* feat: expose framework primitives via API gateway and MCP
Add registry, store, and broker as both HTTP routes and MCP tools
so AI agents and HTTP clients can inspect and operate the framework.
API gateway (/micro/* namespace):
GET /micro/registry List registered services
GET /micro/registry/{name} Describe a service
GET /micro/store List store keys
GET /micro/store/{key} Read a record
POST /micro/store/{key} Write a record
POST /micro/broker/{topic} Publish a message
MCP gateway (micro_* tool prefix):
micro_registry_list List services
micro_registry_get Describe a service
micro_store_list List keys
micro_store_read Read a record
micro_store_write Write a record
micro_broker_publish Publish a message
Framework tools use a Handler field on the MCP Tool struct for
direct dispatch (no RPC). Service tools continue to use RPC.
Rate limiters and circuit breakers are applied to framework
tools the same as service tools.
* fix: make framework internals opt-in on API and MCP gateways
Framework primitives (registry, broker, store) are now only
exposed when explicitly enabled:
API gateway: micro api --internal
MCP gateway: Options{Internal: true}
Off by default — user services are always exposed, framework
internals require the flag. Banner output only shows framework
routes when enabled.
* fix: always expose framework internals, gate by auth in production
Revert the --internal flag approach. Framework primitives (registry,
broker, store) are now always exposed:
- micro api: /micro/* routes always available (dev tool)
- MCP gateway: micro_* tools always registered. When Auth is
configured (production), they require micro:admin scope.
Without Auth (dev), they're open — same as all other tools.
This follows the existing pattern: micro run/api = dev (open),
micro server = production (auth + scopes). Framework internals
follow the same security model as user services.
Remove the Internal option from MCP Options. Remove --internal
flag from micro api.
Note: scope persistence depends on the store backend. The default
in-memory store does not survive restarts. Use MICRO_STORE=file
for persistent scopes in production.
* fix: correct DefaultStore comment — it's file-backed, not memory
* fix(server): don't recreate deleted admin user on restart
When the default admin account is deleted via the dashboard, set
a marker key (auth/.admin-deleted) in the store. On startup, skip
admin creation if the marker exists. This prevents the default
admin/micro credentials from reappearing after restart when the
user has intentionally removed them.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add metadata to store record
* Add metadata to cockroach store
* add metadata to store service implementation
* fix breaking cache test
* Test/fix cockroach metadata usage
* fix store memory metadata bug
* WIP store rewrite
* Fix memory store tests
* Store hard expiry times rather than duration!
* Clarify memory test
* Add limit to store interface
* Implement suffix option
* Don't return nils from noop store
* Fix syncmap
* Start fixing store service
* wip service and cache
* Use _ for special characters in cockroachdb namespace
* Improve cockroach namespace comment
* Use service name as default store namespace
* Fixes
* Implement Store Scope
* Start fixing etcd
* implement read and write with expiry and prefix
* Fix etcd tests
* Fix cockroach store
* Fix cloudflare interface
* Fix certmagic / cloudflare store
* comment lint
* cache isn't implemented yet
* Only prepare DB staements once
Co-authored-by: Ben Toogood <ben@micro.mu>
Co-authored-by: ben-toogood <bentoogood@gmail.com>
Implement the Auth interface, with JWT and service implementations.
* Update Auth Interface
* Define Auth Service Implementation
* Support Service Auth
* Add Auth Service Proto
* Remove erronious files
* Implement Auth Service Package
* Update Auth Interface
* Update Auth Interface. Add Validate, remove Add/Remove roles
* Make Revoke interface more explicit
* Refactor serializing and deserializing service accounts
* Fix srv name & update interface to be more explicit
* Require jwt public key for auth
* Rename Variables (Resource.ID => Resource.Name & ServiceAccount => Account)
* Implement JWT Auth Package
* Remove parent, add ID
* Update auth imports to v2. Add String() to auth interface
Asim Aslam