Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

catalog/capability-packs/appops-operator.yaml

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {"name": "AppOps Operator", "slug": "appops-operator"},
+  "spec": {
+    "description": "Bounded server inspection and typed AppOps operations governed by identity, binding and exact-target policy without shell or Docker socket access.",
+    "allowedRiskClasses": ["R0", "R1", "R2", "R3"],
+    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
+    "toolAllowPatterns": ["server.*"],
+    "toolDenyPatterns": ["server.*.admin", "server.shell.*", "server.secret.*", "server.docker.*"],
+    "environmentConstraints": {"productionWrites": true}
+  }
+}

catalog/capability-packs/developer.yaml

@@ -0,0 +1,42 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Developer",
+    "slug": "developer"
+  },
+  "spec": {
+    "description": "Read capabilities plus bounded non-production developer workflows. Write tools remain absent from v1.0.",
+    "allowedRiskClasses": [
+      "R0",
+      "R1",
+      "R2"
+    ],
+    "scopeTemplates": [
+      "hub:catalog:read",
+      "project:{project}:read",
+      "project:{project}:develop"
+    ],
+    "toolAllowPatterns": [
+      "project.status.get",
+      "knowledge.*",
+      "gitea.*.list",
+      "gitea.repository.get",
+      "gitea.code.search",
+      "gitea.file.read",
+      "deployment.project.status",
+      "deployment.stack.inspect"
+    ],
+    "toolDenyPatterns": [
+      "*.delete",
+      "*.execute",
+      "*.restart",
+      "*.redeploy",
+      "*.rollback",
+      "database.query.*"
+    ],
+    "environmentConstraints": {
+      "productionWrites": false
+    }
+  }
+}

catalog/capability-packs/gitea-controlled-writer.yaml

@@ -0,0 +1,43 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Gitea Controlled Writer",
+    "slug": "gitea-controlled-writer"
+  },
+  "spec": {
+    "description": "Bounded production writes through safe change branches, atomic changesets, managed validation, reviewed pull requests, verified exact-head merge and merged-branch cleanup.",
+    "allowedRiskClasses": ["R2", "R3"],
+    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
+    "toolAllowPatterns": [
+      "gitea.repository.create",
+      "gitea.branchprotection.ensure",
+      "gitea.portfolio.governance.apply",
+      "gitea.branch.create",
+      "gitea.issue.create",
+      "gitea.issue.update",
+      "gitea.issue.comment.create",
+      "gitea.file.create",
+      "gitea.file.update",
+      "gitea.file.delete",
+      "gitea.pullrequest.create",
+      "gitea.pullrequest.update",
+      "gitea.pullrequest.close",
+        "gitea.pullrequest.validation.ensure",
+      "gitea.pullrequest.sync",
+      "gitea.pullrequest.merge",
+      "gitea.branch.delete",
+      "gitea.changeset.apply",
+      "gitea.validation.run",
+      "gitea.workspace.run",
+      "gitea.orchestration.start"
+    ],
+    "toolDenyPatterns": [
+      "gitea.repository.delete",
+      "gitea.*.admin",
+      "gitea.*.force*",
+      "gitea.repository.*.update"
+    ],
+    "environmentConstraints": {"productionWrites": true}
+  }
+}

catalog/capability-packs/infrastructure-reader.yaml

@@ -0,0 +1,43 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Infrastructure Reader",
+    "slug": "infrastructure-reader"
+  },
+  "spec": {
+    "description": "Read-only Unraid and internal Hub observability with secret-safe output.",
+    "allowedRiskClasses": [
+      "R0",
+      "R1"
+    ],
+    "scopeTemplates": [
+      "project:{project}:read",
+      "infra:unraid:read"
+    ],
+    "toolAllowPatterns": [
+      "project.status.get",
+      "unraid.host.*",
+      "unraid.storage.*",
+      "unraid.container.list",
+      "unraid.container.inspect",
+      "unraid.container.health",
+      "unraid.container.logs",
+      "unraid.network.list",
+      "observability.health.summary",
+      "observability.logs.search"
+    ],
+    "toolDenyPatterns": [
+      "*.create",
+      "*.update",
+      "*.delete",
+      "*.execute",
+      "*.restart",
+      "*.rotate",
+      "*.renew"
+    ],
+    "environmentConstraints": {
+      "productionWrites": false
+    }
+  }
+}

