klieo-ops-api

Read-only HTTP monitoring router for klieo agentic systems.

Mount at /_ops to expose operator visibility into agent runs, A2A tasks, and MCP stream state.

Quickstart — laptop-dev

[dependencies]
klieo-ops-api = { version = "2", features = ["dev-auth"] }

use klieo_ops_api::OpsRouterBuilder;

# fn run() -> Result<(), klieo_ops_api::OpsBuilderError> {
let router = OpsRouterBuilder::new()
    .with_dev_auth()
    // .with_run_log_store(run_store) — wire your stores here
    .build()?;
# let _ = router; Ok(()) }

with_dev_auth() wires AllowAnonymous and is gated behind the dev-auth feature (CWE-1188). Production builds without that feature cannot reach the permissive authenticator. Never enable dev-auth on a multi-tenant network — bind to loopback or a dev container only.

Cargo features

Production wiring

use std::sync::Arc;
use klieo_auth_common::Authenticator;
use klieo_ops_api::OpsRouterBuilder;

# fn run(auth: Arc<dyn Authenticator>) -> Result<(), klieo_ops_api::OpsBuilderError> {
let ops = OpsRouterBuilder::new()
    .with_authenticator(auth)
    // .with_run_log_store(run_store)
    // .with_task_store(task_store)
    // .with_resume_buffer(resume_buf)
    .build()?;
# let _ = ops; Ok(()) }

Endpoints

Missing stores return 501 Not Implemented. Auth is pluggable via klieo-auth-common::Authenticator.