dd4246878d
Some checks failed
CI/CD / typecheck (pull_request) Successful in 55s
CI/CD / test (pull_request) Successful in 1m4s
CI/CD / lint (pull_request) Successful in 2m2s
CI/CD / smoke (pull_request) Failing after 1m36s
CI/CD / build (pull_request) Successful in 4m13s
CI/CD / publish (pull_request) Has been skipped
One-command setup replaces the 6-step manual flow — `mcpctl create
secretbackend bao --type openbao --wizard` takes the OpenBao admin token
once, provisions a narrow policy + token role, mints the first periodic
token, stores it on mcpd, verifies end-to-end, and prints the migration
command. The admin token is NEVER persisted.
The stored credential auto-rotates daily: mcpd mints a successor via the
token role (self-rotation capability is part of the policy it was issued
with), verifies the successor, writes it over the backing Secret, then
revokes the predecessor by accessor. TTL 720h means a week of rotation
failures still leaves 20+ days of runway.
Shared:
- New `@mcpctl/shared/vault` — pure HTTP wrappers (verifyHealth,
ensureKvV2, writePolicy, ensureTokenRole, mintRoleToken, revokeAccessor,
lookupSelf, testWriteReadDelete) and policy HCL builder.
mcpd:
- `tokenMeta Json @default("{}")` on SecretBackend. Self-healing schema
migration — empty default lets `prisma db push` add the column cleanly.
- SecretBackendRotator.rotateOne: mint → verify → persist → revoke-old →
update tokenMeta. Failures surface via `lastRotationError` on the row;
the old token keeps working.
- SecretBackendRotatorLoop: on startup rotates overdue backends, schedules
per-backend timers with ±10min jitter. Stops cleanly on shutdown.
- New `POST /api/v1/secretbackends/:id/rotate` (operation
`rotate-secretbackend` — added to bootstrap-admin's auto-migrated ops
alongside migrate-secrets, which was previously missing too).
CLI:
- `--wizard` on `create secretbackend` delegates to the interactive flow.
All prompts can be pre-answered via flags (--url, --admin-token,
--mount, --path-prefix, --policy-name, --token-role,
--no-promote-default) for CI.
- `mcpctl rotate secretbackend <name>` — convenience verb; hits the new
rotate endpoint.
- `describe secretbackend` renders a Token health section (healthy /
STALE / WARNING / ERROR) with generated/renewal/expiry timestamps and
last rotation error. Only shown when tokenMeta.rotatable is true — the
existing k8s-auth + static-token backends don't surface it.
Tests: 15 vault-client unit tests (shared), 8 rotator unit tests (mcpd),
3 wizard flow tests (cli, including a regression test that the admin
token never appears in stdout). Full suite 1885/1885 (+32). Completions
regenerated for the new flags.
Out of scope (explicit): kubernetes-auth wizard, Vault Enterprise
namespaces in the wizard path, rotation for non-wizard static-token
backends. See plan file for details.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
384 lines
14 KiB
Bash
384 lines
14 KiB
Bash
# mcpctl bash completions — auto-generated by scripts/generate-completions.ts
|
|
# DO NOT EDIT MANUALLY — run: pnpm completions:generate
|
|
|
|
_mcpctl() {
|
|
local cur prev words cword
|
|
_init_completion || return
|
|
|
|
local commands="status login logout config get describe delete logs create edit apply patch backup approve console cache test migrate rotate"
|
|
local project_commands="get describe delete logs create edit attach-server detach-server"
|
|
local global_opts="-v --version --daemon-url --direct -p --project -h --help"
|
|
local resources="servers instances secrets secretbackends llms templates projects users groups rbac prompts promptrequests serverattachments proxymodels all"
|
|
local resource_aliases="servers instances secrets secretbackends llms templates projects users groups rbac prompts promptrequests serverattachments proxymodels all server srv instance inst secret sec secretbackend sb llm template tpl project proj user group rbac-definition rbac-binding prompt promptrequest pr serverattachment sa proxymodel pm"
|
|
|
|
# Check if --project/-p was given
|
|
local has_project=false
|
|
local i
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "-p" ]]; then
|
|
has_project=true
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Find the first subcommand
|
|
local subcmd=""
|
|
local subcmd_pos=0
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "--daemon-url" || "${words[i]}" == "-p" ]]; then
|
|
((i++))
|
|
continue
|
|
fi
|
|
if [[ "${words[i]}" != -* ]]; then
|
|
subcmd="${words[i]}"
|
|
subcmd_pos=$i
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Find the resource type after resource commands
|
|
local resource_type=""
|
|
if [[ -n "$subcmd_pos" ]] && [[ $subcmd_pos -gt 0 ]]; then
|
|
