment(attachment CatalogIdentityProviderAttachment) *RegistrationService

WithIdentityProviderAttachment enables confirmed agent-side provider attachment using trusted lifecycle persistence and server-owned OAuth calls.

func (*RegistrationService) WithLifecycleMetadata 

func (s *RegistrationService) WithLifecycleMetadata(metadata *LifecycleMetadataService) *RegistrationService

WithLifecycleMetadata enables narrow, Platform-owned MCP display-name updates. The command is injected from server composition to share the dashboard domain implementation without importing mcpservers into Platform MCP.

func (*RegistrationService) WithLifecycleVisibility 

func (s *RegistrationService) WithLifecycleVisibility(visibility *LifecycleVisibilityService) *RegistrationService

func (*RegistrationService) WithOperationBudgets 

func (s *RegistrationService) WithOperationBudgets(budgets OperationBudgets) *RegistrationService

func (*RegistrationService) WithReadiness 

func (s *RegistrationService) WithReadiness(readiness *ReadinessService) *RegistrationService

func (*RegistrationService) WithTelemetry 

func (s *RegistrationService) WithTelemetry(telemetry LifecycleTelemetry) *RegistrationService

type RegistrationStore 

type RegistrationStore struct {
	// contains filtered or unexported fields
}

RegistrationStore owns the tenant-qualified receipt and desired-state persistence boundary. It does not fetch catalog data, call providers, or create project components.

func NewRegistrationStore 

func NewRegistrationStore(db *pgxpool.Pool) (*RegistrationStore, error)

func (*RegistrationStore) BeginProviderSetup 

func (s *RegistrationStore) BeginProviderSetup(ctx context.Context, principal Principal, binding SetupHandoffBinding, value string, adapters *ProviderAdapters) (ProviderSetupResult, error)

BeginProviderSetup redeems a single-use handoff on a trusted surface and dispatches only to the adapter bound to the registration's persisted provider.

func (*RegistrationStore) BeginReceipt 

func (s *RegistrationStore) BeginReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, error)

BeginReceipt atomically establishes the 24-hour idempotency boundary. It never creates a registration: callers first resolve catalog data outside a transaction, then use ConvergeRegistration to create or reuse the desired registration state.

func (*RegistrationStore) CompleteRegistration 

func (s *RegistrationStore) CompleteRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, configuration resolvedCatalogConfiguration) (OperationReceipt, error)

CompleteRegistration creates the local, private component stack only after a reviewed catalog adapter has validated the remote endpoint. It does not call management handlers, create plugin rows, or publish packages. CompleteRegistration resolves private resources from one server-validated catalogue configuration. Tests and older internal callers use CompleteRegistrationWithRemoteURL to build the equivalent empty configuration.

func (*RegistrationStore) CompleteRegistrationWithRemoteURL 

func (s *RegistrationStore) CompleteRegistrationWithRemoteURL(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt, remoteURL string) (OperationReceipt, error)

func (*RegistrationStore) ConsumeSetupHandoff 

func (s *RegistrationStore) ConsumeSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, value string) (SetupHandoff, error)

func (*RegistrationStore) ConvergeRegistration 

func (s *RegistrationStore) ConvergeRegistration(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, receipt OperationReceipt) (OperationReceipt, error)

ConvergeRegistration creates or reuses the active desired-state registration in one transaction. It intentionally leaves the receipt pending: only the later private-component convergence can complete the receipt and record the registration_succeeded milestone.

func (*RegistrationStore) EligibleCatalogRegistrationTarget 

func (s *RegistrationStore) EligibleCatalogRegistrationTarget(ctx context.Context, organizationID string, project ResolvedProject) (bool, error)

func (*RegistrationStore) FindReceipt 

func (s *RegistrationStore) FindReceipt(ctx context.Context, principal Principal, project ResolvedProject, request CatalogRegistrationRequest, now time.Time) (OperationReceipt, bool, error)

FindReceipt performs an existing-only, real-user scoped lookup. It never deletes expired rows or creates a new idempotency boundary.

func (*RegistrationStore) GetProviderReadiness 

func (s *RegistrationStore) GetProviderReadiness(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID) (Readiness, bool, error)

GetProviderReadiness returns the most recent normalized evidence for the principal's active connection generation. It never returns the stored authorization fingerprint or attempts provider egress.

func (*RegistrationStore) IssueSetupHandoff 

func (s *RegistrationStore) IssueSetupHandoff(ctx context.Context, principal Principal, binding SetupHandoffBinding, now time.Time) (IssuedSetupHandoff, error)

func (*RegistrationStore) ProbeProviderReadiness 

func (s *RegistrationStore) ProbeProviderReadiness(ctx context.Context, principal Principal, projectID, registrationID uuid.UUID, adapters *ProviderAdapters, generic ...CatalogReadinessProber) (Readiness, error)

ProbeProviderReadiness delegates fixture registrations to their reviewed adapter and browser-catalogue registrations to the persisted Remote MCP source path. Both paths persist only normalized, generation-bound evidence.

func (*RegistrationStore) RecordReadiness 

func (s *RegistrationStore) RecordReadiness(ctx context.Context, principal Principal, binding ReadinessBinding, state ReadinessState, evidenceCode string, checkedAt, expiresAt time.Time) (Readiness, error)

func (*RegistrationStore) ResolveProject 

func (s *RegistrationStore) ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)

func (*RegistrationStore) ResolveRegistrationCatalogIdentity 

func (s *RegistrationStore) ResolveRegistrationCatalogIdentity(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (CatalogCandidate, error)

func (*RegistrationStore) ResolveRegistrationDashboardSetup 

func (s *RegistrationStore) ResolveRegistrationDashboardSetup(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID) (RegistrationDashboardSetup, error)

ResolveRegistrationDashboardSetup derives the only dashboard continuation target from the lifecycle-bound private resources. The agent never receives the Remote MCP source URL or configuration values.

func (*RegistrationStore) ResolveRegistrationPendingSecretFields 

func (s *RegistrationStore) ResolveRegistrationPendingSecretFields(ctx context.Context, principal Principal, project ResolvedProject, registrationID uuid.UUID, declared []CatalogConfigurationField) ([]CatalogConfigurationField, error)

ResolveRegistrationPendingSecretFields projects the persisted secret-header state without reading or decrypting secret values. It is used for idempotent registration replays so the agent is not sent back to dashboard setup after the user has already completed it there.

func (*RegistrationStore) WithServerIcons 

func (s *RegistrationStore) WithServerIcons(icons mcpservers.DefaultServerIconSetter) *RegistrationStore

WithServerIcons fetches and stores a logo for each MCP server this store adds, so result cards and the dashboard can show it.

type RegistryCatalog 

type RegistryCatalog struct {
	// contains filtered or unexported fields
}

func NewRegistryCatalog 

func NewRegistryCatalog(client *externalmcp.RegistryClient, descriptors []CatalogDescriptor) *RegistryCatalog

func NewRegistryCatalogSources 

func NewRegistryCatalogSources(sources []RegistryCatalogSource) *RegistryCatalog

NewRegistryCatalogSources composes only server-owned registry sources. The opaque ProviderKey remains unique across every source, preventing a selected entry from being reinterpreted against a different registry.

func (*RegistryCatalog) Inspect 

func (c *RegistryCatalog) Inspect(ctx context.Context, providerKey, catalogRef string) (CatalogDetails, error)

func (*RegistryCatalog) Search 

func (c *RegistryCatalog) Search(ctx context.Context, query string) ([]CatalogCandidate, error)

type RegistryCatalogSource 

type RegistryCatalogSource struct {
	// Client is constructed by server composition. The local fixture uses a
	// development-CA-aware client; normal browser-catalogue registries share the
	// standard client. It is never chosen from Platform MCP input. Every source is
	// strict: search fails closed rather than presenting a partial reviewed catalog.
	Client      externalmcp.RegistryReader
	Descriptors []CatalogDescriptor
}

type RegistryCatalogSourceLoader 

type RegistryCatalogSourceLoader func(ctx context.Context) ([]RegistryCatalogSource, error)

type RemoteMCPReadinessProber 

type RemoteMCPReadinessProber struct {
	// contains filtered or unexported fields
}

RemoteMCPReadinessProber is the generic browser-catalogue readiness path. It intentionally has no provider descriptor: source URL, configured headers and attached remote identity provider are all read from the persisted Remote MCP resources created during registration.

func NewRemoteMCPReadinessProber 

func NewRemoteMCPReadinessProber(logger *slog.Logger, db *pgxpool.Pool, enc *encryption.Client, policy *guardian.Policy, sessions *remotesessions.ChallengeManager) *RemoteMCPReadinessProber

func (*RemoteMCPReadinessProber) ProbeCatalogReadiness 

func (p *RemoteMCPReadinessProber) ProbeCatalogReadiness(ctx context.Context, principal Principal, projectID, registrationID, remoteMCPServerID, userSessionIssuerID, connectionID, generation uuid.UUID) (ProviderReadinessProbeResult, error)

func (*RemoteMCPReadinessProber) WithIdentityChaining 

func (p *RemoteMCPReadinessProber) WithIdentityChaining(governor IdentityChainingGovernor) *RemoteMCPReadinessProber

WithIdentityChaining judges upstreams without an interactive session by identity chaining: ready on a usable chained credential, otherwise marked configured.

type RemovePluginServerInput 

type RemovePluginServerInput struct {
	ProjectID    string `json:"project_id" jsonschema:"explicit project ID owning the plugin"`
	PluginID     string `json:"plugin_id" jsonschema:"exact plugin ID; no default or name fallback"`
	MembershipID string `` /* 131-byte string literal not displayed */
	Confirmed    bool   `json:"confirmed" jsonschema:"true only after the user confirms removal of this exact membership"`
}

type RemovePluginServerOutput 

type RemovePluginServerOutput struct {
	ProjectID    string `json:"project_id"`
	PluginID     string `json:"plugin_id"`
	MembershipID string `json:"membership_id"`
	Removed      bool   `json:"removed"`
	Message      string `json:"message"`
}

type RemoveSelfFromRiskPolicyReceiptResult 

type RemoveSelfFromRiskPolicyReceiptResult struct{ UpdateRiskPolicyReceiptResult }

type RenamePluginInput 

type RenamePluginInput struct {
	ProjectID      string `json:"project_id" jsonschema:"explicit project ID that owns the plugin"`
	Plugin         string `json:"plugin" jsonschema:"exact plugin ID, slug, or name returned by list_plugins"`
	Name           string `json:"name" jsonschema:"new administrator-facing plugin name; at most 256 bytes"`
	IdempotencyKey string `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact rename"`
	Confirmed      bool   `json:"confirmed" jsonschema:"set true only after the user explicitly confirms the exact plugin and its new name"`
}

type RenameProjectInput 

type RenameProjectInput struct {
	ProjectID      string `json:"project_id" jsonschema:"ID of the project to rename, from list_projects"`
	Name           string `json:"name" jsonschema:"new display name, 1 to 40 characters after trimming"`
	IdempotencyKey string `json:"idempotency_key" jsonschema:"caller-chosen key, at most 128 characters, that makes a retry of this exact rename safe"`
	Confirmed      bool   `json:"confirmed" jsonschema:"true only after the user confirmed this exact project and new name"`
}

type RepairAction 

type RepairAction struct {
	Kind  string `json:"kind"`
	Label string `json:"label"`
}

type RepublishPluginInput 

type RepublishPluginInput struct {
	ProjectID      string `json:"project_id" jsonschema:"explicit project ID that owns the plugin"`
	Plugin         string `json:"plugin" jsonschema:"exact plugin ID, slug, or name returned by list_plugins"`
	Confirmed      bool   `` /* 181-byte string literal not displayed */
	IdempotencyKey string `` /* 132-byte string literal not displayed */
}

type RepublishPluginOutput 

type RepublishPluginOutput struct {
	// ProjectID echoes the project whose packages were republished.
	ProjectID string `json:"project_id"`

	// Plugin is the plugin the request named.
	Plugin RepublishedPlugin `json:"plugin"`

	// Outcome is "enqueued" or "already_current".
	Outcome string `json:"outcome"`

	// PublicationEvidence is read after the request committed. Right after an
	// enqueue it normally still reports fresh=false.
	PublicationEvidence *PluginPublicationEvidence `json:"publication_evidence"`

	// Note states whether a publish was requested and that it is asynchronous.
	Note string `json:"note"`

	// Receipt identifies the idempotent request.
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type RepublishedPlugin 

type RepublishedPlugin struct {
	// ID is the resolved plugin ID.
	ID string `json:"id"`

	// Name is the administrator-facing plugin name.
	Name string `json:"name"`

	// Slug is the plugin's project-unique slug.
	Slug string `json:"slug"`

	// IsDefault marks the project's fallback plugin.
	IsDefault bool `json:"is_default"`
}

RepublishedPlugin echoes the plugin the request resolved to.

type RequestMCPReviewInput 

type RequestMCPReviewInput struct {
	ProjectID     string `json:"project_id" jsonschema:"explicit project ID returned by list_projects"`
	TargetKind    string `json:"target_kind" jsonschema:"server_url or stdio_command"`
	Target        string `json:"target" jsonschema:"server URL or command to review; credential-shaped values are redacted before storage"`
	Justification string `json:"justification" jsonschema:"why you need this MCP server; required and visible to reviewers"`
}

type RequestMCPReviewOutput 

type RequestMCPReviewOutput struct {
	RequestID  string `json:"request_id"`
	ProjectID  string `json:"project_id"`
	TargetKind string `json:"target_kind"`
	Target     string `json:"target"`
	Status     string `json:"status"`
	CreatedAt  string `json:"created_at"`
	UpdatedAt  string `json:"updated_at"`
	NextAction string `json:"next_action"`
	ReviewURL  string `json:"review_url,omitempty"`
}

type ResolveDirectoryReviewItemInput 

type ResolveDirectoryReviewItemInput struct {
	ItemID    string                      `json:"item_id" jsonschema:"exact item_id returned by list_directory_review_items"`
	Decision  string                      `json:"decision" jsonschema:"approve, dismiss, or opt_out_key (new attribute values only)"`
	Version   string                      `json:"version,omitempty" jsonschema:"the item's version from list_directory_review_items; required to approve"`
	Roles     []DirectoryReviewRoleChoice `` /* 173-byte string literal not displayed */
	Confirmed bool                        `json:"confirmed" jsonschema:"true only after the user confirms this exact item, decision and role set"`
}

type ResolveDirectoryReviewItemOutput 

type ResolveDirectoryReviewItemOutput struct {
	ItemID          string                       `json:"item_id"`
	State           string                       `json:"state" jsonschema:"approved or dismissed"`
	CreatedRoles    []DirectoryReviewCreatedRole `json:"created_roles"`
	MappedRoles     []DirectoryReviewMappedRole  `json:"mapped_roles"`
	RequestedWork   []string                     `json:"requested_work" jsonschema:"follow-up work requested after commit, never reported as done"`
	PendingItems    *int                         `` /* 132-byte string literal not displayed */
	NextSafeActions string                       `json:"next_safe_actions"`
}

type ResolvedProject 

type ResolvedProject struct {
	ID   uuid.UUID
	Name string
	Slug string
}

type ResolvedWindow 

type ResolvedWindow struct {
	Window DiagnosticWindow `json:"window"`
	From   string           `json:"from"`
	To     string           `json:"to"`
	// contains filtered or unexported fields
}

ResolvedWindow is the window a diagnostic actually read, echoed on every result. A caller never has to infer it from what it asked for.

type ResourceDescriptor 

type ResourceDescriptor struct {
	URI         string
	Name        string
	Title       string
	Description string
	MIMEType    string
	Meta        ResourceMeta
	// contains filtered or unexported fields
}

ResourceDescriptor is one registered resource, reachable either through the MCP server's resources/* methods or by direct read.

