[adiled]

hive/web2: the web2 world as one tendril, wrepl

web2 is an attendant serving one fixed tool, wrepl. A reach carries one command line, and every OpenAPI spec and MCP server web2.json names answers it as if it were a CLI. The thrum sees a tendril like any other: OpenAPI, MCP and OAuth stop at this hive, and a harness that takes tools only over MCP gets wrepl as one tool among bash and the forager's own.

help
github help pulls
github pulls/list rust-lang rust --state open --jq '.[].title'
sentry search-issues --query 'is:unresolved'

wrepl

• help lists the services, <service> help [group | words] a service's commands, and <service> <command> --help a command's flags.
• Flags come from each command's input schema, typed by it: --name value, --name=value, --flag / --no-flag, a flag repeated for an array. Words with no flag fill the required inputs in order. Spelling is forgiven across kebab, snake and camel case.
• --json '{…}' gives the whole input, flags laid over it winning; --jq '<filter>' narrows a JSON result (jaq).
• A mistake answers with what would have worked: did-you-mean for services, commands and flags, the missing required flags, the type a value should be.
• An answer past maxOutput (32 KiB) keeps its start and its end, as bash does.

Services

• OpenAPI 3 from a URL or a file beside web2.json, JSON or YAML: each operation a command named by its operationId, grouped by its first tag, its parameters and JSON body fields as flags, local $refs followed. The commands made from a spec are kept for a day, or until web2 refresh.
• MCP over stdio or streamable HTTP, through rmcp 3.7: one connection per server, opened at first use, closed when idle, opened again when it drops, relisted when the server says its tools changed.
• An mcpServers block pasted from any harness works as it is. web2 import copies in the servers Claude Code, Claude Desktop, Cursor, VS Code and Codex already know here.
• web2.json is read again whenever it changes; a service added there is reached on the next call.

Reading and writing

• A service only reads until web2.json says otherwise: writes, allow (write commands by name or glob, read-*), deny.
• An OpenAPI operation reads when its method is GET, HEAD or OPTIONS. An MCP tool reads only when its annotations say readOnlyHint: true, as the MCP spec has it.
• A refused call answers with the key that would turn it on, and a service's help counts what is off.
• web2 allow, web2 deny and web2 review (each command that is off, turned on or left, one by one) edit web2.json in place, keeping its order, and refuse a change that would break it.

Signing in

• Tokens live in secrets/credentials.json in web2's state directory, mode 0600 in a 0700 directory, never in an environment, a log or an answer. "env": "VAR" reads one from web2's environment instead.
• web2 login <service>: a token at a prompt that does not show it, or --token-stdin; an OpenAPI oauth app through the authorization code flow with PKCE and a callback on 127.0.0.1, renewed before it expires; an MCP server's own OAuth, by its discovery and client registration, through rmcp.
• A spec that names a scheme, with nothing stored, is called without credentials, so anonymous reads still answer; a 401 or 403 says how to sign in.

Not offered

• No sampling, elicitation or roots. A tool that asks for input mid-call (input_required), or turns into a task, answers that wrepl does not follow it.
• Legacy SSE MCP servers and Swagger 2.0 are refused with what to do instead.

The hive

• Its own workspace, depending on thrum-core, hum-thrum and hum-paths only; humd is a dev-dependency, for the bee test.
• Orchfile, build and install as the bash hive has them. Nothing goes on the PATH; the install prints where web2 is. web2 alone is the same REPL a bloom reaches, for a person at this machine.
• One row in the hives catalogue.

Peers

• A peer's bloom reaches web2 only when both sides say so: the peer's humd trusts remote attendants (humd: a peer's attendant serves a bloom here, when this humd trusts it #96), and this web2.json says servePeers: true. Otherwise a peer's reach, which carries its from, is refused, saying so: what web2 is signed in to is this machine's.

Known limit, with its own change to follow

• The tokens are as safe as the user web2 runs as, and bash on a builder runs as that user. They sit in secrets/ so the builder (soon shell) can keep its shells out of hum's secrets, bee keys included.

Verified

• cargo test: 37 unit, 6 end to end against the real binary (an OpenAPI mock, an MCP server over stdio, one over HTTP with a bearer), 1 through a real humd: forager → humd → a nurse reaching wrepl → humd → web2 serve → an MCP server, and back, a config change mid-run included.
• An OpenAPI OAuth sign-in and renewal against a mock token endpoint, the PKCE verifier checked against its challenge.
• An MCP server's OAuth end to end against an authorization server shaped as the spec has it (protected resource and server metadata, client registration, PKCE, the issuer), then a call with the stored token.
• web2 allow / deny / review against a real config, globs included.
• cargo clippy --all-targets -D warnings, ./build (release, --locked), tools/speech.py.
• Live: the Swagger Petstore (a relative server URL), GitHub's REST spec (1,242 commands; an anonymous repos/get in under a second), DeepWiki's MCP over HTTP.