Endpoints and ports

Prodpeek listens on one port, 8787 by default. Change it with PRODPEEK_PORT, and the bind address with PRODPEEK_HOST (127.0.0.1 by default, 0.0.0.0 in the container). See Configuration.

Path	Who	Opens with	Wrong key gets
POST /mcp	An agent reading production	Client key (bearer)	-32002 wrong_door for an admin key
POST /mcp-admin	An agent configuring the instance	Admin key (bearer)	-32002 wrong_door for a client key
/api/v1/…	A script or CI job configuring the instance	Admin key (bearer)	HTTP 403 wrong_door for a client key
/api/docs	Anyone reading the API	Nothing
/admin/…	A person, in the console	Session (sign in)	Redirect to /admin/login
/drop/{secret}	A person pasting one credential, once	The link itself	The link is dead after one use or 15 minutes
GET /metrics	Prometheus	Instance-wide admin key, or nothing with PRODPEEK_METRICS_PUBLIC=1	HTTP 403 wrong_door for a client key; 404 unless PRODPEEK_METRICS=1
GET /healthz	Your load balancer or container runtime	Nothing
GET /		Nothing	Redirects to /admin/

Every wrong_door refusal is written to the audit log. The caller already holds the key, so being told which door it opens leaks nothing.

/mcp error codes

Code	Means
-32001	Unauthorized, or the key has expired
-32002	Wrong door: an admin key at /mcp
-32003	The policy denied this call. data.reason says why
-32004	The service is unavailable: its profile is revoked, stale or drifted
-32005	The instance is not licensed
-32010	The upstream failed

/metrics

Off by default. With PRODPEEK_METRICS=1 it serves Prometheus text format:

Series	Labels
prodpeek_calls_total	service, verdict, reason
prodpeek_upstream_latency_seconds (histogram)	service
prodpeek_monitor_state (1 up, 0 otherwise)	monitor, project
prodpeek_tokens_active	none
prodpeek_audit_seq (the audit chain's head)	none
prodpeek_profile_status	profile, status

No label ever carries an argument value, a URL, a principal or anything an upstream returned. A service name a caller made up is counted as other.

prometheus.yml

scrape_configs:
  - job_name: prodpeek
    metrics_path: /metrics
    authorization:
      credentials: ppa_...   # an admin key with no project scope
    static_configs:
      - targets: ["prodpeek:8787"]