The direct path exists for the same reason Descriptor's does: a surface that speaks Go rather than MCP — the project assistant — must serve the same corpus, gated the same way, or a citation link returned by search would resolve on one surface and dangle on the other.

func (ResourceDescriptor) Read 

func (d ResourceDescriptor) Read(ctx context.Context) (string, error)

Read returns the resource's current text. It is a function rather than a field because freshness is evaluated per read: a guide that passes its revalidation date while the process is running must not keep being served as though it were reviewed today.

type ResourceMeta 

type ResourceMeta struct {
	Authorization ExternalAuthorization
	Audiences     []Audience
}

ResourceMeta is what a resource declares beyond its content: who may read it and which live policy protects external reads. Resources carry no project scope — a reviewed guide is the same document for every project in the organization.

type ResumeDataExportRouteInput 

type ResumeDataExportRouteInput struct {
	ProjectID             string `json:"project_id" jsonschema:"project ID that owns the route, from list_data_exports"`
	RouteID               string `json:"route_id" jsonschema:"exact route ID from list_data_exports"`
	ExpectedDataSource    string `` /* 128-byte string literal not displayed */
	ExpectedDestinationID string `` /* 182-byte string literal not displayed */
	IdempotencyKey        string `json:"idempotency_key" jsonschema:"caller-chosen key that makes a retry of this exact change safe"`
	Confirmed             bool   `json:"confirmed" jsonschema:"true only after the user confirmed this exact project, route, data source, and destination"`
}

ResumeDataExportRouteInput adds the route configuration the user was shown. Resume starts data leaving the platform, so it must start it toward exactly what was confirmed: if the route was repointed or re-sourced after it was read, the resume is refused instead of exporting somewhere nobody saw.

type RiskAnalysisStatusService 

type RiskAnalysisStatusService struct {
	// contains filtered or unexported fields
}

RiskAnalysisStatusService answers "when did the Watchdog analysis last run" for one project. The analysis is event-driven rather than scheduled, so the answer is the state of its most recent run.

func NewRiskAnalysisStatusService 

func NewRiskAnalysisStatusService(logger *slog.Logger, db *pgxpool.Pool, describer analysisstatus.Describer) *RiskAnalysisStatusService

NewRiskAnalysisStatusService returns nil when the analysis run state cannot be described in this deployment, so the registrar serves the tool as a stub rather than reporting a made-up state.

func (*RiskAnalysisStatusService) Get 

func (s *RiskAnalysisStatusService) Get(ctx context.Context, principal Principal, input GetRiskAnalysisStatusInput) (GetRiskAnalysisStatusOutput, error)

Get resolves the project and describes its analysis run state.

type RiskCompatibility 

type RiskCompatibility struct {
	State             string   `json:"state"`
	UnsupportedFields []string `json:"unsupported_fields"`
}

type RiskDetectionScope 

type RiskDetectionScope struct {
	Category     string   `json:"category"`
	MessageTypes []string `json:"message_types"`
}

type RiskExclusionReceiptSummary 

type RiskExclusionReceiptSummary struct {
	ID        string  `json:"id"`
	PolicyID  *string `json:"policy_id,omitempty"`
	MatchType string  `json:"match_type"`
	Enabled   bool    `json:"enabled"`
}

RiskExclusionReceiptSummary omits match values and filters even for allowlisted match types so exact and legacy-regex content can never leak.

type RiskExclusionSummary 

type RiskExclusionSummary struct {
	ID               string            `json:"id"`
	PolicyID         *string           `json:"policy_id,omitempty"`
	MatchType        string            `json:"match_type"`
	MatchValue       string            `json:"match_value,omitempty"`
	MatchFingerprint string            `json:"match_fingerprint,omitempty"`
	MatchLength      int               `json:"match_length,omitempty"`
	RuleIDFilter     string            `json:"rule_id_filter,omitempty"`
	SourceFilter     string            `json:"source_filter,omitempty"`
	Enabled          bool              `json:"enabled"`
	Version          string            `json:"version"`
	CreatedAt        string            `json:"created_at"`
	UpdatedAt        string            `json:"updated_at"`
	Compatibility    RiskCompatibility `json:"compatibility"`
}

type RiskFinding 

type RiskFinding struct {
	ID                 string   `json:"id"`
	PolicyID           string   `json:"policy_id"`
	PolicyVersion      int64    `json:"policy_version"`
	ExecutionID        string   `` /* 206-byte string literal not displayed */
	MCPServerID        string   `json:"mcp_server_id,omitempty"`
	MetaMCPServerID    string   `json:"meta_mcp_server_id,omitempty"`
	ToolsetID          string   `json:"toolset_id,omitempty"`
	ToolName           string   `json:"tool_name,omitempty"`
	Phase              string   `json:"phase,omitempty" jsonschema:"which phase of the mediated MCP execution was scanned: its request or its response"`
	MediationSurface   string   `json:"mediation_surface,omitempty"`
	MCPMethod          string   `json:"mcp_method,omitempty"`
	PrincipalKind      string   `json:"principal_kind,omitempty"`
	IdentityStamped    bool     `json:"identity_stamped,omitempty"`
	EnforcementOutcome string   `json:"enforcement_outcome,omitempty"`
	ChatID             string   `json:"chat_id,omitempty"`
	ChatMessageID      string   `json:"chat_message_id,omitempty"`
	UserReference      string   `json:"user_reference,omitempty"`
	Source             string   `json:"source"`
	RuleID             string   `json:"rule_id"`
	Category           string   `json:"category"`
	Severity           string   `json:"severity"`
	Score              float64  `json:"score"`
	MatchRedacted      string   `json:"match_redacted"`
	Confidence         float64  `json:"confidence"`
	Tags               []string `json:"tags"`
	MessageCreatedAt   string   `json:"message_created_at"`
}

RiskFinding is one individual finding. The matched value is present only as the canonical redaction marker; identities are organization-scoped pseudonyms shared with list_watchdog_findings. The scanner description is deliberately absent: for prompt-policy and destructive-action sources it is a rationale that can quote the scanned content verbatim.

type RiskFindingChatSummary 

type RiskFindingChatSummary struct {
	ChatID           string `json:"chat_id"`
	UserReference    string `json:"user_reference,omitempty"`
	FindingsCount    int64  `json:"findings_count"`
	LatestDetectedAt string `json:"latest_detected_at"`
}

type RiskFindingFalsePositiveReceipt 

type RiskFindingFalsePositiveReceipt struct {
	Project RiskMutationReceiptProject `json:"project"`

	// ChangedFindingIDs moved into the requested state in this call.
	ChangedFindingIDs []string `json:"changed_finding_ids"`

	// AlreadyInRequestedStateFindingIDs exist in the project but were already
	// dismissed (mark) or already active (unmark).
	AlreadyInRequestedStateFindingIDs []string `json:"already_in_requested_state_finding_ids"`

	// NotFoundFindingIDs do not exist in the named project.
	NotFoundFindingIDs []string `json:"not_found_finding_ids"`

	// ResultCategory is dismissed or restored when at least one finding
	// changed, and no_change otherwise.
	ResultCategory string `json:"result_category"`
}

RiskFindingFalsePositiveReceipt partitions every requested finding id into exactly one outcome. Unknown ids never fail the call: they are reported so the agent can tell the user which findings it could not act on.

type RiskFindingGroup 

type RiskFindingGroup struct {
	Value string `json:"value"`
	Count uint64 `json:"count"`
}

type RiskFindingGroups 

type RiskFindingGroups struct {
	Dimension string             `json:"dimension"`
	Groups    []RiskFindingGroup `json:"groups"`
	Truncated bool               `json:"truncated"`
}

type RiskFindingListReader 

type RiskFindingListReader interface {
	ListRiskFindings(context.Context, chrepo.ListRiskFindingsParams) ([]chrepo.RiskFindingListRow, error)
	GroupRiskFindingsByChat(context.Context, chrepo.GroupRiskFindingsByChatParams) ([]chrepo.RiskFindingChatGroup, error)
	ListRiskRuleCountsByCategory(context.Context, chrepo.RiskOverviewWindowParams, string, []string, uint64) ([]chrepo.RiskOverviewRuleCount, error)
}

RiskFindingListReader is the ClickHouse read path for individual findings. Rows carry only the ingest-time display string for the match, never the raw value, and the service re-redacts that string before it leaves the server.

type RiskFindingListService 

type RiskFindingListService struct {
	// contains filtered or unexported fields
}

RiskFindingListService serves individual risk findings, their per-chat rollup and per-rule counts for one category from ClickHouse, the same store as the dashboard's Risk Events listing. Postgres supplies project and policy lookups, since ClickHouse cannot join risk_policies.

func NewRiskFindingListService 

func NewRiskFindingListService(db *pgxpool.Pool, clickhouse RiskFindingListReader, key string) *RiskFindingListService

NewRiskFindingListService panics if the cursor key is missing.

func (*RiskFindingListService) List 

func (s *RiskFindingListService) List(ctx context.Context, principal Principal, input ListRiskFindingPageInput) (ListRiskFindingPageOutput, error)

func (*RiskFindingListService) ListByChat 

func (s *RiskFindingListService) ListByChat(ctx context.Context, principal Principal, input ListRiskFindingsByChatInput) (ListRiskFindingsByChatOutput, error)

func (*RiskFindingListService) RuleBreakdown 

func (s *RiskFindingListService) RuleBreakdown(ctx context.Context, principal Principal, input GetRiskRuleBreakdownInput) (GetRiskRuleBreakdownOutput, error)

type RiskFindingsReader 

type RiskFindingsReader interface {
	ListWatchdogAlerts(context.Context, chrepo.RiskSignalWindowParams, uint64) ([]chrepo.WatchdogAlert, error)
	GroupWatchdogAlerts(context.Context, chrepo.RiskSignalWindowParams, []string, string) ([]chrepo.WatchdogAlertGroup, error)
}

RiskFindingsReader reads grouped metadata and stored display samples, never raw matches.

type RiskFindingsService 

type RiskFindingsService struct {
	// contains filtered or unexported fields
}

func NewRiskFindingsService 

func NewRiskFindingsService(db *pgxpool.Pool, findings RiskFindingsReader, key string) *RiskFindingsService

func (*RiskFindingsService) List 

func (s *RiskFindingsService) List(ctx context.Context, principal Principal, input ListRiskFindingsInput) (ListRiskFindingsOutput, error)

type RiskMutationControls 

type RiskMutationControls struct {
	// contains filtered or unexported fields
}

RiskMutationControls owns the checks shared by every risk write. Admission is intentionally separate from receipt execution so callers can prove the flag fails before opening a write transaction; the budget is charged, also before any transaction, only when no completed receipt answers the request.

func NewRiskMutationControls 

func NewRiskMutationControls(db *pgxpool.Pool, flags feature.Provider, organizations OrganizationSlugResolver, budget OperationBudget, keyMaterial string) (*RiskMutationControls, error)

func (*RiskMutationControls) Admit 

func (c *RiskMutationControls) Admit(ctx context.Context, principal Principal, projectSlug string) (ResolvedProject, error)

Admit resolves an explicit project and checks its exact rollout cohort at invocation time. Missing providers, errors, and indeterminate evaluations all fail closed. The mutation budget is charged later, by Charge, and only when the write is not a replay.

func (*RiskMutationControls) Charge 

func (c *RiskMutationControls) Charge(principal Principal) func(context.Context) error

Charge returns the mutation budget charge for one risk write. The receipt store runs it only when no completed receipt answers the request, and outside any transaction; see executeChargedMutationReceipt.

func (*RiskMutationControls) Receipts 

func (c *RiskMutationControls) Receipts() *RiskMutationReceiptStore

func (*RiskMutationControls) Versions 

func (c *RiskMutationControls) Versions() *riskVersionCodec

type RiskMutationError 

type RiskMutationError struct {
	Code    string
	Message string
	Cause   error
}

RiskMutationError is safe to map into a tool refusal. Message deliberately contains no policy, prompt, URL, principal, CEL, or exclusion material.

func (*RiskMutationError) Error 

func (e *RiskMutationError) Error() string

func (*RiskMutationError) Unwrap 

func (e *RiskMutationError) Unwrap() error

type RiskMutationHandlers 

type RiskMutationHandlers struct {
	ChangeAudience              mcp.ToolHandlerFor[map[string]any, UpdateRiskPolicyToolOutput]
	RemoveSelf                  mcp.ToolHandlerFor[map[string]any, UpdateRiskPolicyToolOutput]
	Controls                    *RiskMutationControls
	CreatePolicy                mcp.ToolHandlerFor[map[string]any, CreateRiskPolicyToolOutput]
	UpdatePolicy                mcp.ToolHandlerFor[map[string]any, UpdateRiskPolicyToolOutput]
	CreateExclusion             mcp.ToolHandlerFor[map[string]any, CreateRiskExclusionToolOutput]
	UpdateExclusion             mcp.ToolHandlerFor[map[string]any, UpdateRiskExclusionToolOutput]
	MarkFindingsFalsePositive   mcp.ToolHandlerFor[map[string]any, MarkRiskFindingsFalsePositiveToolOutput]
	UnmarkFindingsFalsePositive mcp.ToolHandlerFor[map[string]any, UnmarkRiskFindingsFalsePositiveToolOutput]
}

RiskMutationHandlers names the independently selectable write callbacks. Every callback has an exported success type that composition code can construct, while the schemas remain owned by this package. A nil callback keeps its tool in the catalogue as a stable "not enabled" stub.

func NewRiskMutationHandlers 

func NewRiskMutationHandlers(db *pgxpool.Pool, controls *RiskMutationControls, policies *policycore.Core, exclusions *exclusioncore.Core, falsePositives *risk.FalsePositiveCore) (*RiskMutationHandlers, error)

NewRiskMutationHandlers activates policy, exclusion, and per-finding false-positive mutation callbacks. A nil exclusions or falsePositives core leaves the matching tools registered as stable "not enabled" stubs.

func NewRiskPolicyMutationHandlers 

func NewRiskPolicyMutationHandlers(db *pgxpool.Pool, controls *RiskMutationControls, policies *policycore.Core) (*RiskMutationHandlers, error)

NewRiskPolicyMutationHandlers retains the policy-only composition used by the preceding rollout slice.

type RiskMutationReceiptProject 

type RiskMutationReceiptProject struct {
	ID   string `json:"id"`
	Slug string `json:"slug"`
}

type RiskMutationReceiptRequest 

type RiskMutationReceiptRequest struct {
	Operation      string
	IdempotencyKey string
	Input          any
}

RiskMutationReceiptRequest is the safe identity of one normalized write. Input must already have schema defaults, canonical ordering, and transport aliases resolved. It is hashed and is never persisted or logged directly.

type RiskMutationReceiptResult 

type RiskMutationReceiptResult interface {
	// contains filtered or unexported methods
}

RiskMutationReceiptResult is implemented only by the closed, redacted result projections below and the finding false-positive projections beside them. Callbacks cannot supply an open JSON object, so a new user-authored field cannot silently enter operation receipts.

type RiskMutationReceiptStore 

type RiskMutationReceiptStore struct {
	// contains filtered or unexported fields
}

func NewRiskMutationReceiptStore 

func NewRiskMutationReceiptStore(db *pgxpool.Pool) *RiskMutationReceiptStore

func (*RiskMutationReceiptStore) Execute 

func (s *RiskMutationReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, request RiskMutationReceiptRequest, charge func(context.Context) error, mutate RiskMutationTransaction) (OperationReceipt, error)

Execute serializes one user's exact operation/project/key, replays an exact completed input from its stored result without charging, and commits receipt + domain + audit atomically. Any callback, completion, or commit failure rolls all three back.

type RiskMutationToolReceipt 

type RiskMutationToolReceipt struct {
	ID       string `json:"id"`
	Replayed bool   `json:"replayed"`
}

type RiskMutationTransaction 

type RiskMutationTransaction func(ctx context.Context, tx pgx.Tx) (RiskMutationReceiptResult, error)

RiskMutationTransaction performs the domain write and audit write using the same transaction that owns the receipt. Its result must be one of the closed operation-specific projections above.

type RiskPolicyAudience 

type RiskPolicyAudience struct {
	Type          string   `json:"type"`
	PrincipalURNs []string `json:"principal_urns"`
}

RiskPolicyAudience describes positive grants, not exclusions or effective membership.

type RiskPolicyDetail 

type RiskPolicyDetail struct {
	Audience *RiskPolicyAudience `json:"audience,omitempty"`
	RiskPolicySummary
	Version                string               `json:"version"`
	PresidioEntities       []string             `json:"presidio_entities"`
	PresidioScoreThreshold *float64             `json:"presidio_score_threshold,omitempty"`
	ApprovedEmailDomains   []string             `json:"approved_email_domains"`
	DisabledRules          []string             `json:"disabled_rules"`
	DetectionScopes        []RiskDetectionScope `json:"detection_scopes"`
	MCPScope               *RiskPolicyMCPScope  `json:"mcp_scope,omitempty"`
	UserMessage            *string              `json:"user_message,omitempty"`
	Prompt                 *string              `json:"prompt,omitempty"`
}

type RiskPolicyDraft 

type RiskPolicyDraft struct {
	Preset           string   `json:"preset,omitempty"`
	PolicyType       string   `json:"policy_type"`
	Name             string   `json:"name"`
	Enabled          bool     `json:"enabled"`
	Action           string   `json:"action"`
	Score            float64  `json:"score"`
	Sources          []string `json:"sources,omitempty"`
	PresidioEntities []string `json:"presidio_entities,omitempty"`
	Prompt           string   `json:"prompt,omitempty"`
	UserMessage      string   `json:"user_message,omitempty"`
}

type RiskPolicyMCPScope 

type RiskPolicyMCPScope struct {
	AllServers      bool                       `json:"all_servers"`
	ToolAnnotations []string                   `json:"tool_annotations"`
	Servers         []RiskPolicyMCPServerScope `json:"servers"`
}

RiskPolicyMCPScope is present when a policy is limited to MCP tool calls through chosen servers and checked at the gateway before the tool runs. Absent means the policy applies to agent sessions instead.

type RiskPolicyMCPServerScope 

type RiskPolicyMCPServerScope struct {
	MCPServerID string   `json:"mcp_server_id"`
	Tools       []string `json:"tools,omitempty"`
}

RiskPolicyMCPServerScope selects one server. Tools is absent when the server follows the policy's tool_annotations rule, and ["*"] when every tool on it is in scope.

type RiskPolicyReceiptSummary 

type RiskPolicyReceiptSummary struct {
	ID         string `json:"id"`
	PolicyType string `json:"policy_type"`
	Enabled    bool   `json:"enabled"`
	Action     string `json:"action,omitempty"`
}

RiskPolicyReceiptSummary contains only fixed-vocabulary administrative state. Policy names, prompts, CEL, model configuration, principals, and URLs are deliberately absent.

