dbdea98f69
* chore(deps-dev): bump vitest from 3.2.7 to 4.1.10 Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.7 to 4.1.10. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * fix: bump @vitest/coverage-v8 alongside vitest to 4.1.10 The vitest 4.x bump had a peer dependency conflict with @vitest/coverage-v8 still pinned at 3.x. Bump it in lockstep to resolve npm install errors. Refs #13 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: seahaven-openswe[bot] <296972425+seahaven-openswe[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| cdk | ||
| src | ||
| test | ||
| cdk.json | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
sh-mcp-finance
Finance-tier Sea Haven MCP server. Exposes the finance tool registry
(qbo search_vendors, payments lookup_payment_by_* — see docs/design.md §3)
over the same two interfaces as sh-mcp-ops (MCP Streamable HTTP + OpenAPI 3.1),
through the same shared dispatch path.
Finance is sensitive, read-only, and fully audited: every tool call emits a
structured audit record and the response is redacted on egress (bank account /
routing / card / SSN / tax-id masked) before it leaves the server
(docs/design.md §2.5, §7.3).
Run locally (no AWS, no Cognito)
npm install
npm run build
SH_MCP_ENV=local PORT=8082 npm run start -w @sh-mcp/server-finance
# or: SH_MCP_ENV=local npm run dev -w @sh-mcp/server-finance
Endpoints
Identical shape to sh-mcp-ops: GET /healthz, GET /openapi.json (both
unauthenticated), POST /mcp, and POST /tools/:name (both authenticated).
Dev bearer tokens (local only)
| Token | Identity | Scopes |
|---|---|---|
dev-finance |
accounting@seahavenind.com | ops:read, finance:read |
dev-finance-admin |
adam@seahavenind.com | ops:read, finance:read, finance:admin |
Ops-tier tokens (dev-ops-only, dev-assistant) are rejected by this server
(audience binding).
Sample curl — redaction on egress
TOKEN=dev-finance
curl -s -X POST localhost:8082/tools/lookup_payment_by_vendor \
-H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
-d '{"vendor":"Harbor"}' | jq
# → bankAccountNumber / bankRoutingNumber / cardNumber are "[REDACTED]";
# vendor, amount, invoice number are intact.
Each call writes one structured audit line to stdout (CloudWatch in Lambda):
{
"kind": "audit",
"sub": "...",
"tool": "lookup_payment_by_vendor",
"argsHash": "<sha256>",
"decision": "allow",
"result": "ok",
"ts": "..."
}
Args are hashed, never logged raw — secrets never reach the audit log.
MCP Inspector
Point it at http://localhost:8082/mcp (Streamable HTTP) with
Authorization: Bearer dev-finance.
Environment
Same as sh-mcp-ops plus PAYMENTS_TABLE (aws mode). Finance additionally
applies the 15-minute TTL ceiling on finance:* tokens in aws mode
(docs/design.md §2.5). aws mode is not runtime-exercised in Phase 1.
CDK
cdk/app.ts is a synth-only placeholder (no real IAM/Cognito/WAF) — the
finance least-privilege role and audit wiring land in a later phase behind the
mandatory IAM cross-review.