feat(migrate): per-tenant onboarding backfill + revert + CLI (#132 part 2)

Wire the id-preserving mappers into a runnable, idempotent, reversible migration:
- backfill_onboarded_targets(db, dry_run): repositories -> onboarded_targets;
  dast_targets fold into the linked repo target (append LiveUrl, promote type,
  relink dast_scan_runs/pentest_sessions history) or migrate standalone. Skips
  existing (by _id), writes a schema_migrations marker; dry-run computes the
  report without writing. Legacy collections are never deleted.
- revert(db): replay the relink log, drop onboarded_targets + the log, clear the
  marker — restores the pre-migration state.
- CLI: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run]
  [--revert]`, with DatabasePool::list_tenant_ids for --all.
- database.rs: collection_named<T> accessor + list_tenant_ids helper.

Integration test (real Mongo, local-only — CI is --lib) covers fold + relink +
idempotency + revert end to end. 5 mapper unit tests run in CI.

Closes #132.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.cargo/audit.toml

@@ -7,4 +7,17 @@ ignore = [
     # not a realistic attack surface here. Revisit when mongodb bumps hickory.
     "RUSTSEC-2026-0118", # NSEC3 loop, no fix available upstream
     "RUSTSEC-2026-0119", # O(n²) name compression, fixed in hickory-proto >=0.26.1
+
+    # rmcp 0.16.0 — DNS rebinding in Streamable HTTP server transport (missing
+    # Host header validation). Patched in rmcp >= 1.4.0, which is a major API
+    # version jump from our pin; rmcp shipped 0.x → 1.x → 2.x in three months
+    # and the migration touches every tool handler + the auth middleware we
+    # just landed in #92. Threat model in our deployment: the MCP server is
+    # exposed at a public hostname (comp-mcp-dev.meghsakha.com) behind orca's
+    # TLS-terminating ingress with per-tenant bearer auth — the attack model
+    # (browser DNS-rebinding into localhost MCP server) doesn't directly apply.
+    # Defense-in-depth Host-header check is still a worthwhile follow-up.
+    # FOLLOW-UP: bump rmcp to 2.x in a dedicated PR (M7.3 follow-up, sized
+    # multi-hour due to API surface change).
+    "RUSTSEC-2026-0189",
 ]

.gitea/workflows/ci.yml

@@ -13,6 +13,9 @@ env:
   # both --features server and --features web shares common crate work.
   RUSTC_WRAPPER: /usr/local/bin/sccache
   SCCACHE_DIR: /tmp/sccache
+  # compliance-agent depends on tramiton-core via git; use the system git so the
+  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -46,6 +49,19 @@ jobs:
         env:
           RUSTC_WRAPPER: ""
 
+      # compliance-agent has a git dependency on tramiton-core (a private repo on
+      # this Gitea instance). Rewrite its SSH URL to HTTPS + a PAT so the runner
+      # can fetch it. Requires the repo secret TRAMITON_FETCH_TOKEN (a Gitea PAT
+      # with read:repository, owned by a user with access to sharang/tramiton).
+      # (Honored on fetch because CARGO_NET_GIT_FETCH_WITH_CLI=true uses system git.)
+      - name: Configure git auth for private tramiton dependency
+        run: |
+          git config --global \
+            url."https://sharang:${{ secrets.TRAMITON_FETCH_TOKEN }}@gitea.meghsakha.com/".insteadOf \
+            "ssh://git@gitea.meghsakha.com:22222/"
+        env:
+          RUSTC_WRAPPER: ""
+
       # Format (no compilation needed)
       - name: Format
         run: cargo fmt --all --check

Cargo.lock

@@ -676,6 +676,7 @@ dependencies = [
  "jsonwebtoken",
  "mongodb",
  "octocrab",
+ "rand 0.9.2",
  "regex",
  "reqwest",
  "secrecy",
@@ -691,6 +692,7 @@ dependencies = [
  "tower-http",
  "tracing",
  "tracing-subscriber",
+ "tramiton-core",
  "urlencoding",
  "uuid",
  "walkdir",
@@ -701,19 +703,23 @@ dependencies = [
 name = "compliance-core"
 version = "0.1.0"
 dependencies = [
+ "axum",
  "bson",
  "chrono",
  "hex",
+ "jsonwebtoken",
  "mongodb",
  "opentelemetry",
  "opentelemetry-appender-tracing",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
+ "reqwest",
  "secrecy",
  "serde",
  "serde_json",
  "sha2",
  "thiserror 2.0.18",
+ "tokio",
  "tracing",
  "tracing-opentelemetry",
  "tracing-subscriber",
@@ -814,12 +820,15 @@ dependencies = [
  "bson",
  "chrono",
  "compliance-core",
+ "dashmap",
  "dotenvy",
+ "hex",
  "mongodb",
  "rmcp",
  "schemars 1.2.1",
  "serde",
  "serde_json",
+ "sha2",
  "thiserror 2.0.18",
  "tokio",
  "tower-http",
@@ -827,6 +836,20 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "compliance-smoke"
+version = "0.1.0"
+dependencies = [
+ "axum",
+ "compliance-core",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "console_error_panic_hook"
 version = "0.1.7"
@@ -1096,9 +1119,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -4175,7 +4198,7 @@ version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
 dependencies = [
- "toml_edit",
+ "toml_edit 0.23.10+spec-1.0.0",
 ]
 
 [[package]]
@@ -4260,9 +4283,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
@@ -4974,6 +4997,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -5788,6 +5820,27 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_edit 0.22.27",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.7.5+spec-1.1.0"
@@ -5797,6 +5850,20 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde",
+ "serde_spanned",
+ "toml_datetime 0.6.11",
+ "toml_write",
+ "winnow",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.23.10+spec-1.0.0"
@@ -5804,7 +5871,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84c8b9f757e028cee9fa244aea147aab2a9ec09d5325a9b01e0a49730c2b5269"
 dependencies = [
  "indexmap 2.13.0",
- "toml_datetime",
+ "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "winnow",
 ]
@@ -5818,6 +5885,12 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
 [[package]]
 name = "tonic"
 version = "0.12.3"
@@ -6064,6 +6137,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "tramiton-core"
+version = "0.4.0"
+source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.0#e3dc1bf7027a2f6d7b1fe43043d6dfa887ce4af3"
+dependencies = [
+ "serde",
+ "tempfile",
+ "thiserror 1.0.69",
+ "toml",
+ "walkdir",
+]
+
 [[package]]
 name = "tree-sitter"
 version = "0.24.7"

Cargo.toml

@@ -6,6 +6,7 @@ members = [
     "compliance-graph",
     "compliance-dast",
     "compliance-mcp",
+    "compliance-smoke",
 ]
 resolver = "2"
 
@@ -33,3 +34,5 @@ zip = { version = "2", features = ["aes-crypto", "deflate"] }
 dashmap = "6"
 tokio-stream = { version = "0.1", features = ["sync"] }
 aes-gcm = "0.10"
+rand = "0.9"
+base64 = "0.22"

compliance-agent/Cargo.toml

@@ -7,9 +7,14 @@ edition = "2021"
 workspace = true
 
 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb", "telemetry"] }
+compliance-core = { workspace = true, features = ["mongodb", "telemetry", "axum"] }
 compliance-graph = { path = "../compliance-graph" }
 compliance-dast = { path = "../compliance-dast" }
+# Native firmware build/target detection for bare-metal & RTOS artifacts.
+# Same-company IP, used directly (not via CLI) so the whole tramiton suite is
+# available to the onboarding classifier. NOTE: CI must be able to fetch this
+# private repo (see the git-auth step in .gitea/workflows/ci.yml).
+tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.0" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -42,9 +47,11 @@ tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
 futures-core = "0.3"
 dashmap = { workspace = true }
 tokio-stream = { workspace = true }
+rand = { workspace = true }
 
 [dev-dependencies]
-compliance-core = { workspace = true, features = ["mongodb"] }
+compliance-core = { workspace = true, features = ["mongodb", "axum"] }
+tower = { version = "0.5", features = ["util"] }
 reqwest = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -52,5 +59,4 @@ mongodb = { workspace = true }
 uuid = { workspace = true }
 secrecy = { workspace = true }
 axum = "0.8"
-tower = { version = "0.5", features = ["util"] }
 tower-http = { version = "0.6", features = ["cors"] }

compliance-agent/src/agent.rs

@@ -6,7 +6,7 @@ use tokio::sync::{broadcast, watch, Semaphore};
 use compliance_core::models::pentest::PentestEvent;
 use compliance_core::AgentConfig;
 
-use crate::database::Database;
+use crate::database::DatabasePool;
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::PipelineOrchestrator;
 
@@ -16,7 +16,10 @@ const DEFAULT_MAX_CONCURRENT_SESSIONS: usize = 5;
 #[derive(Clone)]
 pub struct ComplianceAgent {
     pub config: AgentConfig,
-    pub db: Database,
+    /// Per-tenant Mongo broker. Every code path must obtain a
+    /// tenant-scoped [`crate::database::Database`] from this pool —
+    /// there is no single shared database any more.
+    pub db_pool: DatabasePool,
     pub llm: Arc<LlmClient>,
     pub http: reqwest::Client,
     /// Per-session broadcast senders for SSE streaming.
@@ -28,7 +31,7 @@ pub struct ComplianceAgent {
 }
 
 impl ComplianceAgent {
-    pub fn new(config: AgentConfig, db: Database) -> Self {
+    pub fn new(config: AgentConfig, db_pool: DatabasePool) -> Self {
         let llm = Arc::new(LlmClient::new(
             config.litellm_url.clone(),
             config.litellm_api_key.clone(),
@@ -42,7 +45,7 @@ impl ComplianceAgent {
             .unwrap_or_default();
         Self {
             config,
-            db,
+            db_pool,
             llm,
             http,
             session_streams: Arc::new(DashMap::new()),
@@ -53,28 +56,27 @@ impl ComplianceAgent {
 
     pub async fn run_scan(
         &self,
+        tenant_id: &str,
         repo_id: &str,
         trigger: compliance_core::models::ScanTrigger,
     ) -> Result<(), crate::error::AgentError> {
-        let orchestrator = PipelineOrchestrator::new(
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-            self.config.clone(),
+        let orchestrator =
-            self.db.clone(),
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-            self.llm.clone(),
-            self.http.clone(),
-        );
         orchestrator.run(repo_id, trigger).await
     }
 
     /// Run a PR review: scan the diff and post review comments.
     pub async fn run_pr_review(
         &self,
+        tenant_id: &str,
         repo_id: &str,
         pr_number: u64,
         base_sha: &str,
         head_sha: &str,
     ) -> Result<(), crate::error::AgentError> {
-        let repo = self
+        let db = self.db_pool.for_tenant_id(tenant_id).await?;
-            .db
+        let repo = db
             .repositories()
             .find_one(mongodb::bson::doc! {
                 "_id": mongodb::bson::oid::ObjectId::parse_str(repo_id)
@@ -85,12 +87,8 @@ impl ComplianceAgent {
                 crate::error::AgentError::Other(format!("Repository {repo_id} not found"))
             })?;
 
-        let orchestrator = PipelineOrchestrator::new(
+        let orchestrator =
-            self.config.clone(),
+            PipelineOrchestrator::new(self.config.clone(), db, self.llm.clone(), self.http.clone());
-            self.db.clone(),
-            self.llm.clone(),
-            self.http.clone(),
-        );
         orchestrator
             .run_pr_review(&repo, repo_id, pr_number, base_sha, head_sha)
             .await

compliance-agent/src/api/handlers/admin.rs

@@ -0,0 +1,115 @@
+//! Cross-tenant admin endpoints (`/api/v1/admin/*`).
+//!
+//! Operator-only. Auth is a **static bearer token** (`ADMIN_API_TOKEN`
+//! env on the agent) — explicitly NOT a Keycloak JWT, because the
+//! whole point of these endpoints is to operate ACROSS tenants. A
+//! customer JWT (which always carries a single tenant_id) has no
+//! business mounting them.
+//!
+//! Routes are only registered when `ADMIN_API_TOKEN` is set. With no
+//! token, the endpoints don't exist at all (404), which is a stronger
+//! guarantee than "401 if you guess the path".
+//!
+//! Operations:
+//! - `GET    /api/v1/admin/tenants`              — list tenant DBs
+//! - `DELETE /api/v1/admin/tenants/{tenant_id}`  — GDPR delete
+//!
+//! Tenant ids in URLs are passed as-is to `DatabasePool::drop_tenant`,
+//! which sanitises them the same way it does for creation. Listing
+//! returns the raw DB names from `list_tenant_db_names` — operators
+//! can reverse-derive the tenant_id from the prefix.
+
+use axum::extract::{Extension, Path, Request};
+use axum::http::{header, StatusCode};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use axum::Json;
+use secrecy::ExposeSecret;
+use serde::Serialize;
+
+use super::dto::AgentExt;
+
+#[derive(Serialize)]
+pub struct ListTenantDbsResponse {
+    pub tenant_db_names: Vec<String>,
+}
+
+#[tracing::instrument(skip_all)]
+pub async fn list_tenant_dbs(
+    Extension(agent): AgentExt,
+) -> Result<Json<ListTenantDbsResponse>, StatusCode> {
+    let names = agent.db_pool.list_tenant_db_names().await.map_err(|e| {
+        tracing::error!("admin: list_tenant_db_names failed: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(ListTenantDbsResponse {
+        tenant_db_names: names,
+    }))
+}
+
+#[tracing::instrument(skip_all, fields(tenant_id = %tenant_id))]
+pub async fn drop_tenant_db(
+    Extension(agent): AgentExt,
+    Path(tenant_id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    agent.db_pool.drop_tenant(&tenant_id).await.map_err(|e| {
+        tracing::error!("admin: drop_tenant failed: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    Ok(Json(serde_json::json!({ "status": "dropped" })))
+}
+
+/// Constant-time-ish comparison of the configured admin token against
+/// the incoming bearer. Uses `subtle`-style byte equality so timing
+/// attacks can't probe the token character by character.
+fn tokens_eq(a: &str, b: &str) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0u8;
+    for (x, y) in a.bytes().zip(b.bytes()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+/// Middleware enforcing the static `ADMIN_API_TOKEN`. Mounted only on
+/// the admin sub-router, so this never runs on customer routes.
+pub async fn require_admin_token(
+    Extension(agent): AgentExt,
+    request: Request,
+    next: Next,
+) -> Response {
+    let Some(expected) = agent.config.admin_api_token.as_ref() else {
+        // Belt-and-braces — if the routes were somehow mounted without
+        // a token configured, refuse rather than no-op-pass.
+        return (StatusCode::NOT_FOUND, "admin disabled").into_response();
+    };
+    let presented = request
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.strip_prefix("Bearer "))
+        .map(|s| s.trim());
+    let Some(presented) = presented.filter(|s| !s.is_empty()) else {
+        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
+    };
+    if !tokens_eq(presented, expected.expose_secret()) {
+        return (StatusCode::UNAUTHORIZED, "Invalid admin token").into_response();
+    }
+    next.run(request).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tokens_eq_basic() {
+        assert!(tokens_eq("abc", "abc"));
+        assert!(!tokens_eq("abc", "abd"));
+        assert!(!tokens_eq("abc", "abcd"));
+        assert!(!tokens_eq("", "x"));
+        assert!(tokens_eq("", ""));
+    }
+}

compliance-agent/src/api/handlers/chat.rs

@@ -7,11 +7,13 @@ use mongodb::bson::doc;
 
 use compliance_core::models::chat::{ChatRequest, ChatResponse, SourceReference};
 use compliance_core::models::embedding::EmbeddingBuildRun;
+use compliance_core::tenant_ctx::TenantCtx;
 use compliance_graph::graph::embedding_store::EmbeddingStore;
 
 use crate::agent::ComplianceAgent;
 use crate::rag::pipeline::RagPipeline;
 
+use super::dto::tenant_db;
 use super::ApiResponse;
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -20,10 +22,12 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn chat(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Json(req): Json<ChatRequest>,
 ) -> Result<Json<ApiResponse<ChatResponse>>, StatusCode> {
-    let pipeline = RagPipeline::new(agent.llm.clone(), agent.db.inner());
+    let db = tenant_db(&agent, &tenant).await?;
+    let pipeline = RagPipeline::new(agent.llm.clone(), db.inner());
 
     // Step 1: Embed the user's message
     let query_vectors = agent
@@ -133,12 +137,15 @@ pub async fn chat(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn build_embeddings(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
+    // Resolve the tenant DB up front so we can move it into the spawn;
+    // the JWT/dev context isn't available inside detached tasks.
+    let db = tenant_db(&agent, &tenant).await?;
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
-        let repo = match agent_clone
+        let repo = match db
-            .db
             .repositories()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
@@ -151,8 +158,7 @@ pub async fn build_embeddings(
         };
 
         // Get latest graph build
-        let build = match agent_clone
+        let build = match db
-            .db
             .graph_builds()
             .find_one(doc! { "repo_id": &repo_id })
             .sort(doc! { "started_at": -1 })
@@ -171,26 +177,22 @@ pub async fn build_embeddings(
             .unwrap_or_else(|| "unknown".to_string());
 
         // Get nodes
-        let nodes: Vec<compliance_core::models::graph::CodeNode> = match agent_clone
+        let nodes: Vec<compliance_core::models::graph::CodeNode> =
-            .db
+            match db.graph_nodes().find(doc! { "repo_id": &repo_id }).await {
-            .graph_nodes()
+                Ok(cursor) => {
-            .find(doc! { "repo_id": &repo_id })
+                    use futures_util::StreamExt;
-            .await
+                    let mut items = Vec::new();
-        {
+                    let mut cursor = cursor;
-            Ok(cursor) => {
+                    while let Some(Ok(item)) = cursor.next().await {
-                use futures_util::StreamExt;
+                        items.push(item);
-                let mut items = Vec::new();
+                    }
-                let mut cursor = cursor;
+                    items
-                while let Some(Ok(item)) = cursor.next().await {
-                    items.push(item);
                 }
-                items
+                Err(e) => {
-            }
+                    tracing::error!("[{repo_id}] Failed to fetch nodes: {e}");
-            Err(e) => {
+                    return;
-                tracing::error!("[{repo_id}] Failed to fetch nodes: {e}");
+                }
-                return;
+            };
-            }
-        };
 
         let creds = crate::pipeline::git::RepoCredentials {
             ssh_key_path: Some(agent_clone.config.ssh_key_path.clone()),
@@ -207,7 +209,7 @@ pub async fn build_embeddings(
             }
         };
 
-        let pipeline = RagPipeline::new(agent_clone.llm.clone(), agent_clone.db.inner());
+        let pipeline = RagPipeline::new(agent_clone.llm.clone(), db.inner());
         match pipeline
             .build_embeddings(&repo_id, &repo_path, &graph_build_id, &nodes)
             .await
@@ -234,9 +236,11 @@ pub async fn build_embeddings(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn embedding_status(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Option<EmbeddingBuildRun>>>, StatusCode> {
-    let store = EmbeddingStore::new(agent.db.inner());
+    let db = tenant_db(&agent, &tenant).await?;
+    let store = EmbeddingStore::new(db.inner());
     let build = store.get_latest_build(&repo_id).await.map_err(|e| {
         tracing::error!("Failed to get embedding status: {e}");
         StatusCode::INTERNAL_SERVER_ERROR

compliance-agent/src/api/handlers/dast.rs

@@ -7,9 +7,11 @@ use mongodb::bson::doc;
 use serde::Deserialize;
 
 use compliance_core::models::dast::{DastFinding, DastScanRun, DastTarget, DastTargetType};
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
+use super::dto::tenant_db;
 use super::{collect_cursor_async, ApiResponse, PaginationParams};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -45,9 +47,11 @@ fn default_rate_limit() -> u32 {
 #[tracing::instrument(skip_all)]
 pub async fn list_targets(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastTarget>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_targets()
@@ -80,6 +84,7 @@ pub async fn list_targets(
 #[tracing::instrument(skip_all)]
 pub async fn add_target(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Json(req): Json<AddTargetRequest>,
 ) -> Result<Json<ApiResponse<DastTarget>>, StatusCode> {
     let mut target = DastTarget::new(req.name, req.base_url, req.target_type);
@@ -89,9 +94,8 @@ pub async fn add_target(
     target.rate_limit = req.rate_limit;
     target.allow_destructive = req.allow_destructive;
 
-    agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    db.dast_targets()
-        .dast_targets()
         .insert_one(&target)
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
@@ -107,19 +111,19 @@ pub async fn add_target(
 #[tracing::instrument(skip_all, fields(target_id = %id))]
 pub async fn trigger_scan(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let target = agent
+    let target = db
-        .db
         .dast_targets()
         .find_one(doc! { "_id": oid })
         .await
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
         .ok_or(StatusCode::NOT_FOUND)?;
 
-    let db = agent.db.clone();
     tokio::spawn(async move {
         let orchestrator = compliance_dast::DastOrchestrator::new(100);
         match orchestrator.run_scan(&target, Vec::new()).await {
@@ -147,9 +151,11 @@ pub async fn trigger_scan(
 #[tracing::instrument(skip_all)]
 pub async fn list_scan_runs(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastScanRun>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_scan_runs()
@@ -183,9 +189,11 @@ pub async fn list_scan_runs(
 #[tracing::instrument(skip_all)]
 pub async fn list_findings(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<DastFinding>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .dast_findings()
@@ -219,12 +227,13 @@ pub async fn list_findings(
 #[tracing::instrument(skip_all, fields(finding_id = %id))]
 pub async fn get_finding(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<DastFinding>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let finding = agent
+    let finding = db
-        .db
         .dast_findings()
         .find_one(doc! { "_id": oid })
         .await

compliance-agent/src/api/handlers/dto.rs

@@ -180,6 +180,27 @@ pub struct SbomVersionDiff {
 pub(crate) type AgentExt = axum::extract::Extension<std::sync::Arc<crate::agent::ComplianceAgent>>;
 pub(crate) type ApiResult<T> = Result<axum::Json<ApiResponse<T>>, axum::http::StatusCode>;
 
+/// Resolve a tenant-scoped [`Database`] from the request's
+/// [`TenantContext`] (inserted by the M7.1 JWT middleware, or by the
+/// dev fallback in unsecured environments). The pool ensures the
+/// tenant's indexes idempotently.
+///
+/// Returns 500 on the rare path where Mongo refuses the database
+/// handle — the M7.1 auth/status middleware already rejects every
+/// other failure mode with 4xx before we get here.
+pub(crate) async fn tenant_db(
+    agent: &crate::agent::ComplianceAgent,
+    tenant: &compliance_core::tenant_ctx::TenantCtx,
+) -> Result<crate::database::Database, axum::http::StatusCode> {
+    agent.db_pool.for_tenant(&tenant.0).await.map_err(|e| {
+        tracing::error!(
+            tenant_id = %tenant.0.tenant_id,
+            "Failed to acquire tenant database: {e}"
+        );
+        axum::http::StatusCode::INTERNAL_SERVER_ERROR
+    })
+}
+
 pub(crate) async fn collect_cursor_async<T: serde::de::DeserializeOwned + Unpin + Send>(
     mut cursor: mongodb::Cursor<T>,
 ) -> Vec<T> {

compliance-agent/src/api/handlers/findings.rs

@@ -5,13 +5,16 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::Finding;
+use compliance_core::tenant_ctx::TenantCtx;
 
 #[tracing::instrument(skip_all, fields(repo_id = ?filter.repo_id, severity = ?filter.severity, scan_type = ?filter.scan_type))]
 pub async fn list_findings(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(filter): Query<FindingsFilter>,
 ) -> ApiResult<Vec<Finding>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let mut query = doc! {};
     if let Some(repo_id) = &filter.repo_id {
         query.insert("repo_id", repo_id);
@@ -81,11 +84,12 @@ pub async fn list_findings(
 #[tracing::instrument(skip_all, fields(finding_id = %id))]
 pub async fn get_finding(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<Finding>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let finding = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let finding = db
         .findings()
         .find_one(doc! { "_id": oid })
         .await
@@ -102,14 +106,14 @@ pub async fn get_finding(
 #[tracing::instrument(skip_all, fields(finding_id = %id))]
 pub async fn update_finding_status(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Json(req): Json<UpdateStatusRequest>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    agent
+    db.findings()
-        .db
-        .findings()
         .update_one(
             doc! { "_id": oid },
             doc! { "$set": { "status": &req.status, "updated_at": mongodb::bson::DateTime::now() } },
@@ -123,6 +127,7 @@ pub async fn update_finding_status(
 #[tracing::instrument(skip_all)]
 pub async fn bulk_update_finding_status(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Json(req): Json<BulkUpdateStatusRequest>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oids: Vec<mongodb::bson::oid::ObjectId> = req
@@ -135,8 +140,8 @@ pub async fn bulk_update_finding_status(
         return Err(StatusCode::BAD_REQUEST);
     }
 
-    let result = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let result = db
         .findings()
         .update_many(
             doc! { "_id": { "$in": oids } },
@@ -153,14 +158,14 @@ pub async fn bulk_update_finding_status(
 #[tracing::instrument(skip_all)]
 pub async fn update_finding_feedback(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Json(req): Json<UpdateFeedbackRequest>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    agent
+    db.findings()
-        .db
-        .findings()
         .update_one(
             doc! { "_id": oid },
             doc! { "$set": { "developer_feedback": &req.feedback, "updated_at": mongodb::bson::DateTime::now() } },

compliance-agent/src/api/handlers/graph.rs

@@ -7,9 +7,11 @@ use mongodb::bson::doc;
 use serde::{Deserialize, Serialize};
 
 use compliance_core::models::graph::{CodeEdge, CodeNode, GraphBuildRun, ImpactAnalysis};
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
+use super::dto::tenant_db;
 use super::{collect_cursor_async, ApiResponse};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
@@ -36,9 +38,11 @@ fn default_search_limit() -> usize {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_graph(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<GraphData>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     // Get latest build
     let build: Option<GraphBuildRun> = db
@@ -98,9 +102,11 @@ pub async fn get_graph(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_nodes(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Vec<CodeNode>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let filter = doc! { "repo_id": &repo_id };
 
     let nodes: Vec<CodeNode> = match db.graph_nodes().find(filter).await {
@@ -123,9 +129,11 @@ pub async fn get_nodes(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_communities(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<ApiResponse<Vec<CommunityInfo>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let filter = doc! { "repo_id": &repo_id };
 
     let nodes: Vec<CodeNode> = match db.graph_nodes().find(filter).await {
@@ -176,9 +184,11 @@ pub struct CommunityInfo {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id, finding_id = %finding_id))]
 pub async fn get_impact(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path((repo_id, finding_id)): Path<(String, String)>,
 ) -> Result<Json<ApiResponse<Option<ImpactAnalysis>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let filter = doc! { "repo_id": &repo_id, "finding_id": &finding_id };
 
     let impact = db
@@ -198,10 +208,12 @@ pub async fn get_impact(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id, query = %params.q))]
 pub async fn search_symbols(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Query(params): Query<SearchParams>,
 ) -> Result<Json<ApiResponse<Vec<CodeNode>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     // Simple text search on qualified_name and name fields
     let filter = doc! {
@@ -234,10 +246,12 @@ pub async fn search_symbols(
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn get_file_content(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
     Query(params): Query<FileContentParams>,
 ) -> Result<Json<ApiResponse<FileContent>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     // Look up the repository to get repo name
     let repo = db
@@ -296,12 +310,13 @@ pub struct FileContent {
 #[tracing::instrument(skip_all, fields(repo_id = %repo_id))]
 pub async fn trigger_build(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(repo_id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
-        let repo = match agent_clone
+        let repo = match db
-            .db
             .repositories()
             .find_one(doc! { "_id": mongodb::bson::oid::ObjectId::parse_str(&repo_id).ok() })
             .await
@@ -333,8 +348,7 @@ pub async fn trigger_build(
 
         match engine.build_graph(&repo_path, &repo_id, &graph_build_id) {
             Ok((code_graph, build_run)) => {
-                let store =
+                let store = compliance_graph::graph::persistence::GraphStore::new(db.inner());
-                    compliance_graph::graph::persistence::GraphStore::new(agent_clone.db.inner());
                 let _ = store.delete_repo_graph(&repo_id).await;
                 let _ = store
                     .store_graph(&build_run, &code_graph.nodes, &code_graph.edges)

compliance-agent/src/api/handlers/health.rs

@@ -3,6 +3,7 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::ScanRun;
+use compliance_core::tenant_ctx::TenantCtx;
 
 #[tracing::instrument(skip_all)]
 pub async fn health() -> Json<serde_json::Value> {
@@ -10,8 +11,12 @@ pub async fn health() -> Json<serde_json::Value> {
 }
 
 #[tracing::instrument(skip_all)]
-pub async fn stats_overview(axum::extract::Extension(agent): AgentExt) -> ApiResult<OverviewStats> {
+pub async fn stats_overview(
-    let db = &agent.db;
+    axum::extract::Extension(agent): AgentExt,
+    tenant: TenantCtx,
+) -> ApiResult<OverviewStats> {
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     let total_repositories = db
         .repositories()

compliance-agent/src/api/handlers/issues.rs

@@ -4,13 +4,16 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::TrackerIssue;
+use compliance_core::tenant_ctx::TenantCtx;
 
 #[tracing::instrument(skip_all)]
 pub async fn list_issues(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> ApiResult<Vec<TrackerIssue>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .tracker_issues()

compliance-agent/src/api/handlers/mcp_tokens.rs

@@ -0,0 +1,186 @@
+//! `/api/v1/mcp-tokens` — per-tenant API tokens for the MCP server.
+//!
+//! These are opaque static bearers issued via the dashboard (or a
+//! direct curl with a KC JWT) and copied into LLM clients (Claude
+//! Desktop / Cursor / ChatGPT). The MCP server hashes incoming bearers
+//! and looks them up in the cross-tenant `<prefix>__admin.mcp_tokens`
+//! collection to derive the tenant_id for routing.
+//!
+//! The raw token is shown to the caller exactly once at creation; the
+//! database only ever stores the SHA-256 hash. Revocation is a soft
+//! delete (sets `revoked: true`) so the audit log keeps the record.
+
+use axum::extract::{Extension, Path};
+use axum::http::StatusCode;
+use axum::Json;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
+use compliance_core::models::{McpToken, McpTokenView};
+use compliance_core::tenant_ctx::TenantCtx;
+use mongodb::bson::doc;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+use super::dto::{AgentExt, ApiResponse};
+
+/// Mongo collection name inside the admin DB.
+const COLLECTION: &str = "mcp_tokens";
+
+/// Token prefix the MCP server expects on every bearer.
+const TOKEN_PREFIX: &str = "mcpt_";
+
+/// Bytes of randomness behind each token. 32 → ~256 bits.
+/// Encoded as URL-safe base64 without padding → 43 chars.
+/// Combined with `mcpt_` → 48-char tokens.
+const TOKEN_RAND_BYTES: usize = 32;
+
+#[derive(serde::Deserialize)]
+pub struct CreateMcpTokenRequest {
+    pub name: String,
+}
+
+/// Returned exactly once at creation. The `token` field is gone from
+/// the listing endpoint — the user must save it now.
+#[derive(serde::Serialize)]
+pub struct CreateMcpTokenResponse {
+    pub token: String,
+    pub view: McpTokenView,
+}
+
+/// `POST /api/v1/mcp-tokens` — mint a new token for the caller's tenant.
+#[tracing::instrument(skip_all)]
+pub async fn create_mcp_token(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Json(req): Json<CreateMcpTokenRequest>,
+) -> Result<Json<CreateMcpTokenResponse>, StatusCode> {
+    if req.name.trim().is_empty() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+    let raw = generate_token();
+    let token_hash = sha256_hex(&raw);
+    let token_prefix: String = raw.chars().take(12).collect();
+
+    let mut token = McpToken {
+        id: None,
+        token_hash,
+        token_prefix,
+        tenant_id: tenant.0.tenant_id.clone(),
+        name: req.name.trim().to_string(),
+        created_by: tenant.0.user_id.clone(),
+        created_at: chrono::Utc::now(),
+        last_used_at: None,
+        revoked: false,
+    };
+
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let res = col.insert_one(&token).await.map_err(|e| {
+        tracing::error!("Failed to insert MCP token: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })?;
+    token.id = res.inserted_id.as_object_id();
+
+    Ok(Json(CreateMcpTokenResponse {
+        view: McpTokenView::from(&token),
+        token: raw,
+    }))
+}
+
+/// `GET /api/v1/mcp-tokens` — list tokens for the caller's tenant.
+/// Hash is never returned; only metadata + the 12-char prefix so the
+/// user can identify which row is which.
+#[tracing::instrument(skip_all)]
+pub async fn list_mcp_tokens(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+) -> Result<Json<ApiResponse<Vec<McpTokenView>>>, StatusCode> {
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let mut cursor = col
+        .find(doc! { "tenant_id": &tenant.0.tenant_id })
+        .sort(doc! { "created_at": -1 })
+        .await
+        .map_err(|e| {
+            tracing::error!("Failed to list MCP tokens: {e}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    let mut out = Vec::new();
+    while cursor.advance().await.map_err(|e| {
+        tracing::warn!("MCP tokens cursor advance failed: {e}");
+        StatusCode::INTERNAL_SERVER_ERROR
+    })? {
+        match cursor.deserialize_current() {
+            Ok(t) => out.push(McpTokenView::from(&t)),
+            Err(e) => tracing::warn!("Failed to deserialize MCP token: {e}"),
+        }
+    }
+    Ok(Json(ApiResponse {
+        data: out,
+        total: None,
+        page: None,
+    }))
+}
+
+/// `DELETE /api/v1/mcp-tokens/{id}` — revoke (soft delete).
+/// Scoped to the caller's tenant: a user can't revoke another tenant's
+/// token even if they guess its id.
+#[tracing::instrument(skip_all, fields(id = %id))]
+pub async fn revoke_mcp_token(
+    Extension(agent): AgentExt,
+    tenant: TenantCtx,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>, StatusCode> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let col = agent.db_pool.admin_db().collection::<McpToken>(COLLECTION);
+    let result = col
+        .update_one(
+            doc! { "_id": oid, "tenant_id": &tenant.0.tenant_id },
+            doc! { "$set": { "revoked": true } },
+        )
+        .await
+        .map_err(|e| {
+            tracing::error!("Failed to revoke MCP token: {e}");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+    if result.matched_count == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+    Ok(Json(serde_json::json!({ "status": "revoked" })))
+}
+
+/// 32 bytes random → URL-safe base64 → 43 chars, no padding.
+/// Prefixed with `mcpt_` so the MCP server can sniff the format
+/// before bothering with the DB lookup.
+fn generate_token() -> String {
+    let mut bytes = [0u8; TOKEN_RAND_BYTES];
+    rand::rng().fill_bytes(&mut bytes);
+    format!("{TOKEN_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes))
+}
+
+fn sha256_hex(s: &str) -> String {
+    let mut h = Sha256::new();
+    h.update(s.as_bytes());
+    hex::encode(h.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn generated_tokens_are_unique_and_prefixed() {
+        let a = generate_token();
+        let b = generate_token();
+        assert_ne!(a, b);
+        assert!(a.starts_with(TOKEN_PREFIX));
+        assert!(b.starts_with(TOKEN_PREFIX));
+        // 5 + 43 = 48 chars
+        assert_eq!(a.len(), 5 + 43);
+    }
+
+    #[test]
+    fn sha256_is_stable_and_64_hex() {
+        let h = sha256_hex("mcpt_abc");
+        assert_eq!(h.len(), 64);
+        assert!(h.chars().all(|c| c.is_ascii_hexdigit()));
+        assert_eq!(sha256_hex("mcpt_abc"), h);
+    }
+}

compliance-agent/src/api/handlers/mod.rs

@@ -1,3 +1,4 @@
+pub mod admin;
 pub mod chat;
 pub mod dast;
 pub mod dto;
@@ -6,6 +7,7 @@ pub mod graph;
 pub mod health;
 pub mod help_chat;
 pub mod issues;
+pub mod mcp_tokens;
 pub mod notifications;
 pub mod pentest_handlers;
 pub use pentest_handlers as pentest;

compliance-agent/src/api/handlers/notifications.rs

@@ -5,15 +5,18 @@ use mongodb::bson::doc;
 use serde::Deserialize;
 
 use compliance_core::models::notification::CveNotification;
+use compliance_core::tenant_ctx::TenantCtx;
 
-use super::dto::{AgentExt, ApiResponse};
+use super::dto::{tenant_db, AgentExt, ApiResponse};
 
 /// GET /api/v1/notifications — List CVE notifications (newest first)
 #[tracing::instrument(skip_all)]
 pub async fn list_notifications(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     axum::extract::Query(params): axum::extract::Query<NotificationFilter>,
 ) -> Result<Json<ApiResponse<Vec<CveNotification>>>, StatusCode> {
+    let db = tenant_db(&agent, &tenant).await?;
     let mut filter = doc! {};
 
     // Filter by status (default: show new + read, exclude dismissed)
@@ -41,15 +44,13 @@ pub async fn list_notifications(
     let limit = params.limit.unwrap_or(50).min(200);
     let skip = (page - 1) * limit as u64;
 
-    let total = agent
+    let total = db
-        .db
         .cve_notifications()
         .count_documents(filter.clone())
         .await
         .unwrap_or(0);
 
-    let notifications: Vec<CveNotification> = match agent
+    let notifications: Vec<CveNotification> = match db
-        .db
         .cve_notifications()
         .find(filter)
         .sort(doc! { "created_at": -1 })
@@ -83,9 +84,10 @@ pub async fn list_notifications(
 #[tracing::instrument(skip_all)]
 pub async fn notification_count(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let count = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let count = db
         .cve_notifications()
         .count_documents(doc! { "status": "new" })
         .await
@@ -98,12 +100,13 @@ pub async fn notification_count(
 #[tracing::instrument(skip_all, fields(id = %id))]
 pub async fn mark_read(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     axum::extract::Path(id): axum::extract::Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let result = agent
+    let result = db
-        .db
         .cve_notifications()
         .update_one(
             doc! { "_id": oid },
@@ -125,12 +128,13 @@ pub async fn mark_read(
 #[tracing::instrument(skip_all, fields(id = %id))]
 pub async fn dismiss_notification(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     axum::extract::Path(id): axum::extract::Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let result = agent
+    let result = db
-        .db
         .cve_notifications()
         .update_one(
             doc! { "_id": oid },
@@ -149,9 +153,10 @@ pub async fn dismiss_notification(
 #[tracing::instrument(skip_all)]
 pub async fn mark_all_read(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let result = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let result = db
         .cve_notifications()
         .update_many(
             doc! { "status": "new" },

compliance-agent/src/api/handlers/pentest_handlers/export.rs

@@ -13,10 +13,11 @@ use compliance_core::models::dast::DastFinding;
 use compliance_core::models::finding::Finding;
 use compliance_core::models::pentest::*;
 use compliance_core::models::sbom::SbomEntry;
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
-use super::super::dto::collect_cursor_async;
+use super::super::dto::{collect_cursor_async, tenant_db};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
 
@@ -35,11 +36,15 @@ pub struct ExportBody {
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn export_session_report(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Json(body): Json<ExportBody>,
 ) -> Result<axum::response::Response, (StatusCode, String)> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
 
     if body.password.len() < 8 {
         return Err((
@@ -49,8 +54,7 @@ pub async fn export_session_report(
     }
 
     // Fetch session
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -64,9 +68,7 @@ pub async fn export_session_report(
 
     // Resolve target name
     let target = if let Ok(tid) = mongodb::bson::oid::ObjectId::parse_str(&session.target_id) {
-        agent
+        db.dast_targets()
-            .db
-            .dast_targets()
             .find_one(doc! { "_id": tid })
             .await
             .ok()
@@ -84,8 +86,7 @@ pub async fn export_session_report(
         .unwrap_or_default();
 
     // Fetch attack chain nodes
-    let nodes: Vec<AttackChainNode> = match agent
+    let nodes: Vec<AttackChainNode> = match db
-        .db
         .attack_chain_nodes()
         .find(doc! { "session_id": &id })
         .sort(doc! { "started_at": 1 })
@@ -96,8 +97,7 @@ pub async fn export_session_report(
     };
 
     // Fetch DAST findings for this session, then deduplicate
-    let raw_findings: Vec<DastFinding> = match agent
+    let raw_findings: Vec<DastFinding> = match db
-        .db
         .dast_findings()
         .find(doc! { "session_id": &id })
         .sort(doc! { "severity": -1, "created_at": -1 })
@@ -122,8 +122,7 @@ pub async fn export_session_report(
         .or_else(|| target.as_ref().and_then(|t| t.repo_id.clone()));
 
     let (sast_findings, sbom_entries, code_context) = if let Some(ref rid) = repo_id {
-        let sast: Vec<Finding> = match agent
+        let sast: Vec<Finding> = match db
-            .db
             .findings()
             .find(doc! {
                 "repo_id": rid,
@@ -143,8 +142,7 @@ pub async fn export_session_report(
             Err(_) => Vec::new(),
         };
 
-        let sbom: Vec<SbomEntry> = match agent
+        let sbom: Vec<SbomEntry> = match db
-            .db
             .sbom_entries()
             .find(doc! {
                 "repo_id": rid,
@@ -164,8 +162,7 @@ pub async fn export_session_report(
         };
 
