Merge superuser MCP server into main (mcp<2 pin, CI)

.env.example

@@ -0,0 +1,46 @@
+# Copy to .env and fill in. Do NOT commit real secrets.
+
+# --- Agent behavior ---
+SUPERUSER_HUMAN_OWNER=you@example.com
+SUPERUSER_APPROVAL_AT=MEDIUM
+SUPERUSER_AUDIT_LOG=superuser-audit.log
+SUPERUSER_COMMAND_TIMEOUT=60
+# SUPERUSER_CONFIG=superuser.yaml
+
+# --- Cisco AI Defense ---
+AI_DEFENSE_ENABLED=true
+AI_DEFENSE_MODE=enforce
+# Inspection API key (explicit MCP tool-call inspection):
+AI_DEFENSE_INSPECTION_API_KEY=
+# Agent Runtime (agentsec.protect) API mode:
+AI_DEFENSE_API_MODE_LLM_ENDPOINT=
+AI_DEFENSE_API_MODE_LLM_API_KEY=
+# Or point at an agentsec.yaml instead of the two vars above:
+# AI_DEFENSE_AGENTSEC_CONFIG=agentsec.yaml
+
+# --- Cisco Duo Agentic Identity (per-tool-call authorization) ---
+DUO_ENABLED=false
+DUO_MODE=enforce
+DUO_AGENT_ID=superuser-agent-1
+# OAuth 2.1 client-credentials (machine-to-machine) endpoint + creds:
+DUO_TOKEN_URL=
+DUO_CLIENT_ID=
+DUO_CLIENT_SECRET=
+# Space-separated scopes requested at token time:
+DUO_SCOPES=superuser.read superuser.exec
+# RFC 8707 resource indicator (audience this agent may access):
+DUO_RESOURCE=
+# Optional explicit per-tool-call decision endpoint (else scope-based):
+DUO_AUTHORIZATION_URL=
+
+# --- Stripe usage-based (metered) billing ---
+STRIPE_ENABLED=false
+STRIPE_API_KEY=
+STRIPE_CUSTOMER_ID=
+STRIPE_METER_EVENT_NAME=superuser_tool_call
+STRIPE_DEFAULT_VALUE=1
+
+# --- GitHub (least-privilege, fine-grained token) ---
+GITHUB_TOKEN=
+GITHUB_ALLOWED_REPOS=your-org/your-repo
+GITHUB_ALLOW_WRITES=false

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e '.[dev]'
+      - run: pytest -q

.github/workflows/publish-mcp.yml

@@ -0,0 +1,60 @@
+name: Publish to PyPI and MCP Registry
+
+# Publishes on a version tag, e.g. `git tag v0.1.0 && git push origin v0.1.0`.
+# The MCP Registry stores metadata only, so the PyPI package must be published
+# first; the registry then verifies ownership via the `mcp-name` marker in the
+# package README.
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # OIDC: PyPI trusted publishing + MCP Registry auth
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Sync version from tag into pyproject.toml and server.json
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "Publishing version $VERSION"
+          python - "$VERSION" <<'PY'
+          import json, re, sys
+          version = sys.argv[1]
+          # pyproject.toml
+          pp = open("pyproject.toml").read()
+          pp = re.sub(r'(?m)^version = ".*"$', f'version = "{version}"', pp, count=1)
+          open("pyproject.toml", "w").write(pp)
+          # server.json (top-level + each package version)
+          data = json.load(open("server.json"))
+          data["version"] = version
+          for pkg in data.get("packages", []):
+              pkg["version"] = version
+          json.dump(data, open("server.json", "w"), indent=2)
+          PY
+
+      - name: Build package
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: Publish package to PyPI (trusted publishing / OIDC)
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+
+      - name: Authenticate to the MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish metadata to the MCP Registry
+        run: ./mcp-publisher publish

.gitignore

@@ -0,0 +1,19 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+
+# Secrets and local config
+.env
+agentsec.yaml
+superuser.yaml
+
+# Runtime artifacts
+superuser-audit.log
+*.log