for ((i=subcmd_pos+1; i < cword; i++)); do
|
|
if [[ "${words[i]}" != -* ]] && [[ " $resource_aliases " == *" ${words[i]} "* ]]; then
|
|
resource_type="${words[i]}"
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Helper: get --project/-p value
|
|
_mcpctl_get_project_value() {
|
|
local i
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "-p" ]] && (( i+1 < cword )); then
|
|
echo "${words[i+1]}"
|
|
return
|
|
fi
|
|
done
|
|
}
|
|
|
|
# Helper: fetch resource names
|
|
_mcpctl_resource_names() {
|
|
local rt="$1"
|
|
if [[ -n "$rt" ]]; then
|
|
if [[ "$rt" == "instances" ]]; then
|
|
mcpctl get instances -o json 2>/dev/null | jq -r '.[][].server.name' 2>/dev/null
|
|
else
|
|
mcpctl get "$rt" -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Helper: find sub-subcommand (for config/create)
|
|
_mcpctl_get_subcmd() {
|
|
local parent_pos="$1"
|
|
local i
|
|
for ((i=parent_pos+1; i < cword; i++)); do
|
|
if [[ "${words[i]}" != -* ]]; then
|
|
echo "${words[i]}"
|
|
return
|
|
fi
|
|
done
|
|
}
|
|
|
|
# If completing option values
|
|
if [[ "$prev" == "--project" || "$prev" == "-p" ]]; then
|
|
local names
|
|
names=$(mcpctl get projects -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return
|
|
fi
|
|
|
|
case "$subcmd" in
|
|
status)
|
|
COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
|
|
return ;;
|
|
login)
|
|
COMPREPLY=($(compgen -W "--mcpd-url -h --help" -- "$cur"))
|
|
return ;;
|
|
logout)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
return ;;
|
|
config)
|
|
local config_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$config_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "view set path reset claude claude-generate setup impersonate help" -- "$cur"))
|
|
else
|
|
case "$config_sub" in
|
|
view)
|
|
COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
|
|
;;
|
|
set)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
path)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
reset)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
claude)
|
|
COMPREPLY=($(compgen -W "-p --project -o --output --inspect --stdout -h --help" -- "$cur"))
|
|
;;
|
|
claude-generate)
|
|
COMPREPLY=($(compgen -W "-p --project -o --output --inspect --stdout -h --help" -- "$cur"))
|
|
;;
|
|
setup)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
impersonate)
|
|
COMPREPLY=($(compgen -W "--quit -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
get)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -o --output -p --project -A --all -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -o --output -p --project -A --all -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
describe)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -o --output --show-values -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -o --output --show-values -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
delete)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -p --project -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -p --project -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
logs)
|
|
if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
|
|
local names
|
|
names=$(mcpctl get instances -o json 2>/dev/null | jq -r '.[][].server.name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names -t --tail -i --instance -h --help" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "-t --tail -i --instance -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
create)
|
|
local create_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$create_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "server secret llm secretbackend project user group rbac mcptoken prompt serverattachment promptrequest help" -- "$cur"))
|
|
else
|
|
case "$create_sub" in
|
|
server)
|
|
COMPREPLY=($(compgen -W "-d --description --package-name --runtime --docker-image --transport --repository-url --external-url --command --container-port --replicas --env --from-template --env-from-secret --force -h --help" -- "$cur"))
|
|
;;
|
|
secret)
|
|
COMPREPLY=($(compgen -W "--data --force -h --help" -- "$cur"))
|
|
;;
|
|
llm)
|
|
COMPREPLY=($(compgen -W "--type --model --url --tier --description --api-key-ref --extra --force -h --help" -- "$cur"))
|
|
;;
|
|
secretbackend)
|
|
COMPREPLY=($(compgen -W "--type --description --default --url --namespace --mount --path-prefix --auth --token-secret --role --auth-mount --sa-token-path --config --wizard --admin-token --policy-name --token-role --no-promote-default --force -h --help" -- "$cur"))
|
|
;;
|
|
project)
|
|
COMPREPLY=($(compgen -W "-d --description --proxy-model --prompt --llm --llm-model --gated --no-gated --server --force -h --help" -- "$cur"))
|
|
;;