         // Build code context from graph nodes
-        let code_ctx: Vec<CodeContextHint> = match agent
+        let code_ctx: Vec<CodeContextHint> = match db
-            .db
             .graph_nodes()
             .find(doc! { "repo_id": rid, "is_entry_point": true })
             .limit(50)

compliance-agent/src/api/handlers/pentest_handlers/session.rs

@@ -7,11 +7,12 @@ use mongodb::bson::doc;
 use serde::Deserialize;
 
 use compliance_core::models::pentest::*;
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 use crate::pentest::PentestOrchestrator;
 
-use super::super::dto::{collect_cursor_async, ApiResponse, PaginationParams};
+use super::super::dto::{collect_cursor_async, tenant_db, ApiResponse, PaginationParams};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
 
@@ -43,6 +44,7 @@ pub struct LookupRepoQuery {
 #[tracing::instrument(skip_all)]
 pub async fn create_session(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Json(req): Json<CreateSessionRequest>,
 ) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
     // Try to acquire a concurrency permit
@@ -57,6 +59,10 @@ pub async fn create_session(
             )
         })?;
 
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
+
     if let Some(ref config) = req.config {
         // ── Wizard path ──────────────────────────────────────────────
         if !config.disclaimer_accepted {
@@ -67,8 +73,7 @@ pub async fn create_session(
         }
 
         // Look up or auto-create DastTarget by app_url
-        let target = match agent
+        let target = match db
-            .db
             .dast_targets()
             .find_one(doc! { "base_url": &config.app_url })
             .await
@@ -87,7 +92,7 @@ pub async fn create_session(
                 }
                 t.allow_destructive = config.allow_destructive;
                 t.excluded_paths = config.scope_exclusions.clone();
-                let res = agent.db.dast_targets().insert_one(&t).await.map_err(|e| {
+                let res = db.dast_targets().insert_one(&t).await.map_err(|e| {
                     (
                         StatusCode::INTERNAL_SERVER_ERROR,
                         format!("Failed to create target: {e}"),
@@ -110,8 +115,7 @@ pub async fn create_session(
 
         // Resolve repo_id from git_repo_url if provided
         if let Some(ref git_url) = config.git_repo_url {
-            if let Ok(Some(repo)) = agent
+            if let Ok(Some(repo)) = db
-                .db
                 .repositories()
                 .find_one(doc! { "git_url": git_url })
                 .await
@@ -120,8 +124,7 @@ pub async fn create_session(
             }
         }
 
-        let insert_result = agent
+        let insert_result = db
-            .db
             .pentest_sessions()
             .insert_one(&session)
             .await
@@ -212,8 +215,7 @@ pub async fn create_session(
         // Persist encrypted credentials to DB
         if session_for_task.config.is_some() {
             if let Some(sid) = session.id {
-                let _ = agent
+                let _ = db
-                    .db
                     .pentest_sessions()
                     .update_one(
                         doc! { "_id": sid },
@@ -245,12 +247,13 @@ pub async fn create_session(
             });
 
         let llm = agent.llm.clone();
-        let db = agent.db.clone();
+        let db_for_orchestrator = db.clone();
         let session_clone = session.clone();
         let target_clone = target.clone();
         let agent_ref = agent.clone();
         tokio::spawn(async move {
-            let orchestrator = PentestOrchestrator::new(llm, db, event_tx, Some(pause_rx));
+            let orchestrator =
+                PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, Some(pause_rx));
             orchestrator
                 .run_session_guarded(&session_clone, &target_clone, &initial_message)
                 .await;
@@ -292,8 +295,7 @@ pub async fn create_session(
             )
         })?;
 
-        let target = agent
+        let target = db
-            .db
             .dast_targets()
             .find_one(doc! { "_id": oid })
             .await
@@ -310,8 +312,7 @@ pub async fn create_session(
         let mut session = PentestSession::new(target_id, strategy);
         session.repo_id = target.repo_id.clone();
 
-        let insert_result = agent
+        let insert_result = db
-            .db
             .pentest_sessions()
             .insert_one(&session)
             .await
@@ -338,12 +339,13 @@ pub async fn create_session(
         });
 
         let llm = agent.llm.clone();
-        let db = agent.db.clone();
+        let db_for_orchestrator = db.clone();
         let session_clone = session.clone();
         let target_clone = target.clone();
         let agent_ref = agent.clone();
         tokio::spawn(async move {
-            let orchestrator = PentestOrchestrator::new(llm, db, event_tx, Some(pause_rx));
+            let orchestrator =
+                PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, Some(pause_rx));
             orchestrator
                 .run_session_guarded(&session_clone, &target_clone, &initial_message)
                 .await;
@@ -373,10 +375,11 @@ fn parse_strategy(s: &str) -> PentestStrategy {
 #[tracing::instrument(skip_all)]
 pub async fn lookup_repo(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<LookupRepoQuery>,
 ) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
-    let repo = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let repo = db
         .repositories()
         .find_one(doc! { "git_url": &params.url })
         .await
@@ -402,9 +405,11 @@ pub async fn lookup_repo(
 #[tracing::instrument(skip_all)]
 pub async fn list_sessions(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<PentestSession>>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .pentest_sessions()
@@ -438,12 +443,13 @@ pub async fn list_sessions(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn get_session(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<PentestSession>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let mut session = agent
+    let mut session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -471,15 +477,18 @@ pub async fn get_session(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn send_message(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Json(req): Json<SendMessageRequest>,
 ) -> Result<Json<ApiResponse<PentestMessage>>, (StatusCode, String)> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
 
     // Verify session exists and is running
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -506,8 +515,7 @@ pub async fn send_message(
         )
     })?;
 
-    let target = agent
+    let target = db
-        .db
         .dast_targets()
         .find_one(doc! { "_id": target_oid })
         .await
@@ -527,13 +535,13 @@ pub async fn send_message(
     // Store user message
     let session_id = id.clone();
     let user_msg = PentestMessage::user(session_id.clone(), req.message.clone());
-    let _ = agent.db.pentest_messages().insert_one(&user_msg).await;
+    let _ = db.pentest_messages().insert_one(&user_msg).await;
 
     let response_msg = user_msg.clone();
 
     // Spawn orchestrator to continue the session
     let llm = agent.llm.clone();
-    let db = agent.db.clone();
+    let db_for_orchestrator = db.clone();
     let message = req.message.clone();
 
     // Use existing broadcast sender if available, otherwise create a new one
@@ -548,7 +556,7 @@ pub async fn send_message(
         .unwrap_or_else(|| agent.register_session_stream(&session_id));
 
     tokio::spawn(async move {
-        let orchestrator = PentestOrchestrator::new(llm, db, event_tx, None);
+        let orchestrator = PentestOrchestrator::new(llm, db_for_orchestrator, event_tx, None);
         orchestrator
             .run_session_guarded(&session, &target, &message)
             .await;
@@ -565,13 +573,16 @@ pub async fn send_message(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn stop_session(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
 
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -590,9 +601,7 @@ pub async fn stop_session(
         ));
     }
 
-    agent
+    db.pentest_sessions()
-        .db
-        .pentest_sessions()
         .update_one(
             doc! { "_id": oid },
             doc! { "$set": {
@@ -612,8 +621,7 @@ pub async fn stop_session(
     // Clean up session resources
     agent.cleanup_session(&id);
 
-    let updated = agent
+    let updated = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -641,13 +649,16 @@ pub async fn stop_session(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn pause_session(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
 
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -684,13 +695,16 @@ pub async fn pause_session(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn resume_session(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
         .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+    let db = tenant_db(&agent, &tenant)
+        .await
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
 
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -727,12 +741,13 @@ pub async fn resume_session(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn get_attack_chain(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<ApiResponse<Vec<AttackChainNode>>>, StatusCode> {
     let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
-    let nodes = match agent
+    let nodes = match db
-        .db
         .attack_chain_nodes()
         .find(doc! { "session_id": &id })
         .sort(doc! { "started_at": 1 })
@@ -757,21 +772,21 @@ pub async fn get_attack_chain(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn get_messages(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<PentestMessage>>>, StatusCode> {
     let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = agent
+    let total = db
-        .db
         .pentest_messages()
         .count_documents(doc! { "session_id": &id })
         .await
         .unwrap_or(0);
 
-    let messages = match agent
+    let messages = match db
-        .db
         .pentest_messages()
         .find(doc! { "session_id": &id })
         .sort(doc! { "created_at": 1 })
@@ -797,21 +812,21 @@ pub async fn get_messages(
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn get_session_findings(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Query(params): Query<PaginationParams>,
 ) -> Result<Json<ApiResponse<Vec<compliance_core::models::dast::DastFinding>>>, StatusCode> {
     let _oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
-    let total = agent
+    let total = db
-        .db
         .dast_findings()
         .count_documents(doc! { "session_id": &id })
         .await
         .unwrap_or(0);
 
-    let findings = match agent
+    let findings = match db
-        .db
         .dast_findings()
         .find(doc! { "session_id": &id })
         .sort(doc! { "created_at": -1 })

compliance-agent/src/api/handlers/pentest_handlers/stats.rs

@@ -6,10 +6,11 @@ use axum::Json;
 use mongodb::bson::doc;
 
 use compliance_core::models::pentest::*;
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
-use super::super::dto::{collect_cursor_async, ApiResponse};
+use super::super::dto::{collect_cursor_async, tenant_db, ApiResponse};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
 
@@ -17,8 +18,10 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 #[tracing::instrument(skip_all)]
 pub async fn pentest_stats(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
 ) -> Result<Json<ApiResponse<PentestStats>>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     let running_sessions = db
         .pentest_sessions()

compliance-agent/src/api/handlers/pentest_handlers/stream.rs

@@ -11,10 +11,11 @@ use tokio_stream::wrappers::BroadcastStream;
 use tokio_stream::StreamExt;
 
 use compliance_core::models::pentest::*;
+use compliance_core::tenant_ctx::TenantCtx;
 
 use crate::agent::ComplianceAgent;
 
-use super::super::dto::collect_cursor_async;
+use super::super::dto::{collect_cursor_async, tenant_db};
 
 type AgentExt = Extension<Arc<ComplianceAgent>>;
 
@@ -25,13 +26,14 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn session_stream(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Sse<impl futures_util::Stream<Item = Result<Event, Infallible>>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
     // Verify session exists
-    let _session = agent
+    let _session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await
@@ -43,8 +45,7 @@ pub async fn session_stream(
     let mut initial_events: Vec<Result<Event, Infallible>> = Vec::new();
 
     // Fetch recent messages for this session
-    let messages: Vec<PentestMessage> = match agent
+    let messages: Vec<PentestMessage> = match db
-        .db
         .pentest_messages()
         .find(doc! { "session_id": &id })
         .sort(doc! { "created_at": 1 })
@@ -56,8 +57,7 @@ pub async fn session_stream(
     };
 
     // Fetch recent attack chain nodes
-    let nodes: Vec<AttackChainNode> = match agent
+    let nodes: Vec<AttackChainNode> = match db
-        .db
         .attack_chain_nodes()
         .find(doc! { "session_id": &id })
         .sort(doc! { "started_at": 1 })
@@ -94,8 +94,7 @@ pub async fn session_stream(
     }
 
     // Add current session status event
-    let session = agent
+    let session = db
-        .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
         .await

compliance-agent/src/api/handlers/repos.rs

@@ -5,13 +5,16 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::*;
+use compliance_core::tenant_ctx::TenantCtx;
 
 #[tracing::instrument(skip_all)]
 pub async fn list_repositories(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> ApiResult<Vec<TrackedRepository>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db
         .repositories()
@@ -43,6 +46,7 @@ pub async fn list_repositories(
 #[tracing::instrument(skip_all)]
 pub async fn add_repository(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Json(req): Json<AddRepositoryRequest>,
 ) -> Result<Json<ApiResponse<TrackedRepository>>, (StatusCode, String)> {
     // Validate repository access before saving
@@ -69,17 +73,15 @@ pub async fn add_repository(
     repo.tracker_token = req.tracker_token;
     repo.scan_schedule = req.scan_schedule;
 
-    agent
+    let db = tenant_db(&agent, &tenant)
-        .db
-        .repositories()
-        .insert_one(&repo)
         .await
-        .map_err(|_| {
+        .map_err(|s| (s, "failed to acquire tenant database".to_string()))?;
-            (
+    db.repositories().insert_one(&repo).await.map_err(|_| {
-                StatusCode::CONFLICT,
+        (
-                "Repository already exists".to_string(),
+            StatusCode::CONFLICT,
-            )
+            "Repository already exists".to_string(),
-        })?;
+        )
+    })?;
 
     Ok(Json(ApiResponse {
         data: repo,
@@ -91,10 +93,12 @@ pub async fn add_repository(
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn update_repository(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
     Json(req): Json<UpdateRepositoryRequest>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
+    let db = tenant_db(&agent, &tenant).await?;
 
     let mut set_doc = doc! { "updated_at": mongodb::bson::DateTime::now() };
 
@@ -126,8 +130,7 @@ pub async fn update_repository(
         set_doc.insert("scan_schedule", schedule);
     }
 
-    let result = agent
+    let result = db
-        .db
         .repositories()
         .update_one(doc! { "_id": oid }, doc! { "$set": set_doc })
         .await
@@ -155,11 +158,16 @@ pub async fn get_ssh_public_key(
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn trigger_scan(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let agent_clone = (*agent).clone();
+    let tenant_id = tenant.0.tenant_id.clone();
     tokio::spawn(async move {
-        if let Err(e) = agent_clone.run_scan(&id, ScanTrigger::Manual).await {
+        if let Err(e) = agent_clone
+            .run_scan(&tenant_id, &id, ScanTrigger::Manual)
+            .await
+        {
             tracing::error!("Manual scan failed for {id}: {e}");
         }
     });
@@ -170,11 +178,12 @@ pub async fn trigger_scan(
 /// Return the webhook secret for a repository (used by dashboard to display it)
 pub async fn get_webhook_config(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let repo = agent
+    let db = tenant_db(&agent, &tenant).await?;
-        .db
+    let repo = db
         .repositories()
         .find_one(doc! { "_id": oid })
         .await
@@ -196,10 +205,12 @@ pub async fn get_webhook_config(
 #[tracing::instrument(skip_all, fields(repo_id = %id))]
 pub async fn delete_repository(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Path(id): Path<String>,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     // Delete the repository
     let result = db

compliance-agent/src/api/handlers/sbom.rs

@@ -6,6 +6,7 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::SbomEntry;
+use compliance_core::tenant_ctx::TenantCtx;
 
 const COPYLEFT_LICENSES: &[&str] = &[
     "GPL-2.0",
@@ -29,8 +30,10 @@ const COPYLEFT_LICENSES: &[&str] = &[
 #[tracing::instrument(skip_all)]
 pub async fn sbom_filters(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
 ) -> Result<Json<serde_json::Value>, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     let managers: Vec<String> = db
         .sbom_entries()
@@ -61,9 +64,11 @@ pub async fn sbom_filters(
 #[tracing::instrument(skip_all, fields(repo_id = ?filter.repo_id, package_manager = ?filter.package_manager))]
 pub async fn list_sbom(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(filter): Query<SbomFilter>,
 ) -> ApiResult<Vec<SbomEntry>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let mut query = doc! {};
 
     if let Some(repo_id) = &filter.repo_id {
@@ -120,9 +125,11 @@ pub async fn list_sbom(
 #[tracing::instrument(skip_all)]
 pub async fn export_sbom(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<SbomExportParams>,
 ) -> Result<impl IntoResponse, StatusCode> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let entries: Vec<SbomEntry> = match db
         .sbom_entries()
         .find(doc! { "repo_id": &params.repo_id })
@@ -236,9 +243,11 @@ pub async fn export_sbom(
 #[tracing::instrument(skip_all)]
 pub async fn license_summary(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<SbomFilter>,
 ) -> ApiResult<Vec<LicenseSummary>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let mut query = doc! {};
     if let Some(repo_id) = &params.repo_id {
         query.insert("repo_id", repo_id);
@@ -285,9 +294,11 @@ pub async fn license_summary(
 #[tracing::instrument(skip_all)]
 pub async fn sbom_diff(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<SbomDiffParams>,
 ) -> ApiResult<SbomDiffResult> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
 
     let entries_a: Vec<SbomEntry> = match db
         .sbom_entries()

compliance-agent/src/api/handlers/scans.rs

@@ -4,13 +4,16 @@ use mongodb::bson::doc;
 
 use super::dto::*;
 use compliance_core::models::ScanRun;
+use compliance_core::tenant_ctx::TenantCtx;
 
 #[tracing::instrument(skip_all)]
 pub async fn list_scan_runs(
     Extension(agent): AgentExt,
+    tenant: TenantCtx,
     Query(params): Query<PaginationParams>,
 ) -> ApiResult<Vec<ScanRun>> {
-    let db = &agent.db;
+    let db = tenant_db(&agent, &tenant).await?;
+    let db = &db;
     let skip = (params.page.saturating_sub(1)) * params.limit as u64;
     let total = db.scan_runs().count_documents(doc! {}).await.unwrap_or(0);
 

compliance-agent/src/api/mod.rs

@@ -1,8 +1,5 @@
-pub mod auth_middleware;
 pub mod handlers;
 pub mod routes;
 pub mod server;
-pub mod tenant_ctx;
 
 pub use server::start_api_server;
-pub use tenant_ctx::TenantCtx;

compliance-agent/src/api/routes.rs

@@ -2,7 +2,6 @@ use axum::routing::{delete, get, patch, post};
 use axum::Router;
 
 use crate::api::handlers;
-use crate::webhooks;
 
 pub fn build_router() -> Router {
     Router::new()
@@ -47,6 +46,15 @@ pub fn build_router() -> Router {
         .route("/api/v1/sbom/diff", get(handlers::sbom_diff))
         .route("/api/v1/issues", get(handlers::list_issues))
         .route("/api/v1/scan-runs", get(handlers::list_scan_runs))
+        // MCP token management (per-tenant API tokens for the MCP server)
+        .route(
+            "/api/v1/mcp-tokens",
+            get(handlers::mcp_tokens::list_mcp_tokens).post(handlers::mcp_tokens::create_mcp_token),
+        )
+        .route(
+            "/api/v1/mcp-tokens/{id}",
+            delete(handlers::mcp_tokens::revoke_mcp_token),
+        )
         // Graph API endpoints
         .route("/api/v1/graph/{repo_id}", get(handlers::graph::get_graph))
         .route(
@@ -175,17 +183,10 @@ pub fn build_router() -> Router {
             "/api/v1/pentest/stats",
             get(handlers::pentest::pentest_stats),
         )
-        // Webhook endpoints (proxied through dashboard)
+    // Webhook routes live on the separate webhook server (port 3002,
-        .route(
+    // see crate::webhooks::server). The M7.2-C tenant-in-URL form is
-            "/webhook/github/{repo_id}",
+    // `/webhook/{tenant_id}/{platform}/{repo_id}` and the handlers
-            post(webhooks::github::handle_github_webhook),
+    // expect a (tenant_id, repo_id) path tuple. Anything mounting
-        )
+    // them here on the API server would mismatch the handler
-        .route(
+    // signature, so the routes are not exported.
-            "/webhook/gitlab/{repo_id}",
-            post(webhooks::gitlab::handle_gitlab_webhook),
-        )
-        .route(
-            "/webhook/gitea/{repo_id}",
-            post(webhooks::gitea::handle_gitea_webhook),
-        )
 }

compliance-agent/src/api/server.rs

@@ -1,19 +1,79 @@
 use std::sync::Arc;
 
+use axum::extract::Request;
 use axum::http::HeaderValue;
-use axum::{middleware, Extension};
+use axum::middleware::Next;
+use axum::response::Response;
+use axum::routing::{delete, get};
+use axum::{middleware, Extension, Router};
 use tokio::sync::RwLock;
 use tower_http::cors::CorsLayer;
 use tower_http::set_header::SetResponseHeaderLayer;
 use tower_http::trace::TraceLayer;
 
+use compliance_core::auth::{require_jwt_auth, require_tenant_status, JwksState};
+use compliance_core::{TenantContext, TenantStatus};
+
 use crate::agent::ComplianceAgent;
-use crate::api::auth_middleware::{require_jwt_auth, require_tenant_status, JwksState};
+use crate::api::handlers;
 use crate::api::routes;
 use crate::error::AgentError;
 
+/// Synthetic tenant id used when Keycloak isn't configured (local dev,
+/// `cargo run` against a bare Mongo). Lets the handler stack stay
+/// uniformly tenant-scoped without the operator having to spin up KC
+/// just to poke at the API. Override via `DEV_TENANT_ID`.
+const DEFAULT_DEV_TENANT_ID: &str = "dev";
+
+/// Inject a synthetic [`TenantContext`] for any request that lacks one.
+/// Only mounted when Keycloak is NOT configured; with KC, the real
+/// `require_jwt_auth` middleware owns this and we never reach here
+/// without a context.
+///
+/// Public so the integration-test harness can mount it without
+/// duplicating the synthetic-context shape.
+pub async fn inject_dev_tenant(mut request: Request, next: Next) -> Response {
+    if request.extensions().get::<TenantContext>().is_none() {
+        let tenant_id =
+            std::env::var("DEV_TENANT_ID").unwrap_or_else(|_| DEFAULT_DEV_TENANT_ID.to_string());
+        let ctx = TenantContext {
+            tenant_slug: tenant_id.clone(),
+            tenant_id,
+            org_roles: vec![],
+            products: vec![],
+            plan: "dev".to_string(),
+            status: TenantStatus::Active,
+            user_id: "dev-user".to_string(),
+            user_name: None,
+        };
+        request.extensions_mut().insert(ctx);
+    }
+    next.run(request).await
+}
+
 pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), AgentError> {
+    // Admin sub-router. Routes are only mounted when ADMIN_API_TOKEN is
+    // configured — without it, the paths don't exist at all (404 rather
+    // than 401), so an operator who hasn't opted in can't fingerprint
+    // the surface area.
+    let admin_router: Router = if agent.config.admin_api_token.is_some() {
+        tracing::info!("Admin API enabled — /api/v1/admin/* mounted behind ADMIN_API_TOKEN bearer");
+        Router::new()
+            .route(
+                "/api/v1/admin/tenants",
+                get(handlers::admin::list_tenant_dbs),
+            )
+            .route(
+                "/api/v1/admin/tenants/{tenant_id}",
+                delete(handlers::admin::drop_tenant_db),
+            )
+            .layer(middleware::from_fn(handlers::admin::require_admin_token))
+    } else {
+        Router::new()
+    };
+
     let mut app = routes::build_router()
+        .merge(admin_router)
         .layer(Extension(Arc::new(agent.clone())))
         .layer(CorsLayer::permissive())
         .layer(TraceLayer::new_for_http())
@@ -44,16 +104,22 @@ pub async fn start_api_server(agent: ComplianceAgent, port: u16) -> Result<(), A
             jwks_url,
         };
         tracing::info!("Keycloak JWT auth enabled for realm '{kc_realm}'");
-        // Layers execute outermost-first. The Extension must run before
+        // Layers execute outermost-first. Extension(jwks_state) must run
-        // require_jwt_auth so that middleware can read JwksState from
+        // before require_jwt_auth so the middleware can read it; the
-        // request extensions, and the status gate must run after the
+        // status gate runs after JWT so TenantContext is in extensions.
-        // JWT auth so TenantContext is in extensions.
         app = app
             .layer(middleware::from_fn(require_tenant_status))
             .layer(middleware::from_fn(require_jwt_auth))
             .layer(Extension(jwks_state));
     } else {
-        tracing::warn!("Keycloak not configured - API endpoints are unprotected");
+        let tenant_id =
+            std::env::var("DEV_TENANT_ID").unwrap_or_else(|_| DEFAULT_DEV_TENANT_ID.to_string());
+        tracing::warn!(
+            tenant_id = %tenant_id,
+            "Keycloak not configured — running unauthenticated against the dev tenant. \
+             DO NOT use in any environment with real customer data."
+        );
+        app = app.layer(middleware::from_fn(inject_dev_tenant));
     }
 
     let addr = format!("0.0.0.0:{port}");

compliance-agent/src/classify/firmware.rs

@@ -0,0 +1,217 @@
+//! Firmware classification via tramiton.
+//!
+//! tramiton is the company's firmware build/repro engine; we do not re-implement
+//! its detection. We depend on `tramiton-core` directly (same-company IP) and run
+//! its provider analysis in-process behind a [`FirmwareDetector`] port, mapping
+//! tramiton's `BuildPlan` onto a [`TargetType`]. A deterministic
+//! [`MockFirmwareDetector`] backs the tests so CI unit tests need neither the
+//! tramiton sources nor a real firmware tree.
+
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{DetectedFact, TargetType};
+use compliance_core::traits::ClassifierVerdict;
+
+/// A minimal firmware-detection summary, mapped from tramiton's `BuildPlan`.
+/// Kept small and tramiton-independent so the classifier and the test mock don't
+/// need to construct a full tramiton plan.
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareDetection {
+    /// The detecting provider (e.g. `zephyr`, `cmake`, `source-archaeology`).
+    pub provider: String,
+    /// Detection confidence: `low` | `medium` | `high`.
+    pub confidence: String,
+    /// Build-system label (e.g. `Zephyr`, `ESP-IDF`, `CMake`).
+    pub build_system: String,
+    /// Framework, when known (`zephyr`, `esp-idf`, `bare-metal`, ...).
+    pub framework: Option<String>,
+    /// Target board / MCU / arch.
+    pub target: FirmwareTarget,
+    /// Unresolved gaps in the plan.
+    pub gaps: Vec<String>,
+}
+
+/// The detected firmware target (board / MCU / arch).
+#[derive(Debug, Clone, Default)]
+pub struct FirmwareTarget {
+    /// Board name.
+    pub board: Option<String>,
+    /// MCU part.
+    pub mcu: Option<String>,
+    /// Architecture.
+    pub arch: Option<String>,
+}
+
+/// A source of tramiton firmware detection.
+#[allow(async_fn_in_trait)]
+pub trait FirmwareDetector: Send + Sync {
+    /// Run detection over a path, returning a firmware detection if tramiton
+    /// could form a build plan.
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError>;
+}
+
+/// Uses `tramiton-core` in-process. The analysis is blocking (filesystem walk),
+/// so it runs on a blocking thread to avoid stalling the async runtime. A path
+/// with no recognizable build system yields `Ok(None)`.
+pub struct TramitonNative;
+
+impl FirmwareDetector for TramitonNative {
+    async fn detect(&self, path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        let path = path.to_path_buf();
+        let plan = tokio::task::spawn_blocking(move || {
+            let repo = tramiton_core::Repo::new(&path);
+            tramiton_core::provider::analyze(&repo)
+        })
+        .await
+        .map_err(|e| CoreError::Other(format!("tramiton detect task join error: {e}")))?
+        .map_err(|e| CoreError::Other(format!("tramiton analyze error: {e}")))?;
+        Ok(plan.map(|bp| detection_from_build_plan(&bp)))
+    }
+}
+
+/// Map tramiton's `BuildPlan` onto our minimal detection summary.
+fn detection_from_build_plan(bp: &tramiton_core::BuildPlan) -> FirmwareDetection {
+    FirmwareDetection {
+        provider: bp.provider.clone(),
+        confidence: bp.confidence.to_string(),
+        build_system: bp.build_system.label().to_string(),
+        framework: bp.framework.clone(),
+        target: FirmwareTarget {
+            board: bp.target.board.clone(),
+            mcu: bp.target.mcu.clone(),
+            arch: bp.target.arch.clone(),
+        },
+        gaps: bp.gaps.clone(),
+    }
+}
+
+/// Map a firmware detection to a target type. Framework/build-system signals
+/// distinguish RTOS from bare-metal from Yocto.
+pub fn detection_to_target_type(det: &FirmwareDetection) -> TargetType {
+    let framework = det.framework.as_deref().unwrap_or("").to_lowercase();
+    let build_system = det.build_system.to_lowercase();
+    let signal = format!("{framework} {build_system} {}", det.provider.to_lowercase());
+
+    const RTOS: [&str; 6] = ["zephyr", "esp-idf", "freertos", "nuttx", "riot", "chibios"];
+    if signal.contains("bitbake") || signal.contains("yocto") || signal.contains("openembedded") {
+        TargetType::EmbeddedLinuxYocto
+    } else if RTOS.iter().any(|k| signal.contains(k)) {
+        TargetType::FirmwareRtos
+    } else {
+        TargetType::FirmwareBareMetal
+    }
+}
+
+/// Map tramiton's confidence label to a `[0,1]` score.
+fn confidence_score(label: &str) -> f32 {
+    match label.to_lowercase().as_str() {
+        "high" => 0.9,
+        "medium" => 0.6,
+        "low" => 0.3,
+        _ => 0.4,
+    }
+}
+
+/// Turn a firmware detection into a classifier verdict, carrying the MCU / board
+/// / build-system as facts.
+pub fn detection_to_verdict(det: &FirmwareDetection) -> ClassifierVerdict {
+    let target_type = detection_to_target_type(det);
+    let mut facts = vec![DetectedFact::new(
+        "build_system",
+        det.build_system.clone(),
+        "tramiton",
+    )];
+    if let Some(fw) = &det.framework {
+        facts.push(DetectedFact::new("framework", fw.clone(), "tramiton"));
+    }
+    if let Some(mcu) = &det.target.mcu {
+        facts.push(DetectedFact::new("mcu", mcu.clone(), "tramiton"));
+    }
+    if let Some(board) = &det.target.board {
+        facts.push(DetectedFact::new("board", board.clone(), "tramiton"));
+    }
+    if let Some(arch) = &det.target.arch {
+        facts.push(DetectedFact::new("arch", arch.clone(), "tramiton"));
+    }
+    ClassifierVerdict {
+        target_type,
+        confidence: confidence_score(&det.confidence),
+        facts,
+        rationale: format!(
+            "tramiton detected build system '{}'{}",
+            det.build_system,
+            det.framework
+                .as_ref()
+                .map(|f| format!(" (framework {f})"))
+                .unwrap_or_default()
+        ),
+    }
+}
+
+/// A deterministic [`FirmwareDetector`] for tests — returns a preset detection.
+pub struct MockFirmwareDetector {
+    /// The detection to return (or `None` for "no detection").
+    pub detection: Option<FirmwareDetection>,
+}
+
+impl FirmwareDetector for MockFirmwareDetector {
+    async fn detect(&self, _path: &Path) -> Result<Option<FirmwareDetection>, CoreError> {
+        Ok(self.detection.clone())
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn detection(build_system: &str, framework: Option<&str>) -> FirmwareDetection {
+        FirmwareDetection {
+            provider: build_system.to_string(),
+            confidence: "high".to_string(),
+            build_system: build_system.to_string(),
+            framework: framework.map(|s| s.to_string()),
+            target: FirmwareTarget {
+                mcu: Some("stm32f429".to_string()),
+                ..Default::default()
+            },
+            gaps: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn zephyr_maps_to_rtos() {
+        assert_eq!(
+            detection_to_target_type(&detection("zephyr", Some("zephyr"))),
+            TargetType::FirmwareRtos
+        );
+    }
+
+    #[test]
+    fn bare_cmake_maps_to_bare_metal() {
+        assert_eq!(
+            detection_to_target_type(&detection("cmake", Some("bare-metal"))),
+            TargetType::FirmwareBareMetal
+        );
+    }
+
+    #[test]
+    fn bitbake_maps_to_yocto() {
+        assert_eq!(
+            detection_to_target_type(&detection("bitbake", None)),
+            TargetType::EmbeddedLinuxYocto
+        );
+    }
+
+    #[test]
+    fn verdict_carries_mcu_fact_and_confidence() {
+        let v = detection_to_verdict(&detection("esp-idf", Some("esp-idf")));
+        assert_eq!(v.target_type, TargetType::FirmwareRtos);
+        assert!((v.confidence - 0.9).abs() < f32::EPSILON);
+        assert!(v
+            .facts
+            .iter()
+            .any(|f| f.key == "mcu" && f.value == "stm32f429"));
+    }
+}

compliance-agent/src/classify/language.rs

@@ -0,0 +1,357 @@
+//! Heuristic target-type classification from artifact kinds and source markers.
+//!
+//! Complements the tramiton firmware detector: this handles web / backend /
+//! mobile / desktop / PLC by sniffing manifest files and file extensions in the
+//! ingested code trees, plus strong priors from the artifact kinds themselves
+//! (a PLC-project artifact is a PLC target; an `.ipa` is an iOS app).
+
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{ArtifactKind, DetectedFact, TargetType};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+/// Max directory depth scanned for marker files.
+const SCAN_DEPTH: usize = 2;
+
+/// Markers collected from a code tree.
+#[derive(Default)]
+struct Markers {
+    files: HashSet<String>,
+    dirs: HashSet<String>,
+    exts: HashSet<String>,
+}
+
+impl Markers {
+    fn has_file(&self, name: &str) -> bool {
+        self.files.contains(name)
+    }
+    fn has_ext(&self, ext: &str) -> bool {
+        self.exts.contains(ext)
+    }
+    fn any_dir_ends_with(&self, suffix: &str) -> bool {
+        self.dirs.iter().any(|d| d.ends_with(suffix))
+    }
+}
+
+/// Recursively collect marker file/dir/extension names up to [`SCAN_DEPTH`].
+fn collect_markers(root: &Path) -> Markers {
+    let mut m = Markers::default();
+    scan_dir(root, 0, &mut m);
+    m
+}
+
+fn scan_dir(dir: &Path, depth: usize, m: &mut Markers) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let path = entry.path();
+        let name = entry.file_name().to_string_lossy().to_lowercase();
+        if path.is_dir() {
+            m.dirs.insert(name);
+            if depth < SCAN_DEPTH {
+                scan_dir(&path, depth + 1, m);
+            }
+        } else {
+            if let Some(ext) = path.extension() {
+                m.exts.insert(ext.to_string_lossy().to_lowercase());
+            }
+            m.files.insert(name);
+        }
+    }
+}
+
+/// Whether a `package.json` at `root` looks like a front-end app.
+fn package_json_is_frontend(root: &Path) -> bool {
+    let Ok(content) = fs::read_to_string(root.join("package.json")) else {
+        return false;
+    };
+    let c = content.to_lowercase();
+    ["react", "next", "vue", "@angular", "svelte", "vite"]
+        .iter()
+        .any(|f| c.contains(f))
+}
+
+/// The heuristic classifier: artifact-kind priors + source-tree markers.
+pub struct HeuristicClassifier;
+
+impl HeuristicClassifier {
+    /// Verdicts from the artifact kinds alone (no filesystem needed).
+    fn kind_priors(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            let lower = a.source_ref.to_lowercase();
+            match a.kind {
+                ArtifactKind::PlcProject => out.push(verdict(
+                    TargetType::PlcSps,
+                    0.85,
+                    "PLC project artifact",
+                    vec![],
+                )),
+                ArtifactKind::MobilePackage => {
+                    let (tt, why) = if lower.ends_with(".ipa") {
+                        (TargetType::IosApp, "iOS package (.ipa)")
+                    } else {
+                        (TargetType::AndroidApp, "Android package (.apk/.aab)")
+                    };
+                    out.push(verdict(tt, 0.85, why, vec![]));
+                }
+                ArtifactKind::ContainerImage => out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "container image",
+                    vec![],
+                )),
+                ArtifactKind::FirmwareImage => out.push(verdict(
+                    TargetType::FirmwareBareMetal,
+                    0.35,
+                    "firmware image (pending tramiton detection)",
+                    vec![],
+                )),
+                ArtifactKind::LiveUrl if input.artifacts.len() == 1 => {
+                    out.push(verdict(TargetType::WebApp, 0.3, "live URL only", vec![]))
+                }
+                _ => {}
+            }
+        }
+        out
+    }
+
+    /// Verdicts from scanning the ingested code trees for manifest markers.
+    fn source_verdicts(&self, input: &ClassificationInput<'_>) -> Vec<ClassifierVerdict> {
+        let mut out = Vec::new();
+        for a in input.artifacts {
+            if !matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive) {
+                continue;
+            }
+            let Some(path) = input.working_paths.get(&a.id) else {
+                continue;
+            };
+            let m = collect_markers(path);
+
+            // Mobile (checked first — strongest signal).
+            if m.has_file("androidmanifest.xml") || m.has_ext("apk") || m.has_ext("aab") {
+                out.push(verdict(
+                    TargetType::AndroidApp,
+                    0.8,
+                    "Android manifest / gradle",
+                    facts_lang("kotlin/java"),
+                ));
+            }
+            if m.any_dir_ends_with(".xcodeproj")
+                || m.has_file("info.plist")
+                || m.has_file("podfile")
+                || m.has_ext("ipa")
+            {
+                out.push(verdict(
+                    TargetType::IosApp,
+                    0.8,
+                    "Xcode project / Info.plist",
+                    facts_lang("swift/objc"),
+                ));
+            }
+            // Desktop.
+            if m.has_ext("sln")
+                || m.has_ext("csproj")
+                || m.has_ext("vcxproj")
+                || m.has_ext("desktop")
+            {
+                out.push(verdict(
+                    TargetType::DesktopApp,
+                    0.7,
+                    "desktop project files",
+                    facts_lang("dotnet/native"),
+                ));
+            }
+            // PLC.
+            if m.has_ext("st") {
+                out.push(verdict(
+                    TargetType::PlcSps,
+                    0.8,
+                    "Structured Text sources",
+                    facts_lang("iec-61131-3"),
+                ));
+            }
+            // Web vs backend from package.json.
+            if m.has_file("package.json") {
+                if package_json_is_frontend(path) {
+                    out.push(verdict(
+                        TargetType::WebApp,
+                        0.65,
+                        "package.json with a front-end framework",
+                        facts_lang("javascript"),
+                    ));
+                } else {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.55,
+                        "package.json (no front-end framework)",
+                        facts_lang("javascript"),
+                    ));
+                }
+            }
+            // Backend languages.
+            for (file, lang) in [
+                ("cargo.toml", "rust"),
+                ("go.mod", "go"),
+                ("pom.xml", "java"),
+                ("requirements.txt", "python"),
+                ("pyproject.toml", "python"),
+            ] {
+                if m.has_file(file) {
+                    out.push(verdict(
+                        TargetType::BackendService,
+                        0.6,
+                        "backend build manifest",
+                        facts_lang(lang),
+                    ));
+                }
+            }
+            // Container-only.
+            if m.has_file("dockerfile") && out.is_empty() {
+                out.push(verdict(
+                    TargetType::BackendService,
+                    0.4,
+                    "Dockerfile",
+                    facts_lang("container"),
+                ));
+            }
+        }
+        out
+    }
+}
+
+impl TargetClassifier for HeuristicClassifier {
+    fn name(&self) -> &str {
+        "heuristic"
+    }
+
+    async fn classify(
+        &self,
+        input: &ClassificationInput<'_>,
+    ) -> Result<Vec<ClassifierVerdict>, CoreError> {
+        let mut out = self.kind_priors(input);
+        out.extend(self.source_verdicts(input));
+        Ok(out)
+    }
+}
+
+fn verdict(
+    target_type: TargetType,
+    confidence: f32,
+    rationale: &str,
+    facts: Vec<DetectedFact>,
+) -> ClassifierVerdict {
+    ClassifierVerdict {
+        target_type,
+        confidence,
+        facts,
+        rationale: rationale.to_string(),
+    }
+}
+
+fn facts_lang(lang: &str) -> Vec<DetectedFact> {
+    vec![DetectedFact::new("language", lang, "heuristic")]
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::collections::HashMap;
+    use std::path::PathBuf;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    async fn classify_tree(setup: impl FnOnce(&Path)) -> Vec<ClassifierVerdict> {
+        let scratch = Scratch::new();
+        setup(&scratch.0);
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let artifacts = vec![artifact];
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify")
+    }
+
+    #[tokio::test]
+    async fn frontend_package_json_is_webapp() {
+        let v = classify_tree(|root| {
+            fs::write(
+                root.join("package.json"),
+                r#"{"dependencies":{"react":"18"}}"#,
+            )
+            .unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::WebApp));
+    }
+
+    #[tokio::test]
+    async fn cargo_toml_is_backend() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("Cargo.toml"), "[package]\nname='x'").unwrap();
+        })
+        .await;
+        assert!(v
+            .iter()
+            .any(|x| x.target_type == TargetType::BackendService));
+    }
+
+    #[tokio::test]
+    async fn android_manifest_is_android() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("AndroidManifest.xml"), "<manifest/>").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::AndroidApp));
+    }
+
+    #[tokio::test]
+    async fn structured_text_is_plc() {
+        let v = classify_tree(|root| {
+            fs::write(root.join("main.st"), "PROGRAM main END_PROGRAM").unwrap();
+        })
+        .await;
+        assert!(v.iter().any(|x| x.target_type == TargetType::PlcSps));
+    }
+
+    #[tokio::test]
+    async fn ipa_artifact_prior_is_ios() {
+        let artifacts = vec![Artifact::mobile_package("app.ipa")];
+        let wp = HashMap::new();
+        let input = ClassificationInput {
+            artifacts: &artifacts,
+            working_paths: &wp,
+            description: None,
+        };
+        let v = HeuristicClassifier
+            .classify(&input)
+            .await
+            .expect("classify");
+        assert!(v.iter().any(|x| x.target_type == TargetType::IosApp));
+    }
+}

