okustera_ai_mcp_token (Resource)

The okustera_ai_mcp_token resource mints an ephemeral (max 900s) audience-scoped Model Context Protocol (MCP) JWT token bound to an isolated okustera_ai_agent_sandbox, resolving credentials via OpenStack Barbican (secret_ref) so raw secrets never enter the sandbox environment.

Example Usage

resource "okustera_ai_mcp_token" "qdrant_mcp" {
  sandbox_id    = okustera_ai_agent_sandbox.secops_agent.id
  mcp_server    = "qdrant-rag"
  secret_ref    = "omc-mcp-qdrant-secret"
  allowed_tools = ["vector_search", "read_collection"]
  ttl_seconds   = 900
}