8000 feat(mesh): agents manage the mesh's nodes over MCP and in the assistant by adeelahmad · Pull Request #618 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

feat(mesh): agents manage the mesh's nodes over MCP and in the assistant - #618

Merged
adeelahmad merged 1 commit into
mainfrom
claude/project-thread-6dqeie
Oct 18, 2026
Merged

feat(mesh): agents manage the mesh's nodes over MCP and in the assistant#618
adeelahmad merged 1 commit into
mainfrom
claude/project-thread-6dqeie

Conversation

@adeelahmad
@adeelahmad adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner

Description

Before: only a person in Settings › Nodes, or a script calling the HTTP API, could add, rename, remove or restore a machine on the mesh. MCP clients and the assistant couldn't see the mesh.

After: MCP clients (admin only, and the write scope for changes) and the assistant (admins) have six tools: mesh (read), add_mesh_node, change_mesh_node, remove_mesh_node, restore_mesh_node and withdraw_mesh_token.

  • Adding or removing a machine. In the assistant, both always wait for the admin's yes, setup conversations included. Renaming, restoring and withdrawing a token happen at once, unless the answer has read outside text.
  • The install line. An approved add_mesh_node shows its install line once on the approval card, with Copy and Done buttons. The line is never kept in the approval or the audit log, and the model never sees it. mesh never shows a token's secret.

How: mesh.add, mesh.check_token and mesh.agent_view are shared by the route, mcp_tools.py and ops_tools.MESH_TOOLS. A new ApprovalOutcome.install_line field carries the line, with OpenAPI and the client regenerated by make openapi. Audit entries use the routes' action names, tagged with via or assistant.

Motivation and Context

This follows the Nebula mesh work (#546, #553, #591, #595, #602, #607, #613). It closes the agent-first gap from AGENTS.md: everything Settings › Nodes does, an agent can now do too.

Types of changes

  • Bug fix
  • New feature (non-breaking change which adds functionality)
  • Breaking change

Checklist:

  • The title is a Conventional Commit.
  • My code follows the code style of this project (pre-commit clean).
  • I added or updated tests: test_mesh_agents.py (5), approval-install-line.test.tsx (2), and updated test_mcp.py and test_approvals.py.
  • Docs updated: docs/mesh.md (new Agents section), docs/mcp.md, docs/assistant.md.
  • Changelog fragment: changelog.d/mesh-tools.md.

Done questions (AGENTS.md)

  • Goal: delivers what the user wanted; merges on green CI.
  • Agents: this PR is the MCP and assistant tools.
  • Zero setup: nothing new to install or configure.
  • Fewest clicks: one yes adds a machine, and the line copies with one click.
  • Configurable: n/a, no new settings.
  • Light: no new dependencies or services.
  • Private and secure:
    • Admin only, and changes need the write scope.
    • The join token's secret is never shown to the model or kept.
    • The threat model's mesh admin entry is updated in all three files.
  • Cost: no model calls added. mesh reads from the database.
  • User decides: adding or removing a machine waits for the admin; defaults are unchanged.
  • Upgrades: n/a, no change to stored data.
  • Honest: README built item and docs/requirements.md row, with checks.
  • Tests, docs and generated files updated with tooling. Backend suite: 1832 passed.
  • Open: Nebula and MCP; no new dependencies.
  • Reported: in the thread. Refine-later items are in docs/mesh.md.
  • Reuse: the route and the tools share mesh.add, and the tools reuse the existing approval flow.

Generated by Claude Code

@adeelahmad
adeelahmad force-pushed the claude/project-thread-6dqeie branch 2 times, most recently from 48ae2ef to c98735b Compare October 18, 2026 15:28
@adeelahmad Claude
adeelahmad commented Oct 18, 2026
Copy link
Copy Markdown
Owner Author

The Next.js check was red here and is red on main too, so this PR didn't cause it.

Generated by Claude Code

8000

@claude
feat(mesh): agents manage the mesh's nodes over MCP and in the assistant
0e0f404 
An admin's agent now does what Settings › Nodes and Network do. `mesh` reads the mesh: on or off, the CA's
fingerprint and expiry, this machine's mesh address, every machine with how it's doing, and the join tokens not
used yet, never their secrets. `add_mesh_node` makes a join token and its install line (turning the mesh on when
it's off), `change_mesh_node` renames a machine or changes its namespaces, `remove_mesh_node` and
`restore_mesh_node` take one off and bring it back, and `withdraw_mesh_token` withdraws a token.

Over MCP every change needs an admin's write-scope token, happens at once and is audited as the web app's are. In
the assistant, adding a machine and taking one off always wait for the person's yes; the rest happens at once
unless the answer read outside text. An approved install line goes to the person once, on the approval card, and is
kept out of the approval's stored result, the audit log and the model's context.

The route, MCP and the assistant share mesh.add (token, line, turning the mesh on) and mesh.check_token, so the
assistant says what's wrong with a token's terms before it asks.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTrHPwWHtEvFJFq3M1YpH4
@adeelahmad
adeelahmad force-pushed the claude/project-thread-6dqeie branch from 2f4fc48 to 0e0f404 Compare October 18, 2026 15:52
@adeelahmad
adeelahmad merged commit 5de11f5 into main Oct 18, 2026
12 checks passed
@adeelahmad
adeelahmad deleted the claude/project-thread-6dqeie branch October 18, 2026 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@adeelahmad @claude
0