compliance-agent/src/classify/mod.rs

@@ -0,0 +1,226 @@
+//! Target classification.
+//!
+//! Runs the classifier registry over a target's artifacts and their ingested
+//! working paths, then merges and ranks the verdicts into a [`Classification`].
+//! The registry is the heuristic classifier (artifact kinds + source markers)
+//! plus the tramiton firmware detector (behind a [`FirmwareDetector`] port).
+
+mod firmware;
+mod language;
+
+pub use firmware::{
+    FirmwareDetection, FirmwareDetector, FirmwareTarget, MockFirmwareDetector, TramitonNative,
+};
+pub use language::HeuristicClassifier;
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use compliance_core::error::CoreError;
+use compliance_core::models::{
+    ArtifactKind, Classification, DetectedFact, OnboardedTarget, TargetType, TargetTypeCandidate,
+};
+use compliance_core::traits::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+
+use firmware::detection_to_verdict;
+
+/// Classify a target from its artifacts and their ingested working paths, using
+/// the heuristic classifier plus the tramiton firmware detector. Verdicts are
+/// merged (max confidence per target type) and ranked into a [`Classification`].
+pub async fn classify_target<D: FirmwareDetector>(
+    target: &OnboardedTarget,
+    working_paths: &HashMap<String, PathBuf>,
+    firmware_detector: &D,
+) -> Result<Classification, CoreError> {
+    let input = ClassificationInput {
+        artifacts: &target.artifacts,
+        working_paths,
+        description: target.description.as_deref(),
+    };
+
+    let mut verdicts = Vec::new();
+    let mut detected_by = Vec::new();
+
+    let heuristic = HeuristicClassifier.classify(&input).await?;
+    if !heuristic.is_empty() {
+        detected_by.push("heuristic".to_string());
+    }
+    verdicts.extend(heuristic);
+
+    // Tramiton firmware detection over firmware / code working paths.
+    let mut tramiton_used = false;
+    for artifact in &target.artifacts {
+        if !matches!(
+            artifact.kind,
+            ArtifactKind::FirmwareImage | ArtifactKind::GitRepo | ArtifactKind::SourceArchive
+        ) {
+            continue;
+        }
+        let Some(path) = working_paths.get(&artifact.id) else {
+            continue;
+        };
+        if let Some(detection) = firmware_detector.detect(path).await? {
+            verdicts.push(detection_to_verdict(&detection));
+            tramiton_used = true;
+        }
+    }
+    if tramiton_used {
+        detected_by.push("tramiton".to_string());
+    }
+
+    Ok(rank(verdicts, detected_by, target.target_type))
+}
+
+/// Merge verdicts by target type (keeping the max confidence and its rationale),
+/// dedupe facts, rank by descending confidence, and assemble a [`Classification`].
+/// Falls back to the declared type when no verdict is produced.
+fn rank(
+    verdicts: Vec<ClassifierVerdict>,
+    detected_by: Vec<String>,
+    fallback: TargetType,
+) -> Classification {
+    let mut best: HashMap<TargetType, (f32, String)> = HashMap::new();
+    let mut facts: Vec<DetectedFact> = Vec::new();
+    for verdict in verdicts {
+        for fact in verdict.facts {
+            if !facts
+                .iter()
+                .any(|e| e.key == fact.key && e.value == fact.value)
+            {
+                facts.push(fact);
+            }
+        }
+        let entry = best
+            .entry(verdict.target_type)
+            .or_insert((0.0, String::new()));
+        if verdict.confidence > entry.0 {
+            *entry = (verdict.confidence, verdict.rationale);
+        }
+    }
+
+    let mut candidates: Vec<TargetTypeCandidate> = best
+        .into_iter()
+        .map(
+            |(target_type, (confidence, rationale))| TargetTypeCandidate {
+                target_type,
+                confidence,
+                rationale,
+            },
+        )
+        .collect();
+    // Descending confidence; ties broken by type name for deterministic ordering.
+    candidates.sort_by(|a, b| {
+        b.confidence
+            .partial_cmp(&a.confidence)
+            .unwrap_or(std::cmp::Ordering::Equal)
+            .then_with(|| a.target_type.to_string().cmp(&b.target_type.to_string()))
+    });
+
+    let suggested = candidates
+        .first()
+        .map(|c| c.target_type)
+        .unwrap_or(fallback);
+
+    Classification {
+        suggested,
+        candidates,
+        facts,
+        detected_by,
+        detected_at: chrono::Utc::now(),
+        confirmed: false,
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::Artifact;
+    use std::fs;
+    use std::path::Path;
+
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-classify-mod-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn no_firmware() -> MockFirmwareDetector {
+        MockFirmwareDetector { detection: None }
+    }
+
+    #[tokio::test]
+    async fn backend_repo_classifies_as_backend() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("go.mod"), "module x").unwrap();
+
+        let artifact = Artifact::git_repo("https://git/x", "main");
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("x".to_string(), TargetType::WebApp);
+        target.artifacts.push(artifact);
+
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::BackendService);
+        assert!(c.detected_by.contains(&"heuristic".to_string()));
+        assert!(!c.confirmed);
+    }
+
+    #[tokio::test]
+    async fn firmware_detector_verdict_ranks_top() {
+        let scratch = Scratch::new();
+        fs::write(scratch.0.join("fw.bin"), b"x").unwrap();
+
+        let artifact =
+            Artifact::firmware_image(scratch.0.join("fw.bin").to_string_lossy().to_string());
+        let mut wp = HashMap::new();
+        wp.insert(artifact.id.clone(), scratch.0.clone());
+        let mut target = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareBareMetal);
+        target.artifacts.push(artifact);
+
+        let detector = MockFirmwareDetector {
+            detection: Some(FirmwareDetection {
+                provider: "zephyr".to_string(),
+                confidence: "high".to_string(),
+                build_system: "zephyr".to_string(),
+                framework: Some("zephyr".to_string()),
+                target: FirmwareTarget {
+                    mcu: Some("nrf52840".to_string()),
+                    ..Default::default()
+                },
+                gaps: vec![],
+            }),
+        };
+
+        let c = classify_target(&target, &wp, &detector)
+            .await
+            .expect("classify");
+        // tramiton's high-confidence RTOS verdict beats the weak firmware prior.
+        assert_eq!(c.suggested, TargetType::FirmwareRtos);
+        assert!(c.detected_by.contains(&"tramiton".to_string()));
+        assert!(c.facts.iter().any(|f| f.key == "mcu"));
+    }
+
+    #[tokio::test]
+    async fn no_signal_falls_back_to_declared_type() {
+        let scratch = Scratch::new();
+        let _ = Path::new(&scratch.0);
+        let target = OnboardedTarget::new("empty".to_string(), TargetType::DesktopApp);
+        let wp = HashMap::new();
+        let c = classify_target(&target, &wp, &no_firmware())
+            .await
+            .expect("classify");
+        assert_eq!(c.suggested, TargetType::DesktopApp);
+        assert!(c.candidates.is_empty());
+    }
+}

compliance-agent/src/config.rs

@@ -45,6 +45,8 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "0 0 * * * *".to_string()),
         git_clone_base_path: env_var_opt("GIT_CLONE_BASE_PATH")
             .unwrap_or_else(|| "/tmp/compliance-scanner/repos".to_string()),
+        artifact_store_base_path: env_var_opt("ARTIFACT_STORE_BASE_PATH")
+            .unwrap_or_else(|| "/data/compliance-scanner/artifacts".to_string()),
         ssh_key_path: env_var_opt("SSH_KEY_PATH")
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),
@@ -59,5 +61,7 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or(true),
         pentest_imap_username: env_var_opt("PENTEST_IMAP_USERNAME"),
         pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
+        admin_api_token: env_secret_opt("ADMIN_API_TOKEN"),
+        tenant_registry_url: env_var_opt("TENANT_REGISTRY_URL"),
     })
 }

compliance-agent/src/database.rs

@@ -1,11 +1,233 @@
+use std::sync::Arc;
+
+use dashmap::DashMap;
 use mongodb::bson::doc;
 use mongodb::options::IndexOptions;
 use mongodb::{Client, Collection, IndexModel};
+use sha2::{Digest, Sha256};
 
 use compliance_core::models::*;
+use compliance_core::TenantContext;
 
 use crate::error::AgentError;
 
+/// Mongo enforces a 63-byte cap on database names (older clusters: 64
+/// on Linux, 63 on Windows; we target the conservative limit).
+const MAX_DB_NAME_LEN: usize = 63;
+
+/// Hex length of the SHA-256 truncation used for the hash fallback
+/// tenant DB name (16 bytes → 32 hex chars). 16 bytes gives ~2^64
+/// birthday-collision resistance — at our 10s-100s tenant scale this
+/// is effectively impossible to hit.
+const HASH_HEX_LEN: usize = 32;
+
+/// Largest `db_prefix` that still guarantees the hash-fallback name
+/// fits in the 63-byte cap: `prefix + "_" + 32 hex chars`.
+const MAX_PREFIX_LEN: usize = MAX_DB_NAME_LEN - 1 - HASH_HEX_LEN;
+
+/// Per-tenant Mongo connection broker (M7.2 isolation model).
+///
+/// Holds one [`Client`] and hands out [`Database`] handles physically
+/// scoped to `<db_prefix>_<tenant_id>`. The driver is the isolation
+/// boundary — a handle for tenant A cannot see tenant B's documents
+/// because it is connected to a different database, not because of an
+/// application-level filter.
+///
+/// Index creation runs idempotently the first time each tenant is seen
+/// in the process's lifetime. Mongo's `createIndex` is itself idempotent
+/// by index name; the in-memory `ensured` set just skips the round-trip.
+#[derive(Clone, Debug)]
+pub struct DatabasePool {
+    client: Client,
+    db_prefix: String,
+    ensured: Arc<DashMap<String, ()>>,
+}
+
+impl DatabasePool {
+    /// Connect to the cluster and prepare to hand out tenant databases
+    /// named `<db_prefix>_<tenant_id>`.
+    ///
+    /// Validates `db_prefix.len() <= MAX_PREFIX_LEN` so the
+    /// hash-fallback path is provably within Mongo's 63-byte db-name
+    /// cap. Refuses to construct a pool that could ever produce an
+    /// over-long name.
+    pub async fn connect(uri: &str, db_prefix: &str) -> Result<Self, AgentError> {
+        if db_prefix.len() > MAX_PREFIX_LEN {
+            return Err(AgentError::Other(format!(
+                "db_prefix '{db_prefix}' is {} chars; max is {MAX_PREFIX_LEN} so the \
+                 hash-fallback tenant DB name fits Mongo's {MAX_DB_NAME_LEN}-byte cap",
+                db_prefix.len()
+            )));
+        }
+        let client = Client::with_uri_str(uri).await?;
+        client
+            .database("admin")
+            .run_command(doc! { "ping": 1 })
+            .await?;
+        tracing::info!(
+            "MongoDB cluster reachable; per-tenant pool ready (db prefix '{db_prefix}')"
+        );
+        Ok(Self {
+            client,
+            db_prefix: db_prefix.to_string(),
+            ensured: Arc::new(DashMap::new()),
+        })
+    }
+
+    /// Return a [`Database`] scoped to this tenant. Ensures indexes on
+    /// first call per tenant (per process). Cheap on the hot path —
+    /// subsequent calls skip the round-trip.
+    pub async fn for_tenant(&self, ctx: &TenantContext) -> Result<Database, AgentError> {
+        self.for_tenant_id(&ctx.tenant_id).await
+    }
+
+    /// Like [`Self::for_tenant`] but accepts a bare tenant_id.
+    /// For background paths (scheduler, webhooks, pipeline orchestrators)
+    /// that don't have a full [`TenantContext`] but know which tenant
+    /// they're operating on (typically resolved from a URL path, a job
+    /// argument, or the registry).
+    pub async fn for_tenant_id(&self, tenant_id: &str) -> Result<Database, AgentError> {
+        let db_name = self.tenant_db_name(tenant_id);
+        let db = Database::from_database(self.client.database(&db_name));
+        // `DashMap::insert` returns the previous value; `None` means we
+        // were the first writer for this tenant_id and own the
+        // index-ensure work.
+        if self.ensured.insert(tenant_id.to_string(), ()).is_none() {
+            if let Err(e) = db.ensure_indexes().await {
+                // Roll the marker back so the next request retries.
+                self.ensured.remove(tenant_id);
+                return Err(e);
+            }
+            tracing::debug!(
+                tenant_id = %tenant_id,
+                db_name = %db_name,
+                "Indexes ensured for tenant database"
+            );
+        }
+        Ok(db)
+    }
+
+    /// Compute the Mongo database name for a tenant. Public for tests
+    /// and tenant offboarding (`pool.client().database(name).drop()`).
+    ///
+    /// Format: `<prefix>_<sanitized_tenant_id>` if it fits the 63-byte
+    /// cap, else `<prefix>_<sha256-16-byte-hex-of-tenant_id>`. The
+    /// `db_prefix` length invariant established at [`Self::connect`]
+    /// guarantees the hash-fallback name always fits — no runtime
+    /// assertion needed.
+    ///
+    /// Collision resistance: the hash fallback is a 16-byte SHA-256
+    /// truncation, which gives ~2^64 birthday-collision resistance. At
+    /// our 10s–100s tenant scale the probability of two tenant_ids
+    /// colliding is effectively zero. (8-byte truncation would have
+    /// been ~2^32 — too close for comfort on a regulated product.)
+    pub fn tenant_db_name(&self, tenant_id: &str) -> String {
+        let sanitized = sanitize_tenant_id(tenant_id);
+        let natural = format!("{}_{}", self.db_prefix, sanitized);
+        if natural.len() <= MAX_DB_NAME_LEN {
+            natural
+        } else {
+            let mut hasher = Sha256::new();
+            hasher.update(tenant_id.as_bytes());
+            let digest = hasher.finalize();
+            let suffix = hex::encode(&digest[..HASH_HEX_LEN / 2]);
+            format!("{}_{}", self.db_prefix, suffix)
+        }
+    }
+
+    /// Raw client handle. Reserved for cross-tenant admin flows that
+    /// must opt in explicitly (tenant listing, drop-on-offboard).
+    pub fn client(&self) -> &Client {
+        &self.client
+    }
+
+    /// Cross-tenant admin database used by features that intentionally
+    /// span tenants (today: MCP bearer tokens — each token row carries
+    /// a `tenant_id` and the MCP server reads them to route requests).
+    ///
+    /// The name `<db_prefix>__admin` (double underscore) is reserved —
+    /// the sanitizer never produces it for a normal tenant DB because
+    /// the natural format is `<db_prefix>_<sanitized_tenant_id>` (one
+    /// underscore) and tenant_ids would have to start with `_admin` to
+    /// collide. New tenant provisioning should reject such ids.
+    pub fn admin_db(&self) -> mongodb::Database {
+        self.client.database(&self.admin_db_name())
+    }
+
+    /// Name of the admin database — public so tests / operators can
+    /// drop it via the raw client.
+    pub fn admin_db_name(&self) -> String {
+        format!("{}__admin", self.db_prefix)
+    }
+
+    /// List every Mongo database currently belonging to this pool,
+    /// identified by the `<db_prefix>_` prefix. The result is the raw
+    /// database names — opening one for offboarding/cleanup goes
+    /// through [`Self::client`].
+    ///
+    /// Note: hashed-fallback names (very long tenant_ids) lose the
+    /// original tenant_id at the cluster level — we know a database
+    /// exists for *some* tenant but not which one. In practice
+    /// tenant_ids are UUIDs (36 chars) and never hit the fallback,
+    /// so this is a theoretical concern, not an operational one.
+    pub async fn list_tenant_db_names(&self) -> Result<Vec<String>, AgentError> {
+        let prefix = format!("{}_", self.db_prefix);
+        let names = self.client.list_database_names().await?;
+        Ok(names
+            .into_iter()
+            .filter(|n| n.starts_with(&prefix))
+            .collect())
+    }
+
+    /// Tenant ids for every provisioned tenant database, derived by stripping
+    /// the `<prefix>_` from the database names. Skips the admin database
+    /// (`<prefix>__admin`). Hash-fallback names (very long tenant_ids) are lost
+    /// at the cluster level and cannot be recovered here — in practice tenant
+    /// ids are UUIDs and never hit that path. Used by the migration CLI's
+    /// `--all` mode.
+    pub async fn list_tenant_ids(&self) -> Result<Vec<String>, AgentError> {
+        let prefix = format!("{}_", self.db_prefix);
+        Ok(self
+            .list_tenant_db_names()
+            .await?
+            .into_iter()
+            .filter_map(|n| n.strip_prefix(&prefix).map(str::to_string))
+            .filter(|id| !id.starts_with('_'))
+            .collect())
+    }
+
+    /// Drop the database for a specific tenant. Used by GDPR delete
+    /// and tenant offboarding. Idempotent — dropping a non-existent
+    /// database is a no-op at the driver level.
+    ///
+    /// Also evicts the tenant from the in-memory `ensured` set so a
+    /// later re-provision triggers fresh `ensure_indexes`.
+    pub async fn drop_tenant(&self, tenant_id: &str) -> Result<(), AgentError> {
+        let db_name = self.tenant_db_name(tenant_id);
+        self.client.database(&db_name).drop().await?;
+        self.ensured.remove(tenant_id);
+        tracing::info!(
+            tenant_id = %tenant_id,
+            db_name = %db_name,
+            "Dropped tenant database"
+        );
+        Ok(())
+    }
+}
+
+/// Mongo database names disallow `/`, `\`, `.`, `"`, `$`, ` `, and NUL.
+/// breakpilot-dev tenant_ids are UUIDs so this is belt-and-braces, but
+/// it lets the pool tolerate any future tenant_id shape without surprise.
+fn sanitize_tenant_id(tenant_id: &str) -> String {
+    tenant_id
+        .chars()
+        .map(|c| match c {
+            '/' | '\\' | '.' | '"' | '$' | ' ' | '\0' => '_',
+            c => c,
+        })
+        .collect()
+}
+
 #[derive(Clone, Debug)]
 pub struct Database {
     inner: mongodb::Database,
@@ -20,6 +242,12 @@ impl Database {
         Ok(Self { inner: db })
     }
 
+    /// Wrap an already-resolved Mongo database. Used by [`DatabasePool`]
+    /// to hand out tenant-scoped handles without a fresh client per tenant.
+    pub(crate) fn from_database(inner: mongodb::Database) -> Self {
+        Self { inner }
+    }
+
     pub async fn ensure_indexes(&self) -> Result<(), AgentError> {
         // repositories: unique git_url
         self.repositories()
@@ -217,6 +445,36 @@ impl Database {
             )
             .await?;
 
+        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
+        // lookup). Non-unique — "one git URL per tenant" is enforced in the
+        // create handler, since a unique multikey index on an array field has
+        // null-collision caveats.
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.source_ref": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: multikey on artifact kind
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.kind": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: target_type filter
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "target_type": 1 })
+                    .build(),
+            )
+            .await?;
+
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -273,6 +531,20 @@ impl Database {
         self.inner.collection("dast_targets")
     }
 
+    /// The unified onboarding targets that replace `repositories` and
+    /// `dast_targets`. Ids are preserved from the legacy collections during
+    /// migration so downstream `repo_id` / `target_id` references keep resolving.
+    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
+        self.inner.collection("onboarded_targets")
+    }
+
+    /// A typed handle to an arbitrary collection by name. For bookkeeping
+    /// collections without a dedicated model (e.g. `schema_migrations`,
+    /// `onboarding_migration_log`).
+    pub fn collection_named<T: Send + Sync>(&self, name: &str) -> Collection<T> {
+        self.inner.collection(name)
+    }
+
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }

compliance-agent/src/ingest/blob.rs

@@ -0,0 +1,154 @@
+//! Content-addressed blob storage and archive extraction for ingest.
+//!
+//! Blobs are stored at `<base>/blobs/<sha[0:2]>/<sha>` and deduplicated by
+//! digest; per-run working directories live under `<base>/work/`.
+
+use std::fs::{self, File};
+use std::io::{self, Read};
+use std::path::{Path, PathBuf};
+
+use sha2::{Digest, Sha256};
+
+use crate::error::AgentError;
+
+/// Read buffer size for streaming hashes/copies (64 KiB).
+const BUF_LEN: usize = 64 * 1024;
+
+/// Stream-hash a file with SHA-256, returning the lowercase-hex digest and the
+/// byte length. Streams so large firmware images never load fully into memory.
+pub fn hash_file(path: &Path) -> Result<(String, u64), AgentError> {
+    let mut file = File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut buf = [0u8; BUF_LEN];
+    let mut total: u64 = 0;
+    loop {
+        let n = file.read(&mut buf)?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+        total += n as u64;
+    }
+    Ok((hex::encode(hasher.finalize()), total))
+}
+
+/// Copy `src` into the content-addressed blob store under `base`, returning the
+/// stored path. Idempotent: an already-present blob is not rewritten.
+pub fn store_file(base: &Path, src: &Path, sha: &str) -> Result<PathBuf, AgentError> {
+    if sha.len() < 2 {
+        return Err(AgentError::Other(format!("invalid content hash '{sha}'")));
+    }
+    let dir = base.join("blobs").join(&sha[0..2]);
+    fs::create_dir_all(&dir)?;
+    let dest = dir.join(sha);
+    if !dest.exists() {
+        fs::copy(src, &dest)?;
+    }
+    Ok(dest)
+}
+
+/// Extract a zip archive into `dest` (created if needed). `enclosed_name`
+/// sanitizes each entry path, so this is safe against zip-slip traversal.
+pub fn extract_zip(archive: &Path, dest: &Path) -> Result<(), AgentError> {
+    let file = File::open(archive)?;
+    let mut zip =
+        zip::ZipArchive::new(file).map_err(|e| AgentError::Other(format!("open zip: {e}")))?;
+    fs::create_dir_all(dest)?;
+    for i in 0..zip.len() {
+        let mut entry = zip
+            .by_index(i)
+            .map_err(|e| AgentError::Other(format!("read zip entry: {e}")))?;
+        // `enclosed_name` returns `None` for traversal-unsafe paths — skip them.
+        let Some(rel) = entry.enclosed_name() else {
+            continue;
+        };
+        let out = dest.join(rel);
+        if entry.is_dir() {
+            fs::create_dir_all(&out)?;
+        } else {
+            if let Some(parent) = out.parent() {
+                fs::create_dir_all(parent)?;
+            }
+            let mut outfile = File::create(&out)?;
+            io::copy(&mut entry, &mut outfile)?;
+        }
+    }
+    Ok(())
+}
+
+/// The working directory for one artifact of a target: `<base>/work/<target>/<artifact>`.
+pub fn work_dir(base: &Path, target_id: &str, artifact_id: &str) -> PathBuf {
+    base.join("work").join(target_id).join(artifact_id)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-{}", uuid::Uuid::new_v4()));
+            fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+        fn path(&self) -> &Path {
+            &self.0
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn hash_is_stable_and_reports_size() {
+        let dir = Scratch::new();
+        let f = dir.path().join("a.bin");
+        fs::write(&f, b"hello world").expect("write");
+        let (sha, size) = hash_file(&f).expect("hash");
+        assert_eq!(size, 11);
+        // Known SHA-256 of "hello world".
+        assert_eq!(
+            sha,
+            "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"
+        );
+    }
+
+    #[test]
+    fn store_is_content_addressed_and_idempotent() {
+        let base = Scratch::new();
+        let src = base.path().join("src.bin");
+        fs::write(&src, b"payload").expect("write");
+        let (sha, _) = hash_file(&src).expect("hash");
+        let p1 = store_file(base.path(), &src, &sha).expect("store");
+        let p2 = store_file(base.path(), &src, &sha).expect("store again");
+        assert_eq!(p1, p2);
+        assert!(p1.ends_with(&sha));
+        assert!(p1.starts_with(base.path().join("blobs").join(&sha[0..2])));
+        assert_eq!(fs::read(&p1).expect("read"), b"payload");
+    }
+
+    #[test]
+    fn extract_zip_writes_entries() {
+        let base = Scratch::new();
+        let archive = base.path().join("a.zip");
+        {
+            let file = File::create(&archive).expect("create");
+            let mut w = zip::ZipWriter::new(file);
+            let opts: zip::write::SimpleFileOptions = Default::default();
+            w.start_file("dir/hello.txt", opts).expect("start");
+            io::Write::write_all(&mut w, b"hi").expect("write");
+            w.finish().expect("finish");
+        }
+        let dest = base.path().join("out");
+        extract_zip(&archive, &dest).expect("extract");
+        assert_eq!(
+            fs::read_to_string(dest.join("dir/hello.txt")).expect("read"),
+            "hi"
+        );
+    }
+}

compliance-agent/src/ingest/mod.rs

@@ -0,0 +1,334 @@
+//! Artifact ingest.
+//!
+//! Normalizes each [`Artifact`] on an [`OnboardedTarget`] into a local working
+//! path plus recorded metadata (content hash, size, discovered facts) that the
+//! classifier and scanners consume. Every blob is SHA-256 hashed — that digest
+//! is also the reconciliation key against sibling products (a firmware sha256
+//! matches tramiton's `Artifact.sha256`).
+
+mod blob;
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use compliance_core::models::{Artifact, ArtifactKind, DetectedFact, OnboardedTarget};
+use compliance_core::AgentConfig;
+
+use crate::error::AgentError;
+use crate::pipeline::git::{GitOps, RepoCredentials};
+
+/// The paths and identifiers an ingest needs. Decoupled from the full
+/// [`AgentConfig`] so ingest is testable without a complete config.
+pub struct IngestContext<'a> {
+    /// Base directory for content-addressed blobs and working dirs.
+    pub artifact_store_base: &'a Path,
+    /// Base directory for git clones.
+    pub git_clone_base: &'a str,
+    /// Default SSH key path (used when an artifact provides none).
+    pub ssh_key_path: &'a str,
+    /// The id of the target these artifacts belong to (namespaces working dirs).
+    pub target_id: &'a str,
+}
+
+impl<'a> IngestContext<'a> {
+    /// Build an ingest context from the agent config for a given target.
+    pub fn from_config(config: &'a AgentConfig, target_id: &'a str) -> Self {
+        Self {
+            artifact_store_base: Path::new(&config.artifact_store_base_path),
+            git_clone_base: &config.git_clone_base_path,
+            ssh_key_path: &config.ssh_key_path,
+            target_id,
+        }
+    }
+}
+
+/// The result of ingesting one artifact.
+pub struct IngestedArtifact {
+    /// The artifact this corresponds to ([`Artifact::id`]).
+    pub artifact_id: String,
+    /// The artifact kind.
+    pub kind: ArtifactKind,
+    /// Local working path (clone dir, extracted dir, or blob file). `None` for
+    /// artifacts with no on-disk form (live URL, plaintext, container ref).
+    pub working_path: Option<PathBuf>,
+    /// SHA-256 of the content (blobs) or git head SHA (git repos).
+    pub content_hash: Option<String>,
+    /// Stored blob size in bytes, when applicable.
+    pub size_bytes: Option<u64>,
+    /// Facts discovered during ingest.
+    pub facts: Vec<DetectedFact>,
+}
+
+/// All ingested artifacts for a target, keyed by artifact id.
+pub struct IngestSet {
+    /// The ingested artifacts, keyed by [`Artifact::id`].
+    pub by_artifact: HashMap<String, IngestedArtifact>,
+}
+
+impl IngestSet {
+    /// The working paths of every ingested artifact that has one — the input the
+    /// classifier expects.
+    pub fn working_paths(&self) -> HashMap<String, PathBuf> {
+        self.by_artifact
+            .iter()
+            .filter_map(|(id, a)| a.working_path.clone().map(|p| (id.clone(), p)))
+            .collect()
+    }
+
+    /// The ingest result for a specific artifact.
+    pub fn get(&self, artifact_id: &str) -> Option<&IngestedArtifact> {
+        self.by_artifact.get(artifact_id)
+    }
+}
+
+/// Ingest every artifact on a target.
+pub fn ingest_all(
+    target: &OnboardedTarget,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestSet, AgentError> {
+    let mut by_artifact = HashMap::new();
+    for artifact in &target.artifacts {
+        let ingested = ingest_artifact(artifact, ctx)?;
+        by_artifact.insert(artifact.id.clone(), ingested);
+    }
+    Ok(IngestSet { by_artifact })
+}
+
+/// Ingest a single artifact, dispatching on its kind.
+pub fn ingest_artifact(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    match artifact.kind {
+        ArtifactKind::GitRepo => ingest_git(artifact, ctx),
+        ArtifactKind::SourceArchive | ArtifactKind::MobilePackage | ArtifactKind::PlcProject => {
+            ingest_blob(artifact, ctx, true)
+        }
+        ArtifactKind::FirmwareImage => ingest_blob(artifact, ctx, false),
+        ArtifactKind::ContainerImage => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("container_ref", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::LiveUrl => Ok(metadata_only(
+            artifact,
+            DetectedFact::new("live_url", artifact.source_ref.as_str(), "ingest"),
+        )),
+        ArtifactKind::PlaintextDescription => Ok(metadata_only(
+            artifact,
+            DetectedFact::new(
+                "description_len",
+                artifact.source_ref.len().to_string(),
+                "ingest",
+            ),
+        )),
+    }
+}
+
+/// Clone (or fetch) a git artifact, recording the head SHA as the content hash.
+fn ingest_git(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+) -> Result<IngestedArtifact, AgentError> {
+    let creds = credentials_for(artifact, ctx.ssh_key_path);
+    let git_ops = GitOps::new(ctx.git_clone_base, creds);
+    let repo_path = git_ops.clone_or_fetch(&artifact.source_ref, &artifact.id)?;
+    let head = GitOps::get_head_sha(&repo_path).ok();
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(repo_path),
+        content_hash: head,
+        size_bytes: None,
+        facts: Vec::new(),
+    })
+}
+
+/// Store a blob artifact content-addressed. When `extract` is set and the blob
+/// is a zip container (source archive, APK/AAB/IPA), also unpack it into a
+/// working directory; otherwise the working path is the stored blob.
+fn ingest_blob(
+    artifact: &Artifact,
+    ctx: &IngestContext<'_>,
+    extract: bool,
+) -> Result<IngestedArtifact, AgentError> {
+    let base = ctx.artifact_store_base;
+    let src = local_source(artifact)?;
+    let (sha, size) = blob::hash_file(&src)?;
+    let stored = blob::store_file(base, &src, &sha)?;
+
+    let mut facts = Vec::new();
+    let working_path = if extract {
+        let dest = blob::work_dir(base, ctx.target_id, &artifact.id);
+        match blob::extract_zip(&stored, &dest) {
+            Ok(()) => dest,
+            Err(e) => {
+                // Not a zip (e.g. a tar.gz source archive) — keep the blob and
+                // note it so later stages can decide what to do.
+                facts.push(DetectedFact::new(
+                    "archive_unextracted",
+                    e.to_string(),
+                    "ingest",
+                ));
+                stored.clone()
+            }
+        }
+    } else {
+        stored.clone()
+    };
+
+    Ok(IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: Some(working_path),
+        content_hash: Some(sha),
+        size_bytes: Some(size),
+        facts,
+    })
+}
+
+/// An artifact with no on-disk form: record a single fact, no hash/path.
+fn metadata_only(artifact: &Artifact, fact: DetectedFact) -> IngestedArtifact {
+    IngestedArtifact {
+        artifact_id: artifact.id.clone(),
+        kind: artifact.kind,
+        working_path: None,
+        content_hash: None,
+        size_bytes: None,
+        facts: vec![fact],
+    }
+}
+
+/// The local file backing a blob artifact: its `stored_path` if already
+/// uploaded, else its `source_ref` interpreted as a filesystem path.
+fn local_source(artifact: &Artifact) -> Result<PathBuf, AgentError> {
+    let path = artifact
+        .stored_path
+        .as_deref()
+        .unwrap_or(artifact.source_ref.as_str());
+    let path = PathBuf::from(path);
+    if !path.exists() {
+        return Err(AgentError::Other(format!(
+            "artifact {} source not found at {}",
+            artifact.id,
+            path.display()
+        )));
+    }
+    Ok(path)
+}
+
+/// Build git credentials from an artifact's auth plus a default SSH key path.
+fn credentials_for(artifact: &Artifact, default_ssh_key_path: &str) -> RepoCredentials {
+    let auth = artifact.auth.as_ref();
+    RepoCredentials {
+        ssh_key_path: auth
+            .and_then(|a| a.ssh_key_path.clone())
+            .or_else(|| Some(default_ssh_key_path.to_string())),
+        auth_token: auth.and_then(|a| a.secret.clone()),
+        auth_username: auth.and_then(|a| a.username.clone()),
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{ArtifactAuth, TargetType};
+
+    /// A unique scratch directory, removed on drop.
+    struct Scratch(PathBuf);
+    impl Scratch {
+        fn new() -> Self {
+            let p = std::env::temp_dir().join(format!("cs-ingest-mod-{}", uuid::Uuid::new_v4()));
+            std::fs::create_dir_all(&p).expect("mkdir scratch");
+            Self(p)
+        }
+    }
+    impl Drop for Scratch {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn ctx_for<'a>(store: &'a Path, target_id: &'a str) -> IngestContext<'a> {
+        IngestContext {
+            artifact_store_base: store,
+            git_clone_base: "/tmp/cs-ingest-test-repos",
+            ssh_key_path: "/tmp/cs-ingest-test-ssh",
+            target_id,
+        }
+    }
+
+    #[test]
+    fn firmware_blob_is_hashed_and_stored() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"firmware-bytes").expect("write");
+
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::firmware_image(fw.to_string_lossy().to_string());
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+
+        assert_eq!(out.kind, ArtifactKind::FirmwareImage);
+        assert_eq!(out.size_bytes, Some(14));
+        let sha = out.content_hash.expect("hash");
+        assert_eq!(sha.len(), 64);
+        // working path is the content-addressed blob
+        let wp = out.working_path.expect("working path");
+        assert!(wp.starts_with(store.join("blobs")));
+    }
+
+    #[test]
+    fn live_url_has_no_blob() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let ctx = ctx_for(&store, "t1");
+        let artifact = Artifact::live_url("https://example.com");
+        let out = ingest_artifact(&artifact, &ctx).expect("ingest");
+        assert!(out.working_path.is_none());
+        assert!(out.content_hash.is_none());
+        assert!(out.facts.iter().any(|f| f.key == "live_url"));
+    }
+
+    #[test]
+    fn ingest_all_collects_working_paths() {
+        let scratch = Scratch::new();
+        let store = scratch.0.join("store");
+        let fw = scratch.0.join("fw.bin");
+        std::fs::write(&fw, b"abc").expect("write");
+        let ctx = ctx_for(&store, "t1");
+
+        let mut target = OnboardedTarget::new("t".to_string(), TargetType::FirmwareBareMetal);
+        target
+            .artifacts
+            .push(Artifact::firmware_image(fw.to_string_lossy().to_string()));
+        target.artifacts.push(Artifact::live_url("https://x"));
+
+        let set = ingest_all(&target, &ctx).expect("ingest all");
+        assert_eq!(set.by_artifact.len(), 2);
+        // Only the firmware artifact yields a working path.
+        assert_eq!(set.working_paths().len(), 1);
+    }
+
+    #[test]
+    fn credentials_prefer_artifact_auth() {
+        let mut artifact = Artifact::git_repo("https://git/x", "main");
+        artifact.auth = Some(ArtifactAuth {
+            method: "token".to_string(),
+            username: Some("bob".to_string()),
+            secret: Some("pat".to_string()),
+            ..Default::default()
+        });
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.auth_token.as_deref(), Some("pat"));
+        assert_eq!(creds.auth_username.as_deref(), Some("bob"));
+    }
+
+    #[test]
+    fn credentials_fall_back_to_default_ssh_key() {
+        let artifact = Artifact::git_repo("git@host:x.git", "main");
+        let creds = credentials_for(&artifact, "/default/ssh/key");
+        assert_eq!(creds.ssh_key_path.as_deref(), Some("/default/ssh/key"));
+        assert!(creds.auth_token.is_none());
+    }
+}

compliance-agent/src/lib.rs

@@ -2,10 +2,13 @@
 
 pub mod agent;
 pub mod api;
+pub mod classify;
 pub mod config;
 pub mod database;
 pub mod error;
+pub mod ingest;
 pub mod llm;
+pub mod migrate;
 pub mod pentest;
 pub mod pipeline;
 pub mod rag;

compliance-agent/src/main.rs

@@ -1,4 +1,50 @@
-use compliance_agent::{agent, api, config, database, scheduler, ssh, webhooks};
+use compliance_agent::{agent, api, config, database, migrate, scheduler, ssh, webhooks};
+
+/// Run the `migrate onboarding` subcommand and exit. Backfills (or reverts) the
+/// unified `onboarded_targets` collection per tenant.
+///
+/// Usage: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]`
+async fn run_migration(
+    args: &[String],
+    pool: &database::DatabasePool,
+) -> Result<(), compliance_agent::error::AgentError> {
+    if args.get(2).map(String::as_str) != Some("onboarding") {
+        eprintln!(
+            "usage: compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run] [--revert]"
+        );
+        std::process::exit(2);
+    }
+    let has = |flag: &str| args.iter().any(|a| a == flag);
+    let dry_run = has("--dry-run");
+    let revert = has("--revert");
+    let tenant = args
+        .iter()
+        .position(|a| a == "--tenant")
+        .and_then(|i| args.get(i + 1))
+        .cloned();
+
+    let tenants: Vec<String> = if has("--all") {
+        pool.list_tenant_ids().await?
+    } else if let Some(t) = tenant {
+        vec![t]
+    } else {
+        eprintln!("specify --all or --tenant <id>");
+        std::process::exit(2);
+    };
+
+    for tenant_id in tenants {
+        let db = pool.for_tenant_id(&tenant_id).await?;
+        if revert {
+            migrate::onboarding::revert(&db).await?;
+            println!("[{tenant_id}] reverted onboarding backfill");
+        } else {
+            let report = migrate::onboarding::backfill_onboarded_targets(&db, dry_run).await?;
+            let prefix = if dry_run { "(dry-run) " } else { "" };
+            println!("[{tenant_id}] {prefix}{report:?}");
+        }
+    }
+    Ok(())
+}
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -25,10 +71,20 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     }
 
     tracing::info!("Connecting to MongoDB...");
-    let db = database::Database::connect(&config.mongodb_uri, &config.mongodb_database).await?;
+    // Per-tenant pool only — the agent has no shared "default" database
-    db.ensure_indexes().await?;
+    // after M7.2-D. `mongodb_database` is now the db-name prefix used
+    // for tenant databases (`<prefix>_<tenant_id>`).
+    let db_pool =
+        database::DatabasePool::connect(&config.mongodb_uri, &config.mongodb_database).await?;
 
