Agent skill · software engineering · jeremylongshore
flexport-enterprise-rbac
Map Flexport endpoint-scoped OAuth credentials and MCP role permissions to approved workloads. Use when designing enterprise access, separating duties, reviewing permissions, or replacing shared broad API keys. Trigger with: "Flexport RBAC", "scope Flexport integration", "review Flexport permissions".
Why this skill is useful
Adds executable scripts for implementing role-based access control and multi-tenant API key management specific to Flexport integrations.
What it needs
Requires typescript installed locally. Requires flexport account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Flexport Permission-Aware Access Broker Overview Flexport has two access concepts that must not be conflated: OAuth clients select endpoint resources, while MCP tools document allowed account roles. API keys are broad across endpoints and should not be described as selectively scoped. Prerequisites Workload-to-outcome inventory and accountable owners Current REST endpoint resource and MCP tool permission documentation Credential registry with environment and rotation metadata Instructions Step 1: Map business outcomes List reads, document changes, invoice work, booking commitments, and MCP tools by workload. Step 2: Assign separate credentials Create one OAuth client per system and select only required endpoint resources. Create a replacement if new resources are later needed. Step 3: Map MCP roles For each MCP tool, record the documented allowed roles and verify the connected user has one; do not infer permission from a REST credential. Step 4: Control broad keys Inventory API keys as exceptions, document their all-endpoint blast radius, restrict storage, and plan replacement where OAuth fits. Step 5: Enforce application policy Require business authorization above provider permission, especially for bookings, trade records, and sensitive shipment/customs data. Step 6: Review with evidence Quarterly or event-driven reviews compare active workloads, credentials, tool use, and owners; revoke orphaned access promptly. Authentication REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions. Tool Discipline Use Read and Grep for discovery and evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flexport-enterprise-rbac