diff --git a/README.md b/README.md index 86949bc..2095ebb 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,8 @@ Tool counts per domain: | Domain | Tools | Highlights | | ----------------- | ----: | --------------------------------------------------------------------- | -| Assist | 20 | `whoami`, grading, HQL validators, crypto decoders, simulators | +| Configuration | 126 | CRUD for connectors, profiles, CAs, triggers, roles/teams, policies, DCV automation, labels, storages | +| Assist | 21 | `whoami`, grading, HQL validators, crypto decoders, simulators | | Lifecycle | 17 | search/aggregate certs, requests, events, enroll, approve, revoke | | Dashboards | 12 | dashboard CRUD, charts, saved HQL queries | | Datasources | 8 | DNS / LDAP / REST datasources, plus a `test_datasource` dry-run | @@ -41,7 +42,7 @@ Full per-tool table with safety tiers in [docs/tools-reference.md](docs/tools-re ## Prerequisites - [Bun](https://bun.sh/) 1.x+ (recommended) or Node.js >= 24.10 -- An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9) +- An Evertrust Horizon instance (tested on 2.10, the primary QA target; also supports 2.8 and 2.9) - API credentials, a client certificate, or browser-based OIDC access to that instance ## Install @@ -185,7 +186,7 @@ See [docs/authentication.md](docs/authentication.md) for the full step-by-step g ## Tool catalog overview -The 84 tools are grouped into 11 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. +The 211 tools are grouped into 12 domains. Each tool ships with explicit "use when / do not use when" guidance for smaller models. The table at the top of this README lists tool counts; [docs/tools-reference.md](docs/tools-reference.md) has the full per-tool table with safety tiers and one-line descriptions. Knowledge resources are exposed at `horizon://knowledge/*` URIs. See [docs/knowledge-resources.md](docs/knowledge-resources.md) for the full catalog. @@ -345,26 +346,21 @@ See [docs/development.md](docs/development.md) for environment setup, fixture ma | Horizon version | Status | | --------------- | ----------------------------------------------------------------------- | +| 2.10 | Tested - primary QA target (DCV automation, federated service accounts, identity providers, OIDC group claims, Terms of Service) | | 2.8.5+ | Tested (full feature set including Base64/Raw computation rules) | | 2.8.0-2.8.4 | Tested (Base64/Raw computation rules not available) | -| 2.7 | Expected to work (in `HORIZON_WARN_VERSIONS`) | -| 2.9 | Expected to work (in `HORIZON_WARN_VERSIONS`) | +| 2.7, 2.9 | Expected to work (in `HORIZON_WARN_VERSIONS`) | ## What is not supported -The following capabilities require direct Horizon API calls or the Horizon UI: +Most Horizon configuration objects now have full CRUD tools in the Configuration domain (126 tools): CAs, certificate profiles, PKI and third-party connectors, WCCE forests, PKI queues, triggers, storages, roles and teams, scheduled tasks, automation/execution/password policies, certificate labels, archives, system configuration, DCV automation, and Terms of Service. -- **Configuration objects** - CAs, trust chains, labels, HTTP proxies, password policies, grading policies, and grading rulesets -- **Profile management** - creating, updating, or deleting profiles (read-only listing and inspection are supported) -- **Credential management** - creating, updating, or deleting stored credentials (read-only listing IS supported via `list_credentials`) -- **PKI and third-party connector management** - connectors to ADCS, EJBCA, HashiCorp Vault, etc. -- **Email/webhook trigger management** - email and webhook (Teams/Slack/Mattermost) triggers (REST notifications ARE supported via `create_rest_notification`) -- **Trigger attachment to profiles** - use the Horizon admin UI or profile API -- **Role, team, IDP, and principal administration** -- **Analytics** - sync status and reindex operations -- **SMTP and notification server configuration** -- **Intune, Jamf, and MDM integration setup** -- **Scheduler and system-level automation** +The following remain read-only or out of scope: + +- **Read-only (list/inspect only)** - identity providers, service accounts, certificate grading policies and rulesets, and stored credentials (`list_credentials`). These can be listed and inspected but not created, updated, or deleted from the MCP server. +- **Principal administration** - managing individual user principals. +- **Analytics** - sync status and reindex operations. +- **SMTP and global notification-server configuration** - individual REST/webhook notification triggers ARE supported via `create_trigger` / `create_rest_notification`. ## Contributing @@ -390,7 +386,7 @@ PRs welcome. Before opening a pull request, run `bun run validate:ci` (it runs f | [Installation](docs/installation.md) | Install methods, OIDC setup, troubleshooting | | [Authentication](docs/authentication.md) | All four auth modes with environment variable reference | | [Client setup](docs/client-setup.md) | Claude Desktop, Claude Code, Cursor, Codex, OpenCode, MCP Inspector | -| [Tool reference](docs/tools-reference.md) | All 84 tools by domain with safety tiers | +| [Tool reference](docs/tools-reference.md) | All 211 tools by domain with safety tiers | | [Knowledge resources](docs/knowledge-resources.md)| 17 core URIs, 4 curated playbooks, generated section resources | | [Development](docs/development.md) | Dev setup, tests, linting | diff --git a/docs/client-setup.md b/docs/client-setup.md index 1937b9f..25265c1 100644 --- a/docs/client-setup.md +++ b/docs/client-setup.md @@ -78,7 +78,7 @@ Or with the standalone binary: } ``` -Start Claude Code from that directory. The 84 tools are available immediately. +Start Claude Code from that directory. The 211 tools are available immediately. ## Cursor @@ -218,4 +218,4 @@ export HORIZON_API_KEY=your-api-key bunx @modelcontextprotocol/inspector bunx @evertrust/horizon-mcp ``` -Opens a browser UI showing all 84 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). +Opens a browser UI showing all 211 tools and the full knowledge resource catalog (17 core URIs + 4 curated playbooks + generated section URIs). diff --git a/docs/installation.md b/docs/installation.md index c72df99..e5547cd 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -3,7 +3,7 @@ ## Prerequisites - Bun 1.x+ (recommended) or Node.js >= 24.10 -- An Evertrust Horizon instance (tested on 2.8, expected to work on 2.7 and 2.9) +- An Evertrust Horizon instance (tested on 2.10, the primary QA target; also supports 2.8 and 2.9) - API credentials or a client certificate with appropriate permissions ## Install methods diff --git a/docs/tools-reference.md b/docs/tools-reference.md index bd896dc..2117d17 100644 --- a/docs/tools-reference.md +++ b/docs/tools-reference.md @@ -194,7 +194,7 @@ a `describe__schema` read tool that must be called before create/update. | WCCE forest mappings | `list/get/create/update/delete_wcce_forest` | read-only + mutating | | Triggers (CRUD gap-fill, 11 subtypes) | `describe_trigger_schema` `create_trigger` `update_trigger` | read-only + mutating (list/get/delete in Triggers domain above) | -### Configuration: System & operations (20 tools) +### Configuration: System & operations (25 tools) | Object | Tools | Safety | |--------|-------|--------|