Module config 

Builds the [brontes::Config] that governs which xianyun subcommands become MCP tools, how they’re annotated, and which ones require explicit client confirmation before they run.

The allowlist, in full

brontes::Config::default() (equivalently, passing None to [brontes::command]) exposes every reachable command as a tool. This module never does that: build always returns a Config whose [Selector::cmd] matchers are an explicit allowlist, built from [selectors::allow_cmds] over exact, fully-qualified command paths. A command that isn’t named in one of the three groups below is invisible to MCP clients, full stop — see tests::guardrail in the crate’s integration tests for the check that keeps a newly added xianyun subcommand from silently falling through the cracks.

Three allowlist tiers, each with its own annotation shape:

• READ_ONLY: pure queries. readOnlyHint: true.
• STATE_CHANGING: expected, reversible side effects (a local cluster comes up, a Helm chart gets upgraded, a CA key gets lazily generated). destructiveHint: false, but not readOnlyHint.
• GATED: commands that tear something down, rewrite a file outside the project (/etc/hosts), or touch the host’s trust store (often under sudo). destructiveHint: true, and wrapped in the confirmation-gating [Middleware] from middleware.

Everything else in xianyun’s command tree — run, tool, kubectl, k9s, stern, edit-mode-process-supervisor — is deliberately excluded. See EXCLUDED for the reasons, one per command.

Constants

EXCLUDED

Commands intentionally excluded from the MCP tool surface, with the reason each one is excluded. Checked against the real command tree by the crate’s guardrail test, so an unclassified new subcommand fails that test instead of silently inheriting brontes’s open-by-default exposure.

GATED

Commands that tear down a cluster and its data, rewrite /etc/hosts, or install/remove a certificate in the host’s trust store (the latter two typically require sudo). Allowlisted, but every call through middleware::confirmation_gate first.

READ_ONLY

Commands that only read state: exact xianyun-rooted paths, matching the path strings brontes’s walker produces (space-joined, starting at the CLI’s own name).

STATE_CHANGING

Commands with real side effects that are expected, local-only, and reversible by running the CLI again (bringing a cluster up, redeploying, pulling repository updates, merging a kubeconfig entry, migrating a config file to the latest schema, or lazily generating/reading the dev CA — ca inspect can write a CA keypair to disk on first run via xianyun_pki::ca::load_or_generate, which disqualifies it from READ_ONLY despite its name).

Functions

build

Builds the full [brontes::Config] for the xianyun command tree: the three-tier allowlist above, an annotation for every allowlisted command, and the confirmation-gating middleware wired to GATED alone.

middleware

Builds the confirmation-gating [Middleware] applied to every selector over GATED commands.