Agent skill · software engineering · jeremylongshore
exa-enterprise-rbac
Govern Exa membership, API and service keys, team budgets, MCP OAuth, and enterprise managed authorization through least privilege and revocation evidence. Use when operating or reviewing this Exa boundary. Trigger with "Exa enterprise rbac", "review Exa enterprise rbac", or "fix Exa enterprise rbac".
Why this skill is useful
Adds executable scripts for managing Exa API key scoping and application-level access controls that are not publicly documented.
What it needs
Requires exa-js installed locally. Requires exa account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Exa Team and Enterprise Access Governance Overview Govern Exa membership, API and service keys, team budgets, MCP OAuth, and enterprise managed authorization through least privilege and revocation evidence. Treat credentials, queries, retrieved content, generated output, spend, and destructive state as separately governed boundaries. Prerequisites The target repository, environment, Exa team, product surface, and accountable owner. The workload's data classification, latency and freshness promise, cost ceiling, and retention policy. Current first-party documentation plus credentials only for a narrowly approved live check. Current Contract Exa teams own usage and plan features; team admins invite members. Team Management is separately enabled and uses service keys to manage API keys. Enterprise managed authorization for Claude follows Okta directory state for eligible organizations, uses auth.exa.ai and mcp.exa.ai/mcp with scope mcp:tools, and does not create users. Authentication For normal REST work, inject EXAAPIKEY from an approved server-side secret manager and send it only as Authorization: Bearer to the configured first-party Exa API host. Team Management service keys, hosted MCP OAuth or enterprise managed authorization, and payment-protocol calls are separate trust models. Never print, commit, place in a URL, or expose a credential to an untrusted client. Instructions 1. Inventory organization, teams, admins, members, keys, OAuth clients, and workloads. 2. Map each human and service identity to an accountable owner and required surface. 3. Separate administrative service keys from ordinary runtime keys. 4. Apply key budgets and rate limits where the enabled API supports them. 5. Test member removal, key revocation, directory deprovisioning, and MCP session termination. 6. Review access, orphaned schedules, spend, and exceptions on a fixed cadence. Tool Discipline Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/exa-enterprise-rbac