gh-christianlouis-dmarq/docs/reference/ai-mcp-automation.md

AI and MCP Automation

Milestone 16 adds optional automation surfaces that are safe by default:

• AI assistance is disabled until ai.enabled=true.
• MCP access is disabled until mcp.enabled=true.
• MCP requires scoped API tokens with mcp:read.
• Provider secrets are not stored in DMARQ settings.
• Safe context redacts secret-like key/value fragments, bearer tokens, long opaque values, and email local-parts in strict mode.
• Action tools produce reviewable proposals first. Confirmation is audited, and the current implementation does not apply DNS or other external changes.

Settings

Key	Default	Purpose
ai.enabled	false	Enables AI assistance endpoints
ai.provider	template	template, local, or remote provider mode
ai.model	empty	Optional model name
ai.remote_base_url	empty	Optional remote provider URL
ai.redaction_mode	strict	strict or balanced safe-context redaction
ai.action_tools_enabled	false	Allows proposal confirmation records
mcp.enabled	false	Enables the read-only MCP endpoint

Use 1Password or another deployment secret injector for provider credentials. Do not put provider API keys into DMARQ settings.

Safe Context

GET /api/v1/ai/domains/{domain}/context builds the payload that model or agent surfaces are allowed to inspect. It includes:

• domain summary counts
• recent report metadata
• top sending sources
• evidence links to the UI
• redaction metadata

The payload deliberately excludes raw report XML, mailbox credentials, OAuth tokens, notification target URLs, and original forensic message content.

MCP

POST /api/v1/mcp accepts minimal JSON-RPC requests for:

• initialize
• tools/list
• tools/call

The current tools are read-only:

• list_domains
• domain_summary
• action_proposals

Create a token with the mcp:read scope and send it through X-API-Key.

Audit

DMARQ records sanitized workspace audit events for:

• ai.summary_generated
• ai.action_proposals_generated
• ai.action_proposal_confirmed
• mcp.tool_called

Audit details are sanitized with the same secret-field redaction used for other workspace audit logs.