{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_gb4fkdxnx6ds","handle":"3tears-mcp","url":"https://wellknown.network/agents/3tears-mcp","links":{"self":"https://wellknown.network/agents/3tears-mcp/record.json","html":"https://wellknown.network/agents/3tears-mcp","markdown":"https://wellknown.network/agents/3tears-mcp/record.md","api":"https://wellknown.network/api/v1/agents/3tears-mcp","status":"https://wellknown.network/api/v1/agents/3tears-mcp/status","claim":"https://wellknown.network/agents/3tears-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/3tears-mcp/claim.json","badge":"https://wellknown.network/agents/3tears-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air::server:3tears-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"3tears-mcp","summary":"Shared MCP framework: McpServer + McpTool + PlatformHttpClient + per-tool RBAC backed by mcp_tool_grants and the task-02 epoch broadcast","description":"# 3tears-mcp\n\nShared MCP (Model Context Protocol) framework. Per-product MCP servers compose this framework instead of reimplementing stdio transport, JWT auth, error mapping, and per-tool RBAC.\n\n## What's in here\n\n| Module | Responsibility |\n|---|---|\n| `server` | `McpServer` -- wraps the official `mcp.server.Server`. Owns tool registration, RBAC gating before handler dispatch, structured error mapping per the MCP spec. |\n| `tool` | `McpTool` dataclass (name, description, input_schema, required_permission, handler) and `register_tool` decorator. |\n| `http_client` | `PlatformHttpClient` -- typed httpx client with JWT login + refresh-on-401. Used by both MCP server tool handlers (calling /api/v1/...) and CLI scripts. One HTTP-client implementation, two transports. |\n| `auth` | `Identity` dataclass + `IdentityProvider` Protocol + `EnvVarIdentityProvider` (stdio impl). `Authorizer` Protocol + `LocalGrantAuthorizer` (default impl backed by `McpToolGrantCollection`). |\n| `rbac` | `McpToolGrantCollection` -- `BaseCollection` over `mcp_tool_grants`. Exposes the in-memory grant cache that `LocalGrantAuthorizer` consults. |\n| `migrations/` | `v01_create_mcp_tool_grants` -- platform-scope DDL. Consumers register via `MigrationRunner.register(epoch_pkg)` (same shape as `threetears.epoch`). |\n\n## RBAC model\n\nPer-tool, default-deny. Each `McpTool` declares a `required_permission` string (e.g. `\"conversations.read\"`, `\"audit.read\"`). On every dispatch:\n\n1. The framework calls `Authorizer.allows(identity, required_permission)`.\n2. `LocalGrantAuthorizer` checks whether the caller's identity matches an active grant in `McpToolGrantCollection` for the requested permission.\n3. If denied, the framework returns a structured MCP error to the client (not a Python exception in the response body).\n\nThe configured admin identity (env-var creds in the stdio impl) is **auto-granted in memory at server startup**. The grant is logged but NOT written to `mcp_tool_grants`. This keeps the table tr…","publisher":{"name":"pace","url":null},"homepage":null,"repository":"https://github.com/pacepace/3tears","version":"0.35.0","license":null,"protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:3tears-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":0.779,"provenance":"derived"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"3tears-mcp","registry":"pypi","observedAt":"2026-09-09T08:22:12.741Z","publishedAt":"2026-09-09T03:19:41.667379Z","latestVersion":"0.35.0"}},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"3tears-mcp","url":"https://pypi.org/project/3tears-mcp/","firstSeenAt":"2026-09-09T08:19:56.300Z","fetchedAt":"2026-09-09T08:19:56.300Z","normalizedAt":"2026-09-09T08:19:56.300Z"}]},"firstSeenAt":"2026-09-09T08:19:56.300Z","updatedAt":"2026-09-09T08:22:12.741Z"}