mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
28475455db
Nine roles reached their MCP surface as the deployment administrator or with an account password kept beside the account in credentials. A Moodle site admin bypasses every capability check, a Nextcloud app password is not scopable, a Gitea token reads every private repository, and a GitLab token on root reads every private project. Each role now declares its own principal in meta/users.yml and provisions it, so the exposed surface is what the service role permits. jellyfin, zammad and snipe-it kept their account but took its password from a credential named token; they read the registry too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
8 lines
210 B
YAML
8 lines
210 B
YAML
---
|
|
administrator: {}
|
|
mcp-web-app-jellyfin:
|
|
firstname: Infinito
|
|
lastname: MCP
|
|
accounts: []
|
|
description: Account the Jellyfin MCP API key is minted for; it reads the library instead of the administrator
|