298 lines
12 KiB
Markdown
298 lines
12 KiB
Markdown
# Task ID: 15
|
|
|
|
**Title:** Create MCP Server Profiles Library
|
|
|
|
**Status:** pending
|
|
|
|
**Dependencies:** 4, 10
|
|
|
|
**Priority:** medium
|
|
|
|
**Description:** Build a library of pre-configured MCP server profiles for popular tools (Slack, Jira, GitHub, Terraform, etc.) with setup guides and permission templates.
|
|
|
|
**Details:**
|
|
|
|
Create comprehensive server definitions:
|
|
|
|
```typescript
|
|
// seed/mcp-servers.ts
|
|
export const mcpServerDefinitions = [
|
|
{
|
|
name: 'slack',
|
|
type: 'slack',
|
|
displayName: 'Slack',
|
|
description: 'Access Slack channels, messages, and users',
|
|
command: 'npx',
|
|
args: ['-y', '@modelcontextprotocol/server-slack'],
|
|
envTemplate: {
|
|
SLACK_BOT_TOKEN: {
|
|
description: 'Slack Bot OAuth Token',
|
|
required: true,
|
|
secret: true,
|
|
setupUrl: 'https://api.slack.com/apps',
|
|
setupGuide: `## Slack MCP Setup\n\n1. Go to https://api.slack.com/apps\n2. Create new app or select existing\n3. Go to OAuth & Permissions\n4. Add scopes: channels:read, channels:history, users:read\n5. Install to workspace\n6. Copy Bot User OAuth Token`
|
|
},
|
|
SLACK_TEAM_ID: { description: 'Slack Team/Workspace ID', required: true }
|
|
},
|
|
defaultProfiles: [
|
|
{ name: 'read-only', config: { permissions: ['read'] } },
|
|
{ name: 'full-access', config: { permissions: ['read', 'write'] } }
|
|
]
|
|
},
|
|
{
|
|
name: 'jira',
|
|
type: 'jira',
|
|
displayName: 'Jira',
|
|
description: 'Access Jira issues, projects, and workflows',
|
|
command: 'npx',
|
|
args: ['-y', '@anthropic/mcp-server-jira'],
|
|
envTemplate: {
|
|
JIRA_URL: { description: 'Jira instance URL', required: true },
|
|
JIRA_EMAIL: { description: 'Jira account email', required: true },
|
|
JIRA_API_TOKEN: {
|
|
description: 'Jira API Token',
|
|
required: true,
|
|
secret: true,
|
|
setupUrl: 'https://id.atlassian.com/manage-profile/security/api-tokens',
|
|
setupGuide: `## Jira API Token Setup\n\n1. Go to https://id.atlassian.com/manage-profile/security/api-tokens\n2. Click Create API token\n3. Give it a label (e.g., "mcpctl")\n4. Copy the token`
|
|
}
|
|
},
|
|
defaultProfiles: [
|
|
{ name: 'read-only', config: { permissions: ['read'], projects: ['*'] } },
|
|
{ name: 'project-limited', config: { permissions: ['read', 'write'], projects: [] } }
|
|
]
|
|
},
|
|
{
|
|
name: 'github',
|
|
type: 'github',
|
|
displayName: 'GitHub',
|
|
description: 'Access GitHub repositories, issues, and PRs',
|
|
command: 'npx',
|
|
args: ['-y', '@modelcontextprotocol/server-github'],
|
|
envTemplate: {
|
|
GITHUB_TOKEN: {
|
|
description: 'GitHub Personal Access Token',
|
|
required: true,
|
|
secret: true,
|
|
setupUrl: 'https://github.com/settings/tokens',
|
|
setupGuide: `## GitHub PAT Setup\n\n1. Go to https://github.com/settings/tokens\n2. Generate new token (classic)\n3. Select scopes: repo, read:user\n4. Copy token`
|
|
}
|
|
}
|
|
},
|
|
{
|
|
name: 'terraform-docs',
|
|
type: 'terraform',
|
|
displayName: 'Terraform Documentation',
|
|
description: 'Access Terraform provider documentation',
|
|
command: 'npx',
|
|
args: ['-y', 'terraform-docs-mcp'],
|
|
envTemplate: {},
|
|
defaultProfiles: [
|
|
{ name: 'aws-only', config: { providers: ['aws'] } },
|
|
{ name: 'all-providers', config: { providers: ['*'] } }
|
|
]
|
|
}
|
|
];
|
|
```
|
|
|
|
**Test Strategy:**
|
|
|
|
Verify all server definitions have required fields. Test setup guides render correctly. Test default profiles work with actual MCP servers.