type RiskPolicySummary 

type RiskPolicySummary struct {
	ID              string                 `json:"id"`
	Name            string                 `json:"name"`
	PolicyType      string                 `json:"policy_type"`
	Enabled         bool                   `json:"enabled"`
	Action          string                 `json:"action,omitempty"`
	Sources         []string               `json:"sources"`
	Score           float64                `json:"score"`
	CreatedAt       string                 `json:"created_at"`
	UpdatedAt       string                 `json:"updated_at"`
	Compatibility   RiskCompatibility      `json:"compatibility"`
	ShadowDecisions *ShadowPolicyDecisions `json:"shadow_decisions,omitempty"`
}

type RiskPolicyVersionGrant 

type RiskPolicyVersionGrant struct {
	PrincipalURN string          `json:"principal_urn"`
	Selector     json.RawMessage `json:"selector"`
}

RiskPolicyVersionGrant captures the complete enforcement identity of one URL grant. The principal and canonical selector remain inside the opaque HMAC.

type RiskPolicyVersionState 

type RiskPolicyVersionState struct {
	Policy                policycore.Policy
	AnalyzerConfig        json.RawMessage
	AllowedURLGrants      []RiskPolicyVersionGrant
	BlockedURLGrants      []RiskPolicyVersionGrant
	StandingDecisionState []string
}

RiskPolicyVersionState is the complete locked policy state needed for an optimistic-concurrency token. Grant-backed URL selectors and audiences, standing-decision state, and canonical analyzer JSON are included because they can change enforcement without changing the policy's public summary. They remain inside the HMAC.

type RiskPresetAlternative 

type RiskPresetAlternative struct {
	Preset     string  `json:"preset"`
	Label      string  `json:"label"`
	Confidence float64 `json:"confidence"`
}

type RiskPresetSummary 

type RiskPresetSummary struct {
	ID                           string   `json:"id"`
	Label                        string   `json:"label"`
	Description                  string   `json:"description"`
	PolicyType                   string   `json:"policy_type"`
	Sources                      []string `json:"sources"`
	PresidioEntities             []string `json:"presidio_entities"`
	Action                       string   `json:"action"`
	Score                        float64  `json:"score"`
	Prompt                       string   `json:"prompt,omitempty"`
	UserMessage                  string   `json:"user_message,omitempty"`
	RequiresApprovedEmailDomains bool     `json:"requires_approved_email_domains"`
	RequiresPromptPolicies       bool     `json:"requires_prompt_policies"`
	CanScopeToMCP                bool     `json:"can_scope_to_mcp"`
}

type RiskProject 

type RiskProject struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type RiskReadService 

type RiskReadService struct {
	// contains filtered or unexported fields
}

func (*RiskReadService) GetPolicy 

func (s *RiskReadService) GetPolicy(ctx context.Context, principal Principal, input GetRiskPolicyInput) (GetRiskPolicyOutput, error)

func (*RiskReadService) ListExclusions 

func (s *RiskReadService) ListExclusions(ctx context.Context, principal Principal, input ListRiskExclusionsInput) (ListRiskExclusionsOutput, error)

func (*RiskReadService) ListPolicies 

func (s *RiskReadService) ListPolicies(ctx context.Context, principal Principal, input ListRiskPoliciesInput) (ListRiskPoliciesOutput, error)

type RiskRuleCount 

type RiskRuleCount struct {
	RuleID   string `json:"rule_id"`
	Source   string `json:"source"`
	Findings int64  `json:"findings"`
}

type RiskTelemetry 

type RiskTelemetry interface {
	Record(context.Context, RiskToolEvent, time.Duration)
}

func NewRiskTelemetry 

func NewRiskTelemetry(logger *slog.Logger, meterProvider metric.MeterProvider) RiskTelemetry

type RiskToolEvent 

type RiskToolEvent struct {
	Tool           string
	Outcome        string
	Replay         string
	CatalogVersion string
	Reconciliation string
}

type RunAnalyticsQueryInput 

type RunAnalyticsQueryInput struct {
	ProjectID  string             `json:"project_id"`
	Dataset    string             `json:"dataset"`
	From       string             `json:"from"`
	To         string             `json:"to"`
	Grain      string             `json:"grain,omitempty"`
	Dimensions []string           `json:"dimensions,omitempty"`
	Measures   []AnalyticsMeasure `json:"measures,omitempty"`
	Filters    []AnalyticsFilter  `json:"filters,omitempty"`
	OrderBy    []AnalyticsOrderBy `json:"order_by,omitempty"`
	Limit      int                `json:"limit,omitempty"`
	Ungrouped  bool               `json:"ungrouped,omitempty"`
	// SignalQuery is the named signal measurement, with explicit sensor and rule.
	SignalQuery *signalquery.Request `json:"signal_query,omitempty"`
}

RunAnalyticsQueryInput is a query against one dataset, mirroring the analytics RPC's payload.

type RunAnalyticsQueryOutput 

type RunAnalyticsQueryOutput struct {
	Project AnalyticsProject `json:"project"`
	Dataset string           `json:"dataset"`
	// Plan is a stable diagnostic identifier, not a table name.
	Plan    string            `json:"plan"`
	Columns []AnalyticsColumn `json:"columns"`
	Rows    []map[string]any  `json:"rows"`
	// SignalResult preserves measurement and completeness metadata beside Rows.
	SignalResult *analytics.SignalResult `json:"signal_result,omitempty"`
}

RunAnalyticsQueryOutput serves both modes: row keys are the dimensions and measure aliases, plus time_bucket under a grain or time when ungrouped.

type Runtime 

type Runtime struct {
	// contains filtered or unexported fields
}

func NewRuntime 

func NewRuntime(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource) *Runtime

func NewRuntimeWithFeedback 

func NewRuntimeWithFeedback(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService) *Runtime

func NewRuntimeWithLifecycle 

func NewRuntimeWithLifecycle(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService, onboarding *OnboardingService, distributions *DistributionService, skills *SkillsService, diagnostics *DiagnosticsService, plugins *PluginsService, sessionRecall *SessionRecallService, candidate CatalogDescriptor) *Runtime

NewRuntimeWithLifecycle wires the Platform MCP onboarding lifecycle. Catalogue selection remains server-validated: callers receive only search/inspect identities and declared configuration fields, never an arbitrary endpoint or provider credential.

func NewRuntimeWithRiskMutations 

func NewRuntimeWithRiskMutations(logger *slog.Logger, authenticator Authenticator, gate Gate, authorizer Authorizer, protectedResourceURL, cursorKeyMaterial string, reader Reader, catalog Catalog, registrations *RegistrationService, readiness ReadinessRecorder, setupResources []SetupResource, feedback *FeedbackService, onboarding *OnboardingService, distributions *DistributionService, skills *SkillsService, diagnostics *DiagnosticsService, workflowRun *WorkflowRunService, plugins *PluginsService, sessionRecall *SessionRecallService, riskMutations *RiskMutationHandlers, candidate CatalogDescriptor, accessReads *AccessReadService, accessRoleMutations *AccessRoleMutationService, assistantIdentity *AssistantIdentityService, signalAuthoring *SignalAuthoringService, connectionMutations ...*MCPConnectionMutationService) *Runtime

func (*Runtime) AssistantTools 

func (r *Runtime) AssistantTools() []Descriptor

AssistantTools returns the descriptors admitted to a project's managed assistant. The assistant adapter composes these directly; nothing else in the catalogue reaches it.

func (*Runtime) Handler 

func (r *Runtime) Handler() http.Handler

func (*Runtime) WithDiscovery 

func (r *Runtime) WithDiscovery(config DiscoveryConfig) *Runtime

WithDiscovery lets the flag move a caller's harness to the small surface.

func (*Runtime) WithOAuthTelemetry 

func (r *Runtime) WithOAuthTelemetry(telemetry OAuthTelemetry) *Runtime

func (*Runtime) WithRiskTelemetry 

func (r *Runtime) WithRiskTelemetry(telemetry RiskTelemetry) *Runtime

func (*Runtime) WithSkills 

func (r *Runtime) WithSkills(catalog *mcpskills.EmbeddedCatalog, gate SkillsGate) (*Runtime, error)

WithSkills serves the embedded Platform MCP skills over the Skills extension to callers whose organization the gate admits: the same catalog, byte for byte, that the Platform MCP package carries and the assistant toolset serves. For any other caller the surface is unchanged: no extension is declared, skills/list and skills/get are unknown methods, and a skill:// read is an ordinary resource that is not found. Skills are never listed by resources/list.

type SearchCatalogInput 

type SearchCatalogInput struct {
	Query       string `json:"query,omitempty" jsonschema:"optional search text; only reviewed catalog candidates are returned"`
	ProviderKey string `json:"provider_key,omitempty" jsonschema:"optional reviewed provider key to filter"`
	Cursor      string `json:"cursor,omitempty" jsonschema:"opaque continuation cursor returned by search_mcp_catalog"`
}

type SearchCatalogOutput 

type SearchCatalogOutput struct {
	Candidates []CatalogCandidate `json:"candidates"`
	NextCursor string             `json:"next_cursor,omitempty"`
}

type SearchChatsInput 

type SearchChatsInput struct {
	ProjectID string `json:"project_id,omitempty"`

	ProjectSlug string `json:"project_slug,omitempty"`

	From string `json:"from"`

	To string `json:"to"`

	// Query is a literal case-insensitive substring; empty browses messages.
	Query string `json:"query,omitempty"`

	SortOrder string `json:"sort_order,omitempty"`

	OwnerUserID string `json:"owner_user_id,omitempty"`

	// ParticipantID matches a message's user ID or a recorded participant's
	// user ID or provider user ID.
	ParticipantID string `json:"participant_id,omitempty"`

	// ParticipantProvider restricts ParticipantID to recorded participants of
	// this provider.
	ParticipantProvider string `json:"participant_provider,omitempty"`

	ChatIDs []string `json:"chat_ids,omitempty"`

	Source string `json:"source,omitempty"`

	Limit int `json:"limit,omitempty"`

	Cursor string `json:"cursor,omitempty"`
}

SearchChatsInput selects an explicit project and date interval.

type SearchChatsOutput 

type SearchChatsOutput struct {
	Hits []ChatMessageHit `json:"hits"`

	// NextCursor continues the search; a page may be short or empty and still
	// have one.
	NextCursor string `json:"next_cursor,omitempty"`
}

SearchChatsOutput is one page of hits.

type SearchGramDocsToolInput 

type SearchGramDocsToolInput struct {
	Query string `` /* 165-byte string literal not displayed */
}

type SearchGramDocsToolOutput 

type SearchGramDocsToolOutput struct {
	Query string `json:"query"`
	// Excerpts is empty when nothing reviewed answers the query. It is never
	// filled with a paraphrase or a guess.
	Excerpts []DocsExcerpt `json:"excerpts"`
	// Code is set only when no excerpt could be returned, so a caller can tell
	// "the corpus has no answer" from "the corpus answered".
	Code    string `json:"code,omitempty"`
	Message string `json:"message,omitempty"`
	// TrustedLinks are where to send the reader when nothing reviewed answers.
	TrustedLinks []string `json:"trusted_links,omitempty"`
}

type SearchMyToolsInput 

type SearchMyToolsInput struct {
	Query  string `` /* 132-byte string literal not displayed */
	Server string `json:"server,omitempty" jsonschema:"Limit the search to one server slug from list_my_servers"`
	Limit  int    `json:"limit,omitempty" jsonschema:"Results per page, 1 to 50; default 10"`
	Cursor string `json:"cursor,omitempty" jsonschema:"next_cursor from the previous page of the same search"`
}

SearchMyToolsInput finds tools across every server the caller can use.

type SearchMyToolsOutput 

type SearchMyToolsOutput struct {
	Tools      []FoundTool `json:"tools"`
	NextCursor string      `json:"next_cursor,omitempty"`
	// Incomplete is true when a server's tools could not all be read; those
	// servers are named in FailedServers.
	Incomplete    bool           `json:"incomplete"`
	FailedServers []FailedServer `json:"failed_servers,omitempty"`
}

SearchMyToolsOutput is one page of ranked tools.

type SearchToolCallsInput 

type SearchToolCallsInput struct {
	ProjectID        string                    `json:"project_id" jsonschema:"project ID to search"`
	Window           string                    `` /* 210-byte string literal not displayed */
	ToolNameContains string                    `json:"tool_name_contains,omitempty" jsonschema:"case-sensitive text the tool name must contain"`
	ErrorContains    string                    `` /* 160-byte string literal not displayed */
	Outcome          string                    `json:"outcome,omitempty" jsonschema:"optional outcome filter: success, failure, blocked, or pending"`
	MCPID            string                    `` /* 235-byte string literal not displayed */
	UserReference    string                    `` /* 199-byte string literal not displayed */
	Attributes       []ToolCallAttributeFilter `` /* 418-byte string literal not displayed */
	Limit            int                       `json:"limit,omitempty" jsonschema:"maximum calls to return; defaults to 20 and is capped at 50"`
	Cursor           string                    `` /* 363-byte string literal not displayed */
}

SearchToolCallsInput narrows one project's tool calls. Every filter is optional; an empty search lists the newest calls in the window.

type SearchToolCallsOutput 

type SearchToolCallsOutput struct {
	ProjectID string `json:"project_id"`
	// MCPID echoes the server the search was narrowed to, when it was.
	MCPID    string       `json:"mcp_id,omitempty"`
	Envelope DataEnvelope `json:"data"`
	// Calls can be shorter than the requested limit, or empty, while more calls
	// matched: the response cap trims a page to what fits and the traversal
	// budget ends the walk outright. An empty page is therefore not the same
	// claim as the envelope's no_observations, which alone says the window
	// produced nothing at all.
	Calls []ToolCallMatch `json:"calls"`
	// NextCursor is absent both at the genuine end of the results and when the
	// traversal budget is spent, so its absence does not prove exhaustion.
	NextCursor string `json:"next_cursor,omitempty"`
	// AttributionUnavailable states that the configured MCP named by mcp_id
	// has no identity its telemetry is reliably recorded under, so nothing
	// could be attributed to it. It is reported beside the empty page rather
	// than left for a caller to mistake for an idle server. Calls a client
	// merely reported under this server's name are never counted as such an
	// identity, so a server known only that way reports unavailable instead of
	// being handed another server's history.
	AttributionUnavailable bool `json:"attribution_unavailable,omitempty"`
}

type SearchUsersInput 

type SearchUsersInput struct {
	ProjectID string `json:"project_id" jsonschema:"project ID to search"`
	Query     string `` /* 148-byte string literal not displayed */
	UserType  string `` /* 165-byte string literal not displayed */
	Window    string `json:"window,omitempty" jsonschema:"observation window: 1h, 24h, 7d (default), or 30d"`
	Limit     int    `json:"limit,omitempty" jsonschema:"maximum people to return; defaults to 10 and is capped at 25"`
	Cursor    string `json:"cursor,omitempty" jsonschema:"opaque cursor returned by a previous search_users result"`
}

SearchUsersInput asks which people a partial identity matches in one project's telemetry. The query is required and must be specific enough to name someone rather than everyone.

type SearchUsersOutput 

type SearchUsersOutput struct {
	ProjectID  string            `json:"project_id"`
	UserType   string            `json:"user_type"`
	Envelope   DataEnvelope      `json:"data"`
	Users      []UserSearchMatch `json:"users"`
	NextCursor string            `json:"next_cursor,omitempty"`
}

type SelectAssistantRuntimeInput 

type SelectAssistantRuntimeInput struct {
	ProjectID              string `json:"project_id" jsonschema:"exact project UUID; never inferred"`
	AssistantID            string `json:"assistant_id" jsonschema:"exact assistant UUID"`
	RuntimeVersion         int    `json:"runtime_version" jsonschema:"2 for legacy runtime or 3 to opt into Kit"`
	ExpectedRuntimeVersion int    `` /* 164-byte string literal not displayed */
	Confirmed              bool   `` /* 151-byte string literal not displayed */
}

type SelectAssistantRuntimeOutput 

type SelectAssistantRuntimeOutput struct {
	ProjectID      string `json:"project_id"`
	AssistantID    string `json:"assistant_id"`
	RuntimeVersion int    `json:"runtime_version"`
}

type SelectedUseRecorder 

type SelectedUseRecorder struct {
	// contains filtered or unexported fields
}

SelectedUseRecorder persists only the first successful normal Remote MCP tool use for an active Platform distribution version. It deliberately accepts no request or response content.

func NewSelectedUseRecorder 

func NewSelectedUseRecorder(db *pgxpool.Pool) *SelectedUseRecorder

func (*SelectedUseRecorder) RecordSuccessfulToolCall 

func (r *SelectedUseRecorder) RecordSuccessfulToolCall(ctx context.Context, observation toolcallobserver.SuccessObservation)

type SendPlatformMCPFeedbackToolInput 

type SendPlatformMCPFeedbackToolInput struct {
	Category        string `` /* 183-byte string literal not displayed */
	Rating          *int   `json:"rating,omitempty" jsonschema:"optional rating from 1 through 5"`
	Success         *bool  `json:"success,omitempty" jsonschema:"optional success outcome"`
	ToolName        string `json:"tool_name,omitempty" jsonschema:"optional known Platform MCP tool name; do not include remote tool names"`
	FailureCategory string `json:"failure_category,omitempty" jsonschema:"optional allowlisted failure or readiness category"`
	Note            string `` /* 166-byte string literal not displayed */
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated retry key, at most 128 characters; reuse only for the same feedback"`
}

type SendPlatformMCPFeedbackToolOutput 

type SendPlatformMCPFeedbackToolOutput struct {
	TrackingID    string `json:"tracking_id"`
	DeliveryState string `json:"delivery_state"`
	ExpiresAt     string `json:"expires_at"`
	Replayed      bool   `json:"replayed"`
}

type SessionRecallService 

type SessionRecallService struct {
	// contains filtered or unexported fields
}

SessionRecallService serves the session-portability recall tools: listing the caller's own captured coding-agent sessions and rendering one as a redacted handoff digest so its work can continue in the current harness.

