-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathconfig.example.toml
More file actions
142 lines (131 loc) · 6.84 KB
/
Copy pathconfig.example.toml
File metadata and controls
142 lines (131 loc) · 6.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
port = 8080
allowed_owners = ["openclaw", "openabdev"]
# Token formats:
# "ghp_xxx" — plain literal
# "env:GITHUB_TOKEN" — from environment variable
# "aws:secretsmanager:my-secret:github_pat" — from AWS Secrets Manager (JSON key)
# "k8s:default/octobroker-secrets:pat" — from K8s secret mounted at /etc/secrets/
[[identities]]
id = "local"
token = "env:GITHUB_TOKEN"
# [[identities]]
# id = "prod"
# token = "aws:secretsmanager:octobroker/pats:pat_prod"
# [[identities]]
# id = "k8s"
# token = "k8s:default/octobroker-secrets:pat"
[cache]
max_entries = 10000
pr_view_ttl_secs = 30
issue_list_ttl_secs = 30
run_list_ttl_secs = 15
commit_list_ttl_secs = 120
repo_view_ttl_secs = 300
default_ttl_secs = 60
# Raw (non-JSON) response cache — used for `gh pr diff`, patches, etc.
# Scoped per (path, query, Accept header, identity) to avoid cross-identity
# leakage and to correctly distinguish paginated/variant requests.
raw_ttl_secs = 30
raw_max_bytes = 268435456 # 256 MiB — total byte budget, enforced via weigher
# MCP reverse proxy (Phase 1: read-only) — https://github.com/openabdev/octobroker/issues/15
# When enabled, octobroker proxies MCP Streamable HTTP traffic on /mcp to GitHub's
# hosted MCP server, injecting a pooled credential upstream. Agents connect
# with zero GitHub tokens:
# { "url": "http://octobroker:8080/mcp" }
[mcp]
enabled = false
# Enable WRITE tools for authenticated agents (Phase 2b-5). Startup fails
# unless [[mcp.agents]], [mcp.github_app] AND [mcp.audit] are all configured
# — writes are never available in network-trust mode, never run on pooled
# PATs, and are always fail-closed audited. When set, the default upstream
# switches to the full write-capable surface.
# enable_writes = false
# Enable GET /git-credential: repository-scoped agents exchange their
# X-Octobroker-Key for a short-lived GitHub App installation token scoped to
# EXACTLY ONE repository with Contents-only permissions, usable as a
# git-over-HTTPS credential (username `x-access-token`). Closes the
# long-lived-PAT gap for `git push`. Same hard gate as writes: agents +
# App backend + audit (durable preflight before mint, result before the
# token is returned). The App needs Contents: read/write for pushes. With
# the singular [mcp.github_app] form, `owner` is REQUIRED — the explicit
# installation_id is verified against the installation's actual account
# before issuance. Client side: `obk git-credential` is a drop-in git
# credential helper (see README for the fail-closed helper setup).
# enable_git_credentials = false
# Max concurrent write calls per agent (0 = unlimited).
# max_inflight_writes = 4
# Upstream MCP endpoint. Default: hosted read-only variant, or the full
# surface when enable_writes is set.
# upstream = "https://api.githubcopilot.com/mcp/readonly"
# Optional toolset restriction (X-MCP-Toolsets header). Only used when no
# [[mcp.agents]] are configured.
# toolsets = ["issues", "pull_requests", "repos"]
# Idle TTL for MCP session → identity pinning.
# session_ttl_secs = 3600
# Durable audit trail for write-classified MCP calls (Phase 2b).
# REQUIRED before writes can be enabled. Two JSONL records per write call
# (request pre-flight + result), fsync'd. FAIL-CLOSED: if the pre-flight
# record cannot be persisted, the write call is rejected (503). The result
# record captures the MCP tool outcome (result.isError) — HTTP 200 alone is
# not a success signal. Argument VALUES are never recorded (key names only).
# [mcp.audit]
# path = "/var/lib/octobroker/mcp-audit.jsonl"
# max_result_bytes = 4194304 # response buffer cap for outcome extraction
# GitHub App credential backend (Phase 2b) — RECOMMENDED for production MCP.
# When configured, the MCP path injects short-lived installation tokens
# (minted lazily, auto-refreshed ~5 min before expiry) instead of pooled
# PATs. Sessions cannot outlive the token they started with: at token
# expiry the session gets 404 and the client re-initializes transparently.
# The PAT pool remains for REST/GraphQL and as the MCP fallback.
# [mcp.github_app]
# app_id = "123456"
# private_key = "aws:secretsmanager:octobroker/app:private_key" # env:/k8s: also work
# owner = "openabdev" # installation discovered from org/user…
# # installation_id = 87654321 # …or set explicitly
# MULTI-INSTALLATION routing — one agent key, several organizations.
# Mutually exclusive with [mcp.github_app]. Each entry is one GitHub App
# installation, keyed by its owner. tools/call frames route to the
# installation matching the repository owner resolved from the CALL
# ARGUMENTS — never from anything the agent chooses directly. At
# `initialize`, octobroker eagerly mints one repo-scoped token and opens one
# upstream MCP session per owner in the agent's repo allowlist (fail-closed:
# any failure fails the whole initialize); the client sees a single session.
# Requires [[mcp.agents]] with non-empty exact `repos` — every repo owner
# must be covered by an entry here (validated at startup).
# [[mcp.github_apps]]
# app_id = "123456" # the same App installed in both orgs, or…
# private_key = "aws:secretsmanager:octobroker/app:private_key"
# owner = "openabdev" # routing key (unique across entries)
# # installation_id = 87654321 # recommended: skip discovery
#
# [[mcp.github_apps]]
# app_id = "654321" # …a separate App per org
# private_key = "aws:secretsmanager:octobroker/app-oablab:private_key"
# owner = "oablab"
# # installation_id = 12345678
# Per-agent authentication + default-deny tool allowlists (Phase 2a).
# When any [[mcp.agents]] entry exists, EVERY /mcp request must present a
# valid X-Octobroker-Key header. tools/call for a tool not on the agent's
# allowlist is rejected at the proxy (403); the allowlist is also injected
# upstream as X-MCP-Tools. No entries = Phase 1 network-trust mode.
#
# Keys support the same secret references as identity tokens.
# For zero-downtime rotation, use `keys` with two entries (both valid at
# once): add the new key, roll agents over, remove the old key.
# Sessions are bound to the agent that initialized them — a session ID
# presented by a different agent is rejected (403).
# [[mcp.agents]]
# id = "openab-bot"
# key = "aws:secretsmanager:octobroker/mcp-keys:openab" # or env:OCTOBROKER_KEY_OPENAB
# # keys = ["env:OCTOBROKER_KEY_OPENAB", "env:OCTOBROKER_KEY_OPENAB_NEXT"] # rotation
# tools = ["issue_read", "list_issues", "pull_request_read"]
# # Repository allowlist: "owner/repo" exact or "owner/*" wildcard.
# # Non-empty = every tools/call must resolve to a listed repo from its
# # arguments; calls with no repo target (e.g. search_code, get_me) are
# # DENIED. Empty/omitted = no repository restriction.
# repos = ["openabdev/octobroker", "oablab/*"]
#
# [[mcp.agents]]
# id = "ci-agent"
# key = "env:OCTOBROKER_KEY_CI"
# tools = ["get_file_contents", "list_commits"]