|
|
|
|
## Subtasks
|
|
|
|
### 15.1. Define TypeScript types and write TDD tests for MCP server profile schemas
|
|
|
|
**Status:** pending
|
|
**Dependencies:** None
|
|
|
|
Create comprehensive TypeScript interfaces and Zod validation schemas for MCP server profile definitions, including tests for all validation rules before implementation.
|
|
|
|
**Details:**
|
|
|
|
Create src/shared/src/types/mcp-profiles.ts with TypeScript interfaces:
|
|
|
|
1. **Core Types**:
|
|
- `McpServerDefinition` - Main server definition with name, type, displayName, description, command, args, envTemplate, defaultProfiles, networkRequirements
|
|
- `EnvTemplateVariable` - Environment variable with description, required, secret, setupUrl, setupGuide, pattern (for validation)
|
|
- `DefaultProfile` - Profile configuration with name, config object, minimumScopes array
|
|
- `NetworkRequirement` - endpoints, ports, protocols for firewall documentation
|
|
|
|
2. **Zod Schemas** in src/shared/src/schemas/mcp-profiles.schema.ts:
|
|
- Validate command is 'npx' or 'docker' or absolute path
|
|
- Validate envTemplate has at least one required variable for auth types
|
|
- Validate secret fields don't appear in args array
|
|
- Validate setupGuide is valid markdown with required sections
|
|
- Validate minimumScopes for each profile type
|
|
|
|
3. **TDD Tests** in src/shared/src/__tests__/mcp-profiles.test.ts:
|
|
- Test valid definitions pass schema validation
|
|
- Test missing required fields fail validation
|
|
- Test invalid command types are rejected
|
|
- Test secret variable exposure in args is detected
|
|
- Test setupGuide markdown structure validation
|
|
- Test profile permission escalation detection
|
|
- Test networkRequirements field validation
|
|
|
|
Export all types from src/shared/src/index.ts for use by other packages.
|
|
|
|
### 15.2. Implement DevOps/SaaS MCP server profiles (Slack, Jira, GitHub, Terraform)
|
|
|
|
**Status:** pending
|
|
**Dependencies:** 15.1
|
|
|
|
Create pre-configured MCP server profile definitions for common DevOps and SaaS tools with complete setup guides, minimum required scopes, and network requirements documentation.
|
|
|
|
**Details:**
|
|
|
|
Create src/mcpd/src/seed/mcp-servers/devops.ts with server definitions:
|
|
|
|
1. **Slack Profile**:
|
|
- Command: npx -y @modelcontextprotocol/server-slack
|
|
- Required scopes: channels:read, channels:history, users:read (READ), plus channels:write, chat:write (WRITE)
|
|
- Network: api.slack.com:443/HTTPS, files.slack.com:443/HTTPS
|
|
- Profiles: read-only (minimum), full-access (with write scopes)
|
|
- Setup guide with step-by-step Slack app creation
|
|
|
|
2. **Jira Profile**:
|
|
- Command: npx -y @anthropic/mcp-server-jira
|
|
- Required scopes: read:jira-work, read:jira-user (READ), write:jira-work (WRITE)
|
|
- Network: *.atlassian.net:443/HTTPS
|
|
- Profiles: read-only, project-limited (with project filter config)
|
|
- Setup guide for API token generation
|
|
|
|
3. **GitHub Profile**:
|
|
- Command: npx -y @modelcontextprotocol/server-github
|
|
- Required scopes: repo:read, read:user (READ), repo:write, workflow (WRITE)
|
|
- Network: api.github.com:443/HTTPS, github.com:443/HTTPS
|
|
- Profiles: read-only, contributor, admin
|
|
- Setup guide for PAT creation with fine-grained tokens
|
|
|
|
4. **Terraform Docs Profile**:
|
|
- Command: npx -y terraform-docs-mcp
|
|
- No auth required (public docs)
|
|
- Network: registry.terraform.io:443/HTTPS
|
|
- Profiles: aws-only, azure-only, gcp-only, all-providers
|
|
|
|
Include mock validation endpoints for local testing in src/mcpd/src/seed/mcp-servers/__mocks__/devops-validators.ts
|
|
|
|
### 15.3. Implement Data Platform MCP server profiles (BigQuery, Snowflake, dbt Cloud, Databricks, Airflow)
|
|
|
|
**Status:** pending
|
|
**Dependencies:** 15.1
|
|
|
|
Create MCP server profile definitions for critical data platform tools with service account authentication patterns, connection string templates, and BI integration support.