Every read fuses tenancy and ownership into the SQL row filter (the queries carry organization + owner user_id + not-deleted + the personal-account exclusion), so there is no fetch-then-authorize step anywhere in this file.

func NewSessionRecallService 

func NewSessionRecallService(
	logger *slog.Logger,
	db *pgxpool.Pool,
	repo *platformrepo.Queries,
	auditor *audit.Logger,
	portability FeatureChecker,
	findings RecallRiskFindingReader,
	budget OperationBudget,
) *SessionRecallService

NewSessionRecallService composes recall. A nil findings reader leaves recall unavailable, since a digest cannot be masked without it.

func (*SessionRecallService) ContinueSession 

func (s *SessionRecallService) ContinueSession(ctx context.Context, principal Principal, input ContinueSessionInput) (ContinueSessionOutput, error)

func (*SessionRecallService) ListMySessions 

func (s *SessionRecallService) ListMySessions(ctx context.Context, principal Principal, input ListMySessionsInput) (ListMySessionsOutput, error)

type SessionRecaller 

type SessionRecaller interface {
	ListMySessions(ctx context.Context, principal Principal, input ListMySessionsInput) (ListMySessionsOutput, error)
	ContinueSession(ctx context.Context, principal Principal, input ContinueSessionInput) (ContinueSessionOutput, error)
}

SessionRecaller is the narrow boundary the session-recall tools call through, so unit tests can model the service without a database.

type SetGatewayMembersInput 

type SetGatewayMembersInput struct {
	ProjectID string   `json:"project_id" jsonschema:"ID of the project the gateway belongs to"`
	GatewayID string   `json:"gateway_id" jsonschema:"exact ID of the gateway to change"`
	MCPIDs    []string `` /* 183-byte string literal not displayed */
}

type SetMCPAddressInput 

type SetMCPAddressInput struct {
	ProjectID       string                          `json:"project_id" jsonschema:"project ID that owns the target"`
	TargetKind      MCPConnectionSettingsTargetKind `json:"target_kind" jsonschema:"exact target type: mcp_server or gateway"`
	TargetID        string                          `json:"target_id" jsonschema:"ID of the exact MCP server or gateway"`
	EndpointID      string                          `` /* 130-byte string literal not displayed */
	Slug            string                          `json:"slug" jsonschema:"endpoint slug; on the platform domain it starts with the organization slug and a hyphen"`
	CustomDomainID  string                          `` /* 132-byte string literal not displayed */
	ExpectedVersion string                          `json:"expected_version" jsonschema:"version from the latest get_mcp_connection_settings for this target"`
	IdempotencyKey  string                          `json:"idempotency_key" jsonschema:"caller-chosen key, at most 128 characters, reused only to retry this exact change"`
	Confirmed       bool                            `` /* 143-byte string literal not displayed */
}

type SetMCPClientAdmissionToolInput 

type SetMCPClientAdmissionToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns the reviewed MCP registration"`
	RegistrationID string `json:"registration_id" jsonschema:"Platform MCP registration ID returned by register_catalog_mcp or register_remote_mcp"`
	Mode           string `` /* 149-byte string literal not displayed */
	Confirmed      bool   `` /* 174-byte string literal not displayed */
}

type SetMCPNetworkAccessInput 

type SetMCPNetworkAccessInput struct {
	ProjectID       string                          `json:"project_id" jsonschema:"project ID that owns the target"`
	TargetKind      MCPConnectionSettingsTargetKind `json:"target_kind" jsonschema:"exact target type: mcp_server or gateway"`
	TargetID        string                          `json:"target_id" jsonschema:"ID of the exact MCP server or gateway"`
	Mode            string                          `json:"mode" jsonschema:"requested network access: public_only, dual, or private_only"`
	ExpectedVersion string                          `json:"expected_version" jsonschema:"version from the latest get_mcp_connection_settings for this target"`
	IdempotencyKey  string                          `json:"idempotency_key" jsonschema:"caller-chosen key, at most 128 characters, reused only to retry this exact change"`
	Confirmed       bool                            `` /* 143-byte string literal not displayed */
}

type SetMCPRoleAuthClientAccessInput 

type SetMCPRoleAuthClientAccessInput struct {
	ProjectID     string `json:"project_id" jsonschema:"explicit project ID that owns the configured MCP"`
	MCPID         string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp"`
	RoleReference string `json:"role_reference" jsonschema:"opaque role reference returned by list_access_roles or get_mcp_access"`
	AuthClientID  string `json:"auth_client_id" jsonschema:"shared credential ID returned for this role by get_mcp_access"`
	Access        string `json:"access" jsonschema:"allowed, blocked, or not_granted"`
	Confirmed     bool   `` /* 162-byte string literal not displayed */
}

type SetMCPRoleAuthClientAccessOutput 

type SetMCPRoleAuthClientAccessOutput struct {
	Role       string                  `json:"role"`
	AuthClient MCPRoleAuthClientAccess `` /* 168-byte string literal not displayed */
}

type SetPluginAssignmentsInput 

type SetPluginAssignmentsInput struct {
	ProjectID                 string            `json:"project_id" jsonschema:"explicit project ID that owns the plugin"`
	Plugin                    string            `json:"plugin" jsonschema:"exact plugin ID, slug, or name returned by list_plugins"`
	AssignmentReferences      []string          `` /* 172-byte string literal not displayed */
	ExpectedAssignmentVersion string            `json:"expected_assignment_version" jsonschema:"assignment version returned by get_plugin immediately before this write"`
	InstallModes              map[string]string `` /* 326-byte string literal not displayed */
	IdempotencyKey            string            `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed                 bool              `` /* 136-byte string literal not displayed */
}

type SetPluginAssignmentsOutput 

type SetPluginAssignmentsOutput struct {
	SetPluginAssignmentsReceiptResult
	// PublishSignal reports whether the best-effort republish was requested
	// after commit. It is "not_requested" on a replay, when the contents did
	// not change, and when the durable publication request already covers it.
	PublishSignal string                  `json:"publish_signal"`
	Receipt       RiskMutationToolReceipt `json:"receipt"`
	// DistributionAdmission is the plugin's standing with the project's Shadow
	// MCP policy after the write, read fresh on every call including replays:
	// covered means every server added by URL in it is approved for the whole
	// audience, which an administrator's own widening records.
	DistributionAdmission *DistributionAdmission `` /* 450-byte string literal not displayed */
}

type SetPluginAssignmentsReceiptResult 

type SetPluginAssignmentsReceiptResult struct {
	ProjectID          string                          `json:"project_id"`
	Plugin             PluginAssignmentMutationPlugin  `json:"plugin"`
	AssignmentVersion  string                          `json:"assignment_version"`
	Assignments        []PluginAssignmentSummaryResult `json:"assignments"`
	ResultCategory     string                          `json:"result_category"`
	PublicationRequest string                          `json:"publication_request,omitempty"`
}

type SetPluginAutoSyncInput 

type SetPluginAutoSyncInput struct {
	ProjectID       string `json:"project_id" jsonschema:"explicit project ID that owns the plugin"`
	Plugin          string `json:"plugin" jsonschema:"exact plugin ID, slug, or name returned by list_plugins"`
	AutoSyncEnabled bool   `` /* 154-byte string literal not displayed */
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact change"`
	Confirmed       bool   `` /* 137-byte string literal not displayed */
}

type SetWorkloadAssertionReuseInput 

type SetWorkloadAssertionReuseInput struct {
	ProjectID           string `` /* 142-byte string literal not displayed */
	IssuerID            string `json:"issuer_id" jsonschema:"exact organization-tier workload issuer UUID"`
	AllowAssertionReuse bool   `` /* 169-byte string literal not displayed */
	Confirmed           bool   `` /* 172-byte string literal not displayed */
}

type SetupCategory 

type SetupCategory string

SetupCategory is the privacy-safe reason an MCP setup needs attention. Values are server-authored from typed errors or closed evidence codes; raw provider, network, or protocol text must never be used as a category. 

const (
	SetupCategoryInvalidURL                     SetupCategory = "invalid_url"
	SetupCategoryUnsafeTargetOrRedirect         SetupCategory = "unsafe_target_or_redirect"
	SetupCategoryUnreachable                    SetupCategory = "unreachable"
	SetupCategoryTimeout                        SetupCategory = "timeout"
	SetupCategoryInvalidMCPResponse             SetupCategory = "invalid_mcp_response"
	SetupCategoryAuthenticationRequired         SetupCategory = "authentication_required"
	SetupCategoryConfigurationRequired          SetupCategory = "configuration_required"
	SetupCategoryOAuthMetadataIncomplete        SetupCategory = "oauth_metadata_incomplete"
	SetupCategoryDynamicRegistrationUnsupported SetupCategory = "dynamic_registration_unsupported"
	SetupCategoryProviderAuthorizationRejected  SetupCategory = "provider_authorization_rejected"
	SetupCategoryTemporarilyUnavailable         SetupCategory = "temporarily_unavailable"
)

type SetupGuideUnavailableError 

type SetupGuideUnavailableError struct {
	URI     string
	DocsURL string
	Links   []string
}

SetupGuideUnavailableError is a withheld guide together with the sources a reader should be sent to instead. The links are the whole point of the refusal: a caller told to hand over trusted documentation needs something to hand over.

func (*SetupGuideUnavailableError) Error 

func (e *SetupGuideUnavailableError) Error() string
func (e *SetupGuideUnavailableError) TrustedLinks() []string

TrustedLinks returns the guide's published page followed by its canonical upstream sources, deduplicated, for a caller assembling a fallback answer.

Never empty: a guide with no page and no canonical sources still has the documentation index, and the whole point of the refusal is to hand the caller somewhere trustworthy to send the reader rather than leave it inventing one.

func (*SetupGuideUnavailableError) Unwrap 

func (e *SetupGuideUnavailableError) Unwrap() error

type SetupHandoff 

type SetupHandoff struct {
	ID                   uuid.UUID
	ProjectID            uuid.UUID
	RegistrationID       uuid.UUID
	ProviderKey          string
	CatalogReference     string
	Intent               string
	ExpiresAt            time.Time
	ConnectionID         uuid.UUID
	ConnectionGeneration uuid.UUID
}

type SetupHandoffBinding 

type SetupHandoffBinding struct {
	ProjectID        uuid.UUID
	RegistrationID   uuid.UUID
	ProviderKey      string
	CatalogReference string
	Intent           string
}

type SetupResource 

type SetupResource struct {
	// Render personalizes reviewed text for the authenticated organization.
	Render func(context.Context, string) (string, error)

	URI         string
	Name        string
	Title       string
	Description string
	// Text is what a reader receives: the citation header followed by the
	// guide. Body is the guide alone.
	Text string
	// Body is what search indexes. The citation header is prose about the
	// guide rather than guide content, so indexing Text would let every guide
	// match on "owner" or "source" and would return the header block as the
	// answer to a setup question.
	Body string

	// Provider and Intent are the two URI segments, kept as fields so search
	// results can cite them without re-parsing the URI.
	Provider string
	Intent   string
	// Owner is who is accountable for reviewing this content.
	Owner string
	// Source identifies the pinned export the content came from, including its
	// version — "mcp-setup-docs/go@v0.3.0", not "mcp-setup-docs".
	Source string
	// ObservedAt is when the upstream provider documentation behind this guide
	// was last observed. RevalidateBy is when that observation expires.
	ObservedAt   time.Time
	RevalidateBy time.Time
	// Aliases are other names the provider is known by — registry identifiers,
	// vendor spellings — so search can match what a caller actually typed.
	Aliases []string
	// Links are the canonical upstream sources. They are the fallback a reader
	// is handed when content is missing or withheld.
	Links []string
	// DocsURL is this guide's published page on the Speakeasy documentation
	// site — the same content, somewhere a person can open, link, and share.
	// The speakeasy:// URI addresses the resource; this addresses the page.
	DocsURL string
}

SetupResource is a reviewed, static setup guide. It is intentionally supplied only by explicit composition, never fetched from a provider or documentation service at request time.

The metadata fields are not decoration: they are the citation a reader needs to judge the content, and the freshness signal that decides whether it is served at all.

func WithSetupCallbackResolver 

func WithSetupCallbackResolver(resources []SetupResource, placeholder string, resolve func(context.Context, string) (string, error)) []SetupResource

WithSetupCallbackResolver resolves the placeholder only after authentication.

type ShadowAIService 

type ShadowAIService struct {
	// contains filtered or unexported fields
}

ShadowAIService serves the two Shadow AI reads: what enrolled devices are running, and what the agents probe for. Organization-scoped, because a detection belongs to a device and a person rather than to a project.

func NewShadowAIService 

func NewShadowAIService(detections shadowAIDetectionReader, library shadowAILibraryReader, authorizer Authorizer, budget OperationBudget) *ShadowAIService

func (*ShadowAIService) ListInventory 

func (s *ShadowAIService) ListInventory(ctx context.Context, principal Principal, input ListShadowAIInventoryInput) (ListShadowAIInventoryOutput, error)

func (*ShadowAIService) ListLibrary 

func (s *ShadowAIService) ListLibrary(ctx context.Context, principal Principal, input ListAIScanLibraryInput) (ListAIScanLibraryOutput, error)

type ShadowAIToolSummary 

type ShadowAIToolSummary struct {
	TargetID    string `json:"target_id"`
	DisplayName string `json:"display_name"`
	Category    string `json:"category"`
	// State is the enforcement verdict: allowed, blocked or unreviewed. A
	// tool Speakeasy cannot recognize at the gateway always reads unreviewed.
	State string `json:"state"`
	// Enforceable reports whether a decision about this tool could reach the
	// gateway at all, which requires it to publish a client ID metadata
	// document. Explains why a tool cannot leave unreviewed.
	Enforceable bool     `json:"enforceable"`
	Signals     []string `json:"signals"`
	UserCount   int64    `json:"user_count"`
	DeviceCount int64    `json:"device_count"`
	LastSeen    string   `json:"last_seen"`
}

type ShadowDecisionAudience 

type ShadowDecisionAudience struct {
	Kind        string        `json:"kind"`
	DisplayName string        `json:"display_name"`
	MemberCount *SubjectCount `json:"member_count,omitempty"`
}

type ShadowDecisionError 

type ShadowDecisionError struct {
	Code    string
	Message string
	Cause   error
}

func (*ShadowDecisionError) Error 

func (e *ShadowDecisionError) Error() string

func (*ShadowDecisionError) Unwrap 

func (e *ShadowDecisionError) Unwrap() error

type ShadowDecisionReceiptResult 

type ShadowDecisionReceiptResult struct {
	Decision       string                   `json:"decision"`
	Audiences      []ShadowDecisionAudience `json:"audiences"`
	ResultCategory string                   `json:"result_category"`
}

type ShadowDecisionReceiptStore 

type ShadowDecisionReceiptStore struct {
	// contains filtered or unexported fields
}

ShadowDecisionReceiptStore writes the operation receipt in the same transaction as the decision core.

func NewShadowDecisionReceiptStore 

func NewShadowDecisionReceiptStore(db *pgxpool.Pool) *ShadowDecisionReceiptStore

func (*ShadowDecisionReceiptStore) Execute 

func (s *ShadowDecisionReceiptStore) Execute(ctx context.Context, principal Principal, project ResolvedProject, key string, normalized normalizedShadowDecision, charge func(context.Context) error, mutate func(context.Context, pgx.Tx) (ShadowDecisionReceiptResult, error)) (OperationReceipt, error)

type ShadowDecisionService 

type ShadowDecisionService struct {
	// contains filtered or unexported fields
}

func NewShadowDecisionService 

func NewShadowDecisionService(db *pgxpool.Pool, shadow *ShadowInventoryService, core *mcpapproval.Service, audiences shadowDecisionAudienceResolver, flags feature.Provider, organizations OrganizationSlugResolver, budget OperationBudget) *ShadowDecisionService

func (*ShadowDecisionService) Decide 

func (s *ShadowDecisionService) Decide(ctx context.Context, principal Principal, input DecideShadowMCPAccessInput) (DecideShadowMCPAccessOutput, error)

type ShadowDistributionReadService 

type ShadowDistributionReadService struct {
	// contains filtered or unexported fields
}

func NewShadowDistributionReadService 

func NewShadowDistributionReadService(logger *slog.Logger, db *pgxpool.Pool) *ShadowDistributionReadService

func (*ShadowDistributionReadService) ForPlugin 

func (s *ShadowDistributionReadService) ForPlugin(ctx context.Context, organizationID string, projectID, pluginID uuid.UUID) DistributionAdmission

func (*ShadowDistributionReadService) ForTarget 

func (s *ShadowDistributionReadService) ForTarget(ctx context.Context, organizationID string, projectID uuid.UUID, targetURL string) DistributionAdmission

func (*ShadowDistributionReadService) NotApplicable 

func (s *ShadowDistributionReadService) NotApplicable(ctx context.Context, organizationID string, projectID uuid.UUID) DistributionAdmission

type ShadowInventoryService 

type ShadowInventoryService struct {
	// contains filtered or unexported fields
}

func NewShadowInventoryService 

func NewShadowInventoryService(dbReader shadowInventoryReader, reviews shadowReviewReader, flags feature.Provider, organizations OrganizationSlugResolver, dbQueries *platformrepo.Queries, budget OperationBudget, keyMaterial string) (*ShadowInventoryService, error)

func (*ShadowInventoryService) GetReview 

func (s *ShadowInventoryService) GetReview(ctx context.Context, principal Principal, input GetShadowMCPReviewInput) (GetShadowMCPReviewOutput, error)

func (*ShadowInventoryService) List 

func (s *ShadowInventoryService) List(ctx context.Context, principal Principal, input ListShadowMCPInventoryInput) (ListShadowMCPInventoryOutput, error)

func (*ShadowInventoryService) ResolveTargetReference 

func (s *ShadowInventoryService) ResolveTargetReference(principal Principal, projectID, targetReference string) (string, string, error)