catalog/capability-packs/knowledge-intake.yaml

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {"name": "Knowledge Hub reviewed intake", "slug": "knowledge-intake"},
+  "spec": {
+    "description": "Read and compare Knowledge Hub content, then submit bounded document proposals for human review; no publication capability.",
+    "allowedRiskClasses": ["R1", "R2"],
+    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
+    "toolAllowPatterns": ["knowledge.ingestion.search", "knowledge.ingestion.context", "knowledge.ingestion.extract", "knowledge.workspace.roots", "knowledge.workspace.children", "knowledge.workspace.page", "knowledge.ingestion.analyze", "knowledge.ingestion.text_proposal", "knowledge.ingestion.submit", "knowledge.ingestion.status"],
+    "toolDenyPatterns": ["*.publish", "*.approve", "*.delete"],
+    "environmentConstraints": {"productionWrites": true}
+  }
+}

catalog/capability-packs/mobilityops-reader.yaml

@@ -0,0 +1,35 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Fleet Ops Reader",
+    "slug": "mobilityops-reader"
+  },
+  "spec": {
+    "description": "Read-only Fleet Ops operational summary, attention list, vehicle status and knowledge search.",
+    "allowedRiskClasses": [
+      "R0",
+      "R1"
+    ],
+    "scopeTemplates": [
+      "hub:catalog:read",
+      "project:{project}:read"
+    ],
+    "toolAllowPatterns": [
+      "project.status.get",
+      "mobilityops.*"
+    ],
+    "toolDenyPatterns": [
+      "*.create",
+      "*.update",
+      "*.delete",
+      "*.execute",
+      "*.restart",
+      "*.redeploy",
+      "*.rollback"
+    ],
+    "environmentConstraints": {
+      "productionWrites": false
+    }
+  }
+}

catalog/capability-packs/opencode-agent.yaml

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {"name": "OpenCode Governed Agent", "slug": "opencode-agent"},
+  "spec": {
+    "description": "Preview-gated asynchronous OpenCode jobs in explicitly registered workspaces and exact allowlisted models.",
+    "allowedRiskClasses": ["R0", "R1", "R2", "R3"],
+    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
+    "toolAllowPatterns": ["opencode.*"],
+    "toolDenyPatterns": ["opencode.*.shell*", "opencode.*.admin*", "opencode.*.provider*"],
+    "environmentConstraints": {"productionWrites": true}
+  }
+}

catalog/capability-packs/opencode-analysis.yaml

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {"name": "OpenCode Read-Only Analysis", "slug": "opencode-analysis"},
+  "spec": {
+    "description": "Optional asynchronous plan analysis with a deliberately read-only workspace mount.",
+    "allowedRiskClasses": ["R0", "R1"],
+    "scopeTemplates": ["project:{project}:read"],
+    "toolAllowPatterns": ["opencode.analysis.*", "opencode.delivery.repositories.list", "opencode.delivery.jobs.list", "opencode.delivery.status", "opencode.delivery.result"],
+    "toolDenyPatterns": ["opencode.job.*", "opencode.analysis.*.shell*", "opencode.analysis.*.admin*"],
+    "environmentConstraints": {"productionWrites": false}
+  }
+}

