mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
28475455db
Nine roles reached their MCP surface as the deployment administrator or with an account password kept beside the account in credentials. A Moodle site admin bypasses every capability check, a Nextcloud app password is not scopable, a Gitea token reads every private repository, and a GitLab token on root reads every private project. Each role now declares its own principal in meta/users.yml and provisions it, so the exposed surface is what the service role permits. jellyfin, zammad and snipe-it kept their account but took its password from a credential named token; they read the registry too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
11 lines
306 B
YAML
11 lines
306 B
YAML
---
|
|
administrator: {}
|
|
mcp-web-app-moodle:
|
|
firstname: Infinito
|
|
lastname: MCP
|
|
accounts: []
|
|
password:
|
|
algorithm: strong_password
|
|
validation: "[^A-Za-z0-9]"
|
|
description: Account the Moodle web-service token is issued for; a token on the site administrator would bypass every capability check
|