Function runMCP

cmd/mcp.go:79–194

(_ *cobra.Command, _ []string)

}

func runMCP(_ *cobra.Command, _ []string) {
	// MCP stdio mode: stderr-only logging so it doesn't interleave with the
	// JSON-RPC framing on stdout.
	log := zerolog.New(os.Stderr).With().Timestamp().Logger()

	// Wire all subsystems an MCP-exposed tool might need. As more ops
	// migrate into internal/service, this list stays the same — the
	// service-provider dependencies don't change per op, only the methods
	// on the provider do.
	storageProvider, err := storage.New(&rootArgs.config, &storage.Dependencies{Log: &log})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create storage provider")
	}
	memoryStoreProvider, err := memory_store.New(&rootArgs.config, &memory_store.Dependencies{
		Log:             &log,
		StorageProvider: storageProvider,
	})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create memory store provider")
	}
	tokenProvider, err := token.New(&rootArgs.config, &token.Dependencies{
		Log:                 &log,
		MemoryStoreProvider: memoryStoreProvider,
	})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create token provider")
	}
	emailProvider, err := email.New(&rootArgs.config, &email.Dependencies{
		Log:             &log,
		StorageProvider: storageProvider,
	})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create email provider")
	}
	smsProvider, err := sms.New(&rootArgs.config, &sms.Dependencies{Log: &log})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create sms provider")
	}
	auditProvider := audit.New(&audit.Dependencies{
		Log:             &log,
		StorageProvider: storageProvider,
	})
	eventsProvider, err := events.New(&rootArgs.config, &events.Dependencies{
		Log:             &log,
		StorageProvider: storageProvider,
	})
	if err != nil {
		log.Fatal().Err(err).Msg("failed to create events provider")
	}

	// Embedded OpenFGA engine, shared init with root.go. Nil (fail-closed)
	// when FGA is not configured or init fails — the permission tools fail
	// closed while the rest of the MCP surface serves.
	authzEngine, closeAuthzEngine := initAuthzEngine(&rootArgs.config, &log)
	defer closeAuthzEngine()

	// Authenticator provider — required by the service layer's TOTP/MFA
	// verification flows (verify_otp, login).