-    let agent = agent::ComplianceAgent::new(config.clone(), db.clone());
+    // One-shot subcommands run and exit without starting the servers.
+    let args: Vec<String> = std::env::args().collect();
+    if args.get(1).map(String::as_str) == Some("migrate") {
+        run_migration(&args, &db_pool).await?;
+        return Ok(());
+    }
+
+    let agent = agent::ComplianceAgent::new(config.clone(), db_pool);
 
     tracing::info!("Starting scheduler...");
     let scheduler_agent = agent.clone();

compliance-agent/src/migrate/mod.rs

@@ -0,0 +1,8 @@
+//! One-time data migrations.
+//!
+//! Currently just the onboarding backfill ([`onboarding`]), which folds the
+//! legacy `repositories` and `dast_targets` collections into the unified
+//! `onboarded_targets` collection, preserving `_id` so every downstream record
+//! keyed by `repo_id` / `target_id` keeps resolving.
+
+pub mod onboarding;

compliance-agent/src/migrate/onboarding.rs

@@ -0,0 +1,406 @@
+//! Backfill: legacy `repositories` + `dast_targets` → `onboarded_targets`.
+//!
+//! The transforms here are **id-preserving**: an [`OnboardedTarget`] keeps the
+//! same `_id` as the `TrackedRepository` / `DastTarget` it came from, so every
+//! downstream collection keyed by that hex id (findings, sbom, scan_runs,
+//! graph, dast_*, pentest_*) keeps resolving with zero row rewrites, and
+//! existing webhook URLs keep working. The mapping functions are pure and unit
+//! tested; the DB orchestration (idempotent per-tenant backfill + revert) is a
+//! thin driver over them.
+
+use compliance_core::models::{
+    Artifact, ArtifactKind, DastTarget, DastTargetType, GitArtifactConfig, IssueTrackerConfig,
+    OnboardedTarget, TargetType, TrackedRepository, WebArtifactConfig,
+};
+use futures_util::TryStreamExt;
+use mongodb::bson::{doc, Document};
+
+use crate::database::Database;
+use crate::error::AgentError;
+
+/// Marker id in `schema_migrations` recording that the backfill has run.
+const MIGRATION_MARKER: &str = "onboarding_backfill_v1";
+
+/// Summary of a backfill run.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct MigrationReport {
+    /// Repositories turned into onboarded targets.
+    pub repos_migrated: u64,
+    /// DAST targets folded into an existing (repo-linked) target as a LiveUrl.
+    pub dast_targets_folded: u64,
+    /// DAST targets with no repo link, migrated as standalone targets.
+    pub dast_targets_standalone: u64,
+    /// Records skipped because a target with that `_id` already existed.
+    pub skipped_existing: u64,
+}
+
+/// Map a legacy `DastTargetType` to a unified [`TargetType`]. REST/GraphQL APIs
+/// are backend services; a browser app is a web app.
+fn target_type_for_dast(kind: &DastTargetType) -> TargetType {
+    match kind {
+        DastTargetType::WebApp => TargetType::WebApp,
+        DastTargetType::RestApi | DastTargetType::GraphQl => TargetType::BackendService,
+    }
+}
+
+/// Build the LiveUrl artifact for a DAST target (its base URL + crawl config +
+/// auth). Shared by fold-in and standalone migration.
+pub fn dast_to_artifact(dast: &DastTarget) -> Artifact {
+    let mut artifact = Artifact::live_url(dast.base_url.clone());
+    artifact.web = Some(WebArtifactConfig {
+        target_kind: dast.target_type.clone(),
+        excluded_paths: dast.excluded_paths.clone(),
+        max_crawl_depth: dast.max_crawl_depth,
+        rate_limit: dast.rate_limit,
+        allow_destructive: dast.allow_destructive,
+    });
+    artifact.auth = dast.auth_config.clone().map(Into::into);
+    artifact
+}
+
+/// Map a `TrackedRepository` to an onboarded target, preserving `_id`. The git
+/// remote becomes a `GitRepo` artifact carrying the repo's branch, watermark,
+/// and auth; tracker config folds into `scan_config`.
+///
+/// `target_type` is a safe default (`BackendService`) — the classifier can
+/// refine it later; `classification` is left `None` (unconfirmed).
+pub fn repo_to_target(repo: &TrackedRepository) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(repo.name.clone(), TargetType::BackendService);
+    target.id = repo.id;
+
+    let mut artifact = Artifact::git_repo(repo.git_url.clone(), repo.default_branch.clone());
+    artifact.git = Some(GitArtifactConfig {
+        default_branch: repo.default_branch.clone(),
+        last_scanned_commit: repo.last_scanned_commit.clone(),
+        local_path: repo.local_path.clone(),
+    });
+    if repo.auth_token.is_some() || repo.auth_username.is_some() {
+        artifact.auth = Some(compliance_core::models::ArtifactAuth {
+            method: "token".to_string(),
+            username: repo.auth_username.clone(),
+            secret: repo.auth_token.clone(),
+            ..Default::default()
+        });
+    }
+    target.artifacts.push(artifact);
+
+    if repo.tracker_type.is_some() {
+        target.scan_config.issue_tracker = Some(IssueTrackerConfig {
+            tracker_type: repo.tracker_type.clone(),
+            owner: repo.tracker_owner.clone(),
+            repo: repo.tracker_repo.clone(),
+            token: repo.tracker_token.clone(),
+        });
+    }
+
+    target.scan_schedule = repo.scan_schedule.clone();
+    target.webhook_enabled = repo.webhook_enabled;
+    target.webhook_secret = repo.webhook_secret.clone();
+    target.findings_count = repo.findings_count;
+    target.created_at = repo.created_at;
+    target.updated_at = repo.updated_at;
+    target
+}
+
+/// Append a DAST target's LiveUrl artifact onto an existing (repo-derived)
+/// target. If the repo default was `BackendService` but the DAST target is a
+/// browser web app, promote the type to `WebApp`.
+pub fn fold_dast_into_target(target: &mut OnboardedTarget, dast: &DastTarget) {
+    if matches!(dast.target_type, DastTargetType::WebApp)
+        && target.target_type == TargetType::BackendService
+    {
+        target.target_type = TargetType::WebApp;
+    }
+    if !target.has(ArtifactKind::LiveUrl) {
+        target.artifacts.push(dast_to_artifact(dast));
+    }
+}
+
+/// Map a repo-less DAST target to a standalone onboarded target, preserving `_id`.
+pub fn dast_to_standalone_target(dast: &DastTarget) -> OnboardedTarget {
+    let mut target =
+        OnboardedTarget::new(dast.name.clone(), target_type_for_dast(&dast.target_type));
+    target.id = dast.id;
+    target.artifacts.push(dast_to_artifact(dast));
+    target.created_at = dast.created_at;
+    target.updated_at = dast.updated_at;
+    target
+}
+
+/// Whether the onboarding backfill has already been applied to this database.
+pub async fn already_applied(db: &Database) -> Result<bool, AgentError> {
+    let found = db
+        .collection_named::<Document>("schema_migrations")
+        .find_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(found.is_some())
+}
+
+/// Backfill `onboarded_targets` from `repositories` + `dast_targets` for one
+/// tenant database.
+///
+/// Id-preserving and **idempotent**: targets that already exist (by `_id`) are
+/// skipped, so re-running is safe. With `dry_run`, computes the report without
+/// writing. The legacy collections are never deleted; the only mutation outside
+/// `onboarded_targets` is the history relink of folded DAST targets, which is
+/// logged so [`revert`] can undo it.
+pub async fn backfill_onboarded_targets(
+    db: &Database,
+    dry_run: bool,
+) -> Result<MigrationReport, AgentError> {
+    let mut report = MigrationReport::default();
+
+    // 1. repositories -> onboarded_targets (preserve _id, skip existing).
+    let mut repos = db.repositories().find(doc! {}).await?;
+    while let Some(repo) = repos.try_next().await? {
+        let Some(id) = repo.id else { continue };
+        if db
+            .onboarded_targets()
+            .find_one(doc! { "_id": id })
+            .await?
+            .is_some()
+        {
+            report.skipped_existing += 1;
+            continue;
+        }
+        if !dry_run {
+            db.onboarded_targets()
+                .insert_one(repo_to_target(&repo))
+                .await?;
+        }
+        report.repos_migrated += 1;
+    }
+
+    // 2. dast_targets -> fold into the linked repo target, or migrate standalone.
+    let mut dasts = db.dast_targets().find(doc! {}).await?;
+    while let Some(dast) = dasts.try_next().await? {
+        let Some(dast_id) = dast.id else { continue };
+        let repo_oid = dast
+            .repo_id
+            .as_deref()
+            .and_then(|r| mongodb::bson::oid::ObjectId::parse_str(r).ok());
+        let linked = match repo_oid {
+            Some(oid) => db.onboarded_targets().find_one(doc! { "_id": oid }).await?,
+            None => None,
+        };
+
+        match (linked, repo_oid) {
+            // Fold into an existing repo-derived target.
+            (Some(mut target), Some(oid)) => {
+                if target.has(ArtifactKind::LiveUrl) {
+                    report.skipped_existing += 1; // already folded on a prior run
+                    continue;
+                }
+                fold_dast_into_target(&mut target, &dast);
+                if !dry_run {
+                    db.onboarded_targets()
+                        .replace_one(doc! { "_id": oid }, &target)
+                        .await?;
+                    relink_history(db, &dast_id.to_hex(), &oid.to_hex()).await?;
+                }
+                report.dast_targets_folded += 1;
+            }
+            // No linked repo target: migrate as a standalone target (keeps _id).
+            _ => {
+                if db
+                    .onboarded_targets()
+                    .find_one(doc! { "_id": dast_id })
+                    .await?
+                    .is_some()
+                {
+                    report.skipped_existing += 1;
+                    continue;
+                }
+                if !dry_run {
+                    db.onboarded_targets()
+                        .insert_one(dast_to_standalone_target(&dast))
+                        .await?;
+                }
+                report.dast_targets_standalone += 1;
+            }
+        }
+    }
+
+    if !dry_run {
+        db.collection_named::<Document>("schema_migrations")
+            .update_one(
+                doc! { "_id": MIGRATION_MARKER },
+                doc! { "$set": { "applied_at": mongodb::bson::DateTime::now() } },
+            )
+            .upsert(true)
+            .await?;
+    }
+    Ok(report)
+}
+
+/// Relink DAST scan runs and pentest sessions from the old DAST target id to the
+/// unified target id, logging each move so [`revert`] can undo it.
+///
+/// Note: if multiple DAST targets fold into the same repo target, revert
+/// restores only the last-logged mapping — a rare edge. The source collections
+/// (`repositories`, `dast_targets`) are never deleted, so no data is lost.
+async fn relink_history(db: &Database, old_id: &str, new_id: &str) -> Result<(), AgentError> {
+    db.dast_scan_runs()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.pentest_sessions()
+        .update_many(
+            doc! { "target_id": old_id },
+            doc! { "$set": { "target_id": new_id } },
+        )
+        .await?;
+    db.collection_named::<Document>("onboarding_migration_log")
+        .insert_one(doc! { "old_target_id": old_id, "new_target_id": new_id })
+        .await?;
+    Ok(())
+}
+
+/// Undo the backfill: replay the relink log in reverse, drop `onboarded_targets`
+/// and the log, and clear the marker. The legacy collections are untouched, so
+/// this restores the pre-migration state.
+pub async fn revert(db: &Database) -> Result<(), AgentError> {
+    let log = db.collection_named::<Document>("onboarding_migration_log");
+    let mut cursor = log.find(doc! {}).await?;
+    while let Some(entry) = cursor.try_next().await? {
+        if let (Ok(old), Ok(new)) = (
+            entry.get_str("old_target_id"),
+            entry.get_str("new_target_id"),
+        ) {
+            db.dast_scan_runs()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+            db.pentest_sessions()
+                .update_many(
+                    doc! { "target_id": new },
+                    doc! { "$set": { "target_id": old } },
+                )
+                .await?;
+        }
+    }
+    db.onboarded_targets().drop().await?;
+    log.drop().await?;
+    db.collection_named::<Document>("schema_migrations")
+        .delete_one(doc! { "_id": MIGRATION_MARKER })
+        .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use compliance_core::models::{DastAuthConfig, TrackerType};
+
+    fn repo() -> TrackedRepository {
+        let mut r = TrackedRepository::new("acme".to_string(), "https://git/acme.git".to_string());
+        r.id = Some(mongodb::bson::oid::ObjectId::new());
+        r.default_branch = "develop".to_string();
+        r.last_scanned_commit = Some("abc123".to_string());
+        r.auth_token = Some("pat".to_string());
+        r.auth_username = Some("bob".to_string());
+        r.tracker_type = Some(TrackerType::Gitea);
+        r.tracker_owner = Some("acme".to_string());
+        r.findings_count = 7;
+        r
+    }
+
+    fn dast(repo_id: Option<String>, kind: DastTargetType) -> DastTarget {
+        let mut d = DastTarget::new(
+            "acme-web".to_string(),
+            "https://acme.example.com".to_string(),
+            kind,
+        );
+        d.id = Some(mongodb::bson::oid::ObjectId::new());
+        d.repo_id = repo_id;
+        d.max_crawl_depth = 5;
+        d.auth_config = Some(DastAuthConfig {
+            method: "bearer".to_string(),
+            login_url: None,
+            username: None,
+            password: None,
+            token: Some("tok".to_string()),
+            headers: None,
+        });
+        d
+    }
+
+    #[test]
+    fn repo_maps_preserving_id_and_git_artifact() {
+        let r = repo();
+        let t = repo_to_target(&r);
+        assert_eq!(t.id, r.id); // id preserved
+        assert_eq!(t.findings_count, 7);
+        assert_eq!(t.scan_schedule, r.scan_schedule);
+        let git = t.code_artifact().expect("git artifact");
+        assert_eq!(git.kind, ArtifactKind::GitRepo);
+        assert_eq!(git.source_ref, "https://git/acme.git");
+        let gc = git.git.as_ref().expect("git config");
+        assert_eq!(gc.default_branch, "develop");
+        assert_eq!(gc.last_scanned_commit.as_deref(), Some("abc123"));
+        let auth = git.auth.as_ref().expect("auth");
+        assert_eq!(auth.secret.as_deref(), Some("pat"));
+        assert_eq!(auth.username.as_deref(), Some("bob"));
+        assert_eq!(
+            t.scan_config
+                .issue_tracker
+                .as_ref()
+                .and_then(|it| it.tracker_type.clone()),
+            Some(TrackerType::Gitea)
+        );
+    }
+
+    #[test]
+    fn standalone_dast_maps_preserving_id_and_live_url() {
+        let d = dast(None, DastTargetType::WebApp);
+        let t = dast_to_standalone_target(&d);
+        assert_eq!(t.id, d.id);
+        assert_eq!(t.target_type, TargetType::WebApp);
+        let url = t.live_url().expect("live url");
+        assert_eq!(url.source_ref, "https://acme.example.com");
+        let web = url.web.as_ref().expect("web config");
+        assert_eq!(web.max_crawl_depth, 5);
+        assert_eq!(
+            url.auth.as_ref().and_then(|a| a.secret.clone()),
+            Some("tok".to_string())
+        );
+    }
+
+    #[test]
+    fn rest_api_dast_maps_to_backend_service() {
+        let d = dast(None, DastTargetType::RestApi);
+        assert_eq!(
+            dast_to_standalone_target(&d).target_type,
+            TargetType::BackendService
+        );
+    }
+
+    #[test]
+    fn fold_adds_live_url_and_promotes_webapp() {
+        let mut t = repo_to_target(&repo());
+        assert_eq!(t.target_type, TargetType::BackendService);
+        fold_dast_into_target(&mut t, &dast(Some("x".to_string()), DastTargetType::WebApp));
+        assert_eq!(t.target_type, TargetType::WebApp); // promoted
+        assert!(t.has(ArtifactKind::LiveUrl));
+        assert!(t.has(ArtifactKind::GitRepo));
+    }
+
+    #[test]
+    fn fold_is_idempotent_on_live_url() {
+        let mut t = repo_to_target(&repo());
+        let d = dast(Some("x".to_string()), DastTargetType::WebApp);
+        fold_dast_into_target(&mut t, &d);
+        fold_dast_into_target(&mut t, &d);
+        let live_urls = t
+            .artifacts
+            .iter()
+            .filter(|a| a.kind == ArtifactKind::LiveUrl)
+            .count();
+        assert_eq!(live_urls, 1);
+    }
+}

compliance-agent/src/pentest/cleanup.rs

@@ -328,6 +328,7 @@ mod tests {
             scan_schedule: String::new(),
             cve_monitor_schedule: String::new(),
             git_clone_base_path: String::new(),
+            artifact_store_base_path: String::new(),
             ssh_key_path: String::new(),
             keycloak_url: None,
             keycloak_realm: None,
@@ -339,6 +340,8 @@ mod tests {
             pentest_imap_tls: true,
             pentest_imap_username: None,
             pentest_imap_password: None,
+            admin_api_token: None,
+            tenant_registry_url: None,
         }
     }
 

compliance-agent/src/pipeline/patterns.rs

@@ -215,7 +215,7 @@ fn scan_with_patterns(
                         repo_id.to_string(),
                         fingerprint,
                         scanner_name.to_string(),
-                        scan_type.clone(),
+                        scan_type,
                         pattern.title.clone(),
                         pattern.description.clone(),
                         pattern.severity.clone(),

compliance-agent/src/scheduler.rs

@@ -4,8 +4,21 @@ use tokio_cron_scheduler::{Job, JobScheduler};
 use compliance_core::models::ScanTrigger;
 
 use crate::agent::ComplianceAgent;
+use crate::database::Database;
 use crate::error::AgentError;
 
+/// Default tenant the scheduler runs against when neither the tenant
+/// registry nor `SCHEDULER_TENANT_IDS` are configured. Matches the
+/// dev-injector default so a bare `cargo run` has the scheduler
+/// scanning whatever lives in `<prefix>_dev`.
+const DEFAULT_SCHEDULER_TENANT_ID: &str = "dev";
+
+/// Request timeout when fetching the live tenant list from the
+/// registry. Kept short — if the registry is slow we'd rather fall
+/// back to env-configured ids and finish the tick than block the
+/// scheduler loop.
+const REGISTRY_FETCH_TIMEOUT_SECS: u64 = 5;
+
 pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError> {
     let sched = JobScheduler::new()
         .await
@@ -18,7 +31,14 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         let agent = scan_agent.clone();
         Box::pin(async move {
             tracing::info!("Scheduled scan triggered");
-            scan_all_repos(&agent).await;
+            let tenants = scheduler_tenants(&agent).await;
+            tracing::debug!(
+                tenant_count = tenants.len(),
+                "Scheduled scan: tenants resolved"
+            );
+            for tenant_id in tenants {
+                scan_all_repos(&agent, &tenant_id).await;
+            }
         })
     })
     .map_err(|e| AgentError::Scheduler(format!("Failed to create scan job: {e}")))?;
@@ -34,7 +54,14 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         let agent = cve_agent.clone();
         Box::pin(async move {
             tracing::info!("CVE monitor triggered");
-            monitor_cves(&agent).await;
+            let tenants = scheduler_tenants(&agent).await;
+            tracing::debug!(
+                tenant_count = tenants.len(),
+                "CVE monitor: tenants resolved"
+            );
+            for tenant_id in tenants {
+                monitor_cves(&agent, &tenant_id).await;
+            }
         })
     })
     .map_err(|e| AgentError::Scheduler(format!("Failed to create CVE monitor job: {e}")))?;
@@ -48,8 +75,14 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
         .await
         .map_err(|e| AgentError::Scheduler(format!("Failed to start scheduler: {e}")))?;
 
+    let tenants = scheduler_tenants(agent).await;
+    let source = if agent.config.tenant_registry_url.is_some() {
+        "tenant-registry (env fallback)"
+    } else {
+        "env (SCHEDULER_TENANT_IDS)"
+    };
     tracing::info!(
-        "Scheduler started: scans='{}', CVE monitor='{}'",
+        "Scheduler started: scans='{}', CVE monitor='{}', tenant source={source}, tenants={tenants:?}",
         agent.config.scan_schedule,
         agent.config.cve_monitor_schedule,
     );
@@ -60,13 +93,205 @@ pub async fn start_scheduler(agent: &ComplianceAgent) -> Result<(), AgentError>
     }
 }
 
-async fn scan_all_repos(agent: &ComplianceAgent) {
+/// Tenants the scheduler iterates each tick.
+///
+/// Resolution order:
+/// 1. **Tenant registry** at `agent.config.tenant_registry_url`
+///    (`GET /v1/tenants`). Fresh on every tick — picks up newly
+///    provisioned tenants without an agent restart.
+/// 2. **`SCHEDULER_TENANT_IDS`** env (comma-separated) — fallback when
+///    the registry is unreachable, the response is malformed, or no
+///    registry URL is configured.
+/// 3. **`DEFAULT_SCHEDULER_TENANT_ID`** (`"dev"`) — last-ditch fallback
+///    so the scheduler keeps doing something useful in dev.
+///
+/// We never panic out of this function — the scheduler must keep
+/// firing even if the registry is offline.
+async fn scheduler_tenants(agent: &ComplianceAgent) -> Vec<String> {
+    if let Some(url) = agent.config.tenant_registry_url.as_deref() {
+        match fetch_tenants_from_registry(&agent.http, url).await {
+            Ok(v) if !v.is_empty() => return v,
+            Ok(_) => {
+                tracing::warn!("tenant-registry returned empty list; falling back to env");
+            }
+            Err(e) => {
+                tracing::warn!(
+                    url = %url,
+                    error = %e,
+                    "tenant-registry fetch failed; falling back to env"
+                );
+            }
+        }
+    }
+    tenants_from_env()
+}
+
+fn tenants_from_env() -> Vec<String> {
+    std::env::var("SCHEDULER_TENANT_IDS")
+        .ok()
+        .map(|s| {
+            s.split(',')
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(String::from)
+                .collect::<Vec<_>>()
+        })
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()])
+}
+
+/// Shape we accept from the registry. Liberal in what we accept:
+/// the registry can return any field shape as long as either `id` or
+/// `tenant_id` is present. Other fields are ignored.
+#[derive(serde::Deserialize)]
+struct RegistryTenant {
+    #[serde(alias = "tenant_id")]
+    id: String,
+    /// Filter out non-running tenants if status is present. Missing
+    /// status defaults to "active" so older registry deployments keep
+    /// working.
+    #[serde(default = "default_status")]
+    status: String,
+}
+
+fn default_status() -> String {
+    "active".to_string()
+}
+
+#[derive(serde::Deserialize)]
+struct RegistryListResponse {
+    data: Vec<RegistryTenant>,
+}
+
+async fn fetch_tenants_from_registry(
+    http: &reqwest::Client,
+    base_url: &str,
+) -> Result<Vec<String>, String> {
+    let url = format!("{}/v1/tenants", base_url.trim_end_matches('/'));
+    let resp = http
+        .get(&url)
+        .timeout(std::time::Duration::from_secs(REGISTRY_FETCH_TIMEOUT_SECS))
+        .send()
+        .await
+        .map_err(|e| format!("request failed: {e}"))?;
+    if !resp.status().is_success() {
+        return Err(format!("registry returned {}", resp.status()));
+    }
+    let body: RegistryListResponse = resp
+        .json()
+        .await
+        .map_err(|e| format!("invalid JSON: {e}"))?;
+    Ok(filter_active(body.data))
+}
+
+/// Frozen/Archived tenants don't need scheduled scans; the M7.1
+/// status gate would 402/410 anyway. Skip them so we don't waste
+/// cycles. Active / trial / demo / anything-else-unknown all run.
+fn filter_active(rows: Vec<RegistryTenant>) -> Vec<String> {
+    rows.into_iter()
+        .filter(|t| !matches!(t.status.as_str(), "frozen" | "archived"))
+        .map(|t| t.id)
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tenant(id: &str, status: &str) -> RegistryTenant {
+        RegistryTenant {
+            id: id.to_string(),
+            status: status.to_string(),
+        }
+    }
+
+    #[test]
+    fn filter_active_keeps_running_skips_frozen_archived() {
+        let rows = vec![
+            tenant("a", "active"),
+            tenant("b", "trial"),
+            tenant("c", "demo"),
+            tenant("d", "frozen"),
+            tenant("e", "archived"),
+            tenant("f", "weird-but-not-known-dead"),
+        ];
+        let out = filter_active(rows);
+        assert_eq!(out, vec!["a", "b", "c", "f"]);
+    }
+
+    #[test]
+    fn deserialize_registry_response_accepts_id_or_tenant_id() {
+        let body = r#"{"data":[
+            {"id":"a","status":"active"},
+            {"tenant_id":"b","status":"trial"},
+            {"id":"c"}
+        ]}"#;
+        let parsed: RegistryListResponse = serde_json::from_str(body).unwrap();
+        assert_eq!(parsed.data.len(), 3);
+        assert_eq!(parsed.data[0].id, "a");
+        assert_eq!(parsed.data[1].id, "b");
+        assert_eq!(parsed.data[2].id, "c");
+        // Default status for the third entry should be "active"
+        assert_eq!(parsed.data[2].status, "active");
+    }
+
+    /// Combined into a single test: cargo runs tests in parallel and
+    /// env vars are process-global, so two separate tests touching
+    /// `SCHEDULER_TENANT_IDS` race each other. Doing both checks in
+    /// one test keeps them in a deterministic order.
+    #[test]
+    fn tenants_from_env_resolution() {
+        std::env::remove_var("SCHEDULER_TENANT_IDS");
+        assert_eq!(
+            tenants_from_env(),
+            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
+            "unset → default"
+        );
+
+        std::env::set_var("SCHEDULER_TENANT_IDS", "acme, globex ,,hello");
+        let out = tenants_from_env();
+        std::env::remove_var("SCHEDULER_TENANT_IDS");
+        assert_eq!(
+            out,
+            vec!["acme", "globex", "hello"],
+            "splits + trims + drops empty"
+        );
+
+        std::env::set_var("SCHEDULER_TENANT_IDS", "");
+        let out = tenants_from_env();
+        std::env::remove_var("SCHEDULER_TENANT_IDS");
+        assert_eq!(
+            out,
+            vec![DEFAULT_SCHEDULER_TENANT_ID.to_string()],
+            "empty → default"
+        );
+    }
+}
+
+/// Resolve the per-tenant database. Logs and returns `None` on failure
+/// so the loop in the caller can continue with other tenants.
+async fn tenant_db(agent: &ComplianceAgent, tenant_id: &str) -> Option<Database> {
+    match agent.db_pool.for_tenant_id(tenant_id).await {
+        Ok(db) => Some(db),
+        Err(e) => {
+            tracing::error!("Scheduler: cannot open tenant database '{tenant_id}': {e}");
+            None
+        }
+    }
+}
+
+async fn scan_all_repos(agent: &ComplianceAgent, tenant_id: &str) {
     use futures_util::StreamExt;
 
-    let cursor = match agent.db.repositories().find(doc! {}).await {
+    let db = match tenant_db(agent, tenant_id).await {
+        Some(db) => db,
+        None => return,
+    };
+
+    let cursor = match db.repositories().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("Failed to list repos for scheduled scan: {e}");
+            tracing::error!("Failed to list repos for tenant '{tenant_id}': {e}");
             return;
         }
     };
@@ -75,33 +300,44 @@ async fn scan_all_repos(agent: &ComplianceAgent) {
 
     for repo in repos {
         let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
-        if let Err(e) = agent.run_scan(&repo_id, ScanTrigger::Scheduled).await {
+        if let Err(e) = agent
-            tracing::error!("Scheduled scan failed for {}: {e}", repo.name);
+            .run_scan(tenant_id, &repo_id, ScanTrigger::Scheduled)
+            .await
+        {
+            tracing::error!(
+                "Scheduled scan failed for {} (tenant '{tenant_id}'): {e}",
+                repo.name
+            );
         }
     }
 }
 
-async fn monitor_cves(agent: &ComplianceAgent) {
+async fn monitor_cves(agent: &ComplianceAgent, tenant_id: &str) {
     use compliance_core::models::notification::{parse_severity, CveNotification};
     use compliance_core::models::SbomEntry;
     use futures_util::StreamExt;
 
+    let db = match tenant_db(agent, tenant_id).await {
+        Some(db) => db,
+        None => return,
+    };
+
     // Fetch all SBOM entries grouped by repo
-    let cursor = match agent.db.sbom_entries().find(doc! {}).await {
+    let cursor = match db.sbom_entries().find(doc! {}).await {
         Ok(c) => c,
         Err(e) => {
-            tracing::error!("CVE monitor: failed to list SBOM entries: {e}");
+            tracing::error!("CVE monitor: failed to list SBOM entries for '{tenant_id}': {e}");
             return;
         }
     };
     let entries: Vec<SbomEntry> = cursor.filter_map(|r| async { r.ok() }).collect().await;
     if entries.is_empty() {
-        tracing::debug!("CVE monitor: no SBOM entries, skipping");
+        tracing::debug!("CVE monitor: no SBOM entries for tenant '{tenant_id}', skipping");
         return;
     }
 
     tracing::info!(
-        "CVE monitor: checking {} dependencies for new CVEs",
+        "CVE monitor: checking {} dependencies for new CVEs (tenant '{tenant_id}')",
         entries.len()
     );
 
@@ -112,7 +348,7 @@ async fn monitor_cves(agent: &ComplianceAgent) {
         std::collections::HashMap::new();
     for rid in &repo_ids {
         if let Ok(oid) = mongodb::bson::oid::ObjectId::parse_str(rid) {
-            if let Ok(Some(repo)) = agent.db.repositories().find_one(doc! { "_id": oid }).await {
+            if let Ok(Some(repo)) = db.repositories().find_one(doc! { "_id": oid }).await {
                 repo_names.insert(rid.clone(), repo.name.clone());
             }
         }
@@ -160,8 +396,7 @@ async fn monitor_cves(agent: &ComplianceAgent) {
         for alert in &alerts {
             let filter = doc! { "cve_id": &alert.cve_id, "repo_id": &alert.repo_id };
             let update = doc! { "$setOnInsert": mongodb::bson::to_bson(alert).unwrap_or_default() };
-            let _ = agent
+            let _ = db
-                .db
                 .cve_alerts()
                 .update_one(filter, update)
                 .upsert(true)
@@ -174,8 +409,7 @@ async fn monitor_cves(agent: &ComplianceAgent) {
                 continue;
             }
             if let Some(entry_id) = &entry.id {
-                let _ = agent
+                let _ = db
-                    .db
                     .sbom_entries()
                     .update_one(
                         doc! { "_id": entry_id },
@@ -213,8 +447,7 @@ async fn monitor_cves(agent: &ComplianceAgent) {
             let update = doc! {
                 "$setOnInsert": mongodb::bson::to_bson(&notification).unwrap_or_default()
             };
-            match agent
+            match db
-                .db
                 .cve_notifications()
                 .update_one(filter, update)
                 .upsert(true)
@@ -232,8 +465,10 @@ async fn monitor_cves(agent: &ComplianceAgent) {
     }
 
     if new_notifications > 0 {
-        tracing::info!("CVE monitor: created {new_notifications} new notification(s)");
+        tracing::info!(
+            "CVE monitor: created {new_notifications} new notification(s) for tenant '{tenant_id}'"
+        );
     } else {
-        tracing::info!("CVE monitor: no new CVEs found");
+        tracing::info!("CVE monitor: no new CVEs found for tenant '{tenant_id}'");
     }
 }

compliance-agent/src/webhooks/gitea.rs

@@ -14,24 +14,30 @@ type HmacSha256 = Hmac<Sha256>;
 
 pub async fn handle_gitea_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path(repo_id): Path<String>,
+    Path((tenant_id, repo_id)): Path<(String, String)>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo to get its webhook secret
+    // Look up the repo in the tenant's database to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let repo = match agent
+    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
-        .db
+        Ok(db) => db,
+        Err(e) => {
+            tracing::warn!("Gitea webhook: cannot open tenant database '{tenant_id}': {e}");
+            return StatusCode::NOT_FOUND;
+        }
+    };
+    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("Gitea webhook: repo {repo_id} not found");
+            tracing::warn!("Gitea webhook: repo {repo_id} not found in tenant '{tenant_id}'");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -66,15 +72,21 @@ pub async fn handle_gitea_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
+            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!("Gitea push webhook: triggering scan for {repo_id}");
+                tracing::info!(
-                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
+                    "Gitea push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                );
+                if let Err(e) = agent_clone
+                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
+                    .await
+                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "pull_request" => handle_pull_request(agent, &repo_id, &payload).await,
+        "pull_request" => handle_pull_request(agent, &tenant_id, &repo_id, &payload).await,
         _ => {
             tracing::debug!("Gitea webhook: ignoring event '{event}'");
             StatusCode::OK
@@ -84,6 +96,7 @@ pub async fn handle_gitea_webhook(
 
 async fn handle_pull_request(
     agent: Arc<ComplianceAgent>,
+    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -106,13 +119,14 @@ async fn handle_pull_request(
     }
 
     let repo_id = repo_id.to_string();
+    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("Gitea PR webhook: reviewing PR #{pr_number} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&repo_id, pr_number, &base_sha, &head_sha)
+            .run_pr_review(&tenant_id, &repo_id, pr_number, &base_sha, &head_sha)
             .await
         {
             tracing::error!("PR review failed for #{pr_number}: {e}");

compliance-agent/src/webhooks/github.rs

@@ -14,24 +14,30 @@ type HmacSha256 = Hmac<Sha256>;
 
 pub async fn handle_github_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path(repo_id): Path<String>,
+    Path((tenant_id, repo_id)): Path<(String, String)>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo to get its webhook secret
+    // Look up the repo in the tenant's database to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let repo = match agent
+    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
-        .db
+        Ok(db) => db,
+        Err(e) => {
+            tracing::warn!("GitHub webhook: cannot open tenant database '{tenant_id}': {e}");
+            return StatusCode::NOT_FOUND;
+        }
+    };
+    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("GitHub webhook: repo {repo_id} not found");
+            tracing::warn!("GitHub webhook: repo {repo_id} not found in tenant '{tenant_id}'");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -66,15 +72,21 @@ pub async fn handle_github_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
+            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!("GitHub push webhook: triggering scan for {repo_id}");
+                tracing::info!(
-                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
+                    "GitHub push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                );
+                if let Err(e) = agent_clone
+                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
+                    .await
+                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "pull_request" => handle_pull_request(agent, &repo_id, &payload).await,
+        "pull_request" => handle_pull_request(agent, &tenant_id, &repo_id, &payload).await,
         _ => {
             tracing::debug!("GitHub webhook: ignoring event '{event}'");
             StatusCode::OK
@@ -84,6 +96,7 @@ pub async fn handle_github_webhook(
 
 async fn handle_pull_request(
     agent: Arc<ComplianceAgent>,
+    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -105,13 +118,14 @@ async fn handle_pull_request(
     }
 
     let repo_id = repo_id.to_string();
+    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("GitHub PR webhook: reviewing PR #{pr_number} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&repo_id, pr_number, &base_sha, &head_sha)
+            .run_pr_review(&tenant_id, &repo_id, pr_number, &base_sha, &head_sha)
             .await
         {
             tracing::error!("PR review failed for #{pr_number}: {e}");

compliance-agent/src/webhooks/gitlab.rs

@@ -10,24 +10,30 @@ use crate::agent::ComplianceAgent;
 
 pub async fn handle_gitlab_webhook(
     Extension(agent): Extension<Arc<ComplianceAgent>>,
-    Path(repo_id): Path<String>,
+    Path((tenant_id, repo_id)): Path<(String, String)>,
     headers: HeaderMap,
     body: Bytes,
 ) -> StatusCode {
-    // Look up the repo to get its webhook secret
+    // Look up the repo in the tenant's database to get its webhook secret
     let oid = match mongodb::bson::oid::ObjectId::parse_str(&repo_id) {
         Ok(oid) => oid,
         Err(_) => return StatusCode::NOT_FOUND,
     };
-    let repo = match agent
+    let db = match agent.db_pool.for_tenant_id(&tenant_id).await {
-        .db
+        Ok(db) => db,
+        Err(e) => {
+            tracing::warn!("GitLab webhook: cannot open tenant database '{tenant_id}': {e}");
+            return StatusCode::NOT_FOUND;
+        }
+    };
+    let repo = match db
         .repositories()
         .find_one(mongodb::bson::doc! { "_id": oid })
         .await
     {
         Ok(Some(repo)) => repo,
         _ => {
-            tracing::warn!("GitLab webhook: repo {repo_id} not found");
+            tracing::warn!("GitLab webhook: repo {repo_id} not found in tenant '{tenant_id}'");
             return StatusCode::NOT_FOUND;
         }
     };
@@ -59,15 +65,21 @@ pub async fn handle_gitlab_webhook(
         "push" => {
             let agent_clone = (*agent).clone();
             let repo_id = repo_id.clone();
+            let tenant_id = tenant_id.clone();
             tokio::spawn(async move {
-                tracing::info!("GitLab push webhook: triggering scan for {repo_id}");
+                tracing::info!(
-                if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
+                    "GitLab push webhook: triggering scan for {repo_id} in tenant {tenant_id}"
+                );
+                if let Err(e) = agent_clone
+                    .run_scan(&tenant_id, &repo_id, ScanTrigger::Webhook)
+                    .await
+                {
                     tracing::error!("Webhook-triggered scan failed: {e}");
                 }
             });
             StatusCode::OK
         }
-        "merge_request" => handle_merge_request(agent, &repo_id, &payload).await,
+        "merge_request" => handle_merge_request(agent, &tenant_id, &repo_id, &payload).await,
         _ => {
             tracing::debug!("GitLab webhook: ignoring event '{event_type}'");
             StatusCode::OK
@@ -77,6 +89,7 @@ pub async fn handle_gitlab_webhook(
 
 async fn handle_merge_request(
     agent: Arc<ComplianceAgent>,
+    tenant_id: &str,
     repo_id: &str,
     payload: &serde_json::Value,
 ) -> StatusCode {
@@ -101,13 +114,14 @@ async fn handle_merge_request(
     }
 
     let repo_id = repo_id.to_string();
+    let tenant_id = tenant_id.to_string();
     let head_sha = head_sha.to_string();
     let base_sha = base_sha.to_string();
     let agent_clone = (*agent).clone();
     tokio::spawn(async move {
         tracing::info!("GitLab MR webhook: reviewing MR !{mr_iid} on {repo_id}");
         if let Err(e) = agent_clone
-            .run_pr_review(&repo_id, mr_iid, &base_sha, &head_sha)
+            .run_pr_review(&tenant_id, &repo_id, mr_iid, &base_sha, &head_sha)
             .await
         {
             tracing::error!("MR review failed for !{mr_iid}: {e}");

compliance-agent/src/webhooks/server.rs

@@ -9,17 +9,21 @@ use crate::webhooks::{gitea, github, gitlab};
 
 pub async fn start_webhook_server(agent: &ComplianceAgent) -> Result<(), AgentError> {
     let app = Router::new()
-        // Per-repo webhook URLs: /webhook/{platform}/{repo_id}
+        // Per-tenant per-repo webhook URLs: /webhook/{tenant_id}/{platform}/{repo_id}
+        // The tenant_id is resolved from the URL path because webhooks
+        // arrive without a JWT — they're authenticated via per-repo HMAC,
+        // not via the tenant gate. The dashboard surfaces the full URL
+        // including the tenant_id when the repo is registered.
         .route(
-            "/webhook/github/{repo_id}",
+            "/webhook/{tenant_id}/github/{repo_id}",
             post(github::handle_github_webhook),
         )
         .route(
-            "/webhook/gitlab/{repo_id}",
+            "/webhook/{tenant_id}/gitlab/{repo_id}",
             post(gitlab::handle_gitlab_webhook),
         )
         .route(
-            "/webhook/gitea/{repo_id}",
+            "/webhook/{tenant_id}/gitea/{repo_id}",
             post(gitea::handle_gitea_webhook),
         )
         .layer(Extension(Arc::new(agent.clone())));

compliance-agent/tests/common/mod.rs

@@ -7,7 +7,7 @@ use std::sync::Arc;
 
 use compliance_agent::agent::ComplianceAgent;
 use compliance_agent::api;
-use compliance_agent::database::Database;
+use compliance_agent::database::DatabasePool;
 use compliance_core::AgentConfig;
 use secrecy::SecretString;
 
@@ -28,10 +28,9 @@ impl TestServer {
         // Unique database name per test run to avoid collisions
         let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
 
-        let db = Database::connect(&mongodb_uri, &db_name)
+        let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await
-            .expect("Failed to connect to MongoDB — is it running?");
+            .expect("Failed to build DatabasePool");
-        db.ensure_indexes().await.expect("Failed to create indexes");
 
         let config = AgentConfig {
             mongodb_uri: mongodb_uri.clone(),
@@ -45,6 +44,7 @@ impl TestServer {
             scan_schedule: String::new(),
             cve_monitor_schedule: String::new(),
             git_clone_base_path: "/tmp/compliance-scanner-tests/repos".into(),
+            artifact_store_base_path: "/tmp/compliance-scanner-tests/artifacts".into(),
             ssh_key_path: "/tmp/compliance-scanner-tests/ssh/id_ed25519".into(),
             github_token: None,
             github_webhook_secret: None,
@@ -67,13 +67,19 @@ impl TestServer {
             pentest_imap_tls: false,
             pentest_imap_username: None,
             pentest_imap_password: None,
+            admin_api_token: None,
+            tenant_registry_url: None,
         };
 
-        let agent = ComplianceAgent::new(config, db);
+        let agent = ComplianceAgent::new(config, db_pool);
 
-        // Build the router with the agent extension
+        // Build the router with the agent extension. After M7.2-B every
+        // handler takes a TenantCtx extractor; without KC in the test
+        // harness, the dev-tenant injector mounts a synthetic context so
+        // tests run end-to-end against `<db_name>_dev`.
         let app = api::routes::build_router()
             .layer(axum::extract::Extension(Arc::new(agent)))
+            .layer(axum::middleware::from_fn(api::server::inject_dev_tenant))
             .layer(tower_http::cors::CorsLayer::permissive());
 
         // Bind to port 0 to get a random available port
@@ -156,10 +162,19 @@ impl TestServer {
         &self.db_name
     }
 