ResolveTargetReference resolves a D1 handle for the D2 mutation path. The underlying URL or command remains inside the server process.

func (*ShadowInventoryService) WithDistributionAdmissionReads 

func (s *ShadowInventoryService) WithDistributionAdmissionReads(read distributionAdmissionReader) *ShadowInventoryService

type ShadowMCPAccessSummary 

type ShadowMCPAccessSummary struct {
	State            string `json:"state"`
	AllowedFor       string `json:"allowed_for"`
	BlockedFor       string `json:"blocked_for"`
	BlockingDefault  string `json:"blocking_default"`
	Decision         string `json:"decision,omitempty"`
	DecisionCoverage string `json:"decision_coverage"`
}

type ShadowMCPEvidenceSummary 

type ShadowMCPEvidenceSummary struct {
	Collected             bool     `json:"collected"`
	Gaps                  []string `json:"gaps"`
	IdentityKind          string   `json:"identity_kind"`
	VersionPinned         bool     `json:"version_pinned"`
	PackagePublication    string   `json:"package_publication"`
	RepositoryState       string   `json:"repository_state"`
	AdvisoryLookup        string   `json:"advisory_lookup"`
	KnownAdvisories       int      `json:"known_advisories"`
	AuthorityState        string   `json:"authority_state"`
	CapabilitySource      string   `json:"capability_source"`
	DeclaredToolCount     int      `json:"declared_tool_count"`
	RiskyDeclarationCount int      `json:"risky_declaration_count"`
	ResearchStatus        string   `json:"research_status"`
	ResearchCoverage      string   `json:"research_coverage"`
	CitationCount         int      `json:"citation_count"`
	TrustedCitationCount  int      `json:"trusted_citation_count"`
}

type ShadowMCPReviewLinkService 

type ShadowMCPReviewLinkService struct {
	// contains filtered or unexported fields
}

ShadowMCPReviewLinkService builds Shadow MCP server page links. The page is the same one the inventory and the approval queue link to, so a server an administrator shared and a server someone asked about land in one place.

func NewShadowMCPReviewLinkService 

func NewShadowMCPReviewLinkService(dashboardURL *url.URL, organizations OrganizationSlugResolver) *ShadowMCPReviewLinkService

func (*ShadowMCPReviewLinkService) ShadowMCPReviewURL 

func (s *ShadowMCPReviewLinkService) ShadowMCPReviewURL(ctx context.Context, principal Principal, project ResolvedProject, serverSlug string) string

type ShadowMCPReviewLinker 

type ShadowMCPReviewLinker interface {
	ShadowMCPReviewURL(ctx context.Context, principal Principal, project ResolvedProject, serverSlug string) string
}

ShadowMCPReviewLinker builds the dashboard page where a Shadow MCP server and its review live.

type ShadowMCPReviewSummary 

type ShadowMCPReviewSummary struct {
	Status           string       `json:"status"`
	StandingDecision string       `json:"standing_decision,omitempty"`
	RequesterCount   SubjectCount `json:"requester_count"`
	EvidenceChanged  bool         `json:"evidence_changed"`
}

type ShadowMCPStanding 

type ShadowMCPStanding struct {
	// State is "approved" when a standing approval covers the audience,
	// "not_required" when no block policy applies, or the raw admission state
	// otherwise.
	State string `json:"state"`
	// Target is the server URL as the inventory records it.
	Target string `json:"target"`
	// ReviewURL is the Shadow MCP server page. Empty without a dashboard URL.
	ReviewURL string `json:"review_url,omitempty"`
}

ShadowMCPStanding is where a direct-remote server stands with the project's Shadow MCP policy after a write: whether the people who receive it are covered, and where to see the entry.

type ShadowMCPTargetSummary 

type ShadowMCPTargetSummary struct {
	Display            string                  `json:"display"`
	TargetKind         string                  `json:"target_kind"`
	ObservationState   string                  `json:"observation_state"`
	FirstSeen          string                  `json:"first_seen,omitempty"`
	LastSeen           string                  `json:"last_seen,omitempty"`
	LastCalled         string                  `json:"last_called,omitempty"`
	ObservedUseCount   int                     `json:"observed_use_count"`
	UserCount          SubjectCount            `json:"user_count"`
	Access             ShadowMCPAccessSummary  `json:"access"`
	Review             *ShadowMCPReviewSummary `json:"review,omitempty"`
	DecisionVersion    string                  `json:"decision_version,omitempty"`
	TargetReference    string                  `json:"target_reference"`
	ReferenceExpiresAt string                  `json:"reference_expires_at"`
}

type ShadowPolicyDecisions 

type ShadowPolicyDecisions struct {
	Disposition        string `json:"effective_disposition"`
	AllowedTargetCount int    `json:"allowed_target_count"`
	BlockedTargetCount int    `json:"blocked_target_count"`
	ManagedVia         string `json:"managed_via"`
}

ShadowPolicyDecisions describes the configured URL-target posture of a blocking Shadow MCP policy. It never contains URLs, principals, or selectors.

type SignalAuthoringService 

type SignalAuthoringService struct {
	// contains filtered or unexported fields
}

SignalAuthoringService composes the authorized owning service with Platform receipt and exact-project controls. External users are the only admitted actors.

func NewSignalAuthoringService 

func NewSignalAuthoringService(management *sigint.Service, projects *PostgresReader, engine *authz.Engine, key string) *SignalAuthoringService

NewSignalAuthoringService retains the normal management authorization and audit path.

type SkillAuthoringResult 

type SkillAuthoringResult struct {
	ProjectSlug         string              `json:"project_slug"`
	Skill               SkillSummary        `json:"skill"`
	Version             SkillVersionSummary `json:"version"`
	CreatedSkill        bool                `json:"created_skill"`
	CreatedVersion      bool                `json:"created_version"`
	Distributed         bool                `json:"distributed"`
	InertMessage        string              `json:"inert_message"`
	NextAction          string              `json:"next_action"`
	DistributionTargets []SkillTarget       `json:"distribution_targets,omitempty"`
}

SkillAuthoringResult is what create and version writes return.

Distributed and DistributionTargets are on it for one reason: authoring a skill changes no runtime behavior at all, and a result that only said "created" would read as activation to the exact caller most likely to stop there. The result states the skill is inert and names where it can be sent.

type SkillAuthorizer 

type SkillAuthorizer interface {
	PrepareContext(ctx context.Context) (context.Context, error)
	RequireAnyUnblocked(ctx context.Context, checks ...authz.Check) error
}

SkillAuthorizer loads the acting user's RBAC grants onto the context and evaluates skill checks against them.

Platform MCP does not travel the session middleware that prepares grants for dashboard requests, so it prepares them itself. Without this the skills service's scope checks would find no grants and refuse every call. The check is here for the one read that names a plugin before it reaches the skills service: authorization has to come before target resolution, or an ungranted caller could tell an existing plugin from a missing one by which refusal it got back.

type SkillDistributionSummary 

type SkillDistributionSummary struct {
	ID               string      `json:"id"`
	SkillID          string      `json:"skill_id"`
	SkillName        string      `json:"skill_name"`
	SkillDisplayName string      `json:"skill_display_name"`
	Target           SkillTarget `json:"target"`

	// PinnedVersionID is set only when the distribution is held to one version.
	PinnedVersionID string `json:"pinned_version_id,omitempty"`

	// FollowsLatest is true when nothing is pinned, so the distribution moves
	// to each newly recorded valid version on its own.
	FollowsLatest bool `json:"follows_latest"`

	// ResolvedVersionID is the version agents load right now.
	ResolvedVersionID string `json:"resolved_version_id"`
	CreatedAt         string `json:"created_at"`
	UpdatedAt         string `json:"updated_at"`

	// LastLoadedOverMcpAt is when an agent last read this skill over one of
	// the project's hosted MCP servers. It is a per-skill value, so every
	// distribution of one skill reports the same time, and it says nothing
	// about which plugin served the read. Absent when the skill was never
	// loaded over MCP; loads reported by coding-agent hooks do not move it.
	LastLoadedOverMcpAt *string `` /* 232-byte string literal not displayed */
}

SkillDistributionSummary is one active distribution as the caller sees it: which skill reaches which target, and which version it resolves to.

type SkillEfficacyMetrics 

type SkillEfficacyMetrics struct {
	ScoredSessions uint64  `json:"scored_sessions"`
	AverageScore   float64 `json:"average_score"`

	// EstimatedTurnsSavedTotal sums the turns-saved estimates that were made.
	EstimatedTurnsSavedTotal float64 `json:"estimated_turns_saved_total"`

	// EstimatedTurnsSavedAverage is the total over EstimatedTurnsSavedSamples,
	// absent when no scored session carried an estimate.
	EstimatedTurnsSavedAverage *float64 `json:"estimated_turns_saved_average,omitempty"`

	// EstimatedTurnsSavedSamples is how many scored sessions carried a
	// turns-saved estimate. It is at most ScoredSessions.
	EstimatedTurnsSavedSamples uint64 `json:"estimated_turns_saved_samples"`

	// EstimatedMinutesSavedTotal sums the minutes-saved estimates that were made.
	EstimatedMinutesSavedTotal float64 `json:"estimated_minutes_saved_total"`

	// EstimatedMinutesSavedAverage is the total over
	// EstimatedMinutesSavedSamples, absent when no scored session carried an
	// estimate.
	EstimatedMinutesSavedAverage *float64 `json:"estimated_minutes_saved_average,omitempty"`

	// EstimatedMinutesSavedSamples is how many scored sessions carried a
	// minutes-saved estimate. It is at most ScoredSessions.
	EstimatedMinutesSavedSamples uint64 `json:"estimated_minutes_saved_samples"`

	ROIConfidenceCounts map[string]uint64 `json:"roi_confidence_counts"`
	FlagCounts          map[string]uint64 `json:"flag_counts"`
}

SkillEfficacyMetrics summarizes sampled judge scores. Every figure covers scored sessions only, and a judge may score a session without estimating what it saved, so each savings average names the sample count it divides by.

type SkillFeedbackCounts 

type SkillFeedbackCounts struct {
	Total           int64 `json:"total"`
	Helped          int64 `json:"helped"`
	PartiallyHelped int64 `json:"partially_helped"`
	DidNotHelp      int64 `json:"did_not_help"`
	Misleading      int64 `json:"misleading"`
	Harmful         int64 `json:"harmful"`
}

type SkillFeedbackMetrics 

type SkillFeedbackMetrics struct {
	WindowStart                 string `json:"window_start"`
	WindowEnd                   string `json:"window_end"`
	FeedbackInWindow            int64  `json:"feedback_in_window"`
	ActivationsInWindow         int64  `json:"activations_in_window"`
	FeedbackActivationsInWindow int64  `json:"feedback_activations_in_window"`
	Unreviewed                  int64  `json:"unreviewed"`
	Converted                   int64  `json:"converted"`
}

type SkillFeedbackSummary 

type SkillFeedbackSummary struct {
	ID             string `json:"id"`
	Source         string `json:"source"`
	Outcome        string `json:"outcome"`
	Note           string `json:"note,omitempty"`
	SkillVersionID string `json:"skill_version_id,omitempty"`
	ReviewedAt     string `json:"reviewed_at,omitempty"`
	CreatedAt      string `json:"created_at"`
}

type SkillFeedbackTimelinePoint 

type SkillFeedbackTimelinePoint struct {
	BucketStart   string `json:"bucket_start"`
	FeedbackCount int64  `json:"feedback_count"`
}

type SkillInsight 

type SkillInsight struct {
	ID          string              `json:"id"`
	Name        string              `json:"name"`
	DisplayName string              `json:"display_name"`
	Metrics     SkillInsightMetrics `json:"metrics"`
}

SkillInsight is one skill's totals over the window. Per-version figures come from compare_skill_versions rather than from here, so ranking a project and comparing one skill stay two separate answers.

type SkillInsightMetrics 

type SkillInsightMetrics struct {
	Activations       uint64 `json:"activations"`
	ActivatedSessions uint64 `json:"activated_sessions"`

	// FullSessionCostUSD is the model cost of every session that used this
	// skill, counted in full. The same session's cost also lands on every other
	// skill it used, so these figures are not additive across rows.
	FullSessionCostUSD float64 `json:"full_session_cost_usd"`

	// AverageFullSessionCostUSD is FullSessionCostUSD per session, absent when
	// nothing used the skill.
	AverageFullSessionCostUSD *float64 `json:"average_full_session_cost_usd,omitempty"`

	// Efficacy is absent when no session using this skill was scored.
	Efficacy *SkillEfficacyMetrics `json:"efficacy,omitempty"`
}

SkillInsightMetrics carries the exact activation counts, the session cost counted against this skill, and, when any session was scored, the sampled score and saved-time figures.

type SkillInsightsReader 

type SkillInsightsReader interface {
	QuerySkillInsights(context.Context, telemetryrepo.QuerySkillInsightsParams) ([]telemetryrepo.SkillInsightBucket, error)
	GetTelemetryWatermark(context.Context, telemetryrepo.GetTelemetryWatermarkParams) (int64, error)
}

SkillInsightsReader is the ClickHouse read behind the two insight tools: exact activation mappings joined to session-grained usage cost and sampled efficacy scores, plus the observation watermark the freshness envelope is classified against. It is the same repository read the managed assistant's platform_skill_insights tool answers from, so both surfaces report one number.

type SkillMCPLinkSummary 

type SkillMCPLinkSummary struct {
	LinkID        string         `json:"link_id"`
	SkillID       string         `json:"skill_id"`
	SkillName     string         `json:"skill_name"`
	Target        SkillMCPTarget `json:"target"`
	CreatedAt     string         `json:"created_at"`
	FollowsLatest bool           `json:"follows_latest"`

	// PinnedVersionID is set only when the link serves one fixed version.
	PinnedVersionID string `json:"pinned_version_id,omitempty"`
}

SkillMCPLinkSummary is one live link: which skill an MCP surface serves, and whether it serves a pinned version or the latest valid one.

type SkillMCPTarget 

type SkillMCPTarget struct {
	Kind SkillMCPTargetKind `json:"kind"`
	ID   string             `json:"id,omitempty"`
	Name string             `json:"name,omitempty"`
	Slug string             `json:"slug,omitempty"`
}

SkillMCPTarget is one MCP surface a skill can be served by. The organization gateway has no row, so it carries neither an id nor a name.

type SkillMCPTargetInventory 

type SkillMCPTargetInventory interface {
	SkillMCPTargets(ctx context.Context, organizationID string, projectID uuid.UUID, kind SkillMCPTargetKind, wanted string) ([]SkillMCPTarget, error)
}

SkillMCPTargetInventory finds the MCP servers or gateways of one kind in one project that an exact id, slug or name could refer to. It is optional on SkillsService: without it the link tools refuse as unavailable.

type SkillMCPTargetKind 

type SkillMCPTargetKind string

SkillMCPTargetKind names the kind of MCP surface a skill is served by. 

const (
	SkillMCPTargetServer              SkillMCPTargetKind = "mcp_server"
	SkillMCPTargetGateway             SkillMCPTargetKind = "meta_mcp_server"
	SkillMCPTargetOrganizationGateway SkillMCPTargetKind = "organization_gateway"
)

type SkillProjectResolver 

type SkillProjectResolver interface {
	ResolveProject(ctx context.Context, organizationID, projectSlug string) (ResolvedProject, error)
}

SkillProjectResolver turns the project slug a caller names into the project every downstream call is scoped by.

type SkillSuggestionChange 

type SkillSuggestionChange struct {
	ID                   string `json:"id"`
	ProposedDiff         string `json:"proposed_diff,omitempty"`
	Rationale            string `json:"rationale"`
	AppliesCleanly       bool   `json:"applies_cleanly"`
	FeedbackCount        int64  `json:"feedback_count"`
	FeedbackSessionCount int64  `json:"feedback_session_count"`
	CreatedAt            string `json:"created_at"`
}

type SkillSuggestionOutcome 

type SkillSuggestionOutcome string

SkillSuggestionOutcome is what approving a suggestion did. 