|
|
|
|
**Details:**
|
|
|
|
Create src/mcpd/src/seed/mcp-servers/data-platform.ts with server definitions:
|
|
|
|
1. **BigQuery Profile**:
|
|
- Command: npx -y @anthropic/mcp-server-bigquery (or community equivalent)
|
|
- Auth: Service account JSON file upload
|
|
- envTemplate: GOOGLE_APPLICATION_CREDENTIALS (path to JSON), BQ_PROJECT_ID
|
|
- Network: bigquery.googleapis.com:443/HTTPS, storage.googleapis.com:443/HTTPS
|
|
- Profiles: viewer (roles/bigquery.dataViewer), analyst (roles/bigquery.user), admin
|
|
|
|
2. **Snowflake Profile**:
|
|
- Auth: Multi-step OAuth or key-pair authentication
|
|
- envTemplate: SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_WAREHOUSE, SNOWFLAKE_PRIVATE_KEY or SNOWFLAKE_PASSWORD
|
|
- Connection string pattern: snowflake://<user>@<account>/<warehouse>
|
|
- Network: <account>.snowflakecomputing.com:443/HTTPS
|
|
- Profiles: reader, analyst, developer
|
|
|
|
3. **dbt Cloud Profile**:
|
|
- Command: npx -y @dbt-labs/mcp-server-dbt (or community)
|
|
- envTemplate: DBT_CLOUD_TOKEN, DBT_CLOUD_ACCOUNT_ID, DBT_CLOUD_PROJECT_ID
|
|
- Network: cloud.getdbt.com:443/HTTPS
|
|
- Profiles: viewer, developer, admin
|
|
|
|
4. **Databricks Profile**:
|
|
- envTemplate: DATABRICKS_HOST, DATABRICKS_TOKEN, DATABRICKS_CLUSTER_ID (optional)
|
|
- Network: <workspace>.azuredatabricks.net:443/HTTPS or <workspace>.cloud.databricks.com:443/HTTPS
|
|
- Profiles: workspace-reader, job-runner, admin
|
|
|
|
5. **Apache Airflow Profile**:
|
|
- envTemplate: AIRFLOW_URL, AIRFLOW_USERNAME, AIRFLOW_PASSWORD (basic) or AIRFLOW_API_KEY
|
|
- Network: <airflow-host>:8080/HTTP or :443/HTTPS
|
|
- Profiles: viewer, operator, admin
|
|
|
|
Include connection string builder utilities and validators for each platform.
|
|
|
|
### 15.4. Implement BI/Analytics tool MCP profiles (Tableau, Looker, Metabase, Grafana)
|
|
|
|
**Status:** pending
|
|
**Dependencies:** 15.1
|
|
|
|
Create MCP server profile definitions for BI and analytics visualization tools commonly used by data analysts for report automation and dashboard access.
