Repository navigation
ADR 0009 + 0010 — v3.1 design decisions (MCP write tools; fail-closed audit) - #27
Merged
Merged
Conversation
The two v3.1 'needs-adr' decisions: - 0009: decline secret-mutating MCP tools — MCP stays read/exec-only, set/delete remain CLI-only. Specifies the deny-by-default mcp.write gate as the shape if a real consumer ever appears. - 0010: keep best-effort (fail-open) audit as the default to avoid a DoS surface; add an opt-in strict (fail-closed) mode mirroring strict leases. Implementation tracked in #26. Closes #18 Closes #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two pure-documentation ADRs resolving the v3.1
needs-adrissues. Bundled because neither carries code and both are the same decision batch.ADR 0009 — No MCP write tools (Closes #18)
Decision: decline.
set/deleteare not exposed over MCP; secret mutation stays CLI-only (human-driven). MCP remains read/exec-only. High blast-radius (delete) for niche benefit, no concrete consumer. Documents the deny-by-defaultmcp.writegate as the future shape if needed.ADR 0010 — Fail-closed audit (Closes #19)
Decision: fail-open default + opt-in strict. Today the access path already discards audit errors (fail-open) despite the doc comment. Keep that default (avoids the DoS surface where an unwritable audit path bricks all secret access); add
LLM_SECRETS_AUDIT_STRICT=1to fail closed, mirroring the strict-leases pattern. The decision is here; implementation is tracked in #26.No behavioural change ships in this PR — docs only.