Skip to content

CHANGELOG.md

Latest commit

 

History

History
66 lines (54 loc) · 3.72 KB

CHANGELOG.md

File metadata and controls

66 lines (54 loc) · 3.72 KB
Raw

Changelog

All notable changes to the aura-mcp skill are documented here.

The format follows Keep a Changelog; this kit tracks the aura__* control-plane tool surface shipped by the Aura fleet gateway.

[0.2.0] — 2026-07-21

Added

  • Committed .mcp.json (secrets as placeholders only) — the aura gateway connection reads its management token from the AURA_MCP_TOKEN env var, so claude.ai cloud environments (which load the repo's .mcp.json from the clone and inject env vars from the environment config) and devices with the var in their shell connect with no per-machine setup. The ${AURA_MCP_TOKEN:-} default keeps the config parseable when the var is unset — the connection then just shows as unavailable until the token is provided (an unset ${VAR} with no default would fail the whole config parse). .mcp.json left .gitignore (the tracked file must never contain a real token); .claude/settings.json sets enableAllProjectMcpServers so the committed config is auto-approved once the folder is trusted — in untrusted checkouts Claude Code deliberately ignores the committed key (settings not checked into the repo only, as of v2.1.196) and prompts once.
  • Every onboarding path now teaches the env-var route (Codex round-1 P1): QUICKSTART §2, connect.md, safety.md token hygiene, and the SKILL frontmatter no longer direct users to paste a token into .mcp.json + gitignore it — that flow is unsafe now that the file is tracked. Inline-token configs remain only for clients without env interpolation (Claude Desktop), with an explicit keep-out-of-version-control warning; Cursor uses ${env:AURA_MCP_TOKEN}.
  • Token env var standardized as AURA_MCP_TOKEN (was AURA_MANAGEMENT_TOKEN in the SKILL frontmatter).

[0.1.1] — 2026-07-10

Fixed

  • Security guidance: the "read-only / reject-only" token recipe told users to leave allowedTools empty — but empty means unrestricted, so a canManage token could then reach every mutating fleet tool (site / infra / content), not just reads. connect.md and QUICKSTART.md now require an explicit allow-list of the read tools + aura__reject_action for a read-only token, and reserve the empty allow-list for a fully-trusted operator token.

[0.1.0] — 2026-07-09

Initial public release — the P5 (distribution) step of the aura-mcp plan: a skill + thin connector for the control-plane tools already shipped in the Aura gateway (planks P1–P4).

Added

  • SKILL.md — the cheat sheet Claude reads: first-action protocol, tool map, menu, and the governance rules that gate the writes.
  • references/tools.md — all 10 aura__* tools with arguments, return shapes, and error codes:
    • Reads: list_pending_approvals, get_action, list_snapshots, list_connections, list_runs, client_summary.
    • Writes: reject_action (safe), restore_snapshot, rollback_run, approve_action.
  • references/connect.md — mint a canManage management token (Fleet → Agent Tokens → "allow manage") and wire an MCP client (Claude Code / Desktop / Cursor) at /api/mcp/fleet with a Bearer aura_ token.
  • references/safety.md — the governance model: human-tap-by-default approvals, the layered approve_action gates (canManage + allow-list + org opt-in + known-owner + self-approval guard), client-wide-only reverts, and scope enforcement.
  • docs/QUICKSTART.md — 5-minute connect.

Notes

  • This is a connector, not a server — all auth, policy, approval-gating, and audit live in the Aura gateway (single enforcement point). No governance is re-implemented here.
  • Requires an Aura account; no standalone value without one.