{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_d8h6rnsurbe8","handle":"wombat-mcp","url":"https://wellknown.network/agents/wombat-mcp","links":{"self":"https://wellknown.network/agents/wombat-mcp/record.json","html":"https://wellknown.network/agents/wombat-mcp","markdown":"https://wellknown.network/agents/wombat-mcp/record.md","api":"https://wellknown.network/api/v1/agents/wombat-mcp","status":"https://wellknown.network/api/v1/agents/wombat-mcp/status","claim":"https://wellknown.network/agents/wombat-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/wombat-mcp/claim.json","badge":"https://wellknown.network/agents/wombat-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/wombat-mcp/history","tools":"https://wellknown.network/api/v1/agents/wombat-mcp/tools"},"ard":{"identifier":"urn:air::server:wombat-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"wombat-mcp","summary":"Model Context Protocol bridge for WOMBATpass with OIDC pass-through auth.","description":"# Wombat MCP Bridge\n\n<img src=\"https://www.wombat-gov.dev/images/WAFpp_upscaled_1000.png\" width=\"120\" alt=\"Wombat logo\" align=\"right\">\n\nA secure [Model Context Protocol](https://modelcontextprotocol.io) server that exposes Wombat (Wombat backend) REST endpoints as MCP tools for AI assistants.\n\n## Architecture\n\n```mermaid\nsequenceDiagram\n    actor User\n    participant AI_Client as AI Client (MCP Host)\n    participant MCP as wombat-mcp (this bridge)\n    participant IdP as Keycloak / IdP\n    participant API as wombat-server\n\n    User->>IdP: Authenticate (OIDC/SAML)\n    IdP-->>User: IdP tokens\n    User->>API: Exchange IdP tokens for Wombat JWT\n    API-->>User: Wombat access token\n\n    User->>AI_Client: Start AI session\n    AI_Client->>MCP: SSE /sse with Authorization: Bearer <Wombat token>\n    MCP->>API: Introspect token (GET /auth/me) or verify HS256 locally\n    API-->>MCP: User profile {id, username, role, is_active}\n\n    alt Token invalid\n        MCP-->>AI_Client: 401 Unauthorized\n    else Token valid\n        AI_Client->>MCP: tools/list\n        MCP-->>AI_Client: Tools filtered by user's role\n\n        AI_Client->>MCP: tools/call (e.g. list runs)\n        MCP->>MCP: Validate arguments against OpenAPI schema\n        MCP->>API: Proxy request with same Bearer token\n        API-->>MCP: Backend response (row-level auth applied)\n        MCP-->>AI_Client: MCP TextContent(result)\n    end\n```\n\n## Security model\n\n- **IdP-agnostic**: The bridge does not talk to Keycloak/Entra/Okta directly. It trusts tokens issued by the upstream `wombat-server`, which handles the actual OIDC/SAML flows.\n- **OIDC pass-through**: The AI client inherits the user's Wombat SSO context by presenting the same Bearer token.\n- **Least privilege**: `tools/list` is filtered by the authenticated user's role. Unauthorized tools are invisible.\n- **Context propagation**: Every backend call forwards the original `Authorization: Bearer` header so Wombat can apply endpoint- and row-level authorization. When a cal…","publisher":{"name":"Artem Lajko, Sascha Lewandowski, Sebastian Meyer, Tim Urlaub","url":null},"homepage":"https://www.wombat-gov.dev/docs/","repository":"https://github.com/wombat-gov/wombat-mcp/issues","version":"0.2.0","license":"Apache-2.0","protocols":["mcp"],"tags":["ai-assistant","cloud","compliance","devsecops","fastapi","governance","mcp","model-context-protocol","security","sse","wombat","wombatpass"],"pricing":null,"endpoints":[{"url":"pypi:wombat-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"infra.cloud","name":"Cloud Platforms","confidence":1,"provenance":"declared"}],"categories":["infra","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"wombat-mcp","registry":"pypi","observedAt":"2026-11-05T22:26:38.522Z","publishedAt":"2026-11-02T20:25:38.764347Z","latestVersion":"0.2.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"wombat-mcp","url":"https://pypi.org/project/wombat-mcp/","firstSeenAt":"2026-11-05T22:26:13.577Z","fetchedAt":"2026-11-05T22:26:13.577Z","normalizedAt":"2026-11-05T22:26:13.577Z"}]},"firstSeenAt":"2026-11-05T22:26:13.577Z","updatedAt":"2026-11-05T22:26:38.522Z"}