feat: expose auth admin summaries

src/wf_mcp/broker/server.py

@@ -18,6 +18,7 @@ from .config import broker_config_from_workflow_config, build_service_from_confi
 from .prompts import register_broker_prompts
 from .resources import register_broker_resources
 from .service import WfMcpService
+from .service.auth_admin import McpAuthAdminProvider
 from .service.source_registry_admin import SourceRegistryAdminProvider
 from .service.workflow_operation_context import context_from_service
 from .tools import register_broker_tools
@@ -67,6 +68,7 @@ def workflow_server_from_service(
     admin = WorkflowAdminApi(
         connections=service.connection_service,
         events=service.events,
+        auth=McpAuthAdminProvider(store=service.store),
     )
     registry_provider = SourceRegistryAdminProvider(
         source_registry_store=source_registry_store,

src/wf_mcp/broker/service/auth_admin.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from wf_api import WorkflowAdminAuthProvider
+
+from ...storage import Store
+
+
+@dataclass(frozen=True, slots=True)
+class McpAuthAdminProvider(WorkflowAdminAuthProvider):
+    """Read-only auth inventory for MCP-backed workflow servers.
+
+    Summaries intentionally expose payload keys, not payload values. Concrete
+    auth variants can provide richer safe display later.
+    """
+
+    store: Store
+
+    def list_auth_records(self) -> list[dict[str, Any]]:
+        return [
+            self.inspect_auth_record(auth_ref)
+            for auth_ref in sorted(self.store.list_auth_refs())
+        ]
+
+    def inspect_auth_record(self, auth_ref: str) -> dict[str, Any]:
+        record = self.store.load_auth(auth_ref)
+        if record is None:
+            raise KeyError(f"unknown auth record {auth_ref!r}")
+        return {
+            "id": record.connection_id,
+            "scheme": record.scheme,
+            "metadata": {},
+            "payload_keys": sorted(str(key) for key in record.payload),
+        }
+
+
+__all__ = ["McpAuthAdminProvider"]