const (
	// SkillSuggestionApplied recorded a new version and closed the suggestion.
	SkillSuggestionApplied SkillSuggestionOutcome = "applied"

	// SkillSuggestionPartiallyApplied recorded a new version from the named
	// changes and left the suggestion open carrying the rest, rebased onto it.
	SkillSuggestionPartiallyApplied SkillSuggestionOutcome = "partially_applied"

	// SkillSuggestionSuperseded recorded nothing: the skill had moved past the
	// version the suggestion was written against, so it was closed as stale.
	SkillSuggestionSuperseded SkillSuggestionOutcome = "superseded"
)

type SkillSuggestionSummary 

type SkillSuggestionSummary struct {
	ID                   string                  `json:"id"`
	SkillID              string                  `json:"skill_id"`
	SkillName            string                  `json:"skill_name"`
	SkillDisplayName     string                  `json:"skill_display_name"`
	BaseVersionID        string                  `json:"base_version_id"`
	Changes              []SkillSuggestionChange `json:"changes"`
	ProposedContent      string                  `json:"proposed_content,omitempty"`
	AppliesCleanly       bool                    `json:"applies_cleanly"`
	Rationale            string                  `json:"rationale"`
	Status               string                  `json:"status"`
	FeedbackCount        int64                   `json:"feedback_count"`
	FeedbackSessionCount int64                   `json:"feedback_session_count"`
	ScoredSessionCount   int64                   `json:"scored_session_count"`
	CreatedAt            string                  `json:"created_at"`
	UpdatedAt            string                  `json:"updated_at"`
}

type SkillSummary 

type SkillSummary struct {
	ID              string   `json:"id"`
	Name            string   `json:"name"`
	DisplayName     string   `json:"display_name"`
	Summary         string   `json:"summary,omitempty"`
	Tags            []string `json:"tags,omitempty"`
	LatestVersionID string   `json:"latest_version_id,omitempty"`
	VersionCount    int64    `json:"version_count"`
	HasValidVersion bool     `json:"has_valid_version"`
	UpdatedAt       string   `json:"updated_at"`
	// LastLoadedOverMcpAt is when an agent last loaded the skill over a hosted
	// MCP server. Absent when it never has, or when the response was built
	// from a skill write that does not compute it.
	LastLoadedOverMcpAt *string `` /* 214-byte string literal not displayed */
}

SkillSummary is the registry projection of one skill. Content is deliberately absent: listing a project's skills should not spend the caller's context on manifests it has not asked to read.

type SkillTarget 

type SkillTarget struct {
	Kind      SkillTargetKind `json:"kind"`
	ID        string          `json:"id"`
	Name      string          `json:"name"`
	Slug      string          `json:"slug,omitempty"`
	IsDefault bool            `json:"is_default,omitempty"`
}

SkillTarget is one resolved or offered distribution target. It is echoed back on every distribution so the caller can see which plugin or assistant its name resolved to rather than inferring it.

type SkillTargetInventory 

type SkillTargetInventory interface {
	SkillTargets(ctx context.Context, organizationID string, projectID uuid.UUID, limitPerKind int) ([]SkillTarget, error)
}

SkillTargetInventory names the plugins and assistants a skill may be distributed to in one project. Lane D6 owns the full plugin catalogue surface; this is the resolution half it promises to supply to distribution, expressed as the narrow read it actually needs.

The limit is per kind, not per result. A combined cap would let a project with many plugins push every assistant out of the answer, and a target that is missing from the answer is a target distribution refuses as not_found.

type SkillTargetKind 

type SkillTargetKind string

SkillTargetKind names what a distribution attaches to. 

const (
	SkillTargetPlugin    SkillTargetKind = "plugin"
	SkillTargetAssistant SkillTargetKind = "assistant"
)

type SkillUsage 

type SkillUsage struct {
	SkillName   string       `json:"skill_name"`
	Activations int64        `json:"activations"`
	ActiveUsers SubjectCount `json:"active_users"`
	Errors      string       `json:"errors"`
}

type SkillUsageUser 

type SkillUsageUser struct {
	SubjectReference string `json:"subject_reference"`
	MaskedIdentity   string `json:"masked_identity"`
	Activity         string `json:"activity"`
	Errors           string `json:"errors"`
}

type SkillVersionInsight 

type SkillVersionInsight struct {
	ID        string              `json:"id"`
	CreatedAt string              `json:"created_at,omitempty"`
	Metrics   SkillInsightMetrics `json:"metrics"`
}

SkillVersionInsight is one version's share of the skill's totals. CreatedAt is empty for a version beyond the registry page that was nonetheless active.

type SkillVersionSummary 

type SkillVersionSummary struct {
	ID              string `json:"id"`
	CanonicalSHA256 string `json:"canonical_sha256"`
	// ServedDigest is the digest an agent sees for this version when a hosted
	// MCP server serves it: the SHA-256 of the exact SKILL.md bytes as
	// "sha256:<hex>". Only valid versions are ever served, so it is absent on
	// an invalid one. Servers also skip a version whose frontmatter name is not
	// the skill's current name (after a rename, say), so its presence does not
	// prove the version is served; it identifies the bytes when it is.
	ServedDigest     string   `` /* 461-byte string literal not displayed */
	SpecValid        bool     `json:"spec_valid"`
	ValidationErrors []string `json:"validation_errors,omitempty"`
	CreatedAt        string   `json:"created_at"`
	Content          string   `json:"content,omitempty"`
	ContentTruncated bool     `json:"content_truncated,omitempty"`
}

SkillVersionSummary is one immutable version. Content appears only when the caller opted in.

type SkillsGate 

type SkillsGate interface {
	SkillsEnabled(ctx context.Context, organizationID string) bool
}

SkillsGate decides whether the external Platform MCP serves the Skills extension (SEP-2640) to an organization.

type SkillsManagement 

type SkillsManagement interface {
	Create(context.Context, *genskills.CreatePayload) (*genskills.RecordSkillResult, error)
	AddVersion(context.Context, *genskills.AddVersionPayload) (*genskills.RecordSkillResult, error)
	Update(context.Context, *genskills.UpdatePayload) (*types.Skill, error)
	List(context.Context, *genskills.ListPayload) (*genskills.ListSkillsResult, error)
	Get(context.Context, *genskills.GetPayload) (*genskills.GetSkillResult, error)
	ListDistributions(context.Context, *genskills.ListDistributionsPayload) (*genskills.ListSkillDistributionsResult, error)
	ListVersions(context.Context, *genskills.ListVersionsPayload) (*genskills.ListSkillVersionsResult, error)
	ListFeedback(context.Context, *genskills.ListFeedbackPayload) (*genskills.ListSkillFeedbackResult, error)
	ListSuggestions(context.Context, *genskills.ListSuggestionsPayload) (*genskills.ListSkillSuggestionsResult, error)
	ListSuggestionFeedback(context.Context, *genskills.ListSuggestionFeedbackPayload) (*genskills.ListSkillSuggestionFeedbackResult, error)
	ApproveSuggestion(context.Context, *genskills.ApproveSuggestionPayload) (*genskills.ApproveSkillSuggestionResult, error)
	DismissSuggestion(context.Context, *genskills.DismissSuggestionPayload) (*types.SkillEditSuggestion, error)
	Distribute(context.Context, *genskills.DistributePayload) (*types.SkillDistribution, error)
	Undistribute(context.Context, *genskills.UndistributePayload) error
	Link(context.Context, *genskills.LinkPayload) (*types.SkillLink, error)
	Unlink(context.Context, *genskills.UnlinkPayload) error
	ListLinks(context.Context, *genskills.ListLinksPayload) (*genskills.ListSkillLinksResult, error)
}

SkillsManagement is the subset of the skills management service this surface calls. Going through the service rather than the repository is what keeps one definition of manifest validation, version immutability, canonical-content idempotency, and typed audit for every surface that authors a skill.

type SkillsService 

type SkillsService struct {
	// contains filtered or unexported fields
}

SkillsService is the handler-facing boundary for skill authoring and distribution over Platform MCP.

func NewSkillsService 

func NewSkillsService(skills SkillsManagement, targets SkillTargetInventory, projects SkillProjectResolver, grants SkillAuthorizer, gate CatalogRegistrationGateChecker, budget OperationBudget) *SkillsService

func (*SkillsService) AddSkillVersion 

func (s *SkillsService) AddSkillVersion(ctx context.Context, principal Principal, input AddSkillVersionInput) (SkillAuthoringResult, error)

func (*SkillsService) ApproveSkillSuggestion 

func (s *SkillsService) ApproveSkillSuggestion(ctx context.Context, principal Principal, input ApproveSkillSuggestionInput) (ApproveSkillSuggestionOutput, error)

ApproveSkillSuggestion records a new skill version from a reviewed suggestion through the same service path the dashboard uses, so the stale check, version recording, suggestion state change, and audit event happen in one transaction. The skill is read back afterwards so the result reports the committed latest version rather than echoing the request.

func (*SkillsService) CompareSkillVersions 

func (s *SkillsService) CompareSkillVersions(ctx context.Context, principal Principal, input CompareSkillVersionsInput) (CompareSkillVersionsOutput, error)

CompareSkillVersions measures one skill's versions against each other over the same window and with the same numbers ListSkillInsights reports.

func (*SkillsService) CreateSkill 

func (s *SkillsService) CreateSkill(ctx context.Context, principal Principal, input CreateSkillInput) (SkillAuthoringResult, error)

func (*SkillsService) DismissSkillSuggestion 

func (s *SkillsService) DismissSkillSuggestion(ctx context.Context, principal Principal, input DismissSkillSuggestionInput) (DismissSkillSuggestionOutput, error)

DismissSkillSuggestion closes a suggestion without changing the skill. The skills service treats a repeat as a no-op, so a retry is safe.

func (*SkillsService) DistributeSkill 

func (s *SkillsService) DistributeSkill(ctx context.Context, principal Principal, input DistributeSkillInput) (DistributeSkillOutput, error)

func (*SkillsService) GetSkill 

func (s *SkillsService) GetSkill(ctx context.Context, principal Principal, input GetSkillInput) (GetSkillOutput, error)

func (*SkillsService) LinkSkillToMCP 

func (s *SkillsService) LinkSkillToMCP(ctx context.Context, principal Principal, input LinkSkillToMCPInput) (LinkSkillToMCPOutput, error)

LinkSkillToMCP links a skill to one MCP server, gateway or the organization gateway, so that surface serves it over MCP. The skills service enforces the rollout, skill read and the write permission the target demands, and treats a repeat for the same skill and target as an update of the pin or a no-op, so the call is safe to retry.

func (*SkillsService) ListSkillDistributions 

func (s *SkillsService) ListSkillDistributions(ctx context.Context, principal Principal, input ListSkillDistributionsInput) (ListSkillDistributionsOutput, error)

ListSkillDistributions reads the active plugin distributions in a project. The skills service lists plugin-channel distributions only; whether an assistant carries a skill is reported per skill by GetSkill.

func (*SkillsService) ListSkillFeedback 

func (s *SkillsService) ListSkillFeedback(ctx context.Context, principal Principal, input ListSkillFeedbackInput) (ListSkillFeedbackOutput, error)

func (*SkillsService) ListSkillInsights 

func (s *SkillsService) ListSkillInsights(ctx context.Context, principal Principal, input ListSkillInsightsInput) (ListSkillInsightsOutput, error)

ListSkillInsights ranks a project's skills by activations, sampled efficacy, session cost, and estimated time saved.

Which skills exist comes from the registry under the caller's own grants, exactly as list_skills resolves them, so a caller sees insights for precisely the skills it may read. The numbers come from ClickHouse keyed by those registry IDs.

func (*SkillsService) ListSkillSuggestionFeedback 

func (s *SkillsService) ListSkillSuggestionFeedback(ctx context.Context, principal Principal, input ListSkillSuggestionFeedbackInput) (ListSkillSuggestionFeedbackOutput, error)

func (*SkillsService) ListSkillSuggestions 

func (s *SkillsService) ListSkillSuggestions(ctx context.Context, principal Principal, input ListSkillSuggestionsInput) (ListSkillSuggestionsOutput, error)

func (*SkillsService) ListSkillVersions 

func (s *SkillsService) ListSkillVersions(ctx context.Context, principal Principal, input ListSkillVersionsInput) (ListSkillVersionsOutput, error)

func (*SkillsService) ListSkills 

func (s *SkillsService) ListSkills(ctx context.Context, principal Principal, input ListSkillsInput) (ListSkillsOutput, error)

func (*SkillsService) UndistributeSkill 

func (s *SkillsService) UndistributeSkill(ctx context.Context, principal Principal, input UndistributeSkillInput) (UndistributeSkillOutput, error)

UndistributeSkill takes a skill back from one plugin or assistant. The skills service enforces the write permission the target demands — plugin write for a plugin, project write for an assistant — and treats a distribution that is already gone as a no-op, so the call is safe to repeat.

func (*SkillsService) UnlinkSkillFromMCP 

func (s *SkillsService) UnlinkSkillFromMCP(ctx context.Context, principal Principal, input UnlinkSkillFromMCPInput) (UnlinkSkillFromMCPOutput, error)

UnlinkSkillFromMCP stops one MCP surface serving a skill. A link that is already gone is a no-op, so the call is safe to retry; the post-write read confirms no live link to that surface remains.

func (*SkillsService) UpdateSkillMetadata 

func (s *SkillsService) UpdateSkillMetadata(ctx context.Context, principal Principal, input UpdateSkillMetadataInput) (UpdateSkillMetadataOutput, error)

func (*SkillsService) WithInsights 

func (s *SkillsService) WithInsights(insights SkillInsightsReader, budget OperationBudget) *SkillsService

WithInsights attaches the ClickHouse read behind the insight tools and the rate limit they answer under.

They are limited with the other telemetry reads rather than with skill authoring and distribution because the work being limited is a ClickHouse scan. Reading insights must not spend the allowance needed to write a skill.

A nil reader leaves both tools registered as stubs.

type SubjectCount 

type SubjectCount struct {
	// contains filtered or unexported fields
}

SubjectCount is a count of people — users, members, operators. It serializes as a number when it is zero or at least SubjectSuppressionThreshold, and as "less_than_5" in between.

Zero is reported exactly because it identifies nobody: it is the difference between "no one used this" and "someone did", which a diagnostic caller needs and which reveals no subject. Counts of events — calls, failures — are not subject counts and are reported exactly; they are plain integers, not this type.

func NewSubjectCount 

func NewSubjectCount(value int64) SubjectCount

NewSubjectCount wraps a raw subject count for suppression at the boundary.

func (SubjectCount) MarshalJSON 

func (c SubjectCount) MarshalJSON() ([]byte, error)

func (SubjectCount) Suppressed 

func (c SubjectCount) Suppressed() bool

Suppressed reports whether this count will be withheld.

func (*SubjectCount) UnmarshalJSON 

func (c *SubjectCount) UnmarshalJSON(data []byte) error

UnmarshalJSON exists so a result round-trips through JSON in tests and in any caller that decodes its own output. A suppressed value decodes back to the suppression floor rather than to a real count, because the real count was never transmitted.

type SubjectToolStatus 

type SubjectToolStatus struct {
	ToolName string `json:"tool_name"`
	Outcome  string `json:"outcome"`
	Errors   string `json:"errors"`
	Blocked  string `json:"blocked"`
}

type SuggestRiskPolicyInput 

type SuggestRiskPolicyInput struct {
	Description string `json:"description"`
}

type SuggestRiskPolicyOutput 

type SuggestRiskPolicyOutput struct {
	Preset                 string                  `json:"preset,omitempty"`
	Confidence             float64                 `json:"confidence"`
	Rationale              string                  `json:"rationale"`
	Draft                  RiskPolicyDraft         `json:"draft"`
	RequiresPromptPolicies bool                    `json:"requires_prompt_policies"`
	CanScopeToMCP          bool                    `json:"can_scope_to_mcp"`
	Alternatives           []RiskPresetAlternative `json:"alternatives"`
	NextStep               string                  `json:"next_step"`
}

type ToggleDataExportRouteInput 

type ToggleDataExportRouteInput struct {
	ProjectID      string `json:"project_id" jsonschema:"project ID that owns the route, from list_data_exports"`
	RouteID        string `json:"route_id" jsonschema:"exact route ID from list_data_exports"`
	IdempotencyKey string `json:"idempotency_key" jsonschema:"caller-chosen key that makes a retry of this exact change safe"`
	Confirmed      bool   `json:"confirmed" jsonschema:"true only after the user confirmed this exact project and route"`
}

type ToggleDataExportRouteOutput 

type ToggleDataExportRouteOutput struct {
	Outcome string `json:"outcome"`
	// Route is a fresh read taken after the commit, so a caller reports the
	// committed state rather than the one it asked for. It is absent when
	// that read could not be taken; SnapshotScope says which.
	Route         *DataExportRoute `json:"route,omitempty"`
	SnapshotScope string           `json:"snapshot_scope"`
	// LastDelivery is "not_recorded": Speakeasy does not keep a per-route time of
	// the last successful delivery.
	LastDelivery string `json:"last_delivery"`
	// WhilePaused states what happens to data produced while the route is
	// paused, so the caller never has to guess between dropped and buffered.
	WhilePaused string                  `json:"while_paused"`
	TakesEffect string                  `json:"takes_effect"`
	Receipt     RiskMutationToolReceipt `json:"receipt"`
}

ToggleDataExportRouteOutput lets a caller tell the outcomes apart: the route changed state (paused or resumed), it was already in the requested state (unchanged), or the call was refused, which is returned as an error result and never as this struct.

type ToolCallAttributeFilter 

type ToolCallAttributeFilter struct {
	Key    string   `json:"key" jsonschema:"attribute key as returned by list_attribute_keys: an @-prefixed custom key or a system key"`
	Op     string   `json:"op,omitempty" jsonschema:"comparison: eq (default), not_eq, in, exists, not_exists, or contains (custom @ keys only)"`
	Values []string `` /* 144-byte string literal not displayed */
}

ToolCallAttributeFilter is one attribute predicate. Filters are combined with AND; a key is discovered with list_attribute_keys first.

type ToolCallMatch 

type ToolCallMatch struct {
	OccurredAt     string `json:"occurred_at"`
	ToolName       string `json:"tool_name,omitempty"`
	TargetType     string `json:"target_type"`
	TargetKind     string `json:"target_kind"`
	Target         string `json:"target,omitempty"`
	Outcome        string `json:"outcome"`
	Client         string `json:"client,omitempty"`
	MaskedIdentity string `json:"masked_identity,omitempty"`
	UserReference  string `json:"user_reference,omitempty"`
}

ToolCallMatch is one tool call reduced to what an investigation needs. It carries no arguments, results, bodies, headers, URLs, trace IDs, or raw identities; the identity is masked and the reference is short-lived.

type ToolCallSearchReader 

type ToolCallSearchReader interface {
	ListToolUsageTraces(ctx context.Context, arg telemetryrepo.ListToolUsageTracesParams) ([]telemetryrepo.ToolUsageTraceSummary, error)
	ListAttributeKeys(ctx context.Context, arg telemetryrepo.ListAttributeKeysParams) ([]string, error)
}

ToolCallSearchReader is the Tool Logs read model the project-wide search answers from: the same bounded trace summary list the dashboard's Tool Logs page and list_recent_tool_calls use, plus the attribute key inventory.

type ToolExposureIndexer 

type ToolExposureIndexer func(ctx context.Context, projectID, toolsetID uuid.UUID) error

ToolExposureIndexer is supplied by server composition. It runs after the change has committed, so its error cannot refuse anything — it is reported to the caller through IndexSignal instead, because the consequence of a rebuild that never started is a dynamic-mode server that cannot list its tools, and an agent that just added a tool needs to be able to say so.

type ToolMeta 

type ToolMeta struct {
	Authorization ExternalAuthorization
	Audiences     []Audience
	ProjectScope  ProjectScope
	// DiscoveryScopes are coarse requirements for tools/list. Any listed scope
	// makes the tool discoverable somewhere; handlers still enforce the exact
	// target. An empty list makes a member tool visible to every active member.
	// Organization-admin tools derive org:admin automatically.
	DiscoveryScopes []authz.Scope
}

ToolMeta is what a tool declares beyond its schemas: who may call it, how it obtains its target, and which live policy protects external calls.

type ToolRefusalError 

type ToolRefusalError struct {
	Code    string
	Payload string
}

ToolRefusalError is a tool's own refusal — a rate limit, a disabled feature, an ineligible target — rather than a failure of the call. The MCP surface returns these as an error result; a direct caller receives this error, so the reason survives instead of being replaced by an empty payload.

func (*ToolRefusalError) Error 

func (e *ToolRefusalError) Error() string

type ToolUsageBreakdownReader 

type ToolUsageBreakdownReader interface {
	GetToolUsageTotals(ctx context.Context, arg telemetryrepo.GetToolUsageSummaryParams) (telemetryrepo.ToolUsageTotalsRow, error)
	GetToolUsageTargets(ctx context.Context, arg telemetryrepo.GetToolUsageSummaryParams) ([]telemetryrepo.ToolUsageTargetSummaryRow, error)
}

ToolUsageBreakdownReader is the target-aware tool usage read the summary answers from. It is the same pipeline the dashboard Insights board and the managed platform_get_tool_usage_summary tool read, so every surface reports one number for one window. It stays separate from DiagnosticsTelemetryReader so a deployment can withhold it independently.

type ToolUsageByTargetType 

type ToolUsageByTargetType struct {
	TargetType      string `json:"target_type"`
	ToolCalls       int64  `json:"tool_calls"`
	FailedToolCalls int64  `json:"failed_tool_calls"`
	// SharePercent is this type's share of tool_calls on the result, rounded
	// server-side to one decimal place. Shares sum to less than 100 when
	// targets_truncated is set.
	SharePercent float64 `json:"share_percent"`
	// Targets counts the distinct servers, gateways, or skills the calls
	// reached after folding onto configured servers.
	Targets int `json:"targets"`
	// TopTargets lists the busiest targets of this type. Shadow MCP servers
	// are known only by the name the calling app used for them, so the shadow
	// bucket reports its count and leaves this empty; list_shadow_mcp_inventory
	// is the reviewed view of which servers those are.
	TopTargets []ToolUsageTarget `json:"top_targets"`
}

ToolUsageByTargetType is every tool call in the window that reached one kind of target.

type ToolUsageTarget 

type ToolUsageTarget struct {
	// Name is the configured MCP server's name when the target resolved to
	// one, and otherwise the configured label the usage pipeline classified
	// the calls under: a gateway's name, a skill's name, or "Local Tools".
	Name string `json:"name"`

	// MCPID is the configured MCP server the calls were attributed to, usable
	// with get_mcp and the diagnostics tools. Empty when the target is not a
	// configured MCP server.
	MCPID string `json:"mcp_id,omitempty"`

	ToolCalls       int64 `json:"tool_calls"`
	FailedToolCalls int64 `json:"failed_tool_calls"`
}

ToolUsageTarget is one server, gateway, or skill's share of a target type's tool calls.

type TrustInboundEMAIdentityProviderInput 

type TrustInboundEMAIdentityProviderInput struct {
	// UserSessionIssuerID is the exact organization-level issuer to change.
	UserSessionIssuerID string `json:"user_session_issuer_id" jsonschema:"exact organization-level user session issuer UUID from get_inbound_ema_trust"`

	// IssuerURL is the identity provider's issuer URL.
	IssuerURL string `` /* 155-byte string literal not displayed */

	// ExpectedTrustedRemoteSessionIssuerID is the trust the preview read.
	ExpectedTrustedRemoteSessionIssuerID string `` /* 253-byte string literal not displayed */

	// ExpectedIdentityProviderIssuerURL is the provider the preview showed.
	ExpectedIdentityProviderIssuerURL string `` /* 215-byte string literal not displayed */

	// Confirmed applies the change; false only previews it.
	Confirmed bool `` /* 145-byte string literal not displayed */
}

TrustInboundEMAIdentityProviderInput names the issuer and identity provider.

type TrustInboundEMAIdentityProviderOutput 

type TrustInboundEMAIdentityProviderOutput struct {
	// Applied is false for a preview.
	Applied bool `json:"applied"`

	// Changed reports whether the trust link changed, or would change.
	Changed bool `json:"changed"`

	// IdentityProviderReused is true when an existing record is used rather
	// than a new one created.
	IdentityProviderReused bool `json:"identity_provider_reused"`

	// IdentityProvider is the identity provider trusted, or to be trusted.
	IdentityProvider InboundEMAIdentityProvider `json:"identity_provider"`

	// ExpectedTrustedRemoteSessionIssuerID is the issuer's trust as read; pass
	// it back on the confirmed call.
	ExpectedTrustedRemoteSessionIssuerID string `json:"expected_trusted_remote_session_issuer_id"`

	// ReplacedRemoteSessionIssuerID is the identity provider the link pointed
	// at before, when the change replaces one.
	ReplacedRemoteSessionIssuerID string `json:"replaced_remote_session_issuer_id,omitempty"`

	// Warnings are conditions that may stop ID-JAGs from being accepted.
	Warnings []string `json:"warnings,omitempty"`

	// Issuer is the issuer's state, read again after a committed change.
	Issuer InboundEMAIssuer `json:"issuer"`

	// IssuerUnavailable reports that the issuer could not be read again after
	// a saved change.
	IssuerUnavailable bool `` /* 254-byte string literal not displayed */

	// Directory reports the directory sync users resolve through.
	Directory InboundEMADirectory `json:"directory"`

	// NextStep is the next safe action.
	NextStep string `json:"next_step"`
}

TrustInboundEMAIdentityProviderOutput reports the preview or committed trust.

type UndistributeSkillInput 

type UndistributeSkillInput struct {
	ProjectSlug    string
	SkillID        string
	Plugin         string
	Assistant      string
	IdempotencyKey string
}

UndistributeSkillInput names exactly one target on the same terms as DistributeSkillInput. The idempotency key is required so a retry loop is shaped like the other Platform MCP mutations; revocation itself converges, so a repeat with the same key finds nothing left to revoke and reports the same end state.

type UndistributeSkillOutput 

type UndistributeSkillOutput struct {
	ProjectSlug string      `json:"project_slug"`
	SkillID     string      `json:"skill_id"`
	SkillName   string      `json:"skill_name"`
	Target      SkillTarget `json:"target"`
	Message     string      `json:"message"`
}

UndistributeSkillOutput is the receipt for a revocation. It mirrors DistributeSkillOutput so a caller reads the same skill and target back from both halves of the operation.

type UndistributeSkillToolInput 

type UndistributeSkillToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns both the skill and the target"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills or list_skill_distributions"`
	Plugin         string `` /* 176-byte string literal not displayed */
	Assistant      string `` /* 142-byte string literal not displayed */
	Confirmed      bool   `` /* 137-byte string literal not displayed */
	IdempotencyKey string `` /* 135-byte string literal not displayed */
}

type UnlinkSkillFromMCPInput 

type UnlinkSkillFromMCPInput struct {
	ProjectSlug    string
	SkillID        string
	TargetKind     string
	MCPServer      string
	Gateway        string
	IdempotencyKey string
}

UnlinkSkillFromMCPInput names one skill and the exact MCP surface that should stop serving it, on the same terms as LinkSkillToMCPInput.

type UnlinkSkillFromMCPOutput 

type UnlinkSkillFromMCPOutput struct {
	ProjectSlug string         `json:"project_slug"`
	SkillID     string         `json:"skill_id"`
	SkillName   string         `json:"skill_name"`
	Target      SkillMCPTarget `json:"target"`
	Removed     bool           `json:"removed"`
	Message     string         `json:"message"`
}

UnlinkSkillFromMCPOutput is the receipt for an unlink. Removed is false when the surface was not serving the skill to begin with.

type UnlinkSkillFromMCPToolInput 

type UnlinkSkillFromMCPToolInput struct {
	ProjectSlug    string `json:"project_slug" jsonschema:"explicit project slug that owns both the skill and the MCP server or gateway"`
	SkillID        string `json:"skill_id" jsonschema:"skill ID returned by list_skills or list_skill_distributions"`
	TargetKind     string `` /* 147-byte string literal not displayed */
	MCPServer      string `` /* 166-byte string literal not displayed */
	Gateway        string `` /* 158-byte string literal not displayed */
	Confirmed      bool   `` /* 131-byte string literal not displayed */
	IdempotencyKey string `` /* 131-byte string literal not displayed */
}

type UnmarkRiskFindingsFalsePositiveReceiptResult 

type UnmarkRiskFindingsFalsePositiveReceiptResult struct {
	RiskFindingFalsePositiveReceipt
}

type UnmarkRiskFindingsFalsePositiveToolOutput 

type UnmarkRiskFindingsFalsePositiveToolOutput struct {
	UnmarkRiskFindingsFalsePositiveReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type UntrustInboundEMAIdentityProviderInput 

type UntrustInboundEMAIdentityProviderInput struct {
	// UserSessionIssuerID is the exact organization-level issuer to change.
	UserSessionIssuerID string `json:"user_session_issuer_id" jsonschema:"exact organization-level user session issuer UUID from get_inbound_ema_trust"`

	// ExpectedTrustedRemoteSessionIssuerID is the trust the preview read.
	ExpectedTrustedRemoteSessionIssuerID string `` /* 209-byte string literal not displayed */

	// Confirmed applies the change; false only previews it.
	Confirmed bool `` /* 134-byte string literal not displayed */
}

UntrustInboundEMAIdentityProviderInput names the issuer.

type UntrustInboundEMAIdentityProviderOutput 

type UntrustInboundEMAIdentityProviderOutput struct {
	// Applied is false for a preview.
	Applied bool `json:"applied"`

	// Changed reports whether the trust link changed, or would change.
	Changed bool `json:"changed"`

	// RemovedIdentityProvider is the identity provider no longer trusted, or
	// to be no longer trusted in a preview.
	RemovedIdentityProvider *InboundEMAIdentityProvider `json:"removed_identity_provider,omitempty"`

	// ExpectedTrustedRemoteSessionIssuerID is the issuer's trust as read; pass
	// it back on the confirmed call.
	ExpectedTrustedRemoteSessionIssuerID string `json:"expected_trusted_remote_session_issuer_id"`

	// Issuer is the issuer's state, read again after a committed change.
	Issuer InboundEMAIssuer `json:"issuer"`

	// IssuerUnavailable reports that the issuer could not be read again after
	// a saved change.
	IssuerUnavailable bool `` /* 254-byte string literal not displayed */

	// NextStep is the next safe action.
	NextStep string `json:"next_step"`
}

UntrustInboundEMAIdentityProviderOutput reports the preview or committed removal.

type UpdateMCPAccessRoleInput 

type UpdateMCPAccessRoleInput struct {
	ProjectID       string              `json:"project_id" jsonschema:"explicit project ID that owns every configured MCP in the delta"`
	RoleReference   string              `json:"role_reference" jsonschema:"opaque role reference returned by list_access_roles, get_mcp_access, or a role mutation"`
	ExpectedVersion string              `json:"expected_version" jsonschema:"opaque role version returned by the preceding role mutation"`
	AddRules        []MCPAccessRoleRule `json:"add_rules,omitempty" jsonschema:"MCP access rules to add without replacing other grants"`
	RemoveRules     []MCPAccessRoleRule `json:"remove_rules,omitempty" jsonschema:"MCP access rules to remove without replacing other grants"`
	IdempotencyKey  string              `json:"idempotency_key" jsonschema:"stable unique key for safely retrying this exact write"`
	Confirmed       bool                `json:"confirmed" jsonschema:"set true only after the user confirms this exact project, role, and MCP access delta"`
}

type UpdateMCPAccessRoleOutput 

type UpdateMCPAccessRoleOutput struct {
	Role           AccessRoleMutationSummary `json:"role"`
	Reconciliation string                    `json:"reconciliation"`
	Receipt        RiskMutationToolReceipt   `json:"receipt"`
}

type UpdateMCPMetadataInput 

type UpdateMCPMetadataInput struct {
	ProjectSlug     string
	RegistrationID  string
	MCPID           string
	Name            string
	ExpectedVersion string
	IdempotencyKey  string
}

type UpdateMCPMetadataResult 

type UpdateMCPMetadataResult struct {
	Project        ResolvedProject
	RegistrationID string
	MCPID          string
	Name           string
	Slug           string
	Visibility     string
	Version        string
	Receipt        OperationReceipt
}

type UpdateMCPMetadataToolInput 

type UpdateMCPMetadataToolInput struct {
	ProjectSlug     string `json:"project_slug" jsonschema:"explicit project slug that owns the Platform-managed MCP"`
	RegistrationID  string `json:"registration_id" jsonschema:"Platform registration ID returned by find_mcp or get_mcp"`
	MCPID           string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp or get_mcp"`
	Name            string `json:"name" jsonschema:"new project-local MCP display name; 1-256 bytes after trimming and no line breaks"`
	ExpectedVersion string `json:"expected_version" jsonschema:"opaque version returned by find_mcp, get_mcp, or a previous update_mcp_metadata result"`
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated idempotency key; reuse only to retry this exact metadata update"`
}

type UpdateMCPMetadataToolOutput 

type UpdateMCPMetadataToolOutput struct {
	ProjectSlug    string `json:"project_slug"`
	RegistrationID string `json:"registration_id"`
	MCPID          string `json:"mcp_id"`
	Name           string `json:"name"`
	Slug           string `json:"slug"`
	Visibility     string `json:"visibility"`
	Version        string `json:"version"`
	ReceiptID      string `json:"receipt_id"`
	Replayed       bool   `json:"replayed"`
}

type UpdateMCPVisibilityInput 

type UpdateMCPVisibilityInput struct {
	ProjectSlug     string
	RegistrationID  string
	MCPID           string
	ExpectedVersion string
	IdempotencyKey  string
}

type UpdateMCPVisibilityResult 

type UpdateMCPVisibilityResult struct {
	Project        ResolvedProject
	RegistrationID string
	MCPID          string
	Visibility     string
	Version        string
	Receipt        OperationReceipt
	Readiness      MCPReadiness
	Published      bool
}

type UpdateMCPVisibilityToolInput 

type UpdateMCPVisibilityToolInput struct {
	ProjectSlug     string `json:"project_slug" jsonschema:"explicit project slug that owns the Platform-managed MCP"`
	RegistrationID  string `json:"registration_id" jsonschema:"Platform registration ID returned by find_mcp or get_mcp"`
	MCPID           string `json:"mcp_id" jsonschema:"configured MCP ID returned by find_mcp or get_mcp"`
	ExpectedVersion string `json:"expected_version" jsonschema:"opaque version returned by find_mcp, get_mcp, or a previous lifecycle update"`
	IdempotencyKey  string `json:"idempotency_key" jsonschema:"caller-generated idempotency key; reuse only to retry this exact visibility update"`
}

type UpdateMCPVisibilityToolOutput 

type UpdateMCPVisibilityToolOutput struct {
	ProjectSlug    string       `json:"project_slug"`
	RegistrationID string       `json:"registration_id"`
	MCPID          string       `json:"mcp_id"`
	Visibility     string       `json:"visibility"`
	Version        string       `json:"version"`
	ReceiptID      string       `json:"receipt_id"`
	Replayed       bool         `json:"replayed"`
	Readiness      MCPReadiness `json:"readiness"`
	Published      bool         `json:"published"`
}

type UpdateRiskExclusionReceiptResult 

type UpdateRiskExclusionReceiptResult struct {
	Project        RiskMutationReceiptProject  `json:"project"`
	Exclusion      RiskExclusionReceiptSummary `json:"exclusion"`
	Version        string                      `json:"version"`
	ResultCategory string                      `json:"result_category"`
	Reconciliation string                      `json:"reconciliation"`
}

type UpdateRiskExclusionToolOutput 

type UpdateRiskExclusionToolOutput struct {
	UpdateRiskExclusionReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type UpdateRiskPolicyReceiptResult 

type UpdateRiskPolicyReceiptResult struct {
	Project        RiskMutationReceiptProject `json:"project"`
	Policy         RiskPolicyReceiptSummary   `json:"policy"`
	Version        string                     `json:"version"`
	ResultCategory string                     `json:"result_category"`
}

type UpdateRiskPolicyToolOutput 

type UpdateRiskPolicyToolOutput struct {
	UpdateRiskPolicyReceiptResult
	Receipt RiskMutationToolReceipt `json:"receipt"`
}

type UpdateSkillMetadataInput 

type UpdateSkillMetadataInput struct {
	ProjectSlug             string
	SkillID                 string
	Name                    string
	DisplayName             string
	Summary                 string
	ClearSummary            bool
	ExpectedLatestVersionID string
}

