create_api_key

Instructions

Implementation Reference

• src/index.ts:730-783 (handler)

  The handler function for the 'create_api_key' tool. It generates a cryptographically random API key (ci_...), hashes it with SHA-256, sends the hash to the backend API, and returns the raw key to the caller with a warning to save it.

  async ({ user_id, name, scope }) => {
    const guard = requireApiKey();
    if (guard) return guard;
    // Generate a random API key using cryptographic RNG
    const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
    const bytes = randomBytes(32);
    let raw = "ci_";
    for (let i = 0; i < 32; i++) {
      raw += chars[bytes[i] % chars.length];
    }
    const masked = raw.slice(0, 6) + "••••••";
  
    // SHA-256 hash the key
    const encoder = new TextEncoder();
    const data = encoder.encode(raw);
    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
    const hashArray = Array.from(new Uint8Array(hashBuffer));
    const keyHash = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
  
    const result = await apiFetch("/api/api-keys", {
      method: "POST",
      headers: apiKeyHeaders(),
      body: {
        user: user_id,
        name,
        key_hash: keyHash,
        masked_key: masked,
        scope: scope || "all",
        enabled: true,
      },
    });
  
    if (result.ok) {
      return {
        content: [
          {
            type: "text" as const,
            text: JSON.stringify(
              {
                api_key: raw,
                masked_key: masked,
                scope: scope || "all",
                record: result.data,
                note: "Save this key — it cannot be retrieved again.",
              },
              null,
              2
            ),
          },
        ],
      };
    }
    return formatResult(result);
  }

• src/index.ts:725-729 (schema)

  Input schema for the 'create_api_key' tool: user_id (string), name (string 1-100 chars), and optional scope (enum: all, evaluate, fleet).

  {
    user_id: z.string().describe("Your user ID (shown on your dashboard)"),
    name: z.string().min(1).max(100).describe("Human-readable name for the key"),
    scope: z.enum(["all", "evaluate", "fleet"]).optional().describe("Endpoint scope (default: all)"),
  },

• src/index.ts:722-784 (registration)

  Registration of the 'create_api_key' tool with the MCP server using server.tool(), including description and Zod schema.

  server.tool(
    "create_api_key",
    "Create a new CI-1T API key. Response: { api_key, masked_key, scope, record }. IMPORTANT: Save the returned api_key — it cannot be retrieved again after creation.",
    {
      user_id: z.string().describe("Your user ID (shown on your dashboard)"),
      name: z.string().min(1).max(100).describe("Human-readable name for the key"),
      scope: z.enum(["all", "evaluate", "fleet"]).optional().describe("Endpoint scope (default: all)"),
    },
    async ({ user_id, name, scope }) => {
      const guard = requireApiKey();
      if (guard) return guard;
      // Generate a random API key using cryptographic RNG
      const chars = "abcdefghijklmnopqrstuvwxyz0123456789";
      const bytes = randomBytes(32);
      let raw = "ci_";
      for (let i = 0; i < 32; i++) {
        raw += chars[bytes[i] % chars.length];
      }
      const masked = raw.slice(0, 6) + "••••••";
  
      // SHA-256 hash the key
      const encoder = new TextEncoder();
      const data = encoder.encode(raw);
      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
      const hashArray = Array.from(new Uint8Array(hashBuffer));
      const keyHash = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
  
      const result = await apiFetch("/api/api-keys", {
        method: "POST",
        headers: apiKeyHeaders(),
        body: {
          user: user_id,
          name,
          key_hash: keyHash,
          masked_key: masked,
          scope: scope || "all",
          enabled: true,
        },
      });
  
      if (result.ok) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify(
                {
                  api_key: raw,
                  masked_key: masked,
                  scope: scope || "all",
                  record: result.data,
                  note: "Save this key — it cannot be retrieved again.",
                },
                null,
                2
              ),
            },
          ],
        };
      }
      return formatResult(result);
    }
  );