mcpcredential

package

v0.0.39 Latest Latest Go to latest Published: Sep 21, 2026 License: Apache-2.0 Imports: 17 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/stacklok/mecatl

Links

Open Source Insights

Documentation ¶

Overview ¶

Package mcpcredential provides the small, root-pinned custody seam used by local MCP onboarding. It deliberately contains no OAuth or client policy.

Index ¶

Constants
type ConfirmFile
type Detector
type Keyring
type MarkerInspection
- func InspectMarker(root string) MarkerInspection
type Options
type Selection
- func Open(ctx context.Context, root, backend, filePath string, keyring Keyring) (Selection, error)
- func Resolve(ctx context.Context, root string, opts Options) (Selection, error)

Constants ¶

View Source

const (
	BackendKeyring = "keyring" // BackendKeyring stores the generated key in the OS keyring.
	BackendFile    = "file"    // BackendFile stores the generated key in a protected file.
	// NativeNamespace is the credential-store namespace reserved for native MCP
	// custody. It is deliberately distinct from the legacy key_env namespace.
	NativeNamespace = "mecatl-mcp-oauth-native/v1" // #nosec G101 -- public namespace discriminator, not a credential.

)

BackendKeyring stores generated keys in the OS keyring; BackendFile uses a protected file.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type ConfirmFile ¶

type ConfirmFile func(context.Context) (bool, error)

ConfirmFile confirms the attended fallback to file custody.

type Detector ¶

type Detector func(context.Context) (bool, error)

Detector reports whether the platform keyring is available.

type Keyring ¶

type Keyring interface {
	Get(string, string) (string, error)
	Set(string, string, string) error
	Delete(string, string) error
}

Keyring reads and writes the OS credential entry used by MCP custody.

type MarkerInspection ¶

type MarkerInspection string

MarkerInspection is the bounded, non-secret result of inspecting custody metadata.

const (
	// MarkerMissing means the custody marker does not exist.
	MarkerMissing MarkerInspection = "missing"
	// MarkerUnavailable means the custody root or marker cannot be inspected.
	MarkerUnavailable MarkerInspection = "unavailable"
	// MarkerLocked means the custody root is locked.
	MarkerLocked MarkerInspection = "locked"
	// MarkerRecovery means the marker requires recovery.
	MarkerRecovery MarkerInspection = "recovery required"
	// MarkerPresent means the custody marker is valid.
	MarkerPresent MarkerInspection = "present"
)

func InspectMarker ¶

func InspectMarker(root string) MarkerInspection

InspectMarker checks only the root-pinned custody marker. It never opens a keyring, reads a credential, or returns marker contents. The result is safe for status/list projections.

type Options ¶

type Options struct {
	Requested, FilePath, Platform string
	Detect                        Detector
	ConfirmFile                   ConfirmFile
	Attended                      bool
	Keyring                       Keyring
}

Options controls MCP credential custody selection.

type Selection ¶

type Selection struct {
	Backend, Locator string
	Key              []byte
}

Selection is the selected custody backend and the key it opened or created.

func Open ¶

func Open(ctx context.Context, root, backend, filePath string, keyring Keyring) (Selection, error)

Open opens an existing root-pinned MCP credential backend.

func Resolve ¶

func Resolve(ctx context.Context, root string, opts Options) (Selection, error)

Resolve selects and opens the root-pinned MCP credential backend.

Source Files ¶

View all Source files

custody.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL