bvandeusenandClaude Opus 5.5
680a6bf3b6
MCP-6 #4970 "Automation tools: playbooks, runs, schedules, alert actions". Viewer: list_playbooks, get_playbook (secret defaults masked), list_inventory (variable names only), list_ansible_runs, get_ansible_run (log tail + grep), list_schedules, wait_for_run (polls, 120s cap). Operator: run_playbook (check mode unless check=false; a steward:confirm playbook applies only with confirmed=true; secret variables reach the run but are never stored, audited or returned), cancel_ansible_run, and create/update/delete_schedule (secrets refused, check by default). Admin: set_alert_action, and the docker plugin's prune_docker, which previews from the disk report unless check=false (Ansible's check mode skips the prune commands, so a check run would show nothing). Every write is audited as "<user> via MCP" with the token id; the audit tool's user filter includes those rows. prune_extra_vars moves to the docker service so the page and the tool share it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.4 KiB
Python
36 lines
1.4 KiB
Python
"""Session tools: who the connected client is acting as."""
|
|
from __future__ import annotations
|
|
|
|
from steward.mcp._context import current_caller
|
|
from steward.models.users import UserRole
|
|
|
|
_ROLE_MEANS = {
|
|
UserRole.viewer: "Read-only: every list_*/get_* tool. Nothing that changes Steward or your hosts.",
|
|
UserRole.operator: "Viewer tools, plus running playbooks (check mode unless told otherwise) "
|
|
"and changing monitors, alerts and schedules.",
|
|
UserRole.admin: "Everything, including the playbook an alert rule runs, pruning Docker disk, "
|
|
"and deleting monitors and alert rules.",
|
|
}
|
|
|
|
|
|
async def whoami() -> dict:
|
|
"""Who this connection acts as in Steward, and what that role may do.
|
|
|
|
Call this first if a tool refuses you for lack of role: `role` is the
|
|
LOWER of the token's ceiling and its user's current role, so it can be
|
|
less than the token was created with. A higher role needs a new token
|
|
from Steward's AI access page, and only up to the user's own role.
|
|
"""
|
|
caller = current_caller()
|
|
return {
|
|
"user": caller.username,
|
|
"user_id": caller.user_id,
|
|
"role": caller.role.value,
|
|
"role_allows": _ROLE_MEANS[caller.role],
|
|
"token_id": caller.token_id,
|
|
}
|
|
|
|
|
|
def register(register_tool) -> None:
|
|
register_tool(whoami, role=UserRole.viewer, read_only=True)
|