admin/gbrain
1
0
Fork 0
mirror of https://github.com/garrytan/gbrain.git synced 2026-07-27 22:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: clarify HTTP localOnly boundary in DEPLOY.md Operations section (#1612)

Browse Source 
Takeover of #1679. The Operations section of docs/mcp/DEPLOY.md still said
all operations are available remotely including sync_brain and file_upload,
contradicting the Scopes section and serve-http.ts's localOnly filtering.
Now consistently states that HTTP exposes only scoped, non-localOnly ops and
that local filesystem surfaces stay on stdio/CLI. Also fixes the admin scope
row to say 'remote-safe admin ops' instead of 'local-only ops'.

Regenerated llms bundles via bun run build:llms.

Co-authored-by: The Lord Argus <TheLordArgus@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-07-22 18:51:13 -07:00
co-authored by The Lord Argus Claude Fable 5
parent b928f40bcd
commit 07bb875eb7
2 changed files with 20 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/mcp/DEPLOY.md
+10 -9
View File
@@ -191,7 +191,7 @@ filesystem surface area.
|-------|---------------|
| `read` | `search`, `query`, `get_page`, `list_pages`, graph traversal |
| `write` | `put_page`, `delete_page`, `add_link`, `add_timeline_entry` |
| `admin` | Client management, token revocation, sweep, local-only ops |
| `admin` | Client management, token revocation, sweep, remote-safe admin ops |
## Legacy Bearer Token Setup
@@ -243,15 +243,16 @@ gbrain auth test \
## Operations
All 30 GBrain operations are available remotely, including `sync_brain` and
`file_upload` (no timeout limits with self-hosted server).
HTTP exposes the scoped, non-`localOnly` operation set. `sync_brain`,
`file_upload`, `file_list`, and `file_url` are intentionally hidden from remote
MCP clients even when the client has `admin` scope. Use the local stdio server
or CLI for those local filesystem surfaces.
**Security note on `file_upload`:** remote MCP callers are confined to the working
directory where `gbrain serve` was launched. Symlinks, `..` traversal, and absolute
paths outside cwd are rejected. Page slugs and filenames are allowlist-validated
(alphanumeric + hyphens; no control chars, RTL overrides, or backslashes). Local
CLI callers (`gbrain file upload ...`) keep unrestricted filesystem access since
the user owns the machine.
Remote callers can still read and write brain content through the normal scoped
operations (`get_page`, `put_page`, `search`, `query`, links, timeline entries,
OAuth/admin management, and other non-`localOnly` tools). Self-hosting removes
third-party MCP timeout ceilings, but it does not relax the local filesystem
trust boundary.
## Deployment Options
llms-full.txt
+10 -9
View File
@@ -3835,7 +3835,7 @@ filesystem surface area.
|-------|---------------|
| `read` | `search`, `query`, `get_page`, `list_pages`, graph traversal |
| `write` | `put_page`, `delete_page`, `add_link`, `add_timeline_entry` |
| `admin` | Client management, token revocation, sweep, local-only ops |
| `admin` | Client management, token revocation, sweep, remote-safe admin ops |
## Legacy Bearer Token Setup
@@ -3887,15 +3887,16 @@ gbrain auth test \
## Operations
All 30 GBrain operations are available remotely, including `sync_brain` and
`file_upload` (no timeout limits with self-hosted server).
HTTP exposes the scoped, non-`localOnly` operation set. `sync_brain`,
`file_upload`, `file_list`, and `file_url` are intentionally hidden from remote
MCP clients even when the client has `admin` scope. Use the local stdio server
or CLI for those local filesystem surfaces.
**Security note on `file_upload`:** remote MCP callers are confined to the working
directory where `gbrain serve` was launched. Symlinks, `..` traversal, and absolute
paths outside cwd are rejected. Page slugs and filenames are allowlist-validated
(alphanumeric + hyphens; no control chars, RTL overrides, or backslashes). Local
CLI callers (`gbrain file upload ...`) keep unrestricted filesystem access since
the user owns the machine.
Remote callers can still read and write brain content through the normal scoped
operations (`get_page`, `put_page`, `search`, `query`, links, timeline entries,
OAuth/admin management, and other non-`localOnly` tools). Self-hosting removes
third-party MCP timeout ceilings, but it does not relax the local filesystem
trust boundary.
## Deployment Options