lazysite

Service killswitches

Every machine channel ships off; each is one explicit switch.

Service killswitches

Since 0.9.0 every machine-facing service is behind its own on/off switch, and every switch ships off. A fresh install serves pages and the browser manager and nothing else; the operator opts in to exactly the channels the site uses. Upgrades never enable a service: an instance upgraded across 0.9.0 keeps all switches off until the operator sets them, by design.

The switches

Key Service While off
mcp_enabled The MCP connector for AI assistants POST answers a JSON-RPC error naming the switch; everything else (including discovery) is 404, so a disabled instance discloses nothing
control_api_enabled The control API (token access to manager actions) Token calls answer {ok:0, code:"service_disabled"} before any token processing; the cookie-based manager UI is unaffected
token_exchange_enabled Pairing-key to token exchange The exchange endpoint refuses with an explanatory error
oauth_enabled The OAuth 2.1 authorisation server All OAuth actions refuse
webdav_enabled The /dav WebDAV endpoint /dav returns 404

Where to set them

Toggle them in the manager under Settings → Services, or set the keys directly in lazysite/lazysite.conf:

mcp_enabled: true
control_api_enabled: true
token_exchange_enabled: true

Each gate is checked before any request handling on its channel - a disabled control API does no token verification at all.

What this means in practice

  • Onboarding an AI assistant needs mcp_enabled (plus oauth_enabled for the Claude.ai / ChatGPT connector flows, or token_exchange_enabled for pairing-key clients). See Onboard an AI agent.
  • An automated publishing partner typically needs webdav_enabled, control_api_enabled and token_exchange_enabled. See Theme and layout publishing.
  • A site with no machine clients leaves everything off and has no machine-facing surface to attack.

If a previously working integration fails after an upgrade or a migration, check the Services page first: a service_disabled response (or a fresh 404 on /dav) means the switch, not the credentials.

Notes

  • The switches gate whole channels; capabilities then decide what an authenticated caller may do on an enabled channel
  • Enabling or disabling a service is a configuration change, so it is audited and takes effect immediately
  • Configuration - the full key list