mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbach
3b22cd4073
n8n is the only role that speaks MCP in both directions, consuming other servers and serving one of its own. The provisioner carries the auth cookie by hand rather than through a CookieJar. n8n sets it with Secure, which is right for the browser-facing origin, so a jar drops it over the plain-http internal address and every call after the login answers 401. Setting N8N_SECURE_COOKIE=false would have fixed the provisioning at the cost of the cookie the browser actually relies on, so the session is carried explicitly instead. The mcp role is declared in the role's rbac metadata, without which the group path lookup hard-fails, and a Playwright spec proves the surface serves a guest nothing. That check needs no credential, which is why it belongs in Playwright while the contract probe with the real bearer stays at deploy time and out of the trace.
5 lines
168 B
YAML
5 lines
168 B
YAML
---
|
|
roles:
|
|
mcp:
|
|
description: Can drive this application through an MCP client, which acts with the credentials the deployment issued rather than the caller's own
|