bvandeusenandClaude Opus 5.5
680a6bf3b6
MCP-6 #4970 "Automation tools: playbooks, runs, schedules, alert actions". Viewer: list_playbooks, get_playbook (secret defaults masked), list_inventory (variable names only), list_ansible_runs, get_ansible_run (log tail + grep), list_schedules, wait_for_run (polls, 120s cap). Operator: run_playbook (check mode unless check=false; a steward:confirm playbook applies only with confirmed=true; secret variables reach the run but are never stored, audited or returned), cancel_ansible_run, and create/update/delete_schedule (secrets refused, check by default). Admin: set_alert_action, and the docker plugin's prune_docker, which previews from the disk report unless check=false (Ansible's check mode skips the prune commands, so a check run would show nothing). Every write is audited as "<user> via MCP" with the token id; the audit tool's user filter includes those rows. prune_extra_vars moves to the docker service so the page and the tool share it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
919 B
Python
25 lines
919 B
Python
"""Audit trail for changes made through MCP.
|
|
|
|
Every mutating tool records its change with `audit_mcp`, under the calling
|
|
user's id and the username "<user> via MCP" (an operator ruling on the API
|
|
Surface), so the audit log separates what a person did from what an agent
|
|
did on their token. The token id goes into the detail.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from steward.core.audit import log_audit
|
|
from steward.mcp._context import current_caller, mcp_app
|
|
|
|
VIA = " via MCP"
|
|
|
|
|
|
def mcp_username(username: str) -> str:
|
|
return (username + VIA)[:64]
|
|
|
|
|
|
async def audit_mcp(action: str, entity_type: str | None = None, entity_id: str | None = None,
|
|
detail: dict | None = None) -> None:
|
|
caller = current_caller()
|
|
await log_audit(mcp_app(), caller.user_id, mcp_username(caller.username), action,
|
|
entity_type, entity_id, {**(detail or {}), "token_id": caller.token_id})
|