-    /// Drop the test database on cleanup
+    /// Drop every per-tenant database belonging to this test run.
+    /// Post-M7.2-D the agent never opens a `db_name` directly —
+    /// data lives only in `<db_name>_<tenant>` per-tenant databases.
     pub async fn cleanup(&self) {
         if let Ok(client) = mongodb::Client::with_uri_str(&self.mongodb_uri).await {
-            client.database(&self.db_name).drop().await.ok();
+            if let Ok(names) = client.list_database_names().await {
+                let prefix = format!("{}_", self.db_name);
+                for name in names {
+                    if name.starts_with(&prefix) {
+                        client.database(&name).drop().await.ok();
+                    }
+                }
+            }
         }
     }
 }

compliance-agent/tests/integration/migration.rs

@@ -0,0 +1,156 @@
+// Integration tests for the onboarding backfill migration.
+//
+// Requires MongoDB (set TEST_MONGODB_URI if not at the default).
+// Not run in CI (which is `--lib` only) — run locally:
+//   cargo test -p compliance-agent --test e2e migration
+
+use compliance_agent::database::{Database, DatabasePool};
+use compliance_agent::migrate::onboarding;
+use compliance_core::models::{
+    ArtifactKind, DastTarget, DastTargetType, TargetType, TrackedRepository,
+};
+use mongodb::bson::{doc, Document};
+
+async fn fresh_db() -> (DatabasePool, String, Database) {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    // Prefix must fit the pool's 30-char cap (`<prefix>_<32 hex>` <= 63).
+    let prefix = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
+    let pool = DatabasePool::connect(&uri, &prefix)
+        .await
+        .expect("connect mongo");
+    let db = pool.for_tenant_id("t1").await.expect("tenant db");
+    (pool, prefix, db)
+}
+
+async fn cleanup(pool: &DatabasePool, prefix: &str) {
+    if let Ok(names) = pool.client().list_database_names().await {
+        for n in names {
+            if n.starts_with(prefix) {
+                pool.client().database(&n).drop().await.ok();
+            }
+        }
+    }
+}
+
+#[tokio::test]
+async fn backfill_folds_relinks_is_idempotent_and_reversible() {
+    let (pool, prefix, db) = fresh_db().await;
+
+    // Seed a repo.
+    let repo = TrackedRepository::new("acme".into(), "https://git/acme.git".into());
+    let repo_id = db
+        .repositories()
+        .insert_one(repo)
+        .await
+        .expect("insert repo")
+        .inserted_id
+        .as_object_id()
+        .expect("repo oid");
+
+    // A DAST target linked to the repo (folds + promotes to WebApp + relinks).
+    let mut linked = DastTarget::new(
+        "acme-web".into(),
+        "https://acme.example.com".into(),
+        DastTargetType::WebApp,
+    );
+    linked.repo_id = Some(repo_id.to_hex());
+    let linked_id = db
+        .dast_targets()
+        .insert_one(linked)
+        .await
+        .expect("insert linked dast")
+        .inserted_id
+        .as_object_id()
+        .expect("linked oid");
+
+    // A repo-less DAST target (standalone).
+    let standalone = DastTarget::new(
+        "acme-api".into(),
+        "https://api.acme.com".into(),
+        DastTargetType::RestApi,
+    );
+    let standalone_id = db
+        .dast_targets()
+        .insert_one(standalone)
+        .await
+        .expect("insert standalone dast")
+        .inserted_id
+        .as_object_id()
+        .expect("standalone oid");
+
+    // A DAST scan run pointing at the linked target — should be relinked to the repo.
+    db.collection_named::<Document>("dast_scan_runs")
+        .insert_one(doc! { "target_id": linked_id.to_hex(), "status": "completed" })
+        .await
+        .expect("insert dast run");
+
+    // --- Backfill ---
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+    let report = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill");
+    assert_eq!(report.repos_migrated, 1);
+    assert_eq!(report.dast_targets_folded, 1);
+    assert_eq!(report.dast_targets_standalone, 1);
+    assert!(onboarding::already_applied(&db).await.unwrap());
+
+    // Repo target: preserved _id, has git + folded live-url, promoted to WebApp.
+    let repo_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": repo_id })
+        .await
+        .unwrap()
+        .expect("repo target");
+    assert!(repo_target.has(ArtifactKind::GitRepo));
+    assert!(repo_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(repo_target.target_type, TargetType::WebApp);
+
+    // Standalone target: preserved _id, live-url, backend service.
+    let standalone_target = db
+        .onboarded_targets()
+        .find_one(doc! { "_id": standalone_id })
+        .await
+        .unwrap()
+        .expect("standalone target");
+    assert!(standalone_target.has(ArtifactKind::LiveUrl));
+    assert_eq!(standalone_target.target_type, TargetType::BackendService);
+
+    // The DAST run was relinked from the old dast id to the repo (unified) id.
+    let run = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run.get_str("target_id").unwrap(), repo_id.to_hex());
+
+    // --- Idempotent: re-run migrates nothing new ---
+    let again = onboarding::backfill_onboarded_targets(&db, false)
+        .await
+        .expect("backfill again");
+    assert_eq!(again.repos_migrated, 0);
+    assert_eq!(again.dast_targets_folded, 0);
+    assert_eq!(again.dast_targets_standalone, 0);
+    assert!(again.skipped_existing >= 2);
+
+    // --- Revert: onboarded targets gone, relink undone, marker cleared ---
+    onboarding::revert(&db).await.expect("revert");
+    assert_eq!(
+        db.onboarded_targets()
+            .count_documents(doc! {})
+            .await
+            .unwrap(),
+        0
+    );
+    let run_after = db
+        .collection_named::<Document>("dast_scan_runs")
+        .find_one(doc! {})
+        .await
+        .unwrap()
+        .expect("run");
+    assert_eq!(run_after.get_str("target_id").unwrap(), linked_id.to_hex());
+    assert!(!onboarding::already_applied(&db).await.unwrap());
+
+    cleanup(&pool, &prefix).await;
+}

compliance-agent/tests/integration/mod.rs

@@ -7,3 +7,4 @@
 // Or nightly: (via CI with MongoDB service container)
 
 mod api;
+mod migration;

compliance-agent/tests/tenant_isolation.rs

@@ -0,0 +1,298 @@
+//! M7.2-A — `DatabasePool` isolation proof.
+//!
+//! Two `TenantContext`s, two databases, one client. Insert on A, query
+//! on B → empty. Insert on B, query on A → only A's docs. Proves that
+//! the per-tenant database split actually isolates at the driver level
+//! and not at "we hope we filter."
+//!
+//! Requires MongoDB. Set `TEST_MONGODB_URI` to override the default
+//! `mongodb://root:example@localhost:27017/?authSource=admin`.
+
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use compliance_agent::database::DatabasePool;
+use compliance_core::models::TrackedRepository;
+use compliance_core::{OrgRole, TenantContext, TenantStatus};
+use mongodb::bson::doc;
+
+fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
+    TenantContext {
+        tenant_id: tenant_id.to_string(),
+        tenant_slug: slug.to_string(),
+        org_roles: vec![OrgRole::ItAdmin],
+        products: vec!["compliance-scanner".to_string()],
+        plan: "starter".to_string(),
+        status: TenantStatus::Active,
+        user_id: "u-1".to_string(),
+        user_name: None,
+    }
+}
+
+fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
+    TrackedRepository {
+        id: None,
+        name: name.to_string(),
+        git_url: git_url.to_string(),
+        default_branch: "main".to_string(),
+        local_path: None,
+        scan_schedule: None,
+        webhook_enabled: false,
+        webhook_secret: None,
+        tracker_type: None,
+        tracker_owner: None,
+        tracker_repo: None,
+        tracker_token: None,
+        auth_token: None,
+        auth_username: None,
+        last_scanned_commit: None,
+        findings_count: 0,
+        created_at: chrono::Utc::now(),
+        updated_at: chrono::Utc::now(),
+    }
+}
+
+#[tokio::test]
+async fn pool_isolates_tenants_at_driver_level() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    // Unique per run so parallel test invocations don't collide. Kept
+    // short because Mongo caps db names at 63 bytes (prefix + tenant_id).
+    let prefix = format!("m72a_{}", short_id());
+
+    let pool = DatabasePool::connect(&uri, &prefix)
+        .await
+        .expect("Failed to connect to MongoDB — is it running?");
+
+    let acme = ctx("00000000-0000-0000-0000-00000000acme", "acme");
+    let globex = ctx("00000000-0000-0000-0000-0000globex000", "globex");
+
+    let acme_db = pool.for_tenant(&acme).await.expect("acme db");
+    let globex_db = pool.for_tenant(&globex).await.expect("globex db");
+
+    // Write distinct repos into each tenant's database.
+    acme_db
+        .repositories()
+        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
+        .await
+        .expect("insert acme");
+    globex_db
+        .repositories()
+        .insert_one(fixture_repo(
+            "globex-platform",
+            "git@example.com:globex/platform.git",
+        ))
+        .await
+        .expect("insert globex");
+
+    // The point of the whole exercise: acme can ONLY see acme's repo
+    // and globex can ONLY see globex's, with no filter doc anywhere
+    // because the isolation is at the database handle, not in the query.
+    let acme_seen = collect(&acme_db).await;
+    let globex_seen = collect(&globex_db).await;
+
+    assert_eq!(acme_seen.len(), 1, "acme should see exactly its own repo");
+    assert_eq!(acme_seen[0].name, "acme-app");
+    assert_eq!(
+        globex_seen.len(),
+        1,
+        "globex should see exactly its own repo"
+    );
+    assert_eq!(globex_seen[0].name, "globex-platform");
+
+    // Sanity: the two databases really are different by name.
+    let acme_db_name = pool.tenant_db_name(&acme.tenant_id);
+    let globex_db_name = pool.tenant_db_name(&globex.tenant_id);
+    assert_ne!(acme_db_name, globex_db_name);
+    assert!(acme_db_name.starts_with(&prefix));
+
+    // Cleanup — drop both per-tenant databases.
+    pool.client()
+        .database(&acme_db_name)
+        .drop()
+        .await
+        .expect("drop acme");
+    pool.client()
+        .database(&globex_db_name)
+        .drop()
+        .await
+        .expect("drop globex");
+}
+
+#[tokio::test]
+async fn for_tenant_is_idempotent_index_creation() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let prefix = format!("m72a_{}", short_id());
+    let pool = DatabasePool::connect(&uri, &prefix).await.expect("connect");
+
+    let acme = ctx("00000000-0000-0000-0000-00000000acme", "acme");
+
+    // Second call must not fail (ensure_indexes already ran, in-memory
+    // marker is set, Mongo's createIndex is idempotent by name anyway).
+    let _ = pool.for_tenant(&acme).await.expect("first call");
+    let _ = pool.for_tenant(&acme).await.expect("second call");
+    let _ = pool.for_tenant(&acme).await.expect("third call");
+
+    // Cleanup
+    let db_name = pool.tenant_db_name(&acme.tenant_id);
+    pool.client().database(&db_name).drop().await.expect("drop");
+}
+
+#[tokio::test]
+async fn tenant_db_name_sanitizes_unsafe_characters() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let pool = DatabasePool::connect(&uri, "m72a_sanitize")
+        .await
+        .expect("connect");
+
+    // Mongo db names cannot contain `/ \ . " $ <space> NUL`. The pool
+    // must rewrite these without exploding on connect.
+    let funky = "te/n.a\\nt$id\" with spaces";
+    let name = pool.tenant_db_name(funky);
+    for c in ['/', '\\', '.', '"', '$', ' '] {
+        assert!(
+            !name.contains(c),
+            "sanitized db name still contains {c:?}: {name}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn admin_helpers_list_and_drop_tenant_dbs() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let prefix = format!("m72d_{}", short_id());
+    let pool = DatabasePool::connect(&uri, &prefix).await.expect("connect");
+
+    let acme = ctx("00000000-0000-0000-0000-00000000acme", "acme");
+    let globex = ctx("00000000-0000-0000-0000-0000globex000", "globex");
+
+    // Provision two tenants and write a doc into each so the databases
+    // actually materialize on the cluster (Mongo lazily creates DBs).
+    let acme_db = pool.for_tenant(&acme).await.expect("acme db");
+    let globex_db = pool.for_tenant(&globex).await.expect("globex db");
+    acme_db
+        .repositories()
+        .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
+        .await
+        .expect("insert acme");
+    globex_db
+        .repositories()
+        .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
+        .await
+        .expect("insert globex");
+
+    // list_tenant_db_names sees both, filtered by prefix
+    let names = pool.list_tenant_db_names().await.expect("list tenants");
+    let acme_name = pool.tenant_db_name(&acme.tenant_id);
+    let globex_name = pool.tenant_db_name(&globex.tenant_id);
+    assert!(
+        names.contains(&acme_name),
+        "expected {acme_name} in {names:?}"
+    );
+    assert!(
+        names.contains(&globex_name),
+        "expected {globex_name} in {names:?}"
+    );
+    for name in &names {
+        assert!(name.starts_with(&format!("{prefix}_")));
+    }
+
+    // drop_tenant removes acme's DB
+    pool.drop_tenant(&acme.tenant_id)
+        .await
+        .expect("drop acme tenant");
+    let after = pool
+        .list_tenant_db_names()
+        .await
+        .expect("list tenants after drop");
+    assert!(
+        !after.contains(&acme_name),
+        "acme should be gone after drop, got {after:?}"
+    );
+    assert!(
+        after.contains(&globex_name),
+        "globex should still be present, got {after:?}"
+    );
+
+    // Cleanup remaining
+    pool.drop_tenant(&globex.tenant_id)
+        .await
+        .expect("drop globex tenant");
+}
+
+#[tokio::test]
+async fn tenant_db_name_falls_back_to_hash_when_too_long() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+    let pool = DatabasePool::connect(&uri, "m72a_long")
+        .await
+        .expect("connect");
+
+    // 100-byte tenant_id would overflow the 63-byte db-name cap with
+    // any reasonable prefix. The pool must hash it down.
+    let huge = "x".repeat(100);
+    let name = pool.tenant_db_name(&huge);
+    assert!(name.len() <= 63, "hashed name should fit: {name}");
+    assert!(name.starts_with("m72a_long_"));
+    // The hash suffix is 32 hex chars (16-byte SHA-256 truncation).
+    let suffix = name.trim_start_matches("m72a_long_");
+    assert_eq!(
+        suffix.len(),
+        32,
+        "expected 32-hex suffix (16-byte hash), got {suffix:?}"
+    );
+    assert!(suffix.chars().all(|c| c.is_ascii_hexdigit()));
+
+    // Stable: same input → same output.
+    assert_eq!(name, pool.tenant_db_name(&huge));
+
+    // Different inputs → different outputs (collision check on a tiny
+    // sample — full birthday-resistance is a proof not a test).
+    let huge2 = "y".repeat(100);
+    assert_ne!(pool.tenant_db_name(&huge), pool.tenant_db_name(&huge2));
+}
+
+#[tokio::test]
+async fn connect_rejects_overlong_db_prefix() {
+    let uri = std::env::var("TEST_MONGODB_URI")
+        .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
+
+    // MAX_PREFIX_LEN is 30 (= 63 - 1 - 32). A 31-char prefix MUST be
+    // rejected at construction so the hash-fallback path can never
+    // produce an over-long db name at runtime.
+    let too_long = "a".repeat(31);
+    let err = DatabasePool::connect(&uri, &too_long).await.unwrap_err();
+    let msg = format!("{err}");
+    assert!(
+        msg.contains("max is 30") || msg.contains(&too_long),
+        "error should explain the cap: {msg}"
+    );
+
+    // Exactly 30 chars is the inclusive bound — must succeed.
+    let just_right = "a".repeat(30);
+    let _ = DatabasePool::connect(&uri, &just_right)
+        .await
+        .expect("30-char prefix should be accepted");
+}
+
+/// Short UUID slug for keeping test prefixes well under Mongo's 63-byte
+/// db-name cap.
+fn short_id() -> String {
+    uuid::Uuid::new_v4().simple().to_string()[..8].to_string()
+}
+
+/// Drain a `repositories` find cursor on the given tenant database.
+async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
+    let mut cursor = db
+        .repositories()
+        .find(doc! {})
+        .await
+        .expect("find repositories");
+    let mut out = Vec::new();
+    while cursor.advance().await.expect("advance") {
+        out.push(cursor.deserialize_current().expect("deserialize"));
+    }
+    out
+}

compliance-agent/tests/tenant_status_middleware.rs

@@ -1,4 +1,4 @@
-//! M7.1 — integration tests for `require_tenant_status`.
+//! M7.1 — integration tests for `compliance_core::auth::require_tenant_status`.
 //!
 //! Exercises the middleware end-to-end through an Axum router so we
 //! catch wiring bugs (extension propagation, method matching) that pure
@@ -15,8 +15,7 @@ use axum::{
     routing::{get, post},
     Router,
 };
-use compliance_agent::api::auth_middleware::require_tenant_status;
+use compliance_core::{auth::require_tenant_status, TenantContext, TenantStatus};
-use compliance_core::{TenantContext, TenantStatus};
 use tower::ServiceExt;
 
 fn ctx_with(status: TenantStatus) -> TenantContext {

compliance-core/Cargo.toml

@@ -18,6 +18,15 @@ telemetry = [
     "dep:tracing-subscriber",
     "dep:tracing",
 ]
+# Pulls in the M7.1 Axum middleware + extractor. Consumers that don't
+# embed an HTTP server (e.g. the wasm dashboard frontend) leave it off.
+axum = [
+    "dep:axum",
+    "dep:jsonwebtoken",
+    "dep:reqwest",
+    "dep:tokio",
+    "dep:tracing",
+]
 
 [dependencies]
 serde = { workspace = true }
@@ -37,3 +46,7 @@ opentelemetry-appender-tracing = { version = "0.29", optional = true }
 tracing-opentelemetry = { version = "0.30", optional = true }
 tracing-subscriber = { workspace = true, optional = true }
 tracing = { workspace = true, optional = true }
+axum = { version = "0.8", optional = true }
+jsonwebtoken = { version = "9", optional = true }
+reqwest = { workspace = true, optional = true }
+tokio = { workspace = true, optional = true }

compliance-core/src/auth.rs

@@ -1,9 +1,9 @@
 //! M7.1 — JWT validation + tenant context propagation.
 //!
 //! `require_jwt_auth` validates a Bearer JWT against Keycloak's JWKS and
-//! attaches a `TenantContext` to the request extensions. Downstream
+//! attaches a [`TenantContext`] to the request extensions. Downstream
-//! middleware (`require_tenant_status`) and Axum extractors (`TenantCtx`)
+//! middleware ([`require_tenant_status`]) and Axum extractors
-//! read it from there.
+//! ([`crate::tenant_ctx::TenantCtx`]) read it from there.
 //!
 //! Skipped paths:
 //! * `/api/v1/health` — Kubernetes liveness; never authenticated.
@@ -23,12 +23,13 @@ use axum::{
     middleware::Next,
     response::{IntoResponse, Response},
 };
-use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use jsonwebtoken::{decode, decode_header, jwk::JwkSet, DecodingKey, Validation};
 use reqwest::StatusCode;
 use serde::Deserialize;
 use tokio::sync::RwLock;
 
+use crate::{OrgRole, TenantContext, TenantStatus};
+
 /// Cached JWKS from Keycloak for token validation.
 #[derive(Clone)]
 pub struct JwksState {
@@ -62,16 +63,24 @@ struct Claims {
 
 const PUBLIC_ENDPOINTS: &[&str] = &["/api/v1/health"];
 
+/// Path prefixes that bypass JWT validation. The admin sub-router
+/// (`/api/v1/admin/*`) has its own static-bearer middleware and must
+/// not be routed through the customer-JWT path — a Keycloak token
+/// always carries a single tenant_id and would semantically conflict
+/// with cross-tenant admin operations.
+const PUBLIC_PREFIXES: &[&str] = &["/api/v1/admin/"];
+
 /// Middleware that validates Bearer JWT tokens against Keycloak's JWKS
 /// and attaches a `TenantContext` extension on success.
 ///
-/// Skips validation for the health endpoint.
+/// Skips validation for the health endpoint and any path under one of
-/// If `JwksState` is not present (Keycloak not configured), requests
+/// the [`PUBLIC_PREFIXES`]. If `JwksState` is not present (Keycloak
-/// pass through and downstream code must handle the missing context.
+/// not configured), requests pass through and downstream code must
+/// handle the missing context.
 pub async fn require_jwt_auth(mut request: Request, next: Next) -> Response {
     let path = request.uri().path();
 
-    if PUBLIC_ENDPOINTS.contains(&path) {
+    if PUBLIC_ENDPOINTS.contains(&path) || PUBLIC_PREFIXES.iter().any(|p| path.starts_with(p)) {
         return next.run(request).await;
     }
 
@@ -147,27 +156,83 @@ async fn validate_token(token: &str, state: &JwksState) -> Result<TenantContext,
 
     let kid = header
         .kid
+        .clone()
         .ok_or_else(|| "JWT missing kid header".to_string())?;
 
-    let jwks = fetch_or_get_jwks(state).await?;
+    // First try against whatever's currently cached. If the kid isn't
+    // there or the signature doesn't verify, the cached JWKS is most
+    // likely stale (KC rotated keys) — refresh once and retry before
+    // giving up. Without this every key rotation produces a silent 401
+    // storm that only goes away when the agent restarts.
+    let jwks = fetch_or_get_jwks(state, false).await?;
+    match try_validate(token, &header, &kid, &jwks) {
+        Ok(ctx) => Ok(ctx),
+        Err(ValidationError::Permanent(e)) => Err(e),
+        Err(ValidationError::Stale(reason)) => {
+            tracing::info!(
+                kid = %kid,
+                reason = %reason,
+                "JWKS appears stale — forcing refresh and retrying"
+            );
+            let jwks = fetch_or_get_jwks(state, true).await?;
+            try_validate(token, &header, &kid, &jwks).map_err(|e| match e {
+                ValidationError::Stale(s) | ValidationError::Permanent(s) => s,
+            })
+        }
+    }
+}
 
-    let jwk = jwks
+#[derive(Debug)]
+enum ValidationError {
+    /// Refresh-eligible: cached JWKS may be stale.
+    Stale(String),
+    /// Refusing the token regardless of JWKS freshness.
+    Permanent(String),
+}
+
+fn try_validate(
+    token: &str,
+    header: &jsonwebtoken::Header,
+    kid: &str,
+    jwks: &JwkSet,
+) -> Result<TenantContext, ValidationError> {
+    let jwk = match jwks
         .keys
         .iter()
-        .find(|k| k.common.key_id.as_deref() == Some(&kid))
+        .find(|k| k.common.key_id.as_deref() == Some(kid))
-        .ok_or_else(|| "no matching key found in JWKS".to_string())?;
+    {
+        Some(j) => j,
+        None => {
+            return Err(ValidationError::Stale(
+                "no matching key found in JWKS".to_string(),
+            ))
+        }
+    };
 
-    let decoding_key =
+    let decoding_key = DecodingKey::from_jwk(jwk)
-        DecodingKey::from_jwk(jwk).map_err(|e| format!("failed to create decoding key: {e}"))?;
+        .map_err(|e| ValidationError::Permanent(format!("failed to create decoding key: {e}")))?;
 
     let mut validation = Validation::new(header.alg);
     validation.validate_exp = true;
     validation.validate_aud = false;
 
-    let data = decode::<Claims>(token, &decoding_key, &validation)
+    let data = match decode::<Claims>(token, &decoding_key, &validation) {
-        .map_err(|e| format!("token validation failed: {e}"))?;
+        Ok(d) => d,
+        Err(e) => {
+            // Signature mismatch is the other refresh-eligible failure:
+            // the matching kid is present but the key bytes don't match.
+            // Everything else (expired, malformed, etc.) is permanent.
+            return Err(
+                if matches!(e.kind(), jsonwebtoken::errors::ErrorKind::InvalidSignature) {
+                    ValidationError::Stale(format!("token validation failed: {e}"))
+                } else {
+                    ValidationError::Permanent(format!("token validation failed: {e}"))
+                },
+            );
+        }
+    };
 
-    claims_to_context(data.claims)
+    claims_to_context(data.claims).map_err(ValidationError::Permanent)
 }
 
 /// Map the decoded JWT payload into the platform-wide `TenantContext`.
@@ -197,14 +262,25 @@ fn claims_to_context(c: Claims) -> Result<TenantContext, String> {
     })
 }
 
-async fn fetch_or_get_jwks(state: &JwksState) -> Result<JwkSet, String> {
+async fn fetch_or_get_jwks(state: &JwksState, force: bool) -> Result<JwkSet, String> {
-    {
+    if !force {
         let cached = state.jwks.read().await;
         if let Some(ref jwks) = *cached {
             return Ok(jwks.clone());
         }
     }
 
+    // Hold the write lock across the fetch so concurrent refreshers
+    // don't all hammer Keycloak when keys rotate. If another writer
+    // already populated a fresh JWKS while we were waiting (and we
+    // weren't asked to force), use theirs.
+    let mut cached = state.jwks.write().await;
+    if !force {
+        if let Some(ref jwks) = *cached {
+            return Ok(jwks.clone());
+        }
+    }
+
     let resp = reqwest::get(&state.jwks_url)
         .await
         .map_err(|e| format!("failed to fetch JWKS: {e}"))?;
@@ -214,7 +290,6 @@ async fn fetch_or_get_jwks(state: &JwksState) -> Result<JwkSet, String> {
         .await
         .map_err(|e| format!("failed to parse JWKS: {e}"))?;
 
-    let mut cached = state.jwks.write().await;
     *cached = Some(jwks.clone());
 
     Ok(jwks)
@@ -292,6 +367,24 @@ mod tests {
         );
     }
 
+    #[test]
+    fn try_validate_returns_stale_when_kid_missing_from_jwks() {
+        // Empty JWKS — the kid we ask for can't possibly match. The error
+        // must classify as Stale so the caller refreshes JWKS and retries.
+        let jwks = JwkSet { keys: vec![] };
+        let header = jsonwebtoken::Header {
+            alg: jsonwebtoken::Algorithm::RS256,
+            kid: Some("kid-rotated-out".to_string()),
+            ..Default::default()
+        };
+        let err = try_validate("ignored.token.value", &header, "kid-rotated-out", &jwks)
+            .expect_err("should fail");
+        match err {
+            ValidationError::Stale(s) => assert!(s.contains("no matching key")),
+            ValidationError::Permanent(s) => panic!("must be Stale, got Permanent: {s}"),
+        }
+    }
+
     #[test]
     fn is_write_detects_methods() {
         assert!(!is_write(&Method::GET));

compliance-core/src/config.rs

@@ -24,6 +24,9 @@ pub struct AgentConfig {
     pub scan_schedule: String,
     pub cve_monitor_schedule: String,
     pub git_clone_base_path: String,
+    /// Base directory for content-addressed artifact blobs and per-run working
+    /// dirs (`<base>/blobs/<sha[0:2]>/<sha>`, `<base>/work/<target>/<artifact>/`).
+    pub artifact_store_base_path: String,
     pub ssh_key_path: String,
     pub keycloak_url: Option<String>,
     pub keycloak_realm: Option<String>,
@@ -37,6 +40,15 @@ pub struct AgentConfig {
     pub pentest_imap_tls: bool,
     pub pentest_imap_username: Option<String>,
     pub pentest_imap_password: Option<SecretString>,
+    /// Static bearer for the cross-tenant admin endpoints under
+    /// `/api/v1/admin/*`. When `None`, those endpoints are not
+    /// mounted at all (defense-in-depth: ops endpoints never reach
+    /// any auth path if no operator has explicitly opted in).
+    pub admin_api_token: Option<SecretString>,
+    /// Live tenant-registry URL the scheduler consults for the list
+    /// of tenants to iterate. When `None` or unreachable, scheduler
+    /// falls back to `SCHEDULER_TENANT_IDS` env (M7.2-C).
+    pub tenant_registry_url: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/lib.rs

@@ -2,11 +2,17 @@ pub mod config;
 pub mod db;
 pub mod error;
 pub mod models;
+pub mod scan_matrix;
 #[cfg(feature = "telemetry")]
 pub mod telemetry;
 pub mod tenant;
 pub mod traits;
 
+#[cfg(feature = "axum")]
+pub mod auth;
+#[cfg(feature = "axum")]
+pub mod tenant_ctx;
+
 pub use config::{AgentConfig, DashboardConfig};
 pub use error::CoreError;
 pub use tenant::{OrgRole, TenantContext, TenantStatus};

compliance-core/src/models/mcp_token.rs

@@ -0,0 +1,69 @@
+//! Per-tenant API tokens used by `compliance-mcp` to authenticate MCP
+//! HTTP requests on behalf of LLM clients (Claude Desktop, Cursor,
+//! ChatGPT, etc.) that can't run a Keycloak OIDC flow.
+//!
+//! Tokens are opaque strings of the form `mcpt_<44 url-safe random
+//! chars>`. The raw value is shown to the user exactly once at
+//! creation; the database only ever sees the SHA-256 hash. Lookups go
+//! through the cross-tenant `<prefix>__admin.mcp_tokens` collection
+//! and return the `tenant_id` the MCP server should route to.
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+/// Persisted token metadata. `token_hash` is the SHA-256 hex of the
+/// raw token; the raw token itself is never stored.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpToken {
+    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
+    pub id: Option<bson::oid::ObjectId>,
+    /// SHA-256 hex of the raw token. Unique index in the collection.
+    pub token_hash: String,
+    /// First 8 chars of the raw token — purely for UI display so users
+    /// can identify which token is which without re-issuing.
+    pub token_prefix: String,
+    /// Routes to `<db_prefix>_<tenant_id>` on MCP requests.
+    pub tenant_id: String,
+    /// User-given label, e.g. "Claude Desktop" or "Sharang's laptop".
+    pub name: String,
+    /// Keycloak `sub` of the user who created this token, for audit.
+    pub created_by: String,
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_used_at: Option<DateTime<Utc>>,
+    /// Soft-delete flag. A revoked token doc stays around for audit
+    /// but never authenticates.
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+/// Public projection of a token — never includes the hash.
+/// Returned by `GET /api/v1/mcp-tokens`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct McpTokenView {
+    pub id: String,
+    pub name: String,
+    /// `mcpt_xxxx…` so the user can identify which row is which.
+    pub token_prefix: String,
+    pub created_by: String,
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub created_at: DateTime<Utc>,
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_used_at: Option<DateTime<Utc>>,
+    pub revoked: bool,
+}
+
+impl From<&McpToken> for McpTokenView {
+    fn from(t: &McpToken) -> Self {
+        Self {
+            id: t.id.map(|o| o.to_hex()).unwrap_or_default(),
+            name: t.name.clone(),
+            token_prefix: t.token_prefix.clone(),
+            created_by: t.created_by.clone(),
+            created_at: t.created_at,
+            last_used_at: t.last_used_at,
+            revoked: t.revoked,
+        }
+    }
+}

compliance-core/src/models/mod.rs

@@ -7,7 +7,9 @@ pub mod finding;
 pub mod graph;
 pub mod issue;
 pub mod mcp;
+pub mod mcp_token;
 pub mod notification;
+pub mod onboarding;
 pub mod pentest;
 pub mod repository;
 pub mod sbom;
@@ -28,7 +30,14 @@ pub use graph::{
 };
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
 pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
+pub use mcp_token::{McpToken, McpTokenView};
 pub use notification::{CveNotification, NotificationSeverity, NotificationStatus};
+pub use onboarding::{
+    default_compliance_profile, Artifact, ArtifactAuth, ArtifactKind, Classification,
+    ComplianceFramework, ComplianceProfile, DetectedFact, ExternalRef, ExternalSystem,
+    GitArtifactConfig, IssueTrackerConfig, OnboardedTarget, PlcArtifactConfig, PlcFormat,
+    TargetScanConfig, TargetType, TargetTypeCandidate, WebArtifactConfig,
+};
 pub use pentest::{
     AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
     PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,

