Christian Krakau-Louis
70 lines
2.2 KiB
Markdown
70 lines
2.2 KiB
Markdown
# AI and MCP Automation
|
|
|
|
Milestone 16 adds optional automation surfaces that are safe by default:
|
|
|
|
- AI assistance is disabled until `ai.enabled=true`.
|
|
- MCP access is disabled until `mcp.enabled=true`.
|
|
- MCP requires scoped API tokens with `mcp:read`.
|
|
- Provider secrets are not stored in DMARQ settings.
|
|
- Safe context redacts secret-like key/value fragments, bearer tokens, long
|
|
opaque values, and email local-parts in strict mode.
|
|
- Action tools produce reviewable proposals first. Confirmation is audited, and
|
|
the current implementation does not apply DNS or other external changes.
|
|
|
|
## Settings
|
|
|
|
| Key | Default | Purpose |
|
|
| --- | --- | --- |
|
|
| `ai.enabled` | `false` | Enables AI assistance endpoints |
|
|
| `ai.provider` | `template` | `template`, `local`, or `remote` provider mode |
|
|
| `ai.model` | empty | Optional model name |
|
|
| `ai.remote_base_url` | empty | Optional remote provider URL |
|
|
| `ai.redaction_mode` | `strict` | `strict` or `balanced` safe-context redaction |
|
|
| `ai.action_tools_enabled` | `false` | Allows proposal confirmation records |
|
|
| `mcp.enabled` | `false` | Enables the read-only MCP endpoint |
|
|
|
|
Use 1Password or another deployment secret injector for provider credentials.
|
|
Do not put provider API keys into DMARQ settings.
|
|
|
|
## Safe Context
|
|
|
|
`GET /api/v1/ai/domains/{domain}/context` builds the payload that model or
|
|
agent surfaces are allowed to inspect. It includes:
|
|
|
|
- domain summary counts
|
|
- recent report metadata
|
|
- top sending sources
|
|
- evidence links to the UI
|
|
- redaction metadata
|
|
|
|
The payload deliberately excludes raw report XML, mailbox credentials, OAuth
|
|
tokens, notification target URLs, and original forensic message content.
|
|
|
|
## MCP
|
|
|
|
`POST /api/v1/mcp` accepts minimal JSON-RPC requests for:
|
|
|
|
- `initialize`
|
|
- `tools/list`
|
|
- `tools/call`
|
|
|
|
The current tools are read-only:
|
|
|
|
- `list_domains`
|
|
- `domain_summary`
|
|
- `action_proposals`
|
|
|
|
Create a token with the `mcp:read` scope and send it through `X-API-Key`.
|
|
|
|
## Audit
|
|
|
|
DMARQ records sanitized workspace audit events for:
|
|
|
|
- `ai.summary_generated`
|
|
- `ai.action_proposals_generated`
|
|
- `ai.action_proposal_confirmed`
|
|
- `mcp.tool_called`
|
|
|
|
Audit details are sanitized with the same secret-field redaction used for other
|
|
workspace audit logs.
|