catalog/capability-packs/production-observer.yaml

@@ -0,0 +1,40 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Production Observer",
+    "slug": "production-observer"
+  },
+  "spec": {
+    "description": "Sanitized production health, deployment state, metadata and bounded logs.",
+    "allowedRiskClasses": [
+      "R0",
+      "R1"
+    ],
+    "scopeTemplates": [
+      "project:{project}:read",
+      "environment:prod:observe"
+    ],
+    "toolAllowPatterns": [
+      "project.status.get",
+      "unraid.container.list",
+      "unraid.container.inspect",
+      "unraid.container.health",
+      "unraid.container.logs",
+      "unraid.project.summary",
+      "deployment.project.status",
+      "deployment.stack.inspect",
+      "observability.health.summary",
+      "observability.logs.search"
+    ],
+    "toolDenyPatterns": [
+      "*.execute",
+      "*.restart",
+      "*.redeploy",
+      "*.rollback"
+    ],
+    "environmentConstraints": {
+      "productionWrites": false
+    }
+  }
+}

catalog/capability-packs/project-reader.yaml

@@ -0,0 +1,73 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {
+    "name": "Project Reader",
+    "slug": "project-reader"
+  },
+  "spec": {
+    "description": "Project knowledge, repository metadata and sanitized health/log visibility without writes.",
+    "allowedRiskClasses": [
+      "R0",
+      "R1"
+    ],
+    "scopeTemplates": [
+      "hub:catalog:read",
+      "project:{project}:read"
+    ],
+    "toolAllowPatterns": [
+      "project.status.get",
+      "knowledge.*",
+      "gitea.capabilities.get",
+      "gitea.connection.check",
+      "gitea.selftest.run",
+      "gitea.repository.get",
+      "gitea.repository.context",
+      "gitea.repository.health",
+      "gitea.branchprotection.get",
+      "gitea.branchprotection.preview",
+      "gitea.branch.list",
+      "gitea.commit.list",
+      "gitea.commit.get",
+      "gitea.ref.compare",
+      "gitea.release.list",
+      "gitea.issue.list",
+      "gitea.issue.search",
+      "gitea.pullrequest.list",
+      "gitea.pullrequest.get",
+      "gitea.pullrequest.feedback",
+      "gitea.commitstatus.list",
+      "gitea.code.search",
+      "gitea.research.search",
+      "gitea.research.fetch",
+      "gitea.file.read",
+      "gitea.tree.list",
+      "gitea.changeset.preview",
+      "gitea.validation.get",
+      "gitea.validation.failure.get",
+      "gitea.validation.list",
+      "gitea.change.status",
+      "gitea.change.review",
+      "gitea.change.reconcile",
+      "gitea.workspace.status",
+      "gitea.portfolio.health",
+      "gitea.portfolio.governance.preview",
+      "gitea.portfolio.governance.verify",
+      "gitea.orchestration.plan",
+      "deployment.project.status",
+      "deployment.stack.inspect"
+    ],
+    "toolDenyPatterns": [
+      "*.create",
+      "*.update",
+      "*.delete",
+      "*.execute",
+      "*.restart",
+      "*.redeploy",
+      "*.rollback"
+    ],
+    "environmentConstraints": {
+      "productionWrites": false
+    }
+  }
+}

catalog/capability-packs/projectbrain-operator.yaml

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "CapabilityPack",
+  "metadata": {"name": "ProjectBrain Operator", "slug": "projectbrain-operator"},
+  "spec": {
+    "description": "Durable project context, review-safe memory, governed feature delivery and execution feedback through ProjectBrain.",
+    "allowedRiskClasses": ["R0", "R1", "R2"],
+    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
+    "toolAllowPatterns": ["projectbrain.*"],
+    "toolDenyPatterns": ["projectbrain.*.admin", "projectbrain.*.force*"],
+    "environmentConstraints": {"productionWrites": true}
+  }
+}

catalog/capability-packs/stitch-designer.yaml

@@ -0,0 +1 @@
+{"apiVersion":"hub.example.com/v1alpha1","kind":"CapabilityPack","metadata":{"name":"Google Stitch Designer","slug":"stitch-designer"},"spec":{"description":"Curated Google Stitch project and screen design workflow without credential exposure or destructive tools.","allowedRiskClasses":["R1","R2"],"scopeTemplates":["project:{project}:read","project:{project}:write"],"toolAllowPatterns":["stitch.*"],"toolDenyPatterns":["stitch.*.delete","stitch.*.admin"],"environmentConstraints":{"productionWrites":true}}}