compliance-core/src/models/onboarding.rs

@@ -0,0 +1,753 @@
+//! The unified onboarding model.
+//!
+//! An [`OnboardedTarget`] is the single source of truth for anything the scanner
+//! can analyze. It records *what kind of software* the target is ([`TargetType`]),
+//! the concrete [`Artifact`]s that were provided for it (a git repo, a firmware
+//! image, a live URL, a PLC project, ...), the classifier's verdict, and the scan
+//! configuration. It replaces the older git-only `TrackedRepository` and the
+//! standalone `DastTarget`, both of which fold into this type as artifacts.
+
+use std::collections::HashMap;
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+use super::dast::{DastAuthConfig, DastTargetType};
+use super::issue::TrackerType;
+use super::pentest::{Environment, PentestConfig, PentestStrategy};
+use super::scan::ScanType;
+
+/// The family of software a target belongs to.
+///
+/// Targets look endlessly varied but fall into a small enumerable set classified
+/// by where the analyzable signal lives. This drives the scan-applicability
+/// matrix and the onboarding wizard's type selection.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum TargetType {
+    /// Browser-facing web application (front end + server).
+    WebApp,
+    /// Headless backend service / API (REST, GraphQL, gRPC).
+    BackendService,
+    /// Desktop application (Windows/macOS/Linux GUI or CLI binary).
+    DesktopApp,
+    /// Android application (APK / AAB).
+    AndroidApp,
+    /// iOS application (IPA).
+    IosApp,
+    /// Bare-metal embedded firmware (no operating system).
+    FirmwareBareMetal,
+    /// Embedded firmware running on an RTOS (Zephyr, FreeRTOS, ...).
+    FirmwareRtos,
+    /// Embedded Linux built with Yocto / OpenEmbedded (BSP + image).
+    EmbeddedLinuxYocto,
+    /// Programmable logic controller software (IEC 61131-3, PLCopen / SPS).
+    PlcSps,
+}
+
+impl std::fmt::Display for TargetType {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::WebApp => write!(f, "web_app"),
+            Self::BackendService => write!(f, "backend_service"),
+            Self::DesktopApp => write!(f, "desktop_app"),
+            Self::AndroidApp => write!(f, "android_app"),
+            Self::IosApp => write!(f, "ios_app"),
+            Self::FirmwareBareMetal => write!(f, "firmware_bare_metal"),
+            Self::FirmwareRtos => write!(f, "firmware_rtos"),
+            Self::EmbeddedLinuxYocto => write!(f, "embedded_linux_yocto"),
+            Self::PlcSps => write!(f, "plc_sps"),
+        }
+    }
+}
+
+/// The kind of artifact provided for a target.
+///
+/// Which scans are possible is a function of the target type *and* which of
+/// these are present (SAST needs code, DAST needs a running URL, and so on).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ArtifactKind {
+    /// A git repository (cloned for static analysis).
+    GitRepo,
+    /// A source archive (zip / tarball) with no live git remote.
+    SourceArchive,
+    /// A firmware image or binary blob.
+    FirmwareImage,
+    /// A mobile package: Android APK/AAB or iOS IPA.
+    MobilePackage,
+    /// An OCI/Docker container image reference.
+    ContainerImage,
+    /// A reachable running instance (base URL / endpoint) for dynamic testing.
+    LiveUrl,
+    /// A PLC project: PLCopen XML or Structured Text source.
+    PlcProject,
+    /// Free-form plaintext describing the target (feeds classification only).
+    PlaintextDescription,
+}
+
+impl std::fmt::Display for ArtifactKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::GitRepo => write!(f, "git_repo"),
+            Self::SourceArchive => write!(f, "source_archive"),
+            Self::FirmwareImage => write!(f, "firmware_image"),
+            Self::MobilePackage => write!(f, "mobile_package"),
+            Self::ContainerImage => write!(f, "container_image"),
+            Self::LiveUrl => write!(f, "live_url"),
+            Self::PlcProject => write!(f, "plc_project"),
+            Self::PlaintextDescription => write!(f, "plaintext_description"),
+        }
+    }
+}
+
+/// Credentials attached to an artifact.
+///
+/// This folds both `TrackedRepository`'s git auth (`auth_token` / `auth_username`
+/// / SSH key) and `DastAuthConfig`'s HTTP auth (form / bearer / cookie) into one
+/// shape so a single artifact carries whatever it needs to be fetched or probed.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ArtifactAuth {
+    /// Auth method: `none` | `token` | `basic` | `bearer` | `cookie` | `form` | `ssh`.
+    #[serde(default)]
+    pub method: String,
+    /// Username (git user, basic-auth user, or `x-access-token` for PATs).
+    pub username: Option<String>,
+    /// The secret credential: PAT, password, or bearer token. Encrypted at rest.
+    pub secret: Option<String>,
+    /// Path to an SSH private key for git-over-SSH.
+    pub ssh_key_path: Option<String>,
+    /// Login URL for form-based authentication.
+    pub login_url: Option<String>,
+    /// Extra headers to send when authenticating / probing.
+    pub headers: Option<HashMap<String, String>>,
+}
+
+impl From<DastAuthConfig> for ArtifactAuth {
+    fn from(c: DastAuthConfig) -> Self {
+        Self {
+            method: c.method,
+            username: c.username,
+            // Prefer a bearer token; otherwise fall back to the password.
+            secret: c.token.or(c.password),
+            ssh_key_path: None,
+            login_url: c.login_url,
+            headers: c.headers,
+        }
+    }
+}
+
+/// Git-specific configuration for a [`ArtifactKind::GitRepo`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GitArtifactConfig {
+    /// Branch to scan.
+    pub default_branch: String,
+    /// Commit SHA of the last completed scan (change-detection watermark).
+    pub last_scanned_commit: Option<String>,
+    /// Local clone path once the repo has been fetched.
+    pub local_path: Option<String>,
+}
+
+impl GitArtifactConfig {
+    /// Config for a fresh git artifact on the given branch.
+    pub fn on_branch(branch: impl Into<String>) -> Self {
+        Self {
+            default_branch: branch.into(),
+            last_scanned_commit: None,
+            local_path: None,
+        }
+    }
+}
+
+impl Default for GitArtifactConfig {
+    fn default() -> Self {
+        Self::on_branch("main")
+    }
+}
+
+/// Dynamic-analysis configuration for a [`ArtifactKind::LiveUrl`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WebArtifactConfig {
+    /// Whether the endpoint is a web app, REST API, or GraphQL API.
+    pub target_kind: DastTargetType,
+    /// URL paths to exclude from crawling / scanning.
+    #[serde(default)]
+    pub excluded_paths: Vec<String>,
+    /// Maximum crawl depth.
+    pub max_crawl_depth: u32,
+    /// Rate limit in requests per second.
+    pub rate_limit: u32,
+    /// Whether destructive methods (DELETE / PUT) are permitted.
+    #[serde(default)]
+    pub allow_destructive: bool,
+}
+
+impl Default for WebArtifactConfig {
+    fn default() -> Self {
+        Self {
+            target_kind: DastTargetType::WebApp,
+            excluded_paths: Vec::new(),
+            max_crawl_depth: 3,
+            rate_limit: 10,
+            allow_destructive: false,
+        }
+    }
+}
+
+/// The source format of a PLC project artifact.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlcFormat {
+    /// PLCopen XML project export.
+    PlcopenXml,
+    /// IEC 61131-3 Structured Text source.
+    StructuredText,
+}
+
+/// PLC-specific configuration for a [`ArtifactKind::PlcProject`] artifact.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PlcArtifactConfig {
+    /// The project source format.
+    pub format: PlcFormat,
+}
+
+/// A single fact discovered about a target by ingest or classification
+/// (e.g. `language=rust`, `build_system=cmake`, `mcu=stm32f429`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DetectedFact {
+    /// The fact name.
+    pub key: String,
+    /// The fact value.
+    pub value: String,
+    /// What produced the fact (e.g. `tramiton`, `language-fingerprint`).
+    pub source: String,
+}
+
+impl DetectedFact {
+    /// Build a fact from its parts.
+    pub fn new(
+        key: impl Into<String>,
+        value: impl Into<String>,
+        source: impl Into<String>,
+    ) -> Self {
+        Self {
+            key: key.into(),
+            value: value.into(),
+            source: source.into(),
+        }
+    }
+}
+
+/// One concrete thing provided for a target: code, a binary, a URL, etc.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Artifact {
+    /// Stable per-artifact id (UUID v4) — scan steps reference this.
+    pub id: String,
+    /// What kind of artifact this is.
+    pub kind: ArtifactKind,
+    /// The source reference: git URL, blob id, live URL, or image ref.
+    pub source_ref: String,
+    /// Optional human-friendly label.
+    pub display_name: Option<String>,
+    /// Content-addressed storage path once ingested (blobs only).
+    pub stored_path: Option<String>,
+    /// SHA-256 of the ingested content (git artifacts store the head SHA).
+    pub content_hash: Option<String>,
+    /// Size of the stored blob in bytes.
+    pub size_bytes: Option<u64>,
+    /// Credentials for fetching or probing this artifact.
+    pub auth: Option<ArtifactAuth>,
+    /// Git configuration (present for [`ArtifactKind::GitRepo`]).
+    pub git: Option<GitArtifactConfig>,
+    /// Dynamic-analysis configuration (present for [`ArtifactKind::LiveUrl`]).
+    pub web: Option<WebArtifactConfig>,
+    /// PLC configuration (present for [`ArtifactKind::PlcProject`]).
+    pub plc: Option<PlcArtifactConfig>,
+    /// Facts discovered about this artifact by ingest / classification.
+    #[serde(default)]
+    pub detected: Vec<DetectedFact>,
+    /// When this artifact was last ingested.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub ingested_at: Option<DateTime<Utc>>,
+}
+
+impl Artifact {
+    /// A bare artifact of the given kind and source reference.
+    fn bare(kind: ArtifactKind, source_ref: impl Into<String>) -> Self {
+        Self {
+            id: uuid::Uuid::new_v4().to_string(),
+            kind,
+            source_ref: source_ref.into(),
+            display_name: None,
+            stored_path: None,
+            content_hash: None,
+            size_bytes: None,
+            auth: None,
+            git: None,
+            web: None,
+            plc: None,
+            detected: Vec::new(),
+            ingested_at: None,
+        }
+    }
+
+    /// A git-repository artifact tracking the given branch.
+    pub fn git_repo(url: impl Into<String>, branch: impl Into<String>) -> Self {
+        let mut a = Self::bare(ArtifactKind::GitRepo, url);
+        a.git = Some(GitArtifactConfig::on_branch(branch));
+        a
+    }
+
+    /// A live-URL artifact with default crawl settings.
+    pub fn live_url(url: impl Into<String>) -> Self {
+        let mut a = Self::bare(ArtifactKind::LiveUrl, url);
+        a.web = Some(WebArtifactConfig::default());
+        a
+    }
+
+    /// A firmware-image artifact referenced by name (blob ingested later).
+    pub fn firmware_image(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::FirmwareImage, source_ref)
+    }
+
+    /// A source-archive artifact referenced by name (blob ingested later).
+    pub fn source_archive(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::SourceArchive, source_ref)
+    }
+
+    /// A mobile-package artifact (APK/AAB/IPA) referenced by name.
+    pub fn mobile_package(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::MobilePackage, source_ref)
+    }
+
+    /// A container-image artifact referenced by OCI ref.
+    pub fn container_image(source_ref: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::ContainerImage, source_ref)
+    }
+
+    /// A PLC-project artifact in the given format.
+    pub fn plc_project(source_ref: impl Into<String>, format: PlcFormat) -> Self {
+        let mut a = Self::bare(ArtifactKind::PlcProject, source_ref);
+        a.plc = Some(PlcArtifactConfig { format });
+        a
+    }
+
+    /// A plaintext-description artifact (classification input only).
+    pub fn plaintext(text: impl Into<String>) -> Self {
+        Self::bare(ArtifactKind::PlaintextDescription, text)
+    }
+}
+
+/// One ranked candidate produced by the classifier.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TargetTypeCandidate {
+    /// The candidate target type.
+    pub target_type: TargetType,
+    /// Confidence in `[0.0, 1.0]`.
+    pub confidence: f32,
+    /// Why this candidate was proposed.
+    pub rationale: String,
+}
+
+/// The classifier's verdict for a target: a suggested type plus ranked
+/// alternatives and the facts the decision rested on.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Classification {
+    /// The top-ranked target type.
+    pub suggested: TargetType,
+    /// All candidates, sorted by descending confidence.
+    #[serde(default)]
+    pub candidates: Vec<TargetTypeCandidate>,
+    /// Facts gathered during classification.
+    #[serde(default)]
+    pub facts: Vec<DetectedFact>,
+    /// Which classifiers contributed (e.g. `["tramiton", "language-fingerprint"]`).
+    #[serde(default)]
+    pub detected_by: Vec<String>,
+    /// When classification ran.
+    #[serde(with = "super::serde_helpers::bson_datetime")]
+    pub detected_at: DateTime<Utc>,
+    /// Whether a human confirmed the suggestion.
+    #[serde(default)]
+    pub confirmed: bool,
+}
+
+/// Issue-tracker linkage, migrated from `TrackedRepository`'s `tracker_*` fields.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct IssueTrackerConfig {
+    /// The tracker platform.
+    pub tracker_type: Option<TrackerType>,
+    /// Tracker owner / organization.
+    pub owner: Option<String>,
+    /// Tracker repository / project.
+    pub repo: Option<String>,
+    /// Per-target tracker access token.
+    pub token: Option<String>,
+}
+
+/// How a target should be scanned.
+///
+/// `enabled_scans` / `disabled_scans` override the scan-applicability matrix
+/// defaults; the pentest and tracker blocks reuse the existing wizard config.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct TargetScanConfig {
+    /// Scans explicitly turned on (empty means "use matrix defaults").
+    #[serde(default)]
+    pub enabled_scans: Vec<ScanType>,
+    /// Scans explicitly turned off.
+    #[serde(default)]
+    pub disabled_scans: Vec<ScanType>,
+    /// Target environment (gates destructive / active testing).
+    #[serde(default)]
+    pub environment: Environment,
+    /// Whether destructive tests are permitted for this target.
+    #[serde(default)]
+    pub allow_destructive: bool,
+    /// Pentest strategy selector.
+    pub strategy: Option<PentestStrategy>,
+    /// Full pentest wizard configuration.
+    pub pentest: Option<PentestConfig>,
+    /// Issue-tracker linkage.
+    pub issue_tracker: Option<IssueTrackerConfig>,
+}
+
+/// A sibling product in the company suite that may already hold authoritative
+/// data for a target. compliance-scanner reconciles with these rather than
+/// recomputing what they already know.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ExternalSystem {
+    /// Reproducible-build & firmware compliance engine (build plan, SBOM, VEX,
+    /// attestation).
+    Tramiton,
+    /// Code assistant (downstream remediation consumer).
+    Werkpilot,
+    /// Compliance-controls RAG (atomic controls derived from laws).
+    BreakpilotCompliance,
+}
+
+impl std::fmt::Display for ExternalSystem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Tramiton => write!(f, "tramiton"),
+            Self::Werkpilot => write!(f, "werkpilot"),
+            Self::BreakpilotCompliance => write!(f, "breakpilot_compliance"),
+        }
+    }
+}
+
+/// A link from this target to a record in a sibling product, used to reconcile
+/// existing evidence instead of recomputing it.
+///
+/// For tramiton, `project_id` is the shared cross-product key and
+/// `subject_sha256` matches a firmware artifact's [`Artifact::content_hash`]
+/// (which equals tramiton's `Artifact.sha256`).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ExternalRef {
+    /// Which sibling product this reference points at.
+    pub system: ExternalSystem,
+    /// The sibling product's project identifier, if known.
+    pub project_id: Option<String>,
+    /// Content digest of the subject artifact (firmware sha256), if known.
+    pub subject_sha256: Option<String>,
+    /// Reconciliation status: `linked` | `reconciled` | `unavailable`.
+    #[serde(default)]
+    pub status: String,
+    /// Opaque, offline-verifiable entitlement grant (e.g. tramiton's signed
+    /// `LicenseGrant`), if the tenant provided one.
+    pub license_grant: Option<String>,
+    /// When evidence was last reconciled from this system.
+    #[serde(default, with = "super::serde_helpers::opt_bson_datetime")]
+    pub last_reconciled_at: Option<DateTime<Utc>>,
+}
+
+impl ExternalRef {
+    /// A freshly linked (not yet reconciled) reference to a sibling system.
+    pub fn linked(system: ExternalSystem) -> Self {
+        Self {
+            system,
+            project_id: None,
+            subject_sha256: None,
+            status: "linked".to_string(),
+            license_grant: None,
+            last_reconciled_at: None,
+        }
+    }
+}
+
+/// A regulatory / standards framework a target must comply with. Drives which
+/// controls the mapping engine pulls from the [`crate::traits::ControlsProvider`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ComplianceFramework {
+    /// EU Cyber Resilience Act.
+    Cra,
+    /// IEC 62443 (industrial automation & control systems security).
+    Iec62443,
+    /// EU General Data Protection Regulation.
+    Gdpr,
+    /// SOC 2.
+    Soc2,
+    /// ISO/IEC 27001.
+    Iso27001,
+    /// EU Radio Equipment Directive (RED) cybersecurity articles.
+    RedDirective,
+}
+
+impl std::fmt::Display for ComplianceFramework {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Cra => write!(f, "cra"),
+            Self::Iec62443 => write!(f, "iec_62443"),
+            Self::Gdpr => write!(f, "gdpr"),
+            Self::Soc2 => write!(f, "soc2"),
+            Self::Iso27001 => write!(f, "iso_27001"),
+            Self::RedDirective => write!(f, "red_directive"),
+        }
+    }
+}
+
+/// The compliance scope of a target: which frameworks apply and, optionally, the
+/// jurisdiction. Captured at onboarding (with per-target-type defaults from
+/// [`default_compliance_profile`]).
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct ComplianceProfile {
+    /// Applicable frameworks.
+    #[serde(default)]
+    pub frameworks: Vec<ComplianceFramework>,
+    /// Free-form jurisdiction (e.g. `eu`, `us`, `de`).
+    pub jurisdiction: Option<String>,
+}
+
+/// The sensible default compliance scope for a target type. Firmware / PLC /
+/// embedded default to CRA + IEC 62443; software defaults to GDPR + SOC 2.
+pub fn default_compliance_profile(target_type: TargetType) -> ComplianceProfile {
+    use ComplianceFramework::{Cra, Gdpr, Iec62443, Soc2};
+    let frameworks = match target_type {
+        TargetType::PlcSps
+        | TargetType::FirmwareBareMetal
+        | TargetType::FirmwareRtos
+        | TargetType::EmbeddedLinuxYocto => vec![Cra, Iec62443],
+        TargetType::WebApp | TargetType::BackendService => vec![Gdpr, Soc2],
+        TargetType::DesktopApp | TargetType::AndroidApp | TargetType::IosApp => {
+            vec![Gdpr, Cra]
+        }
+    };
+    ComplianceProfile {
+        frameworks,
+        jurisdiction: None,
+    }
+}
+
+/// A target onboarded for scanning: the unified replacement for the legacy
+/// `TrackedRepository` (SAST) and `DastTarget` (DAST) records.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct OnboardedTarget {
+    /// Mongo id. Preserved from the legacy record during migration so every
+    /// downstream collection keyed by `repo_id` / `target_id` keeps resolving.
+    #[serde(rename = "_id", skip_serializing_if = "Option::is_none")]
+    pub id: Option<bson::oid::ObjectId>,
+    /// Human-friendly name.
+    #[serde(default)]
+    pub name: String,
+    /// The software family this target belongs to.
+    pub target_type: TargetType,
+    /// Optional free-form description (also a classification input).
+    pub description: Option<String>,
+    /// The artifacts provided for this target.
+    #[serde(default)]
+    pub artifacts: Vec<Artifact>,
+    /// The classifier's verdict, once run.
+    pub classification: Option<Classification>,
+    /// How this target should be scanned.
+    #[serde(default)]
+    pub scan_config: TargetScanConfig,
+    /// The compliance scope (applicable frameworks / jurisdiction).
+    #[serde(default)]
+    pub compliance_profile: ComplianceProfile,
+    /// Links to sibling products (tramiton, ...) holding reconcilable evidence.
+    #[serde(default)]
+    pub external_refs: Vec<ExternalRef>,
+    /// Cron schedule for recurring scans, if any.
+    pub scan_schedule: Option<String>,
+    /// Whether inbound webhooks are enabled for this target.
+    #[serde(default)]
+    pub webhook_enabled: bool,
+    /// HMAC secret for verifying inbound webhooks.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub webhook_secret: Option<String>,
+    /// Cached count of findings across this target's scans.
+    #[serde(default)]
+    pub findings_count: u32,
+    /// Creation timestamp.
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub created_at: DateTime<Utc>,
+    /// Last-update timestamp.
+    #[serde(
+        default = "chrono::Utc::now",
+        with = "super::serde_helpers::bson_datetime"
+    )]
+    pub updated_at: DateTime<Utc>,
+}
+
+impl OnboardedTarget {
+    /// A new target of the given type with a freshly generated webhook secret.
+    pub fn new(name: String, target_type: TargetType) -> Self {
+        let now = Utc::now();
+        let webhook_secret = uuid::Uuid::new_v4().to_string().replace('-', "");
+        Self {
+            id: None,
+            name,
+            target_type,
+            description: None,
+            artifacts: Vec::new(),
+            classification: None,
+            scan_config: TargetScanConfig::default(),
+            compliance_profile: default_compliance_profile(target_type),
+            external_refs: Vec::new(),
+            scan_schedule: None,
+            webhook_enabled: false,
+            webhook_secret: Some(webhook_secret),
+            findings_count: 0,
+            created_at: now,
+            updated_at: now,
+        }
+    }
+
+    /// The first artifact of the given kind, if present.
+    pub fn first_of(&self, kind: ArtifactKind) -> Option<&Artifact> {
+        self.artifacts.iter().find(|a| a.kind == kind)
+    }
+
+    /// Whether the target has at least one artifact of the given kind.
+    pub fn has(&self, kind: ArtifactKind) -> bool {
+        self.artifacts.iter().any(|a| a.kind == kind)
+    }
+
+    /// The primary code artifact (git repo or source archive), if any.
+    pub fn code_artifact(&self) -> Option<&Artifact> {
+        self.artifacts
+            .iter()
+            .find(|a| matches!(a.kind, ArtifactKind::GitRepo | ArtifactKind::SourceArchive))
+    }
+
+    /// The live-URL artifact, if any.
+    pub fn live_url(&self) -> Option<&Artifact> {
+        self.first_of(ArtifactKind::LiveUrl)
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+
+    fn sample_target() -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("acme-web".to_string(), TargetType::WebApp);
+        t.artifacts.push(Artifact::git_repo(
+            "https://git.example.com/acme.git",
+            "main",
+        ));
+        t.artifacts
+            .push(Artifact::live_url("https://acme.example.com"));
+        t
+    }
+
+    #[test]
+    fn onboarded_target_bson_round_trip() {
+        let t = sample_target();
+        let b = bson::to_bson(&t).expect("serialize");
+        let back: OnboardedTarget = bson::from_bson(b.clone()).expect("deserialize");
+        let b2 = bson::to_bson(&back).expect("re-serialize");
+        assert_eq!(b, b2);
+    }
+
+    #[test]
+    fn enum_display_is_snake_case() {
+        assert_eq!(
+            TargetType::FirmwareBareMetal.to_string(),
+            "firmware_bare_metal"
+        );
+        assert_eq!(TargetType::PlcSps.to_string(), "plc_sps");
+        assert_eq!(ArtifactKind::PlcProject.to_string(), "plc_project");
+        assert_eq!(ArtifactKind::MobilePackage.to_string(), "mobile_package");
+    }
+
+    #[test]
+    fn helpers_locate_artifacts() {
+        let t = sample_target();
+        assert!(t.has(ArtifactKind::GitRepo));
+        assert!(t.live_url().is_some());
+        assert!(t.code_artifact().is_some());
+        assert!(!t.has(ArtifactKind::FirmwareImage));
+        assert_eq!(
+            t.first_of(ArtifactKind::GitRepo).map(|a| a.kind),
+            Some(ArtifactKind::GitRepo)
+        );
+    }
+
+    #[test]
+    fn new_target_generates_webhook_secret() {
+        let t = OnboardedTarget::new("t".to_string(), TargetType::BackendService);
+        let secret = t.webhook_secret.expect("secret present");
+        assert_eq!(secret.len(), 32);
+        assert!(!secret.contains('-'));
+    }
+
+    #[test]
+    fn dast_auth_folds_into_artifact_auth() {
+        let dast = DastAuthConfig {
+            method: "bearer".to_string(),
+            login_url: Some("https://x/login".to_string()),
+            username: Some("user".to_string()),
+            password: Some("pw".to_string()),
+            token: Some("tok".to_string()),
+            headers: None,
+        };
+        let auth = ArtifactAuth::from(dast);
+        assert_eq!(auth.method, "bearer");
+        // Bearer token wins over password.
+        assert_eq!(auth.secret.as_deref(), Some("tok"));
+        assert_eq!(auth.login_url.as_deref(), Some("https://x/login"));
+    }
+
+    #[test]
+    fn each_artifact_gets_a_unique_id() {
+        let a = Artifact::firmware_image("fw.bin");
+        let b = Artifact::firmware_image("fw.bin");
+        assert_ne!(a.id, b.id);
+    }
+
+    #[test]
+    fn firmware_default_profile_is_cra_and_62443() {
+        let p = default_compliance_profile(TargetType::FirmwareBareMetal);
+        assert!(p.frameworks.contains(&ComplianceFramework::Cra));
+        assert!(p.frameworks.contains(&ComplianceFramework::Iec62443));
+    }
+
+    #[test]
+    fn webapp_default_profile_is_gdpr_and_soc2() {
+        let p = default_compliance_profile(TargetType::WebApp);
+        assert!(p.frameworks.contains(&ComplianceFramework::Gdpr));
+        assert!(p.frameworks.contains(&ComplianceFramework::Soc2));
+    }
+
+    #[test]
+    fn new_target_gets_default_profile_and_no_external_refs() {
+        let t = OnboardedTarget::new("fw".to_string(), TargetType::FirmwareRtos);
+        assert!(!t.compliance_profile.frameworks.is_empty());
+        assert!(t.external_refs.is_empty());
+    }
+
+    #[test]
+    fn external_ref_linked_defaults() {
+        let r = ExternalRef::linked(ExternalSystem::Tramiton);
+        assert_eq!(r.system, ExternalSystem::Tramiton);
+        assert_eq!(r.status, "linked");
+        assert!(r.project_id.is_none());
+        assert!(r.last_reconciled_at.is_none());
+    }
+}

compliance-core/src/models/scan.rs

@@ -3,7 +3,7 @@ use serde::{Deserialize, Serialize};
 
 use super::repository::ScanTrigger;
 
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ScanType {
     Sast,
@@ -16,6 +16,14 @@ pub enum ScanType {
     SecretDetection,
     Lint,
     CodeReview,
+    /// Static analysis of a firmware image (unpack + component CVE).
+    FirmwareStatic,
+    /// Control-logic security analysis of PLC / SPS programs.
+    PlcControlLogic,
+    /// Static analysis of a mobile package (APK / AAB / IPA).
+    MobileStatic,
+    /// Static analysis of a container image.
+    ContainerScan,
 }
 
 impl std::fmt::Display for ScanType {
@@ -31,6 +39,10 @@ impl std::fmt::Display for ScanType {
             Self::SecretDetection => write!(f, "secret_detection"),
             Self::Lint => write!(f, "lint"),
             Self::CodeReview => write!(f, "code_review"),
+            Self::FirmwareStatic => write!(f, "firmware_static"),
+            Self::PlcControlLogic => write!(f, "plc_control_logic"),
+            Self::MobileStatic => write!(f, "mobile_static"),
+            Self::ContainerScan => write!(f, "container_scan"),
         }
     }
 }
@@ -47,6 +59,8 @@ pub enum ScanRunStatus {
 #[serde(rename_all = "snake_case")]
 pub enum ScanPhase {
     ChangeDetection,
+    ArtifactIngest,
+    Classification,
     Sast,
     SbomGeneration,
     CveScanning,
@@ -55,6 +69,10 @@ pub enum ScanPhase {
     LintScanning,
     CodeReview,
     GraphBuilding,
+    FirmwareStatic,
+    PlcAnalysis,
+    MobileStatic,
+    ContainerScan,
     LlmTriage,
     IssueCreation,
     DastScanning,

compliance-core/src/scan_matrix.rs

@@ -0,0 +1,379 @@
+//! The scan-applicability matrix.
+//!
+//! Which scans are possible for a target is a function of its [`TargetType`] and
+//! which [`ArtifactKind`]s are actually present: SAST needs code, DAST needs a
+//! running URL, firmware-static analysis needs a firmware image, and so on. This
+//! module encodes that as a table — one rule set per target type — and resolves
+//! it against a concrete [`OnboardedTarget`] into a list of [`ScanOption`]s the
+//! onboarding wizard and the scan pipeline both consume.
+
+use crate::models::{ArtifactKind, OnboardedTarget, ScanType, TargetType};
+
+/// What an artifact a scan needs in order to run.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ArtifactRequirement {
+    /// Source code — a git repo or a source archive.
+    Code,
+    /// A reachable running instance (live URL / endpoint).
+    RunningUrl,
+    /// A firmware image / binary blob.
+    Firmware,
+    /// A PLC project (PLCopen XML or Structured Text).
+    Plc,
+    /// A mobile package (APK / AAB / IPA).
+    Mobile,
+    /// A container image.
+    Container,
+    /// No specific artifact required.
+    Any,
+}
+
+/// A static rule: this scan applies to a target type, needs this artifact, and
+/// defaults on/off. The rationale explains the entry to the user.
+#[derive(Debug, Clone, Copy)]
+pub struct ScanRule {
+    /// The scan this rule governs.
+    pub scan: ScanType,
+    /// Whether the scan is on by default (only when its artifact is present).
+    pub default_on: bool,
+    /// Human-readable explanation of what the scan does here.
+    pub rationale: &'static str,
+    /// The artifact the scan consumes.
+    pub requires: ArtifactRequirement,
+}
+
+impl ScanRule {
+    const fn new(
+        scan: ScanType,
+        default_on: bool,
+        rationale: &'static str,
+        requires: ArtifactRequirement,
+    ) -> Self {
+        Self {
+            scan,
+            default_on,
+            rationale,
+            requires,
+        }
+    }
+}
+
+/// A resolved scan choice for a specific target: a rule intersected with the
+/// artifacts actually present. `blocked_reason` is `Some` when the required
+/// artifact is missing.
+#[derive(Debug, Clone)]
+pub struct ScanOption {
+    /// The scan.
+    pub scan: ScanType,
+    /// Whether to pre-select the scan (false when blocked).
+    pub default_on: bool,
+    /// Why the scan is offered.
+    pub rationale: String,
+    /// The artifact kind the scan needs, if any specific one.
+    pub required_artifact: Option<ArtifactKind>,
+    /// Set when the required artifact is absent, explaining the block.
+    pub blocked_reason: Option<String>,
+}
+
+/// The SAST umbrella: every static-analysis sub-scan that runs over source code.
+fn sast_umbrella() -> Vec<ScanRule> {
+    use ArtifactRequirement::Code;
+    vec![
+        ScanRule::new(
+            ScanType::Sast,
+            true,
+            "Static analysis (Semgrep) over source",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Sbom,
+            true,
+            "Software bill of materials from source",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Cve,
+            true,
+            "Match dependencies against known CVEs",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::SecretDetection,
+            true,
+            "Scan source for committed secrets",
+            Code,
+        ),
+        ScanRule::new(ScanType::Lint, true, "Language linters over source", Code),
+        ScanRule::new(
+            ScanType::Gdpr,
+            true,
+            "GDPR data-handling pattern checks",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::OAuth,
+            true,
+            "OAuth misconfiguration patterns",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::Graph,
+            true,
+            "Build the code graph for impact analysis",
+            Code,
+        ),
+        ScanRule::new(
+            ScanType::CodeReview,
+            false,
+            "LLM code review over changed source",
+            Code,
+        ),
+    ]
+}
+
+/// The rule set for a target type. Scans that are never applicable to a type are
+/// simply absent (e.g. DAST is not listed for a PLC target).
+pub fn rules_for(target_type: TargetType) -> Vec<ScanRule> {
+    use ArtifactRequirement::{Firmware, Mobile, Plc, RunningUrl};
+    match target_type {
+        TargetType::WebApp | TargetType::BackendService => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::Dast,
+                true,
+                "Dynamic scan of the running endpoint",
+                RunningUrl,
+            ));
+            r
+        }
+        TargetType::DesktopApp => sast_umbrella(),
+        TargetType::AndroidApp | TargetType::IosApp => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::MobileStatic,
+                true,
+                "Static analysis of the mobile package (manifest, permissions, libs)",
+                Mobile,
+            ));
+            r
+        }
+        TargetType::FirmwareBareMetal | TargetType::FirmwareRtos => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::FirmwareStatic,
+                true,
+                "Unpack and statically analyze the firmware image",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Sbom,
+                true,
+                "SBOM from the firmware image (binwalk / tramiton)",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Cve,
+                true,
+                "Match firmware components against known CVEs",
+                Firmware,
+            ));
+            r
+        }
+        TargetType::EmbeddedLinuxYocto => {
+            let mut r = sast_umbrella();
+            r.push(ScanRule::new(
+                ScanType::FirmwareStatic,
+                true,
+                "EMBA / binwalk static analysis of the image",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Sbom,
+                true,
+                "SBOM from image layers / recipes",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Cve,
+                true,
+                "Match image components against known CVEs",
+                Firmware,
+            ));
+            r.push(ScanRule::new(
+                ScanType::Dast,
+                false,
+                "Dynamic scan of exposed network services (if any)",
+                RunningUrl,
+            ));
+            r
+        }
+        TargetType::PlcSps => vec![ScanRule::new(
+            ScanType::PlcControlLogic,
+            true,
+            "Control-logic security rules over the PLC program",
+            Plc,
+        )],
+    }
+}
+
+/// Whether an active penetration test is applicable to this target type.
+///
+/// Pentest runs as its own session (not a [`ScanType`] scan) and needs a
+/// reachable running target, so it is offered only for the network-reachable
+/// families.
+pub fn supports_pentest(target_type: TargetType) -> bool {
+    matches!(
+        target_type,
+        TargetType::WebApp
+            | TargetType::BackendService
+            | TargetType::AndroidApp
+            | TargetType::IosApp
+            | TargetType::EmbeddedLinuxYocto
+    )
+}
+
+/// The representative artifact kind a requirement is satisfied by.
+fn representative_kind(req: ArtifactRequirement) -> Option<ArtifactKind> {
+    match req {
+        ArtifactRequirement::Code => Some(ArtifactKind::GitRepo),
+        ArtifactRequirement::RunningUrl => Some(ArtifactKind::LiveUrl),
+        ArtifactRequirement::Firmware => Some(ArtifactKind::FirmwareImage),
+        ArtifactRequirement::Plc => Some(ArtifactKind::PlcProject),
+        ArtifactRequirement::Mobile => Some(ArtifactKind::MobilePackage),
+        ArtifactRequirement::Container => Some(ArtifactKind::ContainerImage),
+        ArtifactRequirement::Any => None,
+    }
+}
+
+/// Whether the target carries an artifact that satisfies the requirement.
+fn requirement_satisfied(req: ArtifactRequirement, target: &OnboardedTarget) -> bool {
+    match req {
+        ArtifactRequirement::Code => target.code_artifact().is_some(),
+        ArtifactRequirement::RunningUrl => target.has(ArtifactKind::LiveUrl),
+        ArtifactRequirement::Firmware => target.has(ArtifactKind::FirmwareImage),
+        ArtifactRequirement::Plc => target.has(ArtifactKind::PlcProject),
+        ArtifactRequirement::Mobile => target.has(ArtifactKind::MobilePackage),
+        ArtifactRequirement::Container => target.has(ArtifactKind::ContainerImage),
+        ArtifactRequirement::Any => true,
+    }
+}
+
+/// Resolve the matrix for a concrete target into the scans it can run, marking
+/// any whose required artifact is missing as blocked.
+pub fn applicable_scans(target: &OnboardedTarget) -> Vec<ScanOption> {
+    rules_for(target.target_type)
+        .into_iter()
+        .map(|rule| {
+            let satisfied = requirement_satisfied(rule.requires, target);
+            let required_artifact = representative_kind(rule.requires);
+            let blocked_reason = if satisfied {
+                None
+            } else {
+                Some(match required_artifact {
+                    Some(kind) => format!("no {kind} artifact provided"),
+                    None => "required artifact missing".to_string(),
+                })
+            };
+            ScanOption {
+                scan: rule.scan,
+                default_on: rule.default_on && satisfied,
+                rationale: rule.rationale.to_string(),
+                required_artifact,
+                blocked_reason,
+            }
+        })
+        .collect()
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used, clippy::unwrap_used)]
+mod tests {
+    use super::*;
+    use crate::models::{Artifact, PlcFormat};
+
+    fn target_with(target_type: TargetType, artifacts: Vec<Artifact>) -> OnboardedTarget {
+        let mut t = OnboardedTarget::new("t".to_string(), target_type);
+        t.artifacts = artifacts;
+        t
+    }
+
+    fn option<'a>(opts: &'a [ScanOption], scan: ScanType) -> Option<&'a ScanOption> {
+        opts.iter().find(|o| o.scan == scan)
+    }
+
+    #[test]
+    fn webapp_with_code_and_url_offers_sast_and_dast() {
+        let t = target_with(
+            TargetType::WebApp,
+            vec![
+                Artifact::git_repo("u", "main"),
+                Artifact::live_url("http://x"),
+            ],
+        );
+        let opts = applicable_scans(&t);
+        let sast = option(&opts, ScanType::Sast).expect("sast offered");
+        assert!(sast.default_on && sast.blocked_reason.is_none());
+        let dast = option(&opts, ScanType::Dast).expect("dast offered");
+        assert!(dast.default_on && dast.blocked_reason.is_none());
+    }
+
+    #[test]
+    fn webapp_without_url_blocks_dast() {
+        let t = target_with(TargetType::WebApp, vec![Artifact::git_repo("u", "main")]);
+        let opts = applicable_scans(&t);
+        let dast = option(&opts, ScanType::Dast).expect("dast listed");
+        assert!(!dast.default_on);
+        assert!(dast.blocked_reason.is_some());
+        assert_eq!(dast.required_artifact, Some(ArtifactKind::LiveUrl));
+    }
+
+    #[test]
+    fn firmware_offers_firmware_static_and_not_dast() {
+        let t = target_with(
+            TargetType::FirmwareBareMetal,
+            vec![Artifact::firmware_image("fw.bin")],
+        );
+        let opts = applicable_scans(&t);
+        let fw = option(&opts, ScanType::FirmwareStatic).expect("firmware static offered");
+        assert!(fw.default_on && fw.blocked_reason.is_none());
+        assert!(option(&opts, ScanType::Dast).is_none());
+    }
+
+    #[test]
+    fn plc_offers_only_control_logic() {
+        let t = target_with(
+            TargetType::PlcSps,
+            vec![Artifact::plc_project("p.xml", PlcFormat::PlcopenXml)],
+        );
+        let opts = applicable_scans(&t);
+        assert_eq!(opts.len(), 1);
+        assert_eq!(opts[0].scan, ScanType::PlcControlLogic);
+        assert!(opts[0].default_on);
+    }
+
+    #[test]
+    fn pentest_support_matches_reachable_families() {
+        assert!(supports_pentest(TargetType::WebApp));
+        assert!(supports_pentest(TargetType::BackendService));
+        assert!(!supports_pentest(TargetType::PlcSps));
+        assert!(!supports_pentest(TargetType::FirmwareBareMetal));
+        assert!(!supports_pentest(TargetType::DesktopApp));
+    }
+
+    #[test]
+    fn every_target_type_has_at_least_one_rule() {
+        for tt in [
+            TargetType::WebApp,
+            TargetType::BackendService,
+            TargetType::DesktopApp,
+            TargetType::AndroidApp,
+            TargetType::IosApp,
+            TargetType::FirmwareBareMetal,
+            TargetType::FirmwareRtos,
+            TargetType::EmbeddedLinuxYocto,
+            TargetType::PlcSps,
+        ] {
+            assert!(!rules_for(tt).is_empty(), "{tt} has no rules");
+        }
+    }
+}

compliance-core/src/tenant.rs

@@ -1,9 +1,9 @@
 //! Tenant context propagated through every authenticated request.
 //!
-//! This module is the M7.1 single source of truth for "who is this request
+//! M7.1 single source of truth for "who is this request for". Claims come
-//! for". Claims come from a Keycloak-issued JWT and land here via
+//! from a Keycloak-issued JWT and land here via [`crate::auth::require_jwt_auth`]
-//! `compliance-agent`'s `require_jwt_auth` middleware. Handlers reach into
+//! (enabled with the `axum` feature). Handlers reach into the request
-//! the request extensions with the `TenantCtx` Axum extractor.
+//! extensions with the [`crate::tenant_ctx::TenantCtx`] extractor.
 //!
 //! The shape mirrors the JWT claim names the breakpilot-platform realm
 //! emits (see `platform/orca-platform/dev/keycloak/realm-export.json`).
@@ -87,8 +87,8 @@ impl OrgRole {
     }
 }
 
-/// Everything `compliance-agent` knows about the requesting tenant at the
+/// Everything we know about the requesting tenant at the moment a request
-/// moment a request lands. Cheap to clone (every field is owned + small).
+/// lands. Cheap to clone (every field is owned + small).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TenantContext {
     /// `tenants.id` from the platform's tenant-registry (UUID).

compliance-core/src/tenant_ctx.rs

@@ -9,17 +9,18 @@
 //! }
 //! ```
 //!
-//! The middleware (`require_jwt_auth`) is responsible for inserting the
+//! The middleware ([`crate::auth::require_jwt_auth`]) is responsible for
-//! context into the request extensions. If it's missing on a route that
+//! inserting the context into the request extensions. If it's missing on
-//! uses this extractor, that's a bug in the wiring — we return 401 so the
+//! a route that uses this extractor, that's a bug in the wiring — we
-//! caller sees an auth failure rather than a 500.
+//! return 401 so the caller sees an auth failure rather than a 500.
 
 use axum::{
     extract::FromRequestParts,
     http::{request::Parts, StatusCode},
     response::{IntoResponse, Response},
 };
-use compliance_core::TenantContext;
+
+use crate::TenantContext;
 
 #[derive(Debug, Clone)]
 pub struct TenantCtx(pub TenantContext);
@@ -57,8 +58,8 @@ where
 #[allow(clippy::expect_used, clippy::unwrap_used)]
 mod tests {
     use super::*;
+    use crate::TenantStatus;
     use axum::http::Request;
-    use compliance_core::TenantStatus;
 
     fn ctx() -> TenantContext {
         TenantContext {

compliance-core/src/traits/classifier.rs

@@ -0,0 +1,51 @@
+//! The target-classification port.
+//!
+//! A [`TargetClassifier`] inspects a target's artifacts (and optionally their
+//! ingested working directories) and proposes one or more [`ClassifierVerdict`]s
+//! — a target type, a confidence, and the facts the decision rested on. Concrete
+//! classifiers live in the agent (language/build-system fingerprinting, a
+//! firmware detector backed by tramiton, etc.); a registry merges and ranks
+//! their verdicts. This mirrors the [`crate::traits::Scanner`] port so the two
+//! read the same way.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, DetectedFact, TargetType};
+
+/// Everything a classifier needs to reason about a target.
+pub struct ClassificationInput<'a> {
+    /// The artifacts declared for the target.
+    pub artifacts: &'a [Artifact],
+    /// Ingested working paths, keyed by [`Artifact::id`]. Absent for artifacts
+    /// with no on-disk form (e.g. a live URL).
+    pub working_paths: &'a HashMap<String, PathBuf>,
+    /// Free-form description of the target, if provided.
+    pub description: Option<&'a str>,
+}
+
+/// A single classifier's proposal for a target.
+pub struct ClassifierVerdict {
+    /// The proposed target type.
+    pub target_type: TargetType,
+    /// Confidence in `[0.0, 1.0]`.
+    pub confidence: f32,
+    /// Facts that informed the proposal.
+    pub facts: Vec<DetectedFact>,
+    /// Human-readable explanation.
+    pub rationale: String,
+}
+
+/// A source of target-type classification.
+#[allow(async_fn_in_trait)]
+pub trait TargetClassifier: Send + Sync {
+    /// Stable identifier for this classifier (recorded in `detected_by`).
+    fn name(&self) -> &str;
+
+    /// Propose zero or more ranked verdicts for the given input.
+    async fn classify(
+        &self,
+        input: &ClassificationInput<'_>,
+    ) -> Result<Vec<ClassifierVerdict>, CoreError>;
+}

compliance-core/src/traits/controls.rs

@@ -0,0 +1,45 @@
+//! The compliance-controls provider port.
+//!
+//! The mapping engine turns findings into compliance status against a corpus of
+//! controls. That corpus is pluggable: the built-in OSCAL catalog by default, or
+//! a tenant-owned RAG of atomic controls derived from laws
+//! (`breakpilot-compliance`) when available. A [`ControlsProvider`] abstracts the
+//! source so the mapping engine does not hardcode a catalog.
+
+use crate::error::CoreError;
+use crate::models::ComplianceFramework;
+
+/// A control retrieved from a controls corpus.
+#[derive(Debug, Clone)]
+pub struct Control {
+    /// Stable control identifier (e.g. an OSCAL control id or a RAG chunk id).
+    pub id: String,
+    /// The framework this control belongs to.
+    pub framework: ComplianceFramework,
+    /// Short human-readable title.
+    pub title: String,
+    /// The control text / requirement.
+    pub text: String,
+    /// Free-form source reference (catalog name, law citation, ...).
+    pub source: Option<String>,
+}
+
+/// A query for relevant controls.
+pub struct ControlQuery<'a> {
+    /// Frameworks in scope for the target.
+    pub frameworks: &'a [ComplianceFramework],
+    /// Free-text describing what to map (a finding summary, a component, ...).
+    pub context: &'a str,
+    /// Maximum number of controls to return.
+    pub limit: usize,
+}
+
+/// A source of compliance controls (built-in OSCAL catalog, breakpilot RAG, ...).
+#[allow(async_fn_in_trait)]
+pub trait ControlsProvider: Send + Sync {
+    /// Stable identifier for this provider.
+    fn name(&self) -> &str;
+
+    /// Retrieve the controls most relevant to the query.
+    async fn controls(&self, query: &ControlQuery<'_>) -> Result<Vec<Control>, CoreError>;
+}

compliance-core/src/traits/evidence.rs

@@ -0,0 +1,58 @@
+//! The external-evidence provider port.
+//!
+//! A sibling product (tramiton, for firmware) may already hold authoritative
+//! analysis for an artifact. An [`EvidenceProvider`] lets compliance-scanner
+//! *reconcile* that evidence — a build plan, an SBOM, a VEX document, a
+//! reproducible-build lock, an attestation — instead of recomputing it. The key
+//! used to match is the artifact content digest (a firmware sha256, which equals
+//! [`crate::models::Artifact::content_hash`]).
+//!
+//! Concrete providers live in the agent (a tramiton CLI shell-out today, a cloud
+//! client later) plus a deterministic mock for tests, so nothing here depends on
+//! an external binary.
+
+use std::path::Path;
+
+use crate::error::CoreError;
+use crate::models::{Artifact, ExternalSystem};
+
+/// A single reconcilable evidence document fetched from a sibling product.
+#[derive(Debug, Clone)]
+pub struct EvidenceDocument {
+    /// What the document is: `build_plan` | `sbom` | `vex` | `lock` | `attestation`.
+    pub kind: String,
+    /// The document's format (e.g. `cyclonedx-1.5`, `openvex-0.2.0`, `toml`, `json`).
+    pub format: String,
+    /// The raw document payload.
+    pub content: String,
+}
+
+/// The evidence a provider could return for a target's artifact.
+#[derive(Debug, Clone, Default)]
+pub struct ReconciledEvidence {
+    /// The sibling's project identifier, if resolved.
+    pub project_id: Option<String>,
+    /// The subject content digest the evidence pertains to.
+    pub subject_sha256: Option<String>,
+    /// The documents fetched (any of build plan / SBOM / VEX / lock / attestation).
+    pub documents: Vec<EvidenceDocument>,
+}
+
+/// A source of externally-held, reconcilable evidence for an artifact.
+#[allow(async_fn_in_trait)]
+pub trait EvidenceProvider: Send + Sync {
+    /// Which sibling product this provider integrates.
+    fn system(&self) -> ExternalSystem;
+
+    /// Whether this provider can handle the given artifact + working path
+    /// (e.g. tramiton handles firmware images / embedded source trees).
+    fn handles(&self, artifact: &Artifact, working_path: Option<&Path>) -> bool;
+
+    /// Reconcile existing evidence for the artifact, keyed by its content digest.
+    /// Returns `Ok(None)` when the provider has nothing for this artifact.
+    async fn reconcile(
+        &self,
+        artifact: &Artifact,
+        working_path: Option<&Path>,
+    ) -> Result<Option<ReconciledEvidence>, CoreError>;
+}

compliance-core/src/traits/mod.rs

@@ -1,10 +1,16 @@
+pub mod classifier;
+pub mod controls;
 pub mod dast_agent;
+pub mod evidence;
 pub mod graph_builder;
 pub mod issue_tracker;
 pub mod pentest_tool;
 pub mod scanner;
 
