plugin-auth/weavetab.json at main · Weavetab/plugin-auth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
{
  "$schema": "https://weavetab.dev/schema/plugin.json",
  "name": "@weavetab/plugin-auth",
  "version": "1.0.1",
  "description": "Zero-Leak Enterprise Session & Cookie Vault for Weavetab. Securely capture and inject encrypted browser sessions without exposing credentials to agent context.",
  "entry": "dist/index.js",
  "engines": {
    "weavetab": "^2.5.1",
    "node": ">=18.0.0"
  },
  "environments": [
    "mcp"
  ],
  "authors": [
    {
      "name": "Weavetab",
      "role": "Author & Maintainer",
      "url": "https://weavetab.dev"
    }
  ],
  "license": "MIT",
  "tags": [
    "Auth",
    "Vault",
    "Security",
    "Session",
    "Cookies"
  ],
  "links": {
    "github": "https://github.com/weavetab/plugin-auth",
    "npm": "https://www.npmjs.com/package/@weavetab/plugin-auth"
  },
  "defaultConfig": {
    "vaultDir": "",
    "defaultNavigate": true,
    "includeStorage": true
  },
  "permissions": {
    "cdp": {
      "evaluate": true,
      "reason": "Extracts and restores cookies and origin storage directly across the local CDP socket."
    },
    "fs": {
      "read": true,
      "write": true,
      "reason": "Stores and reads encrypted AES-256-GCM session vault profiles under ~/.weavetab/vault/."
    },
    "tools": {
      "add": true,
      "reason": "Registers the plugin_auth_capture, plugin_auth_inject, plugin_auth_list, and plugin_auth_delete MCP tools."
    }
  },
  "tools": [
    {
      "name": "plugin_auth_capture",
      "description": "Snapshots active session cookies and origin storage from the active tab or target URL, encrypts them locally with AES-256-GCM, and stores them in the local vault. Raw credentials are never leaked to LLM context.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "service": {
            "type": "string",
            "description": "Identifier name for this session profile (e.g. 'github', 'google', 'stripe'). Inferred from domain if omitted."
          },
          "url": {
            "type": "string",
            "description": "Explicit URL to capture session cookies for. When omitted, inferred from the active browser tab."
          },
          "include_storage": {
            "type": "boolean",
            "description": "Whether to capture localStorage alongside cookies (default true)."
          }
        }
      }
    },
    {
      "name": "plugin_auth_inject",
      "description": "Decrypts a local session vault profile and injects cookies and origin storage directly into the active browser tab via CDP. Zero credentials enter agent prompt context.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "service": {
            "type": "string",
            "description": "The service identifier or domain of the stored vault profile to inject (e.g. 'github')."
          },
          "url": {
            "type": "string",
            "description": "Optional destination URL to navigate to after injection. Defaults to profile origin."
          },
          "navigate": {
            "type": "boolean",
            "description": "Whether to navigate to the target URL after injection so the authenticated view renders (default true)."
          }
        },
        "required": ["service"]
      }
    },
    {
      "name": "plugin_auth_list",
      "description": "Lists all captured session profiles in the local vault with metadata (service, domain, cookie count, captured timestamp). Never reveals raw tokens or values.",
      "inputSchema": {
        "type": "object",
        "properties": {}
      }
    },
    {
      "name": "plugin_auth_delete",
      "description": "Permanently deletes an encrypted session profile from the local vault.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "service": {
            "type": "string",
            "description": "Identifier of the profile to delete."
          }
        },
        "required": ["service"]
      }
    }
  ]
}