|
|
|
|
**Details:**
|
|
|
|
Create src/mcpd/src/seed/mcp-servers/analytics.ts with server definitions:
|
|
|
|
1. **Tableau Profile**:
|
|
- Auth: Personal Access Token (PAT) or connected app JWT
|
|
- envTemplate: TABLEAU_SERVER_URL, TABLEAU_SITE_ID, TABLEAU_TOKEN_NAME, TABLEAU_TOKEN_SECRET
|
|
- Network: <tableau-server>:443/HTTPS (Tableau Cloud: online.tableau.com)
|
|
- Profiles: viewer (read dashboards), explorer (create workbooks), creator (full access)
|
|
- Setup guide for PAT generation in Tableau account settings
|
|
|
|
2. **Looker Profile**:
|
|
- Auth: API3 client credentials
|
|
- envTemplate: LOOKER_BASE_URL, LOOKER_CLIENT_ID, LOOKER_CLIENT_SECRET
|
|
- Network: <instance>.cloud.looker.com:443/HTTPS
|
|
- Profiles: viewer, developer, admin
|
|
- Setup guide for API3 key creation
|
|
|
|
3. **Metabase Profile**:
|
|
- Auth: Session token or API key
|
|
- envTemplate: METABASE_URL, METABASE_USERNAME, METABASE_PASSWORD or METABASE_API_KEY
|
|
- Network: <metabase-host>:3000/HTTP or :443/HTTPS
|
|
- Profiles: viewer, analyst, admin
|
|
- Note: Self-hosted vs Cloud configuration differences
|
|
|
|
4. **Grafana Profile**:
|
|
- Auth: API key or service account token
|
|
- envTemplate: GRAFANA_URL, GRAFANA_API_KEY or GRAFANA_SERVICE_ACCOUNT_TOKEN
|
|
- Network: <grafana-host>:3000/HTTP or :443/HTTPS
|
|
- Profiles: viewer, editor, admin
|
|
- Setup guide for service account token creation
|
|
|
|
All profiles should include query/export permissions appropriate for analyst workflows (read dashboards, export data, schedule reports where supported).
|
|
|
|
### 15.5. Create profile registry, validation service, and network requirements documentation generator
|
|
|
|
**Status:** pending
|
|
**Dependencies:** 15.2, 15.3, 15.4
|
|
|
|
Build the central profile registry that indexes all MCP server definitions, provides validation services, and generates network requirements documentation for firewall planning.
|
|
|
|
**Details:**
|
|
|
|
Create src/mcpd/src/services/mcp-profile-registry.ts:
|
|
|
|
1. **McpProfileRegistry Class**:
|
|
- `getAllDefinitions()` - Returns all registered MCP server definitions
|
|
- `getDefinitionByName(name: string)` - Lookup by server name
|
|
- `getDefinitionsByCategory(category: 'devops' | 'data-platform' | 'analytics')` - Filter by category
|
|
- `searchDefinitions(query: string)` - Search by name, description, or tags
|
|
- `validateDefinition(def: McpServerDefinition)` - Validate against Zod schema
|
|
- `registerCustomDefinition(def: McpServerDefinition)` - Add user-defined servers
|
|
|
|
2. **ProfileValidationService** in src/mcpd/src/services/profile-validation.ts:
|
|
- `validateCredentials(serverName: string, env: Record<string, string>)` - Test credentials with mock endpoints
|
|
- `checkMinimumScopes(serverName: string, profile: string)` - Verify profile has required scopes
|
|
- `detectPermissionEscalation(base: string[], requested: string[])` - Security check for scope expansion
|
|
|
|
3. **NetworkDocsGenerator** in src/mcpd/src/services/network-docs-generator.ts:
|
|
- `generateFirewallRules(serverNames: string[])` - Output firewall rules in various formats (iptables, AWS SG, Azure NSG)
|
|
- `generateNetworkDiagram(projectName: string)` - Mermaid diagram of network flows
|
|
- `exportToCSV()` - Export all endpoints/ports/protocols for firewall team
|
|
|
|
4. **Seed Database Integration**:
|
|
- Update src/mcpd/src/seed/index.ts to load all profile definitions
|
|
- Create `seedMcpServerLibrary()` function that populates database from profile registry
|
|
- Support incremental updates when new profiles are added
|
|
|
|
Export registry and services from src/mcpd/src/index.ts
|