+pub use classifier::{ClassificationInput, ClassifierVerdict, TargetClassifier};
+pub use controls::{Control, ControlQuery, ControlsProvider};
 pub use dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
+pub use evidence::{EvidenceDocument, EvidenceProvider, ReconciledEvidence};
 pub use graph_builder::{LanguageParser, ParseOutput};
 pub use issue_tracker::IssueTracker;
 pub use pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};

compliance-dashboard/src/app.rs

@@ -44,6 +44,8 @@ pub enum Route {
         PentestSessionPage { session_id: String },
         #[route("/mcp-servers")]
         McpServersPage {},
+        #[route("/mcp-tokens")]
+        McpTokensPage {},
 }
 
 const FAVICON: Asset = asset!("/assets/favicon.svg");

compliance-dashboard/src/infrastructure/agent_client.rs

@@ -0,0 +1,210 @@
+//! Authenticated HTTP client for talking to the compliance-agent.
+//!
+//! Every dashboard server function that hits `comp-dev.meghsakha.com/api/v1/*`
+//! must go through here so the Keycloak access token from the user's
+//! session is attached as `Authorization: Bearer <token>`. Without it
+//! the agent's M7.1 `require_jwt_auth` middleware rejects with 401
+//! "Missing authorization header".
+//!
+//! When Keycloak is not configured (dev convenience), the helper
+//! returns an unauthenticated builder — matching the agent's
+//! pass-through behavior in the same state.
+//!
+//! **Token refresh**: KC access tokens are short-lived (5 min default
+//! in the certifai realm). Before attaching, we decode the JWT's `exp`
+//! claim and proactively refresh via the stored refresh_token if the
+//! access token is expired or about to expire. The session is updated
+//! with the new pair. If refresh fails, we send the (stale) token
+//! anyway — the agent's 401 will surface to the UI, which can prompt
+//! re-login.
+
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use dioxus::prelude::ServerFnError;
+use dioxus_fullstack::FullstackContext;
+use reqwest::Method;
+
+use super::auth::LOGGED_IN_USER_SESS_KEY;
+use super::server_state::ServerState;
+use super::user_state::UserStateInner;
+
+/// Seconds before the JWT's `exp` time at which we consider it stale
+/// enough to refresh. Covers clock skew + the round-trip to the agent
+/// so the token doesn't expire mid-flight.
+const REFRESH_SKEW_SECS: i64 = 30;
+
+/// Build a `RequestBuilder` for `<agent_api_url><path>` with the
+/// session's access token attached. `path` should include a leading
+/// `/`, e.g. `"/api/v1/repositories"`.
+pub async fn agent_request(
+    method: Method,
+    path: &str,
+) -> Result<reqwest::RequestBuilder, ServerFnError> {
+    let state: ServerState = FullstackContext::extract().await?;
+    let url = format!("{}{}", state.agent_api_url, path);
+    let mut req = reqwest::Client::new().request(method, &url);
+    req = attach_token(req, &state).await?;
+    Ok(req)
+}
+
+/// Same as [`agent_request`] but for `GET`. Convenience for the common case.
+pub async fn agent_get(path: &str) -> Result<reqwest::RequestBuilder, ServerFnError> {
+    agent_request(Method::GET, path).await
+}
+
+/// Attach the session's bearer token if Keycloak is configured AND the
+/// session has a logged-in user. Refresh the token proactively if it's
+/// expired or about to expire. Persists refreshed tokens back into the
+/// session.
+async fn attach_token(
+    req: reqwest::RequestBuilder,
+    state: &ServerState,
+) -> Result<reqwest::RequestBuilder, ServerFnError> {
+    if state.keycloak.is_none() {
+        return Ok(req);
+    }
+    let session: tower_sessions::Session = FullstackContext::extract().await?;
+    let user: Option<UserStateInner> = session
+        .get(LOGGED_IN_USER_SESS_KEY)
+        .await
+        .map_err(|e| ServerFnError::new(format!("session read failed: {e}")))?;
+    let Some(mut user) = user else {
+        return Ok(req);
+    };
+
+    if token_needs_refresh(&user.access_token) {
+        tracing::debug!("Access token expired or near-expiring; refreshing");
+        match refresh_tokens(state, &user.refresh_token).await {
+            Ok((new_access, new_refresh)) => {
+                user.access_token = new_access;
+                if let Some(rt) = new_refresh {
+                    user.refresh_token = rt;
+                }
+                if let Err(e) = session.insert(LOGGED_IN_USER_SESS_KEY, &user).await {
+                    tracing::warn!("Failed to persist refreshed tokens: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!("Token refresh failed: {e}; sending current token anyway");
+                // Fall through — the agent will 401 and the UI will
+                // prompt re-login. Better than failing the request at
+                // the dashboard layer with no helpful UX cue.
+            }
+        }
+    }
+
+    Ok(req.bearer_auth(user.access_token))
+}
+
+/// Decode the JWT's payload (no signature verification — the agent
+/// does that) and check the `exp` claim. Treats malformed tokens as
+/// expired so the refresh path runs.
+fn token_needs_refresh(jwt: &str) -> bool {
+    let Some(payload_b64) = jwt.split('.').nth(1) else {
+        return true;
+    };
+    let Ok(bytes) = URL_SAFE_NO_PAD.decode(payload_b64) else {
+        return true;
+    };
+    #[derive(serde::Deserialize)]
+    struct ExpClaim {
+        exp: i64,
+    }
+    let Ok(claims) = serde_json::from_slice::<ExpClaim>(&bytes) else {
+        return true;
+    };
+    let now = chrono::Utc::now().timestamp();
+    claims.exp - REFRESH_SKEW_SECS <= now
+}
+
+/// Exchange a refresh_token for a new access_token. Returns the new
+/// access_token and (optionally) the new refresh_token KC issued.
+/// KC may rotate refresh_tokens on use; we honor whatever it sends.
+async fn refresh_tokens(
+    state: &ServerState,
+    refresh_token: &str,
+) -> Result<(String, Option<String>), String> {
+    let kc = state
+        .keycloak
+        .ok_or_else(|| "Keycloak not configured".to_string())?;
+    if refresh_token.is_empty() {
+        return Err("no refresh_token in session".to_string());
+    }
+
+    #[derive(serde::Deserialize)]
+    struct TokenResp {
+        access_token: String,
+        refresh_token: Option<String>,
+    }
+
+    let resp = reqwest::Client::new()
+        .post(kc.token_endpoint())
+        .form(&[
+            ("grant_type", "refresh_token"),
+            ("client_id", kc.client_id.as_str()),
+            ("refresh_token", refresh_token),
+        ])
+        .send()
+        .await
+        .map_err(|e| format!("refresh request failed: {e}"))?;
+
+    if !resp.status().is_success() {
+        let status = resp.status();
+        let body = resp.text().await.unwrap_or_default();
+        return Err(format!("refresh rejected ({status}): {body}"));
+    }
+
+    let r: TokenResp = resp
+        .json()
+        .await
+        .map_err(|e| format!("refresh response parse failed: {e}"))?;
+    Ok((r.access_token, r.refresh_token))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use base64::Engine;
+
+    /// Build a JWT-shaped string (header.payload.sig) with the given
+    /// payload. Signature is bogus — we never verify it locally.
+    fn make_jwt(payload: &serde_json::Value) -> String {
+        let payload_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(payload).unwrap());
+        format!("hdr.{payload_b64}.sig")
+    }
+
+    #[test]
+    fn token_needs_refresh_true_when_expired() {
+        let exp = chrono::Utc::now().timestamp() - 60;
+        let jwt = make_jwt(&serde_json::json!({ "exp": exp }));
+        assert!(token_needs_refresh(&jwt));
+    }
+
+    #[test]
+    fn token_needs_refresh_true_within_skew_window() {
+        // 10 seconds left; less than the 30s skew → must refresh.
+        let exp = chrono::Utc::now().timestamp() + 10;
+        let jwt = make_jwt(&serde_json::json!({ "exp": exp }));
+        assert!(token_needs_refresh(&jwt));
+    }
+
+    #[test]
+    fn token_needs_refresh_false_with_plenty_of_life() {
+        let exp = chrono::Utc::now().timestamp() + 600;
+        let jwt = make_jwt(&serde_json::json!({ "exp": exp }));
+        assert!(!token_needs_refresh(&jwt));
+    }
+
+    #[test]
+    fn token_needs_refresh_true_on_malformed_jwt() {
+        assert!(token_needs_refresh(""));
+        assert!(token_needs_refresh("not.a.jwt"));
+        assert!(token_needs_refresh("only-one-segment"));
+        assert!(token_needs_refresh("hdr.not-base64!.sig"));
+    }
+
+    #[test]
+    fn token_needs_refresh_true_when_exp_missing() {
+        let jwt = make_jwt(&serde_json::json!({ "sub": "abc" }));
+        assert!(token_needs_refresh(&jwt));
+    }
+}

compliance-dashboard/src/infrastructure/chat.rs

@@ -61,23 +61,21 @@ pub async fn send_chat_message(
     message: String,
     history: Vec<ChatHistoryMessage>,
 ) -> Result<ChatApiResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    // Chat uses a longer timeout because the LLM round-trip can be slow;
-        dioxus_fullstack::FullstackContext::extract().await?;
+    // agent_request doesn't expose a per-call timeout so we layer one on.
-
+    let resp = super::agent_client::agent_request(
-    let url = format!("{}/api/v1/chat/{repo_id}", state.agent_api_url);
+        reqwest::Method::POST,
-    let client = reqwest::Client::builder()
+        &format!("/api/v1/chat/{repo_id}"),
-        .timeout(std::time::Duration::from_secs(120))
+    )
-        .build()
+    .await?
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    .timeout(std::time::Duration::from_secs(120))
-    let resp = client
+    .json(&serde_json::json!({
-        .post(&url)
+        "message": message,
-        .json(&serde_json::json!({
+        "history": history,
-            "message": message,
+    }))
-            "history": history,
+    .send()
-        }))
+    .await
-        .send()
+    .map_err(|e| ServerFnError::new(format!("Request failed: {e}")))?;
-        .await
-        .map_err(|e| ServerFnError::new(format!("Request failed: {e}")))?;
 
     let text = resp
         .text()
@@ -91,19 +89,14 @@ pub async fn send_chat_message(
 
 #[server]
 pub async fn trigger_embedding_build(repo_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-
+        &format!("/api/v1/chat/{repo_id}/build-embeddings"),
-    let url = format!(
+    )
-        "{}/api/v1/chat/{repo_id}/build-embeddings",
+    .await?
-        state.agent_api_url
+    .send()
-    );
+    .await
-    let client = reqwest::Client::new();
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-    client
-        .post(&url)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     Ok(())
 }
 
@@ -111,11 +104,9 @@ pub async fn trigger_embedding_build(repo_id: String) -> Result<(), ServerFnErro
 pub async fn fetch_embedding_status(
     repo_id: String,
 ) -> Result<EmbeddingStatusResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/chat/{repo_id}/status"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-
+        .send()
-    let url = format!("{}/api/v1/chat/{repo_id}/status", state.agent_api_url);
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: EmbeddingStatusResponse = resp

compliance-dashboard/src/infrastructure/dast.rs

@@ -26,10 +26,9 @@ pub struct DastFindingDetailResponse {
 
 #[server]
 pub async fn fetch_dast_targets() -> Result<DastTargetsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/dast/targets")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/dast/targets", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: DastTargetsResponse = resp
@@ -41,10 +40,9 @@ pub async fn fetch_dast_targets() -> Result<DastTargetsResponse, ServerFnError>
 
 #[server]
 pub async fn fetch_dast_scan_runs() -> Result<DastScanRunsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/dast/scan-runs")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/dast/scan-runs", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: DastScanRunsResponse = resp
@@ -56,10 +54,9 @@ pub async fn fetch_dast_scan_runs() -> Result<DastScanRunsResponse, ServerFnErro
 
 #[server]
 pub async fn fetch_dast_findings() -> Result<DastFindingsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/dast/findings")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/dast/findings", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: DastFindingsResponse = resp
@@ -73,10 +70,9 @@ pub async fn fetch_dast_findings() -> Result<DastFindingsResponse, ServerFnError
 pub async fn fetch_dast_finding_detail(
     id: String,
 ) -> Result<DastFindingDetailResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/dast/findings/{id}"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/dast/findings/{id}", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: DastFindingDetailResponse = resp
@@ -88,12 +84,8 @@ pub async fn fetch_dast_finding_detail(
 
 #[server]
 pub async fn add_dast_target(name: String, base_url: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/dast/targets")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/dast/targets", state.agent_api_url);
-    let client = reqwest::Client::new();
-    client
-        .post(&url)
         .json(&serde_json::json!({
             "name": name,
             "base_url": base_url,
@@ -106,17 +98,13 @@ pub async fn add_dast_target(name: String, base_url: String) -> Result<(), Serve
 
 #[server]
 pub async fn trigger_dast_scan(target_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/dast/targets/{target_id}/scan"),
-        "{}/api/v1/dast/targets/{target_id}/scan",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .send()
-    let client = reqwest::Client::new();
+    .await
-    client
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .post(&url)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     Ok(())
 }

compliance-dashboard/src/infrastructure/findings.rs

@@ -24,39 +24,35 @@ pub struct FindingsQuery {
 
 #[server]
 pub async fn fetch_findings(query: FindingsQuery) -> Result<FindingsListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let mut path = format!("/api/v1/findings?page={}&limit=20", query.page);
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let mut url = format!(
-        "{}/api/v1/findings?page={}&limit=20",
-        state.agent_api_url, query.page
-    );
     if !query.severity.is_empty() {
-        url.push_str(&format!("&severity={}", query.severity));
+        path.push_str(&format!("&severity={}", query.severity));
     }
     if !query.scan_type.is_empty() {
-        url.push_str(&format!("&scan_type={}", query.scan_type));
+        path.push_str(&format!("&scan_type={}", query.scan_type));
     }
     if !query.status.is_empty() {
-        url.push_str(&format!("&status={}", query.status));
+        path.push_str(&format!("&status={}", query.status));
     }
     if !query.repo_id.is_empty() {
-        url.push_str(&format!("&repo_id={}", query.repo_id));
+        path.push_str(&format!("&repo_id={}", query.repo_id));
     }
     if !query.q.is_empty() {
-        url.push_str(&format!(
+        path.push_str(&format!(
             "&q={}",
             url::form_urlencoded::byte_serialize(query.q.as_bytes()).collect::<String>()
         ));
     }
     if !query.sort_by.is_empty() {
-        url.push_str(&format!("&sort_by={}", query.sort_by));
+        path.push_str(&format!("&sort_by={}", query.sort_by));
     }
     if !query.sort_order.is_empty() {
-        url.push_str(&format!("&sort_order={}", query.sort_order));
+        path.push_str(&format!("&sort_order={}", query.sort_order));
     }
 
-    let resp = reqwest::get(&url)
+    let resp = super::agent_client::agent_get(&path)
+        .await?
+        .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: FindingsListResponse = resp
@@ -68,11 +64,9 @@ pub async fn fetch_findings(query: FindingsQuery) -> Result<FindingsListResponse
 
 #[server]
 pub async fn fetch_finding_detail(id: String) -> Result<Finding, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/findings/{id}"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/findings/{id}", state.agent_api_url);
+        .send()
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: serde_json::Value = resp
@@ -86,18 +80,15 @@ pub async fn fetch_finding_detail(id: String) -> Result<Finding, ServerFnError>
 
 #[server]
 pub async fn update_finding_status(id: String, status: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::PATCH,
-    let url = format!("{}/api/v1/findings/{id}/status", state.agent_api_url);
+        &format!("/api/v1/findings/{id}/status"),
-
+    )
-    let client = reqwest::Client::new();
+    .await?
-    client
+    .json(&serde_json::json!({ "status": status }))
-        .patch(&url)
+    .send()
-        .json(&serde_json::json!({ "status": status }))
+    .await
-        .send()
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
     Ok(())
 }
 
@@ -106,34 +97,25 @@ pub async fn bulk_update_finding_status(
     ids: Vec<String>,
     status: String,
 ) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(reqwest::Method::PATCH, "/api/v1/findings/bulk-status")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/findings/bulk-status", state.agent_api_url);
-
-    let client = reqwest::Client::new();
-    client
-        .patch(&url)
         .json(&serde_json::json!({ "ids": ids, "status": status }))
         .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
-
     Ok(())
 }
 
 #[server]
 pub async fn update_finding_feedback(id: String, feedback: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::PATCH,
-    let url = format!("{}/api/v1/findings/{id}/feedback", state.agent_api_url);
+        &format!("/api/v1/findings/{id}/feedback"),
-
+    )
-    let client = reqwest::Client::new();
+    .await?
-    client
+    .json(&serde_json::json!({ "feedback": feedback }))
-        .patch(&url)
+    .send()
-        .json(&serde_json::json!({ "feedback": feedback }))
+    .await
-        .send()
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
-
     Ok(())
 }

compliance-dashboard/src/infrastructure/graph.rs

@@ -50,10 +50,9 @@ pub struct SearchResponse {
 
 #[server]
 pub async fn fetch_graph(repo_id: String) -> Result<GraphDataResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/graph/{repo_id}"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/graph/{repo_id}", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: GraphDataResponse = resp
@@ -68,15 +67,12 @@ pub async fn fetch_impact(
     repo_id: String,
     finding_id: String,
 ) -> Result<ImpactResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp =
-        dioxus_fullstack::FullstackContext::extract().await?;
+        super::agent_client::agent_get(&format!("/api/v1/graph/{repo_id}/impact/{finding_id}"))
-    let url = format!(
+            .await?
-        "{}/api/v1/graph/{repo_id}/impact/{finding_id}",
+            .send()
-        state.agent_api_url
+            .await
-    );
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: ImpactResponse = resp
         .json()
         .await
@@ -86,10 +82,9 @@ pub async fn fetch_impact(
 
 #[server]
 pub async fn fetch_communities(repo_id: String) -> Result<CommunitiesResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/graph/{repo_id}/communities"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/graph/{repo_id}/communities", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: CommunitiesResponse = resp
@@ -104,15 +99,13 @@ pub async fn fetch_file_content(
     repo_id: String,
     file_path: String,
 ) -> Result<FileContentResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        "/api/v1/graph/{repo_id}/file-content?path={file_path}"
-    let url = format!(
+    ))
-        "{}/api/v1/graph/{repo_id}/file-content?path={file_path}",
+    .await?
-        state.agent_api_url
+    .send()
-    );
+    .await
-    let resp = reqwest::get(&url)
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: FileContentResponse = resp
         .json()
         .await
@@ -122,15 +115,13 @@ pub async fn fetch_file_content(
 
 #[server]
 pub async fn search_nodes(repo_id: String, query: String) -> Result<SearchResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        "/api/v1/graph/{repo_id}/search?q={query}&limit=50"
-    let url = format!(
+    ))
-        "{}/api/v1/graph/{repo_id}/search?q={query}&limit=50",
+    .await?
-        state.agent_api_url
+    .send()
-    );
+    .await
-    let resp = reqwest::get(&url)
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: SearchResponse = resp
         .json()
         .await
@@ -140,14 +131,13 @@ pub async fn search_nodes(repo_id: String, query: String) -> Result<SearchRespon
 
 #[server]
 pub async fn trigger_graph_build(repo_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!("{}/api/v1/graph/{repo_id}/build", state.agent_api_url);
+        &format!("/api/v1/graph/{repo_id}/build"),
-    let client = reqwest::Client::new();
+    )
-    client
+    .await?
-        .post(&url)
+    .send()
-        .send()
+    .await
-        .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     Ok(())
 }

compliance-dashboard/src/infrastructure/issues.rs

@@ -12,11 +12,9 @@ pub struct IssuesListResponse {
 
 #[server]
 pub async fn fetch_issues(page: u64) -> Result<IssuesListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/issues?page={page}&limit=20"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/issues?page={page}&limit=20", state.agent_api_url);
+        .send()
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: IssuesListResponse = resp

compliance-dashboard/src/infrastructure/mcp_tokens.rs

@@ -0,0 +1,90 @@
+//! Server-functions for the MCP-tokens management UI.
+//!
+//! These wrap the agent's `/api/v1/mcp-tokens` CRUD endpoints. The raw
+//! token returned by `create_mcp_token` is only visible at creation
+//! time — the agent's storage never holds the plaintext.
+
+use dioxus::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct McpTokenView {
+    pub id: String,
+    pub name: String,
+    pub token_prefix: String,
+    pub created_by: String,
+    pub created_at: serde_json::Value,
+    #[serde(default)]
+    pub last_used_at: Option<serde_json::Value>,
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct McpTokensListResponse {
+    pub data: Vec<McpTokenView>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct CreateMcpTokenResponse {
+    /// Raw token. Shown ONCE — the user must copy it now.
+    pub token: String,
+    pub view: McpTokenView,
+}
+
+#[server]
+pub async fn fetch_mcp_tokens() -> Result<McpTokensListResponse, ServerFnError> {
+    let resp = super::agent_client::agent_get("/api/v1/mcp-tokens")
+        .await?
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: McpTokensListResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+#[server]
+pub async fn create_mcp_token(name: String) -> Result<CreateMcpTokenResponse, ServerFnError> {
+    if name.trim().is_empty() {
+        return Err(ServerFnError::new("Name is required"));
+    }
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/mcp-tokens")
+        .await?
+        .json(&serde_json::json!({ "name": name.trim() }))
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to create token: {body}"
+        )));
+    }
+    let body: CreateMcpTokenResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+#[server]
+pub async fn revoke_mcp_token(id: String) -> Result<(), ServerFnError> {
+    let resp = super::agent_client::agent_request(
+        reqwest::Method::DELETE,
+        &format!("/api/v1/mcp-tokens/{id}"),
+    )
+    .await?
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to revoke token: {body}"
+        )));
+    }
+    Ok(())
+}

compliance-dashboard/src/infrastructure/mod.rs

@@ -8,6 +8,7 @@ pub mod graph;
 pub mod help_chat;
 pub mod issues;
 pub mod mcp;
+pub mod mcp_tokens;
 pub mod notifications;
 pub mod pentest;
 #[allow(clippy::too_many_arguments)]
@@ -18,6 +19,8 @@ pub mod stats;
 
 // Server-only modules
 #[cfg(feature = "server")]
+mod agent_client;
+#[cfg(feature = "server")]
 mod auth;
 #[cfg(feature = "server")]
 mod auth_middleware;

compliance-dashboard/src/infrastructure/notifications.rs

@@ -32,11 +32,9 @@ pub struct NotificationCountResponse {
 
 #[server]
 pub async fn fetch_notification_count() -> Result<u64, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/notifications/count")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-
+        .send()
-    let url = format!("{}/api/v1/notifications/count", state.agent_api_url);
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: NotificationCountResponse = resp
@@ -48,11 +46,9 @@ pub async fn fetch_notification_count() -> Result<u64, ServerFnError> {
 
 #[server]
 pub async fn fetch_notifications() -> Result<NotificationListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/notifications?limit=20")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-
+        .send()
-    let url = format!("{}/api/v1/notifications?limit=20", state.agent_api_url);
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: NotificationListResponse = resp
@@ -64,12 +60,8 @@ pub async fn fetch_notifications() -> Result<NotificationListResponse, ServerFnE
 
 #[server]
 pub async fn mark_all_notifications_read() -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/notifications/read-all")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-
-    let url = format!("{}/api/v1/notifications/read-all", state.agent_api_url);
-    reqwest::Client::new()
-        .post(&url)
         .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
@@ -78,14 +70,13 @@ pub async fn mark_all_notifications_read() -> Result<(), ServerFnError> {
 
 #[server]
 pub async fn dismiss_notification(id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::PATCH,
-
+        &format!("/api/v1/notifications/{id}/dismiss"),
-    let url = format!("{}/api/v1/notifications/{id}/dismiss", state.agent_api_url);
+    )
-    reqwest::Client::new()
+    .await?
-        .patch(&url)
+    .send()
-        .send()
+    .await
-        .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     Ok(())
 }

compliance-dashboard/src/infrastructure/pentest.rs

@@ -32,12 +32,10 @@ pub struct AttackChainResponse {
 
 #[server]
 pub async fn fetch_pentest_sessions() -> Result<PentestSessionsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
     // Fetch sessions
-    let url = format!("{}/api/v1/pentest/sessions", state.agent_api_url);
+    let resp = super::agent_client::agent_get("/api/v1/pentest/sessions")
-    let resp = reqwest::get(&url)
+        .await?
+        .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let mut body: PentestSessionsResponse = resp
@@ -46,31 +44,32 @@ pub async fn fetch_pentest_sessions() -> Result<PentestSessionsResponse, ServerF
         .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     // Fetch DAST targets to resolve target names
-    let targets_url = format!("{}/api/v1/dast/targets", state.agent_api_url);
+    if let Ok(tresp_builder) = super::agent_client::agent_get("/api/v1/dast/targets").await {
-    if let Ok(tresp) = reqwest::get(&targets_url).await {
+        if let Ok(tresp) = tresp_builder.send().await {
-        if let Ok(tbody) = tresp.json::<serde_json::Value>().await {
+            if let Ok(tbody) = tresp.json::<serde_json::Value>().await {
-            let targets = tbody.get("data").and_then(|v| v.as_array());
+                let targets = tbody.get("data").and_then(|v| v.as_array());
-            if let Some(targets) = targets {
+                if let Some(targets) = targets {
-                // Build target_id -> name lookup
+                    // Build target_id -> name lookup
-                let target_map: std::collections::HashMap<String, String> = targets
+                    let target_map: std::collections::HashMap<String, String> = targets
-                    .iter()
+                        .iter()
-                    .filter_map(|t| {
+                        .filter_map(|t| {
-                        let id = t.get("_id")?.get("$oid")?.as_str()?.to_string();
+                            let id = t.get("_id")?.get("$oid")?.as_str()?.to_string();
-                        let name = t.get("name")?.as_str()?.to_string();
+                            let name = t.get("name")?.as_str()?.to_string();
-                        Some((id, name))
+                            Some((id, name))
-                    })
+                        })
-                    .collect();
+                        .collect();
 
-                // Enrich sessions with target_name
+                    // Enrich sessions with target_name
-                for session in body.data.iter_mut() {
+                    for session in body.data.iter_mut() {
-                    if let Some(tid) = session.get("target_id").and_then(|v| v.as_str()) {
+                        if let Some(tid) = session.get("target_id").and_then(|v| v.as_str()) {
-                        if let Some(name) = target_map.get(tid) {
+                            if let Some(name) = target_map.get(tid) {
-                            session.as_object_mut().map(|obj| {
+                                session.as_object_mut().map(|obj| {
-                                obj.insert(
+                                    obj.insert(
-                                    "target_name".to_string(),
+                                        "target_name".to_string(),
-                                    serde_json::Value::String(name.clone()),
+                                        serde_json::Value::String(name.clone()),
-                                )
+                                    )
-                            });
+                                });
+                            }
                         }
                     }
                 }
@@ -83,10 +82,9 @@ pub async fn fetch_pentest_sessions() -> Result<PentestSessionsResponse, ServerF
 
 #[server]
 pub async fn fetch_pentest_session(id: String) -> Result<PentestSessionResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/pentest/sessions/{id}"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/pentest/sessions/{id}", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let mut body: PentestSessionResponse = resp
@@ -96,26 +94,27 @@ pub async fn fetch_pentest_session(id: String) -> Result<PentestSessionResponse,
 
     // Resolve target name from targets list
     if let Some(tid) = body.data.get("target_id").and_then(|v| v.as_str()) {
-        let targets_url = format!("{}/api/v1/dast/targets", state.agent_api_url);
+        if let Ok(tresp_builder) = super::agent_client::agent_get("/api/v1/dast/targets").await {
-        if let Ok(tresp) = reqwest::get(&targets_url).await {
+            if let Ok(tresp) = tresp_builder.send().await {
-            if let Ok(tbody) = tresp.json::<serde_json::Value>().await {
+                if let Ok(tbody) = tresp.json::<serde_json::Value>().await {
-                if let Some(targets) = tbody.get("data").and_then(|v| v.as_array()) {
+                    if let Some(targets) = tbody.get("data").and_then(|v| v.as_array()) {
-                    for t in targets {
+                        for t in targets {
-                        let t_id = t
+                            let t_id = t
-                            .get("_id")
+                                .get("_id")
-                            .and_then(|v| v.get("$oid"))
+                                .and_then(|v| v.get("$oid"))
-                            .and_then(|v| v.as_str())
+                                .and_then(|v| v.as_str())
-                            .unwrap_or("");
+                                .unwrap_or("");
-                        if t_id == tid {
+                            if t_id == tid {
-                            if let Some(name) = t.get("name").and_then(|v| v.as_str()) {
+                                if let Some(name) = t.get("name").and_then(|v| v.as_str()) {
-                                body.data.as_object_mut().map(|obj| {
+                                    body.data.as_object_mut().map(|obj| {
-                                    obj.insert(
+                                        obj.insert(
-                                        "target_name".to_string(),
+                                            "target_name".to_string(),
-                                        serde_json::Value::String(name.to_string()),
+                                            serde_json::Value::String(name.to_string()),
-                                    )
+                                        )
-                                });
+                                    });
+                                }
+                                break;
                             }
-                            break;
                         }
                     }
                 }
@@ -130,15 +129,12 @@ pub async fn fetch_pentest_session(id: String) -> Result<PentestSessionResponse,
 pub async fn fetch_pentest_messages(
     session_id: String,
 ) -> Result<PentestMessagesResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp =
-        dioxus_fullstack::FullstackContext::extract().await?;
+        super::agent_client::agent_get(&format!("/api/v1/pentest/sessions/{session_id}/messages"))
-    let url = format!(
+            .await?
-        "{}/api/v1/pentest/sessions/{session_id}/messages",
+            .send()
-        state.agent_api_url
+            .await
-    );
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: PentestMessagesResponse = resp
         .json()
         .await
@@ -148,10 +144,9 @@ pub async fn fetch_pentest_messages(
 
 #[server]
 pub async fn fetch_pentest_stats() -> Result<PentestStatsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/pentest/stats")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/pentest/stats", state.agent_api_url);
+        .send()
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: PentestStatsResponse = resp
@@ -163,15 +158,13 @@ pub async fn fetch_pentest_stats() -> Result<PentestStatsResponse, ServerFnError
 
 #[server]
 pub async fn fetch_attack_chain(session_id: String) -> Result<AttackChainResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        "/api/v1/pentest/sessions/{session_id}/attack-chain"
-    let url = format!(
+    ))
-        "{}/api/v1/pentest/sessions/{session_id}/attack-chain",
+    .await?
-        state.agent_api_url
+    .send()
-    );
+    .await
-    let resp = reqwest::get(&url)
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: AttackChainResponse = resp
         .json()
         .await
@@ -185,20 +178,17 @@ pub async fn create_pentest_session(
     strategy: String,
     message: String,
 ) -> Result<PentestSessionResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp =
-        dioxus_fullstack::FullstackContext::extract().await?;
+        super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/pentest/sessions")
-    let url = format!("{}/api/v1/pentest/sessions", state.agent_api_url);
+            .await?
-    let client = reqwest::Client::new();
+            .json(&serde_json::json!({
-    let resp = client
+                "target_id": target_id,
-        .post(&url)
+                "strategy": strategy,
-        .json(&serde_json::json!({
+                "message": message,
-            "target_id": target_id,
+            }))
-            "strategy": strategy,
+            .send()
-            "message": message,
+            .await
-        }))
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: PentestSessionResponse = resp
         .json()
         .await
@@ -211,18 +201,15 @@ pub async fn create_pentest_session(
 pub async fn create_pentest_session_wizard(
     config_json: String,
 ) -> Result<PentestSessionResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/pentest/sessions", state.agent_api_url);
     let config: serde_json::Value =
         serde_json::from_str(&config_json).map_err(|e| ServerFnError::new(e.to_string()))?;
-    let client = reqwest::Client::new();
+    let resp =
-    let resp = client
+        super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/pentest/sessions")
-        .post(&url)
+            .await?
-        .json(&serde_json::json!({ "config": config }))
+            .json(&serde_json::json!({ "config": config }))
-        .send()
+            .send()
-        .await
+            .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
     if !resp.status().is_success() {
         let text = resp.text().await.unwrap_or_default();
         return Err(ServerFnError::new(format!(
@@ -239,8 +226,6 @@ pub async fn create_pentest_session_wizard(
 /// Look up a tracked repository by its git URL
 #[server]
 pub async fn lookup_repo_by_url(url: String) -> Result<serde_json::Value, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
     let encoded_url: String = url
         .bytes()
         .flat_map(|b| {
@@ -251,13 +236,12 @@ pub async fn lookup_repo_by_url(url: String) -> Result<serde_json::Value, Server
             }
         })
         .collect();
-    let api_url = format!(
+    let resp =
-        "{}/api/v1/pentest/lookup-repo?url={}",
+        super::agent_client::agent_get(&format!("/api/v1/pentest/lookup-repo?url={encoded_url}"))
-        state.agent_api_url, encoded_url
+            .await?
-    );
+            .send()
-    let resp = reqwest::get(&api_url)
+            .await
-        .await
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: serde_json::Value = resp
         .json()
         .await
@@ -270,21 +254,17 @@ pub async fn send_pentest_message(
     session_id: String,
     message: String,
 ) -> Result<PentestMessagesResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/pentest/sessions/{session_id}/chat"),
-        "{}/api/v1/pentest/sessions/{session_id}/chat",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .json(&serde_json::json!({
-    let client = reqwest::Client::new();
+        "message": message,
-    let resp = client
+    }))
-        .post(&url)
+    .send()
-        .json(&serde_json::json!({
+    .await
-            "message": message,
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        }))
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: PentestMessagesResponse = resp
         .json()
         .await
@@ -294,35 +274,27 @@ pub async fn send_pentest_message(
 
 #[server]
 pub async fn stop_pentest_session(session_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/pentest/sessions/{session_id}/stop"),
-        "{}/api/v1/pentest/sessions/{session_id}/stop",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .send()
-    let client = reqwest::Client::new();
+    .await
-    client
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .post(&url)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     Ok(())
 }
 
 #[server]
 pub async fn pause_pentest_session(session_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/pentest/sessions/{session_id}/pause"),
-        "{}/api/v1/pentest/sessions/{session_id}/pause",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .send()
-    let client = reqwest::Client::new();
+    .await
-    let resp = client
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .post(&url)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     if !resp.status().is_success() {
         let text = resp.text().await.unwrap_or_default();
         return Err(ServerFnError::new(format!("Pause failed: {text}")));
@@ -332,18 +304,14 @@ pub async fn pause_pentest_session(session_id: String) -> Result<(), ServerFnErr
 
 #[server]
 pub async fn resume_pentest_session(session_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/pentest/sessions/{session_id}/resume"),
-        "{}/api/v1/pentest/sessions/{session_id}/resume",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .send()
-    let client = reqwest::Client::new();
+    .await
-    let resp = client
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .post(&url)
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     if !resp.status().is_success() {
         let text = resp.text().await.unwrap_or_default();
         return Err(ServerFnError::new(format!("Resume failed: {text}")));
@@ -355,15 +323,12 @@ pub async fn resume_pentest_session(session_id: String) -> Result<(), ServerFnEr
 pub async fn fetch_pentest_findings(
     session_id: String,
 ) -> Result<DastFindingsResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp =
-        dioxus_fullstack::FullstackContext::extract().await?;
+        super::agent_client::agent_get(&format!("/api/v1/pentest/sessions/{session_id}/findings"))
-    let url = format!(
+            .await?
-        "{}/api/v1/pentest/sessions/{session_id}/findings",
+            .send()
-        state.agent_api_url
+            .await
-    );
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: DastFindingsResponse = resp
         .json()
         .await
@@ -385,23 +350,19 @@ pub async fn export_pentest_report(
     requester_name: String,
     requester_email: String,
 ) -> Result<ExportReportResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!(
+        &format!("/api/v1/pentest/sessions/{session_id}/export"),
-        "{}/api/v1/pentest/sessions/{session_id}/export",
+    )
-        state.agent_api_url
+    .await?
-    );
+    .json(&serde_json::json!({
-    let client = reqwest::Client::new();
+        "password": password,
-    let resp = client
+        "requester_name": requester_name,
-        .post(&url)
+        "requester_email": requester_email,
-        .json(&serde_json::json!({
+    }))
-            "password": password,
+    .send()
-            "requester_name": requester_name,
+    .await
-            "requester_email": requester_email,
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        }))
-        .send()
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     if !resp.status().is_success() {
         let text = resp.text().await.unwrap_or_default();
         return Err(ServerFnError::new(format!("Export failed: {text}")));

compliance-dashboard/src/infrastructure/repositories.rs

@@ -12,14 +12,10 @@ pub struct RepositoryListResponse {
 
 #[server]
 pub async fn fetch_repositories(page: u64) -> Result<RepositoryListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let path = format!("/api/v1/repositories?page={page}&limit=20");
-        dioxus_fullstack::FullstackContext::extract().await?;
+    let resp = super::agent_client::agent_get(&path)
-    let url = format!(
+        .await?
-        "{}/api/v1/repositories?page={page}&limit=20",
+        .send()
-        state.agent_api_url
-    );
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: RepositoryListResponse = resp
@@ -41,10 +37,6 @@ pub async fn add_repository(
     tracker_repo: Option<String>,
     tracker_token: Option<String>,
 ) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/repositories", state.agent_api_url);
-
     let mut body = serde_json::json!({
         "name": name,
         "git_url": git_url,
@@ -69,9 +61,8 @@ pub async fn add_repository(
         body["tracker_token"] = serde_json::Value::String(tk);
     }
 
-    let client = reqwest::Client::new();
+    let resp = super::agent_client::agent_request(reqwest::Method::POST, "/api/v1/repositories")
-    let resp = client
+        .await?
-        .post(&url)
         .json(&body)
         .send()
         .await
@@ -100,10 +91,6 @@ pub async fn update_repository(
     tracker_token: Option<String>,
     scan_schedule: Option<String>,
 ) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-    let url = format!("{}/api/v1/repositories/{repo_id}", state.agent_api_url);
-
     let mut body = serde_json::Map::new();
     if let Some(v) = name.filter(|s| !s.is_empty()) {
         body.insert("name".into(), serde_json::Value::String(v));
@@ -133,13 +120,15 @@ pub async fn update_repository(
         body.insert("scan_schedule".into(), serde_json::Value::String(v));
     }
 
-    let client = reqwest::Client::new();
+    let resp = super::agent_client::agent_request(
-    let resp = client
+        reqwest::Method::PATCH,
-        .patch(&url)
+        &format!("/api/v1/repositories/{repo_id}"),
-        .json(&body)
+    )
-        .send()
+    .await?
-        .await
+    .json(&body)
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    .send()
+    .await
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     if !resp.status().is_success() {
         let text = resp.text().await.unwrap_or_default();
@@ -153,11 +142,9 @@ pub async fn update_repository(
 
 #[server]
 pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/settings/ssh-public-key")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/settings/ssh-public-key", state.agent_api_url);
+        .send()
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
 
@@ -179,16 +166,14 @@ pub async fn fetch_ssh_public_key() -> Result<String, ServerFnError> {
 
 #[server]
 pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::DELETE,
-    let url = format!("{}/api/v1/repositories/{repo_id}", state.agent_api_url);
+        &format!("/api/v1/repositories/{repo_id}"),
-
+    )
-    let client = reqwest::Client::new();
+    .await?
-    let resp = client
+    .send()
-        .delete(&url)
+    .await
-        .send()
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     if !resp.status().is_success() {
         let body = resp.text().await.unwrap_or_default();
@@ -202,16 +187,14 @@ pub async fn delete_repository(repo_id: String) -> Result<(), ServerFnError> {
 
 #[server]
 pub async fn trigger_repo_scan(repo_id: String) -> Result<(), ServerFnError> {
-    let state: super::server_state::ServerState =
+    super::agent_client::agent_request(
-        dioxus_fullstack::FullstackContext::extract().await?;
+        reqwest::Method::POST,
-    let url = format!("{}/api/v1/repositories/{repo_id}/scan", state.agent_api_url);
+        &format!("/api/v1/repositories/{repo_id}/scan"),
-
+    )
-    let client = reqwest::Client::new();
+    .await?
-    client
+    .send()
-        .post(&url)
+    .await
-        .send()
+    .map_err(|e| ServerFnError::new(e.to_string()))?;
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
 
     Ok(())
 }
@@ -224,16 +207,12 @@ pub struct WebhookConfigResponse {
 
 #[server]
 pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp =
-        dioxus_fullstack::FullstackContext::extract().await?;
+        super::agent_client::agent_get(&format!("/api/v1/repositories/{repo_id}/webhook-config"))
-    let url = format!(
+            .await?
-        "{}/api/v1/repositories/{repo_id}/webhook-config",
+            .send()
-        state.agent_api_url
+            .await
-    );
+            .map_err(|e| ServerFnError::new(e.to_string()))?;
-
-    let resp = reqwest::get(&url)
-        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: WebhookConfigResponse = resp
         .json()
         .await
@@ -244,11 +223,9 @@ pub async fn fetch_webhook_config(repo_id: String) -> Result<WebhookConfigRespon
 /// Check if a repository has any running scans
 #[server]
 pub async fn check_repo_scanning(repo_id: String) -> Result<bool, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/scan-runs?page=1&limit=1")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/scan-runs?page=1&limit=1", state.agent_api_url);
+        .send()
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: serde_json::Value = resp

compliance-dashboard/src/infrastructure/sbom.rs

@@ -87,11 +87,9 @@ pub struct SbomFiltersResponse {
 
 #[server]
 pub async fn fetch_sbom_filters() -> Result<SbomFiltersResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/sbom/filters")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-
+        .send()
-    let url = format!("{}/api/v1/sbom/filters", state.agent_api_url);
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let text = resp
@@ -112,9 +110,6 @@ pub async fn fetch_sbom_filtered(
     license: Option<String>,
     page: u64,
 ) -> Result<SbomListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
-        dioxus_fullstack::FullstackContext::extract().await?;
-
     let mut params = vec![format!("page={page}"), "limit=50".to_string()];
     if let Some(r) = &repo_id {
         if !r.is_empty() {
@@ -140,9 +135,10 @@ pub async fn fetch_sbom_filtered(
         }
     }
 
-    let url = format!("{}/api/v1/sbom?{}", state.agent_api_url, params.join("&"));
+    let path = format!("/api/v1/sbom?{}", params.join("&"));
-
+    let resp = super::agent_client::agent_get(&path)
-    let resp = reqwest::get(&url)
+        .await?
+        .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let text = resp
@@ -156,15 +152,10 @@ pub async fn fetch_sbom_filtered(
 
 #[server]
 pub async fn fetch_sbom_export(repo_id: String, format: String) -> Result<String, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let path = format!("/api/v1/sbom/export?repo_id={repo_id}&format={format}");
-        dioxus_fullstack::FullstackContext::extract().await?;
+    let resp = super::agent_client::agent_get(&path)
-
+        .await?
-    let url = format!(
+        .send()
-        "{}/api/v1/sbom/export?repo_id={}&format={}",
-        state.agent_api_url, repo_id, format
-    );
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let text = resp
@@ -178,17 +169,16 @@ pub async fn fetch_sbom_export(repo_id: String, format: String) -> Result<String
 pub async fn fetch_license_summary(
     repo_id: Option<String>,
 ) -> Result<LicenseSummaryResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let mut path = "/api/v1/sbom/licenses".to_string();
-        dioxus_fullstack::FullstackContext::extract().await?;
-
-    let mut url = format!("{}/api/v1/sbom/licenses", state.agent_api_url);
     if let Some(r) = &repo_id {
         if !r.is_empty() {
-            url = format!("{url}?repo_id={r}");
+            path = format!("{path}?repo_id={r}");
         }
     }
 
