---
credentials:
  cmk_password:
    description: Password for the Checkmk site administrator (cmkadmin), seeded via CMK_PASSWORD on first container start and re-converged onto the site on
      every deploy.
    algorithm: alphanumeric
  mcp_bearer:
    description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the upstream credential the adapter presents, because authenticating
      to the application says nothing about who called the adapter."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48
  mcp_upstream_token:
    description: "Read-scoped API token the MCP adapter presents to this application. Separate from mcp_bearer, which guards the adapter itself: one says who may
      call the adapter, the other what the adapter may read."
    algorithm: alphanumeric
    validation: "^[A-Za-z0-9]{32,}$"
    length: 48