Configuration

SkilledOpenApiPlugin.init({
  source,             // required — see Sources page
  requireSignature?,  // default: true
  trustedKeys?,       // default: []
  dev?,               // default: false
  outbound?,          // see below; defaults filled in
  sourceConflictPolicy?, // default: 'static-wins'
  bundleCacheDir?,    // default: '.frontmcp/skilled-openapi'
  credentials?,       // optional in-memory CredentialResolver seed
  exposeOperationsAsInternalTools?, // default: true
})

interface SignatureKey {
  keyId: string;       // matches BundleIntegrity.keyId
  alg: 'RS256' | 'EdDSA';
  publicKeyPem: string; // PEM-encoded SPKI (RSA) or Ed25519
}

import * as path from 'node:path';
import { FrontMcp, LogLevel } from '@frontmcp/sdk';
import SkilledOpenApiPlugin from '@frontmcp/plugin-skilled-openapi';

@FrontMcp({
  info: { name: 'Acme MCP', version: '1.0.0' },
  apps: [],
  plugins: [
    SkilledOpenApiPlugin.init({
      source: {
        type: 'saas',
        endpoint: process.env.FRONTMCP_BUNDLE_ENDPOINT!,
        authToken: process.env.FRONTMCP_BUNDLE_TOKEN!,
        expectedAudience: process.env.FRONTMCP_BUNDLE_AUDIENCE!,
        expectedIssuer: process.env.FRONTMCP_BUNDLE_ISSUER!,
        jwksUrl: process.env.FRONTMCP_BUNDLE_JWKS_URL!,
        pollIntervalMs: 300_000,
      },
      trustedKeys: [
        {
          keyId: process.env.FRONTMCP_BUNDLE_KEY_ID!,
          alg: 'EdDSA',
          publicKeyPem: process.env.FRONTMCP_BUNDLE_PUBKEY!,
        },
      ],
      bundleCacheDir: '/var/cache/skilled-openapi',
      // Default-deny the execution surface: a policy-less op is rejected unless
      // it is explicitly `public: true` in the bundle (see Bundle format).
      unprotectedOps: 'deny',
      // outbound defaults are production-safe; tune maxConcurrencyPerHost only if needed
    }),
  ],
  logging: { level: LogLevel.Info },
  http: { port: 8080 },
})
export default class Server {}

import { Plugin, ProviderType } from '@frontmcp/sdk';
import { SkilledOpenApiCredentialResolver } from '@frontmcp/plugin-skilled-openapi';
// your vault adapter from libs/auth or similar

@Plugin({
  name: 'my-vault-bridge',
  providers: [
    {
      provide: SkilledOpenApiCredentialResolver,
      useValue: new MyVaultBackedResolver(/* ... */),
    } as ProviderType,
  ],
})
export class VaultBridgePlugin {}

import { SkilledOpenApiConfig } from '@frontmcp/plugin-skilled-openapi';

class MyHook {
  constructor(private readonly config: SkilledOpenApiConfig) {}

  doStuff() {
    console.log(this.config.outbound.defaultTimeoutMs);
    // ...
  }
}