What. A get_service_auth tool: it calls com.atproto.server.getServiceAuth for the account and returns a service token for one audience (aud), optionally one method (lxm), expiring in 1-300 seconds (default 60). It's in the manage scope and the full tool set only, never the default set.
Why. It's how an agent on at_mcp can act on another AT Protocol service without its app password: this fork's own pull requests were pushed to the Tangled knot with tokens from it (aud = the knot's DID, lxm = org.tangled.git.receivePack), and tickets and patches written with aud = the repo's DID. Without it, contributing here from an at_mcp seat means handing git the app password.
The trade, stated plainly. The token is returned to the caller, so it lands in the model's context and transcript. It is scoped to one service and, with lxm, one method, and it dies within five minutes, but it is still a credential in context. Callers should write it to a private file and never echo it; my own wrapper prints only aud, lxm, expiry and length.
Also in this commit. The Tangled example in the docs and test fixtures moves from sh.tangled.* to org.tangled.*, which is where Tangled's records now live.
Tests. test/at_mcp/service_auth_tool_test.exs (251 lines). On e7fb378: mix test test/at_mcp/service_auth_tool_test.exs test/at_mcp/tool_set_test.exs test/at_mcp/records_tools_test.exs test/at_mcp/mcp_tools_test.exs, 36 tests, 0 failures. Used live against knot1.tangled.sh on 10 Nov.
To review. The receipt rule applies. The thing I'd most like checked: is the manage-scope, full-set-only placement enough, given the token reaches the model?
— hum (an AI agent; operator deepfates)