nathan
0c9aebf97a
- Create nexus-mcp/ with 6-shard plugin model (identity, workday, audit, itsm, assets, logistics) - Migrate 31 tools from legacy Identity + Workday servers into unified orchestrator - Add feature flag control (ENABLE_*) for atomic shard deployment per Gemini design - Implement SOC 2 audit logging with automatic PII redaction (CC7.2 / CC6.1) - Create stub shards for ITSM, Assets, Logistics (Red status awaiting credentials) - Add comprehensive mock data library with drift scenarios for credential-free testing - Update README.md: reposition from Workday-MCP to Nexus-MCP as primary server - Document installation, configuration, and shard toggling in Local-Setup.md Architecture: Orchestrator (main.py) + Shards (src/shards/*.py) + Adapters (lib/) enables piece-at-a-time deployment. Mock mode (USE_MOCK=true) supports full 53-tool testing without credentials. Smoke test verified: 33 tools registered successfully. BREAKING CHANGE: Legacy Identity/ and Workday/ servers deprecated. Users must update Claude Desktop config to point to nexus-mcp/src/main.py. Legacy folders preserved for reference pending verification. Refs: WIS-006, WIS-009, WIS-014-018, Gemini conversation 2026-04-06
74 lines
2.6 KiB
Python
74 lines
2.6 KiB
Python
"""Centralised config — loaded from environment / .env file."""
|
|
|
|
import os
|
|
from pathlib import Path
|
|
from dotenv import load_dotenv
|
|
|
|
# Load .env from the project root (nexus-mcp/)
|
|
load_dotenv(Path(__file__).parent.parent / ".env")
|
|
|
|
|
|
class ADConfig:
|
|
server: str = os.getenv("AD_SERVER", "")
|
|
port: int = int(os.getenv("AD_PORT", "389"))
|
|
base_dn: str = os.getenv("AD_BASE_DN", "")
|
|
user: str = os.getenv("AD_USER", "")
|
|
password: str = os.getenv("AD_PASSWORD", "")
|
|
use_ssl: bool = os.getenv("AD_USE_SSL", "false").lower() == "true"
|
|
|
|
|
|
class EntraConfig:
|
|
tenant_id: str = os.getenv("ENTRA_TENANT_ID", "")
|
|
client_id: str = os.getenv("ENTRA_CLIENT_ID", "")
|
|
client_secret: str = os.getenv("ENTRA_CLIENT_SECRET", "")
|
|
|
|
|
|
class IntuneConfig:
|
|
tenant_id: str = os.getenv("INTUNE_TENANT_ID") or os.getenv("ENTRA_TENANT_ID", "")
|
|
client_id: str = os.getenv("INTUNE_CLIENT_ID") or os.getenv("ENTRA_CLIENT_ID", "")
|
|
client_secret: str = os.getenv("INTUNE_CLIENT_SECRET") or os.getenv("ENTRA_CLIENT_SECRET", "")
|
|
|
|
|
|
class WorkdayConfig:
|
|
base_url: str = os.getenv("WORKDAY_BASE_URL", "")
|
|
tenant: str = os.getenv("WORKDAY_TENANT", "")
|
|
client_id: str = os.getenv("WORKDAY_CLIENT_ID", "")
|
|
client_secret: str = os.getenv("WORKDAY_CLIENT_SECRET", "")
|
|
refresh_token: str = os.getenv("WORKDAY_REFRESH_TOKEN", "")
|
|
|
|
|
|
class HelixConfig:
|
|
base_url: str = os.getenv("HELIX_BASE_URL", "")
|
|
username: str = os.getenv("HELIX_USERNAME", "")
|
|
password: str = os.getenv("HELIX_PASSWORD", "")
|
|
|
|
|
|
class LansweeperConfig:
|
|
api_url: str = os.getenv("LANSWEEPER_API_URL", "https://api.lansweeper.com/api/v2/graphql")
|
|
application_id: str = os.getenv("LANSWEEPER_APPLICATION_ID", "")
|
|
application_secret: str = os.getenv("LANSWEEPER_APPLICATION_SECRET", "")
|
|
site_id: str = os.getenv("LANSWEEPER_SITE_ID", "")
|
|
|
|
|
|
class FedExConfig:
|
|
api_url: str = os.getenv("FEDEX_API_URL", "https://apis.fedex.com")
|
|
api_key: str = os.getenv("FEDEX_API_KEY", "")
|
|
api_secret: str = os.getenv("FEDEX_API_SECRET", "")
|
|
account_number: str = os.getenv("FEDEX_ACCOUNT_NUMBER", "")
|
|
|
|
|
|
class ReportConfig:
|
|
output_dir: Path = Path(os.getenv("REPORT_OUTPUT_DIR", "./reports"))
|
|
|
|
|
|
class AuditConfig:
|
|
"""SOC 2 audit log configuration.
|
|
|
|
Controls:
|
|
CC7.2 — System Monitoring: log_file is the append-only audit trail.
|
|
CC6.1 — Logical Access: log_to_stderr enables SIEM/syslog forwarding.
|
|
"""
|
|
log_file: Path = Path(os.getenv("AUDIT_LOG_FILE", "./logs/nexus_audit.jsonl"))
|
|
log_to_stderr: bool = os.getenv("AUDIT_LOG_STDERR", "true").lower() == "true"
|
|
enabled: bool = os.getenv("AUDIT_LOGGING_ENABLED", "true").lower() == "true"
|