|
|
user)
|
|
COMPREPLY=($(compgen -W "--password --name --force -h --help" -- "$cur"))
|
|
;;
|
|
group)
|
|
COMPREPLY=($(compgen -W "--description --member --force -h --help" -- "$cur"))
|
|
;;
|
|
rbac)
|
|
COMPREPLY=($(compgen -W "--subject --roleBindings --force -h --help" -- "$cur"))
|
|
;;
|
|
mcptoken)
|
|
COMPREPLY=($(compgen -W "-p --project --rbac --bind --ttl --description --force -h --help" -- "$cur"))
|
|
;;
|
|
prompt)
|
|
COMPREPLY=($(compgen -W "-p --project --content --content-file --priority --link -h --help" -- "$cur"))
|
|
;;
|
|
serverattachment)
|
|
COMPREPLY=($(compgen -W "-p --project -h --help" -- "$cur"))
|
|
;;
|
|
promptrequest)
|
|
COMPREPLY=($(compgen -W "-p --project --content --content-file --priority -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
edit)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "servers secrets projects groups rbac prompts promptrequests -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
apply)
|
|
COMPREPLY=($(compgen -f -W "-f --file --dry-run -h --help" -- "$cur"))
|
|
return ;;
|
|
patch)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
backup)
|
|
local backup_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$backup_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "log restore help" -- "$cur"))
|
|
else
|
|
case "$backup_sub" in
|
|
log)
|
|
COMPREPLY=($(compgen -W "-n --limit -h --help" -- "$cur"))
|
|
;;
|
|
restore)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
attach-server)
|
|
if [[ $((cword - subcmd_pos)) -ne 1 ]]; then return; fi
|
|
local proj names all_servers proj_servers
|
|
proj=$(_mcpctl_get_project_value)
|
|
if [[ -n "$proj" ]]; then
|
|
all_servers=$(mcpctl get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
proj_servers=$(mcpctl --project "$proj" get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
names=$(comm -23 <(echo "$all_servers" | sort) <(echo "$proj_servers" | sort))
|
|
else
|
|
names=$(_mcpctl_resource_names "servers")
|
|
fi
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return ;;
|
|
detach-server)
|
|
if [[ $((cword - subcmd_pos)) -ne 1 ]]; then return; fi
|
|
local proj names
|
|
proj=$(_mcpctl_get_project_value)
|
|
if [[ -n "$proj" ]]; then
|
|
names=$(mcpctl --project "$proj" get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
fi
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return ;;
|
|
approve)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "promptrequest -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
mcp)
|
|
COMPREPLY=($(compgen -W "-p --project -h --help" -- "$cur"))
|
|
return ;;
|
|
console)
|
|
if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
|
|
local names
|
|
names=$(mcpctl get projects -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names --stdin-mcp --audit -h --help" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "--stdin-mcp --audit -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
cache)
|
|
local cache_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$cache_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "stats clear help" -- "$cur"))
|
|
else
|
|
case "$cache_sub" in
|
|
stats)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
clear)
|
|
COMPREPLY=($(compgen -W "--older-than -y --yes -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
test)
|
|
local test_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$test_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "mcp help" -- "$cur"))
|
|
else
|
|
case "$test_sub" in
|
|
mcp)
|
|
COMPREPLY=($(compgen -W "--token --tool --args --expect-tools --timeout -o --output --no-health -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
migrate)
|
|
local migrate_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$migrate_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "secrets help" -- "$cur"))
|
|
else
|
|
case "$migrate_sub" in
|
|
secrets)
|
|
COMPREPLY=($(compgen -W "--from --to --names --keep-source --dry-run -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
rotate)
|
|
local rotate_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$rotate_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "secretbackend help" -- "$cur"))
|
|
else
|
|
case "$rotate_sub" in
|
|
secretbackend)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
help)
|
|
COMPREPLY=($(compgen -W "$commands" -- "$cur"))
|
|
return ;;
|
|
esac
|
|
|
|
# No subcommand yet — offer commands based on context
|
|
if [[ -z "$subcmd" ]]; then
|
|
if $has_project; then
|
|
COMPREPLY=($(compgen -W "$project_commands $global_opts" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "$commands $global_opts" -- "$cur"))
|
|
fi
|
|
fi
|
|
}
|
|
|
|
complete -F _mcpctl mcpctl
|