Setup AI Operations
Configure only the providers the user chooses. Plugin installation is not
authorization to authenticate providers, install Python packages, or spend
credits.
Onboarding Boundary
Onboarding ends after plugin installation and component verification. During
onboarding, do not ask for API keys, tokens, or other credentials, do not
initiate provider login, and do not provision a provider runtime. Report that
planning is available without credentials. Defer provider login and
authentication until an approved execution plan selects a provider and
execution requires access.
Procedure
- Determine whether this is onboarding or just-in-time preparation for a
selected execution.
- During onboarding, inspect the MCP definitions, report all three providers
as unverified, state that planning is ready, and stop without authentication
or provisioning.
- After an approved plan selects a provider and execution requires access,
configure only that provider.
- For Foundry, start
aiops-foundry at https://mcp.ai.azure.com and
complete Microsoft Entra ID login. Confirm an Azure subscription, Foundry
project, and Contributor-or-higher access before execution.
- For Hugging Face, start
aiops-huggingface and complete the first-party
login flow. Provider settings control enabled Hub and Space tools.
- Keep all provider credentials optional during installation and planning.
Do not request or validate an API key until the user has selected a model and
operation that needs it.
- After model selection, route hosted providers through provider-native login
and local providers through the exact host environment variable or approved
secret storage. Never write, print, or request the secret value in chat.
- For ElevenLabs runtime setup, identify
ELEVENLABS_API_KEY as the selected
execution secret when the chosen model requires it.
- Run
scripts/provision-runtime.mjs without flags. Show its preview: Python,
exact elevenlabs-mcp==0.12.2 package, private runtime target, and package
index policy.
- Ask for explicit consent before
--apply.
- On approval, rerun the provisioner with
--apply.
- Reload the host, then run
npm run verify from the plugin source or its
equivalent installed-path verifier.
- Report each provider independently. One unavailable provider does not make
the optional plugin unusable for the others.
Runtime Boundary
- Hugging Face uses a publisher-hosted HTTP MCP server.
- ElevenLabs uses a plugin-private Python virtual environment.
- Provisioning never installs globally and never supplies
--index-url or an
alternate package source.
ELEVENLABS_MCP_OUTPUT_MODE=resources avoids implicit Desktop writes.- Provider credentials stay in provider OAuth, environment variables, or host
secret storage.
- Host environment variables and approved secret storage remain outside
generated plans, logs, manifests, and commits.
Failure Handling
| Signal |
Action |
| Hosted provider needs login |
Complete the provider-native flow; do not invent headers. |
| Python is below 3.11 |
Stop and select a supported interpreter before provisioning. |
| Package install fails |
Report pip's error without adding an index override. |
| Runtime is missing |
Re-run preview and consented apply. Do not replace it with uvx or unpinned pip. |
| Selected model needs a missing API key |
Stop execution, name the exact host environment variable or approved secret-storage route, and keep other providers usable. |
Anti-Patterns
| Anti-pattern |
Correction |
| Configure every provider automatically |
Ask which providers the user wants. |
| Paste tokens into MCP JSON |
Use OAuth, environment, or secret storage. |
Run pip install globally |
Provision the plugin-private environment. |
| Apply without preview |
Show the exact package and target first. |
| Treat setup as spending consent |
Execution requires a separate approved plan. |
Would Revise If
Revise by 2026-11-11 if provider authentication cannot be completed on a
supported host, if the exact ElevenLabs runtime fails after successful setup,
or if two users confuse provider setup with consent to execute paid work.
1---2name: setup-ai-operations3description: Configure optional Microsoft Foundry, Hugging Face, and ElevenLabs provider access for AI Operations. Use after installing the plugin, when a provider is unavailable, when auditing authentication, or when previewing and provisioning the exact ElevenLabs private runtime.4---5
6# Setup AI Operations
7
8Configure only the providers the user chooses. Plugin installation is not
9authorization to authenticate providers, install Python packages, or spend
10credits.
11
12## Onboarding Boundary
13
14Onboarding ends after plugin installation and component verification. During
15onboarding, do not ask for API keys, tokens, or other credentials, do not
16initiate provider login, and do not provision a provider runtime. Report that
17planning is available without credentials. Defer provider login and
18authentication until an approved execution plan selects a provider and
19execution requires access.
20
21## Procedure
22
231. Determine whether this is onboarding or just-in-time preparation for a
24 selected execution.
252. During onboarding, inspect the MCP definitions, report all three providers
26 as unverified, state that planning is ready, and stop without authentication
27 or provisioning.
283. After an approved plan selects a provider and execution requires access,
29 configure only that provider.
304. For Foundry, start `aiops-foundry` at `https://mcp.ai.azure.com` and
31 complete Microsoft Entra ID login. Confirm an Azure subscription, Foundry
32 project, and Contributor-or-higher access before execution.
335. For Hugging Face, start `aiops-huggingface` and complete the first-party
34 login flow. Provider settings control enabled Hub and Space tools.
356. Keep all provider credentials optional during installation and planning.
36 Do not request or validate an API key until the user has selected a model and
37 operation that needs it.
387. After model selection, route hosted providers through provider-native login
39 and local providers through the exact host environment variable or approved
40 secret storage. Never write, print, or request the secret value in chat.
418. For ElevenLabs runtime setup, identify `ELEVENLABS_API_KEY` as the selected
42 execution secret when the chosen model requires it.
439. Run `scripts/provision-runtime.mjs` without flags. Show its preview: Python,
44 exact `elevenlabs-mcp==0.12.2` package, private runtime target, and package
45 index policy.
4610. Ask for explicit consent before `--apply`.
4711. On approval, rerun the provisioner with `--apply`.
4812. Reload the host, then run `npm run verify` from the plugin source or its
49 equivalent installed-path verifier.
5013. Report each provider independently. One unavailable provider does not make
51 the optional plugin unusable for the others.
52
53## Runtime Boundary
54
55- Hugging Face uses a publisher-hosted HTTP MCP server.
56- ElevenLabs uses a plugin-private Python virtual environment.
57- Provisioning never installs globally and never supplies `--index-url` or an
58 alternate package source.
59- `ELEVENLABS_MCP_OUTPUT_MODE=resources` avoids implicit Desktop writes.
60- Provider credentials stay in provider OAuth, environment variables, or host
61 secret storage.
62- Host environment variables and approved secret storage remain outside
63 generated plans, logs, manifests, and commits.
64
65## Failure Handling
66
67| Signal | Action |
68| --- | --- |
69| Hosted provider needs login | Complete the provider-native flow; do not invent headers. |
70| Python is below 3.11 | Stop and select a supported interpreter before provisioning. |
71| Package install fails | Report pip's error without adding an index override. |
72| Runtime is missing | Re-run preview and consented apply. Do not replace it with `uvx` or unpinned pip. |
73| Selected model needs a missing API key | Stop execution, name the exact host environment variable or approved secret-storage route, and keep other providers usable. |
74
75## Anti-Patterns
76
77| Anti-pattern | Correction |
78| --- | --- |
79| Configure every provider automatically | Ask which providers the user wants. |
80| Paste tokens into MCP JSON | Use OAuth, environment, or secret storage. |
81| Run `pip install` globally | Provision the plugin-private environment. |
82| Apply without preview | Show the exact package and target first. |
83| Treat setup as spending consent | Execution requires a separate approved plan. |
84
85## Would Revise If
86
87Revise by **2026-11-11** if provider authentication cannot be completed on a
88supported host, if the exact ElevenLabs runtime fails after successful setup,
89or if two users confuse provider setup with consent to execute paid work.
gabrielmoreira