mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
585bb04ab2
Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id → XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:* / inject (primora:// refs) / agent credential broker (dummy tokens in the child, real secret on the wire) / TTL sessions / stack:* operator group. Project vault (backend): core.project_secrets, AES-256-GCM via the platform encryptor. Metadata-only list, audit-logged reveal, and secret://NAME refs resolved at job delivery — refs stored, values never. Surfaces: dashboard Vault page (+ local-vault card under the Tauri shell), desktop vault window via IPC to the primora binary, secrets:* --remote CLI mode, metadata/write-only MCP tools so agents consume secrets via secret:// refs without holding plaintext. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
1.4 KiB
1.4 KiB
@primora/mcp
Primora MCP stdio server - exposes the platform as primora_* tools to any
MCP client (Claude Desktop, Cursor, etc.).
Build
npm run build --workspace @primora/mcp # → dist/server.js
Configure
Point your MCP client at node dist/server.js. The server shares the CLI's
config file - primora login once and both tools work. Env vars override:
PRIMORA_BASE_URL, PRIMORA_API_KEY, PRIMORA_ORG, PRIMORA_PROJECT.
Tools
30+ primora_* tools covering organizations, projects, buckets, objects,
collections, API keys, integrations, webhooks, scheduled jobs, telemetry,
and audit: primora_whoami, primora_list_projects,
primora_upload_object, primora_query_audit, primora_run_job, …
Secrets are agent-safe by design — values are never returned by any tool:
primora_vault_status/primora_vault_list— local-vault state and metadata (names/urls/notes only); requiresprimora vault unlockon the host.primora_vault_exec— runsprimoracommands with a vault secret injected into the child's env;vault/secrets/inject/agent/login/useandkeys:createare denied so no response can carry a credential.primora_secrets_list/primora_secrets_set— project-vault metadata and write-only storage. No reveal or delete: agents consume secrets throughsecret://NAMEreferences in job payloads, resolved server-side at delivery.