mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
28475455db
Nine roles reached their MCP surface as the deployment administrator or with an account password kept beside the account in credentials. A Moodle site admin bypasses every capability check, a Nextcloud app password is not scopable, a Gitea token reads every private repository, and a GitLab token on root reads every private project. Each role now declares its own principal in meta/users.yml and provisions it, so the exposed surface is what the service role permits. jellyfin, zammad and snipe-it kept their account but took its password from a credential named token; they read the registry too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
16 lines
340 B
YAML
16 lines
340 B
YAML
---
|
|
administrator: {}
|
|
no-reply:
|
|
username: no-reply
|
|
roles:
|
|
- bot
|
|
accounts: [mailbox]
|
|
limits:
|
|
rate: 60 / 1min
|
|
burst: 3600
|
|
mcp-web-app-nextcloud:
|
|
firstname: Infinito
|
|
lastname: MCP
|
|
accounts: []
|
|
description: Account the Nextcloud MCP app password is issued for; an app password carries the full rights of its account
|