ghpool/config.example.toml at main · openabdev/ghpool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
port = 8080

allowed_owners = ["openclaw", "openabdev"]

# Token formats:
#   "ghp_xxx"                                    — plain literal
#   "env:GITHUB_TOKEN"                           — from environment variable
#   "aws:secretsmanager:my-secret:github_pat"    — from AWS Secrets Manager (JSON key)
#   "k8s:default/ghpool-secrets:pat"             — from K8s secret mounted at /etc/secrets/

[[identities]]
id = "local"
token = "env:GITHUB_TOKEN"

# [[identities]]
# id = "prod"
# token = "aws:secretsmanager:ghpool/pats:pat_prod"

# [[identities]]
# id = "k8s"
# token = "k8s:default/ghpool-secrets:pat"

[cache]
max_entries = 10000
pr_view_ttl_secs = 30
issue_list_ttl_secs = 30
run_list_ttl_secs = 15
commit_list_ttl_secs = 120
repo_view_ttl_secs = 300
default_ttl_secs = 60
# Raw (non-JSON) response cache — used for `gh pr diff`, patches, etc.
# Scoped per (path, query, Accept header, identity) to avoid cross-identity
# leakage and to correctly distinguish paginated/variant requests.
raw_ttl_secs = 30
raw_max_bytes = 268435456  # 256 MiB — total byte budget, enforced via weigher

# MCP reverse proxy (Phase 1: read-only) — https://github.com/openabdev/ghpool/issues/15
# When enabled, ghpool proxies MCP Streamable HTTP traffic on /mcp to GitHub's
# hosted MCP server, injecting a pooled credential upstream. Agents connect
# with zero GitHub tokens:
#   { "url": "http://ghpool:8080/mcp" }
[mcp]
enabled = false
# Enable WRITE tools for authenticated agents (Phase 2b-5). Startup fails
# unless [[mcp.agents]], [mcp.github_app] AND [mcp.audit] are all configured
# — writes are never available in network-trust mode, never run on pooled
# PATs, and are always fail-closed audited. When set, the default upstream
# switches to the full write-capable surface.
# enable_writes = false
# Max concurrent write calls per agent (0 = unlimited).
# max_inflight_writes = 4
# Upstream MCP endpoint. Default: hosted read-only variant, or the full
# surface when enable_writes is set.
# upstream = "https://api.githubcopilot.com/mcp/readonly"
# Optional toolset restriction (X-MCP-Toolsets header). Only used when no
# [[mcp.agents]] are configured.
# toolsets = ["issues", "pull_requests", "repos"]
# Idle TTL for MCP session → identity pinning.
# session_ttl_secs = 3600

# Durable audit trail for write-classified MCP calls (Phase 2b).
# REQUIRED before writes can be enabled. Two JSONL records per write call
# (request pre-flight + result), fsync'd. FAIL-CLOSED: if the pre-flight
# record cannot be persisted, the write call is rejected (503). The result
# record captures the MCP tool outcome (result.isError) — HTTP 200 alone is
# not a success signal. Argument VALUES are never recorded (key names only).
# [mcp.audit]
# path = "/var/lib/ghpool/mcp-audit.jsonl"
# max_result_bytes = 4194304  # response buffer cap for outcome extraction

# GitHub App credential backend (Phase 2b) — RECOMMENDED for production MCP.
# When configured, the MCP path injects short-lived installation tokens
# (minted lazily, auto-refreshed ~5 min before expiry) instead of pooled
# PATs. Sessions cannot outlive the token they started with: at token
# expiry the session gets 404 and the client re-initializes transparently.
# The PAT pool remains for REST/GraphQL and as the MCP fallback.
# [mcp.github_app]
# app_id = "123456"
# private_key = "aws:secretsmanager:ghpool/app:private_key"  # env:/k8s: also work
# owner = "openabdev"          # installation discovered from org/user…
# # installation_id = 87654321 # …or set explicitly

# Per-agent authentication + default-deny tool allowlists (Phase 2a).
# When any [[mcp.agents]] entry exists, EVERY /mcp request must present a
# valid X-Ghpool-Key header. tools/call for a tool not on the agent's
# allowlist is rejected at the proxy (403); the allowlist is also injected
# upstream as X-MCP-Tools. No entries = Phase 1 network-trust mode.
#
# Keys support the same secret references as identity tokens.
# For zero-downtime rotation, use `keys` with two entries (both valid at
# once): add the new key, roll agents over, remove the old key.
# Sessions are bound to the agent that initialized them — a session ID
# presented by a different agent is rejected (403).
# [[mcp.agents]]
# id = "openab-bot"
# key = "aws:secretsmanager:ghpool/mcp-keys:openab"   # or env:GHPOOL_KEY_OPENAB
# # keys = ["env:GHPOOL_KEY_OPENAB", "env:GHPOOL_KEY_OPENAB_NEXT"]  # rotation
# tools = ["issue_read", "list_issues", "pull_request_read"]
# # Repository allowlist: "owner/repo" exact or "owner/*" wildcard.
# # Non-empty = every tools/call must resolve to a listed repo from its
# # arguments; calls with no repo target (e.g. search_code, get_me) are
# # DENIED. Empty/omitted = no repository restriction.
# repos = ["openabdev/ghpool", "oablab/*"]
#
# [[mcp.agents]]
# id = "ci-agent"
# key = "env:GHPOOL_KEY_CI"
# tools = ["get_file_contents", "list_commits"]