UpdateSkillMetadataInput changes registry naming only. Instructions live in versions, so nothing here can alter what a skill tells an agent to do.

type UpdateSkillMetadataOutput 

type UpdateSkillMetadataOutput struct {
	ProjectSlug string       `json:"project_slug"`
	Skill       SkillSummary `json:"skill"`
}

type UpdateSkillMetadataToolInput 

type UpdateSkillMetadataToolInput struct {
	ProjectSlug             string `json:"project_slug" jsonschema:"explicit project slug that owns the skill"`
	SkillID                 string `json:"skill_id" jsonschema:"skill ID returned by list_skills"`
	Name                    string `json:"name,omitempty" jsonschema:"new canonical skill name; omitted leaves it unchanged"`
	DisplayName             string `json:"display_name,omitempty" jsonschema:"new user-facing skill name; omitted leaves it unchanged"`
	Summary                 string `json:"summary,omitempty" jsonschema:"new registry summary; omitted leaves it unchanged"`
	ClearSummary            bool   `json:"clear_summary,omitempty" jsonschema:"remove the registry summary instead of replacing it"`
	ExpectedLatestVersionID string `` /* 167-byte string literal not displayed */
}

type UpgradeAssistantIdentityInput 

type UpgradeAssistantIdentityInput struct {
	ProjectID   string  `json:"project_id" jsonschema:"exact project UUID owning the assistant; never inferred"`
	AssistantID string  `` /* 145-byte string literal not displayed */
	AgentID     *string `` /* 168-byte string literal not displayed */
	AgentName   *string `json:"agent_name,omitempty" jsonschema:"name for the new agent; cannot be combined with agent_id"`
	Confirmed   bool    `` /* 156-byte string literal not displayed */
}

type UpgradeAssistantIdentityOutput 

type UpgradeAssistantIdentityOutput struct {
	ProjectID     string  `json:"project_id"`
	AssistantID   string  `json:"assistant_id"`
	IdentityState *string `json:"identity_state,omitempty"`
	AgentID       *string `json:"agent_id,omitempty"`
}

type UserMetricsTool 

type UserMetricsTool struct {
	Tool     string `json:"tool"`
	Server   string `json:"server,omitempty"`
	Calls    int64  `json:"calls"`
	Failures int64  `json:"failures"`
}

UserMetricsTool is one tool the person called, with exact counts. Server is the MCP server a hook-recorded tool names, or the source a hosted tool was generated from; a native agent tool names no server and leaves it empty.

type UserSearchMatch 

type UserSearchMatch struct {
	UserReference  string `json:"user_reference"`
	MaskedIdentity string `json:"masked_identity"`
	Activity       string `json:"activity"`
	Errors         string `json:"errors"`
	LastSeenAt     string `json:"last_seen_at"`
}

UserSearchMatch is one person, masked, with categorical evidence and a short-lived reference. Exact individual counts are deliberately absent here; get_user_metrics_summary answers those for one referenced person under its own audit entry.

type UserSearchReader 

type UserSearchReader interface {
	SearchUsers(ctx context.Context, arg telemetryrepo.SearchUsersParams) ([]telemetryrepo.UserSummary, error)
	GetUserMetricsSummary(ctx context.Context, arg telemetryrepo.GetUserMetricsSummaryParams) (*telemetryrepo.MetricsSummaryRow, error)
}

UserSearchReader is the per-person telemetry read model behind search_users and get_user_metrics_summary: the same two ClickHouse queries the dashboard's employee directory and employee page read from.

type WatchdogAlert 

type WatchdogAlert struct {
	RuleID          string              `json:"rule_id"`
	DataType        string              `json:"data_type"`
	Severity        string              `json:"severity"`
	Score           float64             `json:"score"`
	Count           uint64              `json:"count"`
	UsersAffected   uint64              `json:"users_affected"`
	ClientsAffected uint64              `json:"clients_affected"`
	Clients         []string            `json:"clients"`
	FirstSeen       string              `json:"first_seen"`
	LastSeen        string              `json:"last_seen"`
	Evidence        string              `json:"evidence"`
	GroupBy         []RiskFindingGroups `json:"group_by,omitempty"`
}

WatchdogAlert is one rule-level signal, not an individual matched finding.

type WhoamiOrganization 

type WhoamiOrganization struct {
	ID   string `json:"id"`
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type WhoamiOutput 

type WhoamiOutput struct {
	User         WhoamiUser         `json:"user"`
	Organization WhoamiOrganization `json:"organization"`
	// Roles are the caller's live roles in the active organization, from
	// direct assignments and directory role mappings alike.
	Roles []WhoamiRole `json:"roles"`
	// ClientName is the name the connecting OAuth client registered. The client
	// chooses it, so it identifies the connection but proves nothing.
	ClientName string `json:"client_name,omitempty"`
	// OtherOrganizations are the caller's other active memberships, which they
	// can reconnect to. Empty on the project assistant: it has no connection
	// to switch, and its transcript belongs to the active organization.
	OtherOrganizations          []WhoamiOrganization `json:"other_organizations"`
	OtherOrganizationsTruncated bool                 `json:"other_organizations_truncated"`
}

type WhoamiRole 

type WhoamiRole struct {
	Name string `json:"name"`
	Slug string `json:"slug"`
}

type WhoamiService 

type WhoamiService struct {
	// contains filtered or unexported fields
}

WhoamiService backs the whoami tool.

func NewWhoamiService 

func NewWhoamiService(db *pgxpool.Pool) *WhoamiService

func (*WhoamiService) Whoami 

func (s *WhoamiService) Whoami(ctx context.Context, principal Principal) (WhoamiOutput, error)

type WhoamiUser 

type WhoamiUser struct {
	Email       string `json:"email"`
	DisplayName string `json:"display_name"`
}

WhoamiUser carries no user ID: no tool takes one, and the email already identifies the caller.

type WidgetService 

type WidgetService struct {
	// contains filtered or unexported fields
}

WidgetService lets an external user read and manage a project's Explore widgets through the widgets service, which stays the source of truth for authorization, validation and audit.

func NewWidgetService 

func NewWidgetService(logger *slog.Logger, management *widgets.Service, projects *PostgresReader, engine *authz.Engine, flags feature.Provider, organizations OrganizationSlugResolver, key string) *WidgetService

NewWidgetService returns nil when a dependency is missing, so the tools are served as stable refusals.

func (*WidgetService) Delete 

func (s *WidgetService) Delete(ctx context.Context, principal Principal, input widgetTargetInput) (widgetWriteOutput, error)

Delete previews or commits deleting a widget, taking it off every dashboard.

func (*WidgetService) Duplicate 

func (s *WidgetService) Duplicate(ctx context.Context, principal Principal, input widgetTargetInput) (widgetWriteOutput, error)

Duplicate previews or commits a copy of a widget the caller then owns.

func (*WidgetService) Get 

func (s *WidgetService) Get(ctx context.Context, principal Principal, input getWidgetInput) (getWidgetOutput, error)

Get returns one widget's full definition.

func (*WidgetService) List 

func (s *WidgetService) List(ctx context.Context, principal Principal, input listWidgetsInput) (listWidgetsOutput, error)

List returns the project's widgets, most recently updated first.

func (*WidgetService) Save 

func (s *WidgetService) Save(ctx context.Context, principal Principal, input saveWidgetInput) (widgetWriteOutput, error)

Save previews or commits a create (no widget_id) or a full update.

type WorkflowRunEmitter 

type WorkflowRunEmitter interface {
	CaptureEvent(ctx context.Context, eventName string, distinctID string, eventProperties map[string]any) error
}

WorkflowRunEmitter delivers one diagnostics event to Speakeasy's own analytics pipeline. It is deliberately narrow: this package never sees the vendor client's types.

type WorkflowRunInput 

type WorkflowRunInput struct {
	// Skill names the workflow that ran.
	Skill string `json:"skill" jsonschema:"name of the workflow that ran, for example add-existing-mcp-servers"`

	// RunID groups every event from one run. The caller generates it.
	RunID string `json:"run_id" jsonschema:"caller-generated identifier grouping this run's events, at most 128 characters"`

	// ProjectSlug is the project the run targeted.
	ProjectSlug string `json:"project_slug,omitempty" jsonschema:"project slug the run targeted, when the workflow targets one"`

	// Client names the local client the run was driven from.
	Client string `json:"client,omitempty" jsonschema:"local client the run was driven from, for example claude_code"`

	// Items is everything the run handled, including what it excluded. A run
	// that handled nothing sends none, which is itself a reportable result.
	Items []WorkflowRunItem `` /* 134-byte string literal not displayed */
}

WorkflowRunInput is one run of one shipped Platform MCP workflow.

type WorkflowRunItem 

type WorkflowRunItem struct {
	// Name is the non-secret name the workflow knows this item by.
	Name string `json:"name" jsonschema:"non-secret name this workflow knows the item by"`

	// Kind is the declared transport or type, usually the reason an excluded
	// item was excluded.
	Kind string `json:"kind,omitempty" jsonschema:"optional item kind, for example streamable_http, sse, or stdio"`

	// Endpoint is the safe remote endpoint when the item has one. It is a
	// separate validated field rather than free text so a credential cannot
	// reach analytics inside a URL.
	Endpoint string `` /* 127-byte string literal not displayed */

	// Outcome is what the run did with this item.
	Outcome string `json:"outcome" jsonschema:"one of added, added_unverified, already_present, blocked, failed"`

	// Reason explains a blocked or failed outcome in the workflow's own words.
	Reason string `json:"reason,omitempty" jsonschema:"short explanation for a blocked or failed outcome, at most 1000 characters"`
}

WorkflowRunItem is one thing a workflow run handled.

type WorkflowRunService 

type WorkflowRunService struct {
	// contains filtered or unexported fields
}

WorkflowRunService records one run of a shipped Platform MCP workflow for Speakeasy's own debugging. It is internal telemetry about how a workflow behaves in the field: nothing it emits is readable back through the product.

func NewWorkflowRunService 

func NewWorkflowRunService(logger *slog.Logger, emitter WorkflowRunEmitter) *WorkflowRunService

func (*WorkflowRunService) Record 

func (s *WorkflowRunService) Record(ctx context.Context, principal Principal, input WorkflowRunInput) error

Record validates one run report and emits it. An endpoint that fails the credential contract is dropped from its item rather than rejecting the whole report: the items most worth seeing are the ones a workflow excluded.

type WorkloadAssertionReuseManagement 

type WorkloadAssertionReuseManagement interface {
	List(context.Context, *gen.ListPayload) (*gen.WorkloadIdentityPolicy, error)
	UpdateIssuer(context.Context, *gen.UpdateIssuerPayload) (*gen.WorkloadIdentityPolicy, error)
}

WorkloadAssertionReuseManagement preserves the management API's live scope, organization-tier visibility, row locking, and atomic audit checks.

type WorkloadAssertionReuseOutput 

type WorkloadAssertionReuseOutput struct {
	ProjectID           string `json:"project_id"`
	OrganizationID      string `json:"organization_id"`
	IssuerID            string `json:"issuer_id"`
	IssuerName          string `json:"issuer_name"`
	PolicyScope         string `json:"policy_scope"`
	AllowAssertionReuse bool   `json:"allow_assertion_reuse"`
}

type WorkloadAssertionReuseService 

type WorkloadAssertionReuseService struct {
	// contains filtered or unexported fields
}

type WorkspaceInvitation 

type WorkspaceInvitation struct {
	ID               string
	OrganizationName string
	// RequiresSSO marks an organization whose SSO connection covers the
	// invitee's email when this sign-in did not go through it. It cannot be
	// joined until the user signs in with that SSO.
	RequiresSSO bool
}

WorkspaceInvitation is a live invitation to an existing organization.

type WorkspaceProvisioner 

type WorkspaceProvisioner interface {
	SuggestedWorkspaceName(ctx context.Context, userID string) (string, error)
	ProvisionWorkspace(ctx context.Context, userID, name, clientName string) (OrganizationOption, error)
	PendingInvitations(ctx context.Context, verifiedEmail, ssoOrganizationID string) ([]WorkspaceInvitation, error)
	JoinInvitedWorkspace(ctx context.Context, userID, verifiedEmail, ssoOrganizationID, invitationID string) (OrganizationOption, error)
}

WorkspaceProvisioner creates the first organization for a user who signs in with no organization, so a new user can connect without visiting the dashboard first. A user with a pending invitation to their verified email joins that organization instead. ProvisionWorkspace must refuse a user who already belongs to an organization or has a pending invitation. A nil provisioner in OAuthHTTPConfig refuses a user with no organization instead.

type XAAEMAProvider 

type XAAEMAProvider struct {
	Kind                  string  `` /* 149-byte string literal not displayed */
	RemoteSessionIssuerID *string `json:"remote_session_issuer_id,omitempty" jsonschema:"the external provider's remote session issuer, when it names one"`
	UnavailableReason     *string `` /* 297-byte string literal not displayed */
	LastAcceptedAt        *string `` /* 578-byte string literal not displayed */
}

type XAAIdentityChaining 

type XAAIdentityChaining struct {
	Served          bool                         `` /* 169-byte string literal not displayed */
	NotServedReason *string                      `` /* 697-byte string literal not displayed */
	Providers       []XAAEMAProvider             `` /* 494-byte string literal not displayed */
	Bindings        []XAAIdentityChainingBinding `json:"bindings"`
}

type XAAIdentityChainingBinding 

type XAAIdentityChainingBinding struct {
	State            string   `json:"state"`
	Stage            string   `json:"stage"`
	Remediation      string   `json:"remediation,omitempty"`
	Retryable        bool     `json:"retryable"`
	GrantSource      string   `json:"grant_source"`
	RequestedScopes  []string `json:"requested_scopes" jsonschema:"scopes identity chaining requests, after dropping OpenID Connect scopes"`
	ConfiguredScopes []string `` /* 237-byte string literal not displayed */
	ConnectionScopes []string `` /* 461-byte string literal not displayed */
	ScopesOutOfDate  bool     `` /* 178-byte string literal not displayed */
}

Source Files

View all Source files

Directories

Path Synopsis
Package localfixture owns the code-defined reviewed provider used only by the explicit local Platform MCP fixture composition.
 Package localfixture owns the code-defined reviewed provider used only by the explicit local Platform MCP fixture composition.
Package oauth defines Platform MCP's organization-bound OAuth state contracts.
 Package oauth defines Platform MCP's organization-bound OAuth state contracts.
Package remotesessionprovider implements reviewed Platform MCP provider readiness over shared remote-session authorization.
 Package remotesessionprovider implements reviewed Platform MCP provider readiness over shared remote-session authorization.
Package servernames folds the server names agent hooks report back onto the MCP servers configured in a project.
 Package servernames folds the server names agent hooks report back onto the MCP servers configured in a project.
Package setupcorpus builds the reviewed Platform MCP setup resource corpus from the pinned mcp-setup-docs export.
 Package setupcorpus builds the reviewed Platform MCP setup resource corpus from the pinned mcp-setup-docs export.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.