qring-mcp

Instructions

Implementation Reference

• src/mcp/server.ts:780-799 (handler)

  The tool handler for "audit_log" in the MCP server, which processes parameters and calls `queryAudit`.

  async (params) => {
    const events = queryAudit({
      key: params.key,
      action: params.action,
      limit: params.limit,
    });
  
    if (events.length === 0) return text("No audit events found");
  
    const lines = events.map((e) => {
      const parts = [e.timestamp, e.action];
      if (e.key) parts.push(e.key);
      if (e.scope) parts.push(`[${e.scope}]`);
      if (e.env) parts.push(`env:${e.env}`);
      if (e.detail) parts.push(e.detail);
      return parts.join(" | ");
    });
  
    return text(lines.join("\n"));
  },

• src/mcp/server.ts:769-779 (registration)

  The registration of the "audit_log" tool within the MCP server setup.

  server.tool(
    "audit_log",
    "Query the audit log for secret access history (observer effect). Shows who accessed what and when.",
    {
      key: z.string().optional().describe("Filter by key"),
      action: z
        .enum(["read", "write", "delete", "list", "export", "generate", "entangle", "tunnel", "teleport", "collapse"])
        .optional()
        .describe("Filter by action"),
      limit: z.number().optional().default(20).describe("Max events to return"),
    },

• src/core/observer.ts:71-112 (helper)

  The `queryAudit` function which retrieves and filters audit log events from the filesystem.

  export function queryAudit(query: AuditQuery = {}): AuditEvent[] {
    const path = getAuditPath();
    if (!existsSync(path)) return [];
  
    try {
      const lines = readFileSync(path, "utf8")
        .split("\n")
        .filter((l) => l.trim());
  
      let events: AuditEvent[] = lines
        .map((line) => {
          try {
            return JSON.parse(line) as AuditEvent;
          } catch {
            return null;
          }
        })
        .filter((e): e is AuditEvent => e !== null);
  
      if (query.key) {
        events = events.filter((e) => e.key === query.key);
      }
      if (query.action) {
        events = events.filter((e) => e.action === query.action);
      }
      if (query.since) {
        const since = new Date(query.since).getTime();
        events = events.filter(
          (e) => new Date(e.timestamp).getTime() >= since,
        );
      }
  
      events.sort(
        (a, b) =>
          new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime(),
      );
  
      if (query.limit) {
        events = events.slice(0, query.limit);
      }
  
      return events;