-    let resp = reqwest::get(&url)
+    let resp = super::agent_client::agent_get(&path)
+        .await?
+        .send()
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let text = resp
@@ -205,15 +195,10 @@ pub async fn fetch_sbom_diff(
     repo_a: String,
     repo_b: String,
 ) -> Result<SbomDiffResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let path = format!("/api/v1/sbom/diff?repo_a={repo_a}&repo_b={repo_b}");
-        dioxus_fullstack::FullstackContext::extract().await?;
+    let resp = super::agent_client::agent_get(&path)
-
+        .await?
-    let url = format!(
+        .send()
-        "{}/api/v1/sbom/diff?repo_a={}&repo_b={}",
-        state.agent_api_url, repo_a, repo_b
-    );
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let text = resp

compliance-dashboard/src/infrastructure/scans.rs

@@ -12,14 +12,9 @@ pub struct ScansListResponse {
 
 #[server]
 pub async fn fetch_scan_runs(page: u64) -> Result<ScansListResponse, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get(&format!("/api/v1/scan-runs?page={page}&limit=20"))
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!(
+        .send()
-        "{}/api/v1/scan-runs?page={page}&limit=20",
-        state.agent_api_url
-    );
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: ScansListResponse = resp

compliance-dashboard/src/infrastructure/stats.rs

@@ -16,11 +16,9 @@ pub struct OverviewStats {
 
 #[server]
 pub async fn fetch_overview_stats() -> Result<OverviewStats, ServerFnError> {
-    let state: super::server_state::ServerState =
+    let resp = super::agent_client::agent_get("/api/v1/stats/overview")
-        dioxus_fullstack::FullstackContext::extract().await?;
+        .await?
-    let url = format!("{}/api/v1/stats/overview", state.agent_api_url);
+        .send()
-
-    let resp = reqwest::get(&url)
         .await
         .map_err(|e| ServerFnError::new(e.to_string()))?;
     let body: serde_json::Value = resp

compliance-dashboard/src/pages/mcp_tokens.rs

@@ -0,0 +1,271 @@
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::components::page_header::PageHeader;
+use crate::components::toast::{ToastType, Toasts};
+use crate::infrastructure::mcp_tokens::{
+    create_mcp_token, fetch_mcp_tokens, revoke_mcp_token, CreateMcpTokenResponse,
+};
+
+#[component]
+pub fn McpTokensPage() -> Element {
+    let mut tokens = use_resource(|| async { fetch_mcp_tokens().await.ok() });
+    let mut toasts = use_context::<Toasts>();
+
+    // Create-form state
+    let mut show_form = use_signal(|| false);
+    let mut new_name = use_signal(String::new);
+    let mut submitting = use_signal(|| false);
+
+    // After creation, the raw token shows once in a banner
+    let mut just_created: Signal<Option<CreateMcpTokenResponse>> = use_signal(|| None);
+
+    // Revoke confirmation: (id, name)
+    let mut confirm_revoke: Signal<Option<(String, String)>> = use_signal(|| None);
+
+    rsx! {
+        PageHeader {
+            title: "MCP Tokens",
+            description: "Static bearer tokens for the MCP server. Use in your LLM client (Claude Desktop, Cursor, etc.) — one token per tool/device.",
+        }
+
+        // ── Just-created banner ────────────────────────────────────
+        if let Some(resp) = just_created() {
+            div { class: "card mb-4", style: "border: 1px solid var(--accent-warning); background: var(--bg-warning-subtle);",
+                div { class: "card-header", style: "color: var(--accent-warning);",
+                    Icon { icon: BsExclamationTriangle, width: 14, height: 14 }
+                    " Copy this token now — it won't be shown again"
+                }
+                div { style: "padding: 1rem;",
+                    p { style: "margin-bottom: 0.5rem; color: var(--text-secondary);",
+                        "Token for "
+                        strong { "{resp.view.name}" }
+                    }
+                    div { class: "copyable", style: "background: var(--bg-secondary); padding: 0.75rem; border-radius: 4px;",
+                        code { style: "font-family: var(--font-mono); word-break: break-all; flex: 1;", "{resp.token}" }
+                        crate::components::copy_button::CopyButton { value: resp.token.clone(), small: false }
+                    }
+                    div { style: "margin-top: 0.75rem;",
+                        button {
+                            class: "btn btn-sm btn-ghost",
+                            onclick: move |_| just_created.set(None),
+                            "Dismiss"
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Create form ────────────────────────────────────────────
+        div { class: "mb-4",
+            button {
+                class: "btn btn-primary",
+                onclick: move |_| {
+                    show_form.set(!show_form());
+                    new_name.set(String::new());
+                },
+                if show_form() { "Cancel" } else {
+                    Icon { icon: BsPlusLg, width: 14, height: 14 }
+                    " Create Token"
+                }
+            }
+        }
+
+        if show_form() {
+            div { class: "card mb-4",
+                div { class: "card-header", "New MCP Token" }
+                div { style: "padding: 1rem;",
+                    div { class: "form-group",
+                        label { "Name" }
+                        input {
+                            r#type: "text",
+                            placeholder: "Claude Desktop on my laptop",
+                            value: "{new_name}",
+                            oninput: move |e| new_name.set(e.value()),
+                        }
+                        small { style: "color: var(--text-secondary);", "A label so you can identify this token in the list. Not visible to LLM clients." }
+                    }
+                    div { style: "margin-top: 1rem;",
+                        button {
+                            class: "btn btn-primary",
+                            disabled: submitting() || new_name().trim().is_empty(),
+                            onclick: move |_| {
+                                let name = new_name().trim().to_string();
+                                if name.is_empty() {
+                                    return;
+                                }
+                                spawn(async move {
+                                    submitting.set(true);
+                                    match create_mcp_token(name).await {
+                                        Ok(resp) => {
+                                            toasts.push(ToastType::Success, "Token created. Copy it now — it won't be shown again.");
+                                            just_created.set(Some(resp));
+                                            show_form.set(false);
+                                            new_name.set(String::new());
+                                            tokens.restart();
+                                        }
+                                        Err(e) => {
+                                            toasts.push(ToastType::Error, format!("Failed to create token: {e}"));
+                                        }
+                                    }
+                                    submitting.set(false);
+                                });
+                            },
+                            if submitting() { "Creating..." } else { "Create" }
+                        }
+                    }
+                }
+            }
+        }
+
+        // ── Tokens list ────────────────────────────────────────────
+        match &*tokens.read() {
+            Some(Some(resp)) => {
+                if resp.data.is_empty() {
+                    rsx! {
+                        div { class: "card",
+                            p { style: "padding: 1rem; color: var(--text-secondary);", "No MCP tokens yet. Create one to start using the MCP server from an LLM client." }
+                        }
+                    }
+                } else {
+                    rsx! {
+                        div { class: "mcp-cards-grid",
+                            for token in resp.data.iter() {
+                                {
+                                    let id = token.id.clone();
+                                    let name = token.name.clone();
+                                    let prefix = token.token_prefix.clone();
+                                    let created_str = format_timestamp(&token.created_at);
+                                    let last_used_str = token
+                                        .last_used_at
+                                        .as_ref()
+                                        .map(format_timestamp)
+                                        .unwrap_or_else(|| "never".to_string());
+                                    let revoked = token.revoked;
+                                    rsx! {
+                                        div { class: "mcp-card", style: if revoked { "opacity: 0.55;" } else { "" },
+                                            div { class: "mcp-card-header",
+                                                div { class: "mcp-card-title",
+                                                    Icon { icon: BsKey, width: 14, height: 14 }
+                                                    h3 { "{name}" }
+                                                    if revoked {
+                                                        span { class: "mcp-card-status stopped", "revoked" }
+                                                    }
+                                                }
+                                                if !revoked {
+                                                    button {
+                                                        class: "btn btn-sm btn-ghost btn-ghost-danger",
+                                                        title: "Revoke token",
+                                                        onclick: {
+                                                            let id = id.clone();
+                                                            let name = name.clone();
+                                                            move |_| {
+                                                                confirm_revoke.set(Some((id.clone(), name.clone())));
+                                                            }
+                                                        },
+                                                        Icon { icon: BsTrash, width: 14, height: 14 }
+                                                    }
+                                                }
+                                            }
+                                            div { class: "mcp-card-details",
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsKey, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Prefix" }
+                                                    code { class: "mcp-detail-value", "{prefix}…" }
+                                                }
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsCalendar, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Created" }
+                                                    span { class: "mcp-detail-value", "{created_str}" }
+                                                }
+                                                div { class: "mcp-detail-row",
+                                                    Icon { icon: BsClockHistory, width: 13, height: 13 }
+                                                    span { class: "mcp-detail-label", "Last used" }
+                                                    span { class: "mcp-detail-value", "{last_used_str}" }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            Some(None) => rsx! {
+                div { class: "card",
+                    p { style: "padding: 1rem; color: var(--accent-danger);", "Failed to load MCP tokens." }
+                }
+            },
+            None => rsx! {
+                div { class: "card",
+                    p { style: "padding: 1rem; color: var(--text-secondary);", "Loading..." }
+                }
+            },
+        }
+
+        // ── Revoke confirmation modal ──────────────────────────────
+        if let Some((id, name)) = confirm_revoke() {
+            div { class: "modal-overlay",
+                div { class: "modal",
+                    h3 { "Revoke token?" }
+                    p {
+                        "The token "
+                        strong { "{name}" }
+                        " will stop working immediately. This cannot be undone. Any LLM client using it will start getting 401."
+                    }
+                    div { style: "display: flex; gap: 0.5rem; margin-top: 1rem; justify-content: flex-end;",
+                        button {
+                            class: "btn btn-ghost",
+                            onclick: move |_| confirm_revoke.set(None),
+                            "Cancel"
+                        }
+                        button {
+                            class: "btn btn-danger",
+                            onclick: {
+                                let id = id.clone();
+                                move |_| {
+                                    let id = id.clone();
+                                    spawn(async move {
+                                        match revoke_mcp_token(id).await {
+                                            Ok(()) => {
+                                                toasts.push(ToastType::Success, "Token revoked");
+                                                tokens.restart();
+                                            }
+                                            Err(e) => {
+                                                toasts.push(ToastType::Error, format!("Failed to revoke: {e}"));
+                                            }
+                                        }
+                                        confirm_revoke.set(None);
+                                    });
+                                }
+                            },
+                            "Revoke"
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Best-effort timestamp formatter. The agent serializes BSON DateTime
+/// as `{"$date":{"$numberLong":"..."}}` in extended JSON. We accept
+/// that shape, plain ISO strings, or anything else (best-effort).
+fn format_timestamp(v: &serde_json::Value) -> String {
+    if let Some(s) = v.as_str() {
+        return s.to_string();
+    }
+    if let Some(ms) = v
+        .get("$date")
+        .and_then(|d| d.get("$numberLong"))
+        .and_then(|s| s.as_str())
+        .and_then(|s| s.parse::<i64>().ok())
+    {
+        return chrono::DateTime::<chrono::Utc>::from_timestamp_millis(ms)
+            .map(|d| d.format("%Y-%m-%d %H:%M").to_string())
+            .unwrap_or_else(|| ms.to_string());
+    }
+    "—".to_string()
+}

compliance-dashboard/src/pages/mod.rs

@@ -11,6 +11,7 @@ pub mod graph_index;
 pub mod impact_analysis;
 pub mod issues;
 pub mod mcp_servers;
+pub mod mcp_tokens;
 pub mod overview;
 pub mod pentest_dashboard;
 pub mod pentest_session;
@@ -30,6 +31,7 @@ pub use graph_index::GraphIndexPage;
 pub use impact_analysis::ImpactAnalysisPage;
 pub use issues::IssuesPage;
 pub use mcp_servers::McpServersPage;
+pub use mcp_tokens::McpTokensPage;
 pub use overview::OverviewPage;
 pub use pentest_dashboard::PentestDashboardPage;
 pub use pentest_session::PentestSessionPage;

compliance-mcp/Cargo.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
-compliance-core = { workspace = true, features = ["mongodb"] }
+compliance-core = { workspace = true, features = ["mongodb", "axum"] }
 rmcp = { version = "0.16", features = ["server", "macros", "transport-io", "transport-streamable-http-server"] }
 tokio = { workspace = true }
 serde = { workspace = true }
@@ -19,3 +19,6 @@ bson = { version = "2", features = ["chrono-0_4"] }
 schemars = "1.0"
 axum = "0.8"
 tower-http = { version = "0.6", features = ["cors"] }
+sha2 = { workspace = true }
+hex = { workspace = true }
+dashmap = { workspace = true }

compliance-mcp/src/auth.rs

@@ -0,0 +1,129 @@
+//! Bearer-token authentication for incoming MCP HTTP requests.
+//!
+//! LLM clients (Claude Desktop / Cursor / ChatGPT / etc.) can't run
+//! Keycloak OIDC, so the MCP server uses opaque static tokens minted
+//! per-tenant via the agent's `POST /api/v1/mcp-tokens` endpoint.
+//!
+//! Flow per request:
+//! 1. Extract `Authorization: Bearer <token>`. Missing → 401.
+//! 2. SHA-256 hash the token.
+//! 3. Look up the hash in `<prefix>__admin.mcp_tokens`. Missing or
+//!    revoked → 401.
+//! 4. Fire-and-forget update of `last_used_at` so the dashboard can
+//!    show staleness without blocking the handler.
+//! 5. Stash the tenant_id in [`TENANT_ID`] (a `tokio::task_local`) so
+//!    the MCP tool handlers can read it without modifying rmcp's
+//!    handler signatures.
+//!
+//! The `task_local` is scoped around the inner service call via
+//! [`bearer_auth`], so every handler invoked downstream sees the
+//! tenant_id without us having to thread it through the macro-
+//! generated tool router.
+
+use axum::body::Body;
+use axum::extract::{Request, State};
+use axum::http::StatusCode;
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use mongodb::bson::doc;
+use sha2::{Digest, Sha256};
+
+use crate::database::DatabasePool;
+
+tokio::task_local! {
+    /// Tenant id resolved from the bearer for this request. Set by
+    /// [`bearer_auth`] before the inner service runs; read by the
+    /// MCP tool handlers via [`current_tenant_id`].
+    pub static TENANT_ID: String;
+}
+
+/// Mongo collection name in `<prefix>__admin`.
+const COLLECTION: &str = "mcp_tokens";
+
+/// Returns the tenant_id set by the auth middleware. `None` outside a
+/// request scope (e.g. unit tests that bypass the middleware).
+pub fn current_tenant_id() -> Option<String> {
+    TENANT_ID.try_with(|s| s.clone()).ok()
+}
+
+/// Axum middleware: validate bearer → set [`TENANT_ID`] → call inner.
+pub async fn bearer_auth(
+    State(pool): State<DatabasePool>,
+    request: Request,
+    next: Next,
+) -> Response {
+    let Some(token) = extract_bearer(&request) else {
+        return (StatusCode::UNAUTHORIZED, "Missing bearer token").into_response();
+    };
+    if !token.starts_with("mcpt_") {
+        return (StatusCode::UNAUTHORIZED, "Invalid token format").into_response();
+    }
+    let token_hash = sha256_hex(&token);
+
+    let col = pool.admin_db().collection::<TokenLookup>(COLLECTION);
+    let found = match col
+        .find_one(doc! { "token_hash": &token_hash, "revoked": false })
+        .await
+    {
+        Ok(Some(t)) => t,
+        Ok(None) => {
+            return (StatusCode::UNAUTHORIZED, "Invalid or revoked token").into_response();
+        }
+        Err(e) => {
+            tracing::error!("MCP token lookup failed: {e}");
+            return (StatusCode::INTERNAL_SERVER_ERROR, "Token lookup error").into_response();
+        }
+    };
+
+    // Fire-and-forget last_used_at update — never block the handler.
+    let col2 = pool.admin_db().collection::<TokenLookup>(COLLECTION);
+    let hash_for_update = token_hash.clone();
+    tokio::spawn(async move {
+        let _ = col2
+            .update_one(
+                doc! { "token_hash": &hash_for_update },
+                doc! { "$set": { "last_used_at": mongodb::bson::DateTime::now() } },
+            )
+            .await;
+    });
+
+    let tenant_id = found.tenant_id;
+    let inner = next.run(request);
+    TENANT_ID.scope(tenant_id, inner).await
+}
+
+/// Bare-bones projection — we don't need the whole `McpToken` here,
+/// just enough to route and confirm validity.
+#[derive(serde::Deserialize)]
+struct TokenLookup {
+    tenant_id: String,
+}
+
+fn extract_bearer(req: &Request<Body>) -> Option<String> {
+    req.headers()
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|s| s.strip_prefix("Bearer "))
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+}
+
+fn sha256_hex(s: &str) -> String {
+    let mut h = Sha256::new();
+    h.update(s.as_bytes());
+    hex::encode(h.finalize())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sha256_known_value() {
+        // python -c 'import hashlib; print(hashlib.sha256(b"mcpt_known").hexdigest())'
+        assert_eq!(
+            sha256_hex("mcpt_known"),
+            "27cf6cf678a44244106863c1c031be8e57b84c2b3019d742f755f8e7afa75dfd"
+        );
+    }
+}

compliance-mcp/src/database.rs

@@ -1,19 +1,127 @@
-use mongodb::{Client, Collection};
+//! Per-tenant Mongo broker for the MCP server.
+//!
+//! Mirror of the agent's `compliance_agent::database::DatabasePool` —
+//! duplicated here rather than lifted into `compliance-core` to keep
+//! this PR focused. If a third consumer ever needs it, lift then.
+//!
+//! Bearer tokens (validated by the auth middleware) carry a tenant_id
+//! and the handler resolves the per-tenant database via
+//! [`DatabasePool::for_tenant_id`]. The admin database
+//! (`<db_prefix>__admin`) holds the cross-tenant `mcp_tokens`
+//! collection that the middleware queries on every request.
+
+use std::sync::Arc;
+
+use dashmap::DashMap;
+use mongodb::{bson::doc, Client, Collection};
+use sha2::{Digest, Sha256};
 
 use compliance_core::models::*;
 
+/// 63-byte Mongo db-name cap; same invariant as the agent's pool.
+const MAX_DB_NAME_LEN: usize = 63;
+/// 16-byte SHA-256 truncation, hex-encoded → 32 chars.
+const HASH_HEX_LEN: usize = 32;
+const MAX_PREFIX_LEN: usize = MAX_DB_NAME_LEN - 1 - HASH_HEX_LEN;
+
+#[derive(Clone, Debug)]
+pub struct DatabasePool {
+    client: Client,
+    db_prefix: String,
+    /// Tenants we've handed out a [`Database`] for. The MCP server
+    /// doesn't ensure indexes (the agent owns that side of the
+    /// schema), so the marker exists only to satisfy the parallel
+    /// shape — current code never reads it.
+    #[allow(dead_code)]
+    seen: Arc<DashMap<String, ()>>,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum DbError {
+    #[error("db_prefix '{prefix}' is {len} chars; max is {max} so the hash-fallback DB name fits Mongo's 63-byte cap")]
+    PrefixTooLong {
+        prefix: String,
+        len: usize,
+        max: usize,
+    },
+    #[error(transparent)]
+    Mongo(#[from] mongodb::error::Error),
+}
+
+impl DatabasePool {
+    pub async fn connect(uri: &str, db_prefix: &str) -> Result<Self, DbError> {
+        if db_prefix.len() > MAX_PREFIX_LEN {
+            return Err(DbError::PrefixTooLong {
+                prefix: db_prefix.to_string(),
+                len: db_prefix.len(),
+                max: MAX_PREFIX_LEN,
+            });
+        }
+        let client = Client::with_uri_str(uri).await?;
+        client
+            .database("admin")
+            .run_command(doc! { "ping": 1 })
+            .await?;
+        tracing::info!(
+            "MCP MongoDB cluster reachable; per-tenant pool ready (db prefix '{db_prefix}')"
+        );
+        Ok(Self {
+            client,
+            db_prefix: db_prefix.to_string(),
+            seen: Arc::new(DashMap::new()),
+        })
+    }
+
+    /// Read-only handle to the tenant's database. No indexes are
+    /// ensured here — the agent owns writes, MCP only reads.
+    pub fn for_tenant_id(&self, tenant_id: &str) -> Database {
+        let db_name = self.tenant_db_name(tenant_id);
+        self.seen.insert(tenant_id.to_string(), ());
+        Database::new(self.client.database(&db_name))
+    }
+
+    /// Cross-tenant admin DB — holds the `mcp_tokens` collection that
+    /// the auth middleware queries to map bearer → tenant_id.
+    pub fn admin_db(&self) -> mongodb::Database {
+        self.client.database(&format!("{}__admin", self.db_prefix))
+    }
+
+    pub fn tenant_db_name(&self, tenant_id: &str) -> String {
+        let sanitized = sanitize_tenant_id(tenant_id);
+        let natural = format!("{}_{}", self.db_prefix, sanitized);
+        if natural.len() <= MAX_DB_NAME_LEN {
+            natural
+        } else {
+            let mut h = Sha256::new();
+            h.update(tenant_id.as_bytes());
+            let digest = h.finalize();
+            let suffix = hex::encode(&digest[..HASH_HEX_LEN / 2]);
+            format!("{}_{}", self.db_prefix, suffix)
+        }
+    }
+}
+
+fn sanitize_tenant_id(tenant_id: &str) -> String {
+    tenant_id
+        .chars()
+        .map(|c| match c {
+            '/' | '\\' | '.' | '"' | '$' | ' ' | '\0' => '_',
+            c => c,
+        })
+        .collect()
+}
+
+/// Typed accessors for the MCP-readable collections in a tenant DB.
+/// Matches the agent's `Database` shape but only exposes what the MCP
+/// tool handlers actually need.
 #[derive(Clone, Debug)]
 pub struct Database {
     inner: mongodb::Database,
 }
 
 impl Database {
-    pub async fn connect(uri: &str, db_name: &str) -> Result<Self, mongodb::error::Error> {
+    pub(crate) fn new(inner: mongodb::Database) -> Self {
-        let client = Client::with_uri_str(uri).await?;
+        Self { inner }
-        let db = client.database(db_name);
-        db.run_command(mongodb::bson::doc! { "ping": 1 }).await?;
-        tracing::info!("MCP server connected to MongoDB '{db_name}'");
-        Ok(Self { inner: db })
     }
 
     pub fn findings(&self) -> Collection<Finding> {

compliance-mcp/src/main.rs

@@ -1,10 +1,11 @@
+mod auth;
 mod database;
 mod server;
 mod tools;
 
 use std::sync::Arc;
 
-use database::Database;
+use database::DatabasePool;
 use rmcp::transport::{
     streamable_http_server::session::local::LocalSessionManager, StreamableHttpServerConfig,
     StreamableHttpService,
@@ -24,36 +25,60 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let mongo_uri =
         std::env::var("MONGODB_URI").unwrap_or_else(|_| "mongodb://localhost:27017".to_string());
-    let db_name =
+    // MONGODB_DATABASE is reused as the per-tenant DB-name prefix —
+    // same convention as the agent so `<prefix>__admin.mcp_tokens`
+    // and `<prefix>_<tenant_id>` line up across services.
+    let db_prefix =
         std::env::var("MONGODB_DATABASE").unwrap_or_else(|_| "compliance_scanner".to_string());
 
-    let db = Database::connect(&mongo_uri, &db_name).await?;
+    let pool = DatabasePool::connect(&mongo_uri, &db_prefix).await?;
 
-    // If MCP_PORT is set, run as Streamable HTTP server; otherwise use stdio.
+    // HTTP transport: bind a small axum router with bearer-auth in
+    // front of the rmcp service. `/health` stays public for orca's
+    // container probe.
     if let Ok(port_str) = std::env::var("MCP_PORT") {
         let port: u16 = port_str.parse()?;
         tracing::info!("Starting MCP server on HTTP port {port}");
 
-        let db_clone = db.clone();
+        let pool_for_factory = pool.clone();
         let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(db_clone.clone())),
+            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
             Arc::new(LocalSessionManager::default()),
             StreamableHttpServerConfig::default(),
         );
 
         let router = axum::Router::new()
             .route("/health", axum::routing::get(|| async { "ok" }))
-            .nest_service("/mcp", service);
+            .nest_service(
+                "/mcp",
+                axum::Router::new().fallback_service(service).layer(
+                    axum::middleware::from_fn_with_state(pool.clone(), auth::bearer_auth),
+                ),
+            );
         let listener = tokio::net::TcpListener::bind(("0.0.0.0", port)).await?;
         tracing::info!("MCP HTTP server listening on 0.0.0.0:{port}");
         axum::serve(listener, router).await?;
     } else {
+        // stdio transport — used when run as a local MCP server next
+        // to the LLM client. There's no HTTP layer to do bearer auth,
+        // so we synthesize a tenant_id from STDIO_TENANT_ID for local
+        // development. NEVER use this in production.
         tracing::info!("Starting MCP server on stdio");
-        let server = ComplianceMcpServer::new(db);
+        let synth_tenant = std::env::var("STDIO_TENANT_ID").unwrap_or_else(|_| "dev".to_string());
+        tracing::warn!(
+            tenant_id = %synth_tenant,
+            "stdio transport — using synthetic tenant id; DO NOT use in production"
+        );
+        let server = ComplianceMcpServer::new(pool);
         let transport = rmcp::transport::stdio();
         use rmcp::ServiceExt;
-        let handle = server.serve(transport).await?;
+        auth::TENANT_ID
-        handle.waiting().await?;
+            .scope(synth_tenant, async {
+                let handle = server.serve(transport).await?;
+                handle.waiting().await?;
+                Ok::<_, Box<dyn std::error::Error>>(())
+            })
+            .await?;
     }
 
     Ok(())

compliance-mcp/src/server.rs

@@ -2,20 +2,37 @@ use rmcp::{
     handler::server::wrapper::Parameters, model::*, tool, tool_handler, tool_router, ServerHandler,
 };
 
-use crate::database::Database;
+use crate::auth::current_tenant_id;
+use crate::database::{Database, DatabasePool};
 use crate::tools::{dast, findings, pentest, sbom};
 
 pub struct ComplianceMcpServer {
-    db: Database,
+    pool: DatabasePool,
     #[allow(dead_code)]
     tool_router: rmcp::handler::server::router::tool::ToolRouter<Self>,
 }
 
+impl ComplianceMcpServer {
+    /// Resolve the per-tenant `Database` from the bearer-set
+    /// `task_local`. Every tool handler calls this; missing context
+    /// surfaces as `internal_error` because it means the auth
+    /// middleware was misconfigured (handler ran without scope).
+    fn tenant_db(&self) -> Result<Database, rmcp::ErrorData> {
+        let tenant_id = current_tenant_id().ok_or_else(|| {
+            rmcp::ErrorData::internal_error(
+                "no tenant context — bearer middleware not in chain".to_string(),
+                None,
+            )
+        })?;
+        Ok(self.pool.for_tenant_id(&tenant_id))
+    }
+}
+
 #[tool_router]
 impl ComplianceMcpServer {
-    pub fn new(db: Database) -> Self {
+    pub fn new(pool: DatabasePool) -> Self {
         Self {
-            db,
+            pool,
             tool_router: Self::tool_router(),
         }
     }
@@ -29,7 +46,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<findings::ListFindingsParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::list_findings(&self.db, params).await
+        let db = self.tenant_db()?;
+        findings::list_findings(&db, params).await
     }
 
     #[tool(description = "Get a single finding by its ID")]
@@ -37,7 +55,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<findings::GetFindingParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::get_finding(&self.db, params).await
+        let db = self.tenant_db()?;
+        findings::get_finding(&db, params).await
     }
 
     #[tool(description = "Get a summary of findings counts grouped by severity and status")]
@@ -45,7 +64,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<findings::FindingsSummaryParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        findings::findings_summary(&self.db, params).await
+        let db = self.tenant_db()?;
+        findings::findings_summary(&db, params).await
     }
 
     // ── SBOM ──────────────────────────────────────────────
@@ -57,7 +77,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<sbom::ListSbomPackagesParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::list_sbom_packages(&self.db, params).await
+        let db = self.tenant_db()?;
+        sbom::list_sbom_packages(&db, params).await
     }
 
     #[tool(
@@ -67,7 +88,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<sbom::SbomVulnReportParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        sbom::sbom_vuln_report(&self.db, params).await
+        let db = self.tenant_db()?;
+        sbom::sbom_vuln_report(&db, params).await
     }
 
     // ── DAST ──────────────────────────────────────────────
@@ -79,7 +101,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<dast::ListDastFindingsParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::list_dast_findings(&self.db, params).await
+        let db = self.tenant_db()?;
+        dast::list_dast_findings(&db, params).await
     }
 
     #[tool(description = "Get a summary of recent DAST scan runs and finding counts")]
@@ -87,7 +110,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<dast::DastScanSummaryParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        dast::dast_scan_summary(&self.db, params).await
+        let db = self.tenant_db()?;
+        dast::dast_scan_summary(&db, params).await
     }
 
     // ── Pentest ─────────────────────────────────────────────
@@ -99,7 +123,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<pentest::ListPentestSessionsParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::list_pentest_sessions(&self.db, params).await
+        let db = self.tenant_db()?;
+        pentest::list_pentest_sessions(&db, params).await
     }
 
     #[tool(description = "Get a single AI pentest session by its ID")]
@@ -107,7 +132,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<pentest::GetPentestSessionParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_pentest_session(&self.db, params).await
+        let db = self.tenant_db()?;
+        pentest::get_pentest_session(&db, params).await
     }
 
     #[tool(
@@ -117,7 +143,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<pentest::GetAttackChainParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_attack_chain(&self.db, params).await
+        let db = self.tenant_db()?;
+        pentest::get_attack_chain(&db, params).await
     }
 
     #[tool(description = "Get chat messages from a pentest session")]
@@ -125,7 +152,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<pentest::GetPentestMessagesParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::get_pentest_messages(&self.db, params).await
+        let db = self.tenant_db()?;
+        pentest::get_pentest_messages(&db, params).await
     }
 
     #[tool(
@@ -135,7 +163,8 @@ impl ComplianceMcpServer {
         &self,
         Parameters(params): Parameters<pentest::PentestStatsParams>,
     ) -> Result<CallToolResult, rmcp::ErrorData> {
-        pentest::pentest_stats(&self.db, params).await
+        let db = self.tenant_db()?;
+        pentest::pentest_stats(&db, params).await
     }
 }
 
@@ -149,7 +178,7 @@ impl ServerHandler for ComplianceMcpServer {
                 .build(),
             server_info: Implementation::from_build_env(),
             instructions: Some(
-                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions."
+                "Compliance Scanner MCP server. Query security findings, SBOM data, DAST results, and AI pentest sessions for your tenant."
                     .to_string(),
             ),
         }

compliance-smoke/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "compliance-smoke"
+version = "0.1.0"
+edition = "2021"
+description = "Tiny Axum service exercising compliance-core M7.1 tenant gating. Run smoke.sh against it before merging anything that touches the auth/tenant path."
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "compliance-smoke"
+path = "src/main.rs"
+
+[dependencies]
+compliance-core = { workspace = true, features = ["axum"] }
+axum = "0.8"
+tokio = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+reqwest = { workspace = true }

compliance-smoke/src/main.rs

@@ -0,0 +1,111 @@
+//! M7.1 smoke service.
+//!
+//! A standalone Axum binary whose only job is to host the
+//! [`compliance_core::auth`] middleware + [`compliance_core::tenant_ctx`]
+//! extractor on three endpoints, so `scripts/smoke.sh` can prove the
+//! tenant-gating contract end-to-end before any auth-path PR merges.
+//!
+//! Endpoints:
+//! * `GET  /api/v1/health` — public, never authenticated.
+//! * `GET  /api/v1/echo`   — protected read; returns the [`TenantContext`].
+//! * `POST /api/v1/echo`   — protected write; exercises the `Frozen → 402`
+//!   gate on the same handler.
+//!
+//! Configuration (env):
+//! * `KEYCLOAK_URL`   — e.g. `http://localhost:8080`. Required.
+//! * `KEYCLOAK_REALM` — e.g. `certifai`. Required.
+//! * `SMOKE_PORT`     — defaults to `3010`.
+
+use std::sync::Arc;
+
+use axum::{middleware, routing::get, Extension, Json, Router};
+use compliance_core::{
+    auth::{require_jwt_auth, require_tenant_status, JwksState},
+    tenant_ctx::TenantCtx,
+};
+use serde::Serialize;
+use tokio::sync::RwLock;
+
+#[derive(Serialize)]
+struct EchoResponse {
+    method: &'static str,
+    tenant_id: String,
+    tenant_slug: String,
+    plan: String,
+    status: String,
+    products: Vec<String>,
+    org_roles: Vec<String>,
+    user_id: String,
+    user_name: Option<String>,
+}
+
+async fn health() -> Json<serde_json::Value> {
+    Json(serde_json::json!({ "ok": true }))
+}
+
+async fn echo_read(TenantCtx(ctx): TenantCtx) -> Json<EchoResponse> {
+    Json(echo(ctx, "GET"))
+}
+
+async fn echo_write(TenantCtx(ctx): TenantCtx) -> Json<EchoResponse> {
+    Json(echo(ctx, "POST"))
+}
+
+fn echo(ctx: compliance_core::TenantContext, method: &'static str) -> EchoResponse {
+    EchoResponse {
+        method,
+        tenant_id: ctx.tenant_id,
+        tenant_slug: ctx.tenant_slug,
+        plan: ctx.plan,
+        status: ctx.status.to_string(),
+        products: ctx.products,
+        org_roles: ctx.org_roles.iter().map(|r| format!("{r:?}")).collect(),
+        user_id: ctx.user_id,
+        user_name: ctx.user_name,
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let kc_url = std::env::var("KEYCLOAK_URL")
+        .map_err(|_| "KEYCLOAK_URL is required (e.g. http://localhost:8080)")?;
+    let kc_realm = std::env::var("KEYCLOAK_REALM")
+        .map_err(|_| "KEYCLOAK_REALM is required (e.g. certifai)")?;
+    let port: u16 = std::env::var("SMOKE_PORT")
+        .ok()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(3010);
+
+    let jwks_url = format!("{kc_url}/realms/{kc_realm}/protocol/openid-connect/certs");
+    let jwks_state = JwksState {
+        jwks: Arc::new(RwLock::new(None)),
+        jwks_url: jwks_url.clone(),
+    };
+
+    // Layers execute outermost-first. The Extension must be registered
+    // before `require_jwt_auth` so the middleware can read JwksState; the
+    // status gate must run after JWT so `TenantContext` is in extensions.
+    let app = Router::new()
+        .route("/api/v1/health", get(health))
+        .route("/api/v1/echo", get(echo_read).post(echo_write))
+        .layer(middleware::from_fn(require_tenant_status))
+        .layer(middleware::from_fn(require_jwt_auth))
+        .layer(Extension(jwks_state));
+
+    let addr = format!("0.0.0.0:{port}");
+    let listener = tokio::net::TcpListener::bind(&addr).await?;
+    tracing::info!(
+        port,
+        jwks = %jwks_url,
+        "compliance-smoke listening — try `scripts/smoke.sh`"
+    );
+    axum::serve(listener, app).await?;
+    Ok(())
+}

scripts/smoke.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# M7.1 tenant-gating smoke test.
+#
+# Drives compliance-smoke against a live Keycloak realm with five test
+# users (one per tenant_status), asserts the response code on each
+# endpoint, and exits non-zero on any mismatch.
+#
+# Pre-reqs (one-time):
+#   * KC up at $KC_URL with realm $KC_REALM
+#   * Client $KC_CLIENT has direct-access-grants enabled
+#   * Users + tenant_status mappers per certifai/keycloak/realm-export.json
+#   * compliance-smoke binary running and reachable at $SMOKE_URL
+#
+# Usage:
+#   scripts/smoke.sh              # uses defaults below
+#   SMOKE_URL=... scripts/smoke.sh
+
+set -euo pipefail
+
+KC_URL="${KC_URL:-http://localhost:8080}"
+KC_REALM="${KC_REALM:-certifai}"
+KC_CLIENT="${KC_CLIENT:-certifai-dashboard}"
+SMOKE_URL="${SMOKE_URL:-http://localhost:3010}"
+
+readonly TOKEN_ENDPOINT="${KC_URL}/realms/${KC_REALM}/protocol/openid-connect/token"
+
+PASS=0
+FAIL=0
+
+red()    { printf '\033[31m%s\033[0m' "$*"; }
+green()  { printf '\033[32m%s\033[0m' "$*"; }
+yellow() { printf '\033[33m%s\033[0m' "$*"; }
+
+# Fetches an access token via direct access grant. Echoes the raw token.
+get_token() {
+    local user="$1" pass="$2"
+    curl -sS -X POST "$TOKEN_ENDPOINT" \
+        -H 'Content-Type: application/x-www-form-urlencoded' \
+        -d "grant_type=password" \
+        -d "client_id=${KC_CLIENT}" \
+        -d "username=${user}" \
+        -d "password=${pass}" \
+        -d "scope=openid" \
+        | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p'
+}
+
+# Hits SMOKE_URL$path with the given method and (optional) bearer token,
+# asserts the response status code matches $want.
+assert_status() {
+    local label="$1" method="$2" path="$3" want="$4" token="${5:-}"
+    local args=(-sS -o /dev/null -w '%{http_code}' -X "$method" "${SMOKE_URL}${path}")
+    if [[ -n "$token" ]]; then
+        args+=(-H "Authorization: Bearer ${token}")
+    fi
+    local got
+    got=$(curl "${args[@]}")
+    if [[ "$got" == "$want" ]]; then
+        printf '  %s %s %-4s %-15s → %s\n' "$(green PASS)" "$label" "$method" "$path" "$got"
+        PASS=$((PASS + 1))
+    else
+        printf '  %s %s %-4s %-15s → got %s, want %s\n' "$(red FAIL)" "$label" "$method" "$path" "$got" "$want"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+header() {
+    printf '\n%s %s\n' "$(yellow '##')" "$1"
+}
+
+# ---- Pre-flight ----------------------------------------------------------
+header "Pre-flight"
+if ! curl -sS -o /dev/null -w '%{http_code}\n' "${SMOKE_URL}/api/v1/health" | grep -q '^200$'; then
+    printf '  %s smoke service not reachable at %s\n' "$(red ERR)" "$SMOKE_URL"
+    exit 2
+fi
+if ! curl -sS -o /dev/null -w '%{http_code}\n' "${KC_URL}/realms/${KC_REALM}/.well-known/openid-configuration" | grep -q '^200$'; then
+    printf '  %s Keycloak realm %s not reachable at %s\n' "$(red ERR)" "$KC_REALM" "$KC_URL"
+    exit 2
+fi
+printf '  %s smoke service + Keycloak both up\n' "$(green OK)"
+
+# ---- Public endpoint --------------------------------------------------
+header "Public endpoint (no auth required)"
+assert_status anon GET  /api/v1/health 200
+
+# ---- Anonymous access to protected endpoints ----------------------------
+header "Anonymous → 401 on protected endpoints"
+assert_status anon GET  /api/v1/echo   401
+assert_status anon POST /api/v1/echo   401
+
+# ---- Bad token ----------------------------------------------------------
+header "Bad token → 401"
+assert_status bogus GET  /api/v1/echo  401 "not-a-real-jwt"
+assert_status bogus POST /api/v1/echo  401 "not-a-real-jwt"
+
+# ---- Active tenant (admin user) -----------------------------------------
+header "admin@certifai.local (active) → full access"
+TOKEN=$(get_token admin@certifai.local admin)
+if [[ -z "$TOKEN" ]]; then
+    printf '  %s failed to fetch token for admin\n' "$(red ERR)"
+    exit 2
+fi
+assert_status active GET  /api/v1/echo 200 "$TOKEN"
+assert_status active POST /api/v1/echo 200 "$TOKEN"
+
+# ---- Active tenant (USER role) ------------------------------------------
+header "user@certifai.local (active) → full access"
+TOKEN=$(get_token user@certifai.local user)
+assert_status active GET  /api/v1/echo 200 "$TOKEN"
+assert_status active POST /api/v1/echo 200 "$TOKEN"
+
+# ---- Trial tenant -------------------------------------------------------
+header "trial@acme.local (trial) → full access"
+TOKEN=$(get_token trial@acme.local trial)
+assert_status trial  GET  /api/v1/echo 200 "$TOKEN"
+assert_status trial  POST /api/v1/echo 200 "$TOKEN"
+
+# ---- Frozen tenant ------------------------------------------------------
+header "frozen@acme.local (frozen) → read-only, writes 402"
+TOKEN=$(get_token frozen@acme.local frozen)
+assert_status frozen GET  /api/v1/echo 200 "$TOKEN"
+assert_status frozen POST /api/v1/echo 402 "$TOKEN"
+
+# ---- Archived tenant ----------------------------------------------------
+header "archived@acme.local (archived) → 410 everywhere"
+TOKEN=$(get_token archived@acme.local archived)
+assert_status archived GET  /api/v1/echo 410 "$TOKEN"
+assert_status archived POST /api/v1/echo 410 "$TOKEN"
+
+# ---- Summary ------------------------------------------------------------
+printf '\n'
+if [[ "$FAIL" -gt 0 ]]; then
+    printf '%s %d passed, %d failed\n' "$(red FAIL)" "$PASS" "$FAIL"
+    exit 1
+fi
+printf '%s %d/%d assertions passed\n' "$(green PASS)" "$PASS" "$PASS"