@plasius/mcp-admin-contracts

Public-safe MCP admin discovery contract descriptors and response builders for the live Plasius MCP admin surface.

Boundary

This package contains contract metadata only:

• MCP action descriptors
• MCP schema/context/discovery response builders
• AI plugin manifest builder
• rollout flag identifiers used by the contract
• deprecated legacy env-name constants retained for source compatibility only
• analytics and bounded user-aggregation whitelist constants
• TypeScript types for these payloads

It intentionally does not contain runtime enforcement:

• no authentication or session logic
• no authorization checks
• no persistence or data clients
• no audit writers
• no mutation execution
• no environment reads
• no production data

Consumers must continue to enforce authentication, authorization, rollout gates, rate limits, audit logging, and input validation in their own runtime boundary. Stored feature flags are the rollout source of truth; exported *_ENV_VAR constants are legacy compatibility names and must not be used as production runtime controls.

Install

npm install @plasius/mcp-admin-contracts

Usage

import {
  buildMcpDiscoveryResponse,
  buildMcpSchemaResponse,
  buildMcpContextResponse,
  MCP_ADMIN_ANALYTICS_METRICS,
} from "@plasius/mcp-admin-contracts";

The exported registry currently covers:

• feature-flag MCP adapters
• capability-rule and effective-capability descriptors keyed by canonical tuple identities
• bounded analytics queries and curated analytics presets
• bounded grouped user-aggregation summaries without raw per-user export
• governed asset catalog, source-intake, pipeline, and review descriptors for the hosted plasius-ltd-site MCP backend

Action descriptors keep their existing description field and also expose descriptionKey and descriptionDefault so clients can resolve display text through @plasius/translations:

import { createI18n } from "@plasius/translations";
import {
  buildMcpDiscoveryResponse,
  mcpAdminContractsTranslations,
} from "@plasius/mcp-admin-contracts";

const i18n = createI18n({
  language: "en-GB",
  fallback: "en-GB",
  translations: mcpAdminContractsTranslations,
});
const [action] = buildMcpDiscoveryResponse().actions;

console.log(i18n.t(action.descriptionKey));

Local Development

npm install
npm run build
npm test
npm run pack:check

pack:check blocks accidental private runtime imports, environment reads, and runtime path leakage before publishing.

Governance

• Agent boundary: AGENTS.md
• Delivery workflow: WORKFLOW.md
• Rollout controls: FLAGS_AND_CAPABILITIES.md
• Non-functional requirements: NFR.md
• Security policy: SECURITY.md
• Code of conduct: CODE_OF_CONDUCT.md
• ADRs: docs/adrs
• CLA and legal docs: legal

For Plasius-LTD/mcp-admin-contracts#12, the parent hardening flag repo-review.2026-05-17.hardening.enabled is runtime N/A because restoring these governance files does not change package behavior.

License

Apache-2.0