The config.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Getconfig.get
| Property | Value |
|---|---|
| Capability | config.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Owner |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
Read an env value / inventory. { key? }. A SECRET value is NEVER
returned plaintext - only a masked standing { isSecret:true, set:true }. A non-secret env value is
returned. Without key, lists the keys (masked) - the env inventory.
Call POST /v/config.get with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool config.get.
Setconfig.set
| Property | Value |
|---|---|
| Capability | config.write |
| Risk class | Sensitive - autonomy L2 |
| Min. permission | Owner |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
Set an env/secret kv. { key, value, isSecret? }. REFUSES a routing
key (NFR-OPS-5). A secret value is encrypted (INV-7); a non-secret is plaintext. Warns: env changes
feeding the front-door proxy need a restart, not a reload.
Call POST /v/config.set with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool config.set.