feat: expose auth admin summaries

src/wf_mcp/broker/server.py

@@ -18,6 +18,7 @@ from .config import broker_config_from_workflow_config, build_service_from_confi
 from .prompts import register_broker_prompts
 from .resources import register_broker_resources
 from .service import WfMcpService
+from .service.auth_admin import McpAuthAdminProvider
 from .service.source_registry_admin import SourceRegistryAdminProvider
 from .service.workflow_operation_context import context_from_service
 from .tools import register_broker_tools
@@ -67,6 +68,7 @@ def workflow_server_from_service(
     admin = WorkflowAdminApi(
         connections=service.connection_service,
         events=service.events,
+        auth=McpAuthAdminProvider(store=service.store),
     )
     registry_provider = SourceRegistryAdminProvider(
         source_registry_store=source_registry_store,

src/wf_mcp/broker/service/auth_admin.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from wf_api import WorkflowAdminAuthProvider
+
+from ...storage import Store
+
+
+@dataclass(frozen=True, slots=True)
+class McpAuthAdminProvider(WorkflowAdminAuthProvider):
+    """Read-only auth inventory for MCP-backed workflow servers.
+
+    Summaries intentionally expose payload keys, not payload values. Concrete
+    auth variants can provide richer safe display later.
+    """
+
+    store: Store
+
+    def list_auth_records(self) -> list[dict[str, Any]]:
+        return [
+            self.inspect_auth_record(auth_ref)
+            for auth_ref in sorted(self.store.list_auth_refs())
+        ]
+
+    def inspect_auth_record(self, auth_ref: str) -> dict[str, Any]:
+        record = self.store.load_auth(auth_ref)
+        if record is None:
+            raise KeyError(f"unknown auth record {auth_ref!r}")
+        return {
+            "id": record.connection_id,
+            "scheme": record.scheme,
+            "metadata": {},
+            "payload_keys": sorted(str(key) for key in record.payload),
+        }
+
+
+__all__ = ["McpAuthAdminProvider"]

src/wf_mcp/storage/store.py

@@ -24,6 +24,9 @@ class Store:
     def load_auth(self, connection_id: str) -> AuthRecord | None:
         raise NotImplementedError
 
+    def list_auth_refs(self) -> list[str]:
+        raise NotImplementedError
+
     def save_auth_record(self, record: NeutralAuthRecord) -> None:
         raise NotImplementedError
 
@@ -90,6 +93,11 @@ class FileStore(Store):
         data = json.loads(path.read_text(encoding="utf-8"))
         return AuthRecord(**data)
 
+    def list_auth_refs(self) -> list[str]:
+        """Return auth refs present in the local file auth store."""
+
+        return sorted(path.stem for path in self.auth_dir.glob("*.json"))
+
     def save_auth_record(self, record: NeutralAuthRecord) -> None:
         """Save neutral auth through the legacy MCP file shape."""