# Permissions Helper

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-teddy563-mcwrench-permissions-helper`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Teddy563](https://agentstack.voostack.com/s/teddy563)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Teddy563](https://github.com/Teddy563)
- **Source:** https://github.com/Teddy563/mcwrench/tree/main/skills/permissions-helper
- **Website:** https://mcwrench.teddy.bar

## Install

```sh
agentstack add skill-teddy563-mcwrench-permissions-helper
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Permissions Helper

Default permission engine: **LuckPerms** (`luckperms.net/wiki`). Vault bridges economy/perms
for plugins that read through it. Get the model right before writing nodes.

## The four concepts (do not conflate them)

- **Groups** carry permissions; users inherit groups. `/lp creategroup vip`,
  `/lp group vip permission set essentials.fly true`, `/lp user Steve parent add vip`.
- **Tracks** are ordered ladders of groups for promotion/demotion only —
  `/lp track staff append helper`, `…append mod`. Per the wiki: *"tracks act only as a means for
  easy promotion and demotion… and do not influence inheritance."* `/lp user Steve promote staff`.
- **Contexts** (`key=value`) restrict **where** a permission/parent/meta applies. Built-in keys:
  `server`, `world`, `gamemode`, `dimension-type`. See `references/luckperms-contexts.md`.
- **Meta** — prefix, suffix, weight, and custom meta keys (read elsewhere via PlaceholderAPI
  `%luckperms_meta_key%`). `/lp group vip meta setprefix 10 "&a[VIP] "`.

## Node convention

`plugin.feature.action`, e.g. `essentials.home.multiple.vip`, `worldguard.region.bypass`.
Wildcards (`essentials.home.*`) work but were historically discouraged in Bukkit; LuckPerms can
apply child permissions with `apply-bukkit-child-permissions: true`. Prefer explicit nodes for
auditability; use wildcards knowingly.

## Inheritance & prefix resolution

- Primary-group calculation defaults to `parents-by-weight`. Give groups a **weight**
  (`/lp group admin meta setweight 100`) so the highest-weight group wins prefix/suffix.
- Negated nodes (`-some.node`) override positives by specificity/weight — use to carve exceptions.
- Temporary perms/parents: `/lp user Steve permission settemp … 7d`.

## Networks (multiple servers, one DB)

- Point every backend at the **same** LuckPerms SQL database for a shared identity.
- Use **static server contexts** (per-server `contexts.yml`, e.g. `server-type=skyblock`) or the
  server's `server` context so one DB grants per-server perks without leaking them network-wide.
- Run LuckPerms on the **Velocity proxy too** (LuckPerms-Velocity) for proxy-level perms; keep
  the API jar versions aligned across proxy and backends, or contexts break on update.

## Working method

1. Establish the rank ladder (groups + a track) before assigning individual nodes.
2. Scope with contexts when a perk is per-world/per-server/per-gamemode.
3. Set weights for clean prefix resolution.
4. When unsure of a plugin's exact node names, call `learn-plugin-docs` for that plugin and read
   its permissions section — do not invent nodes.
5. Give the user the exact `/lp …` commands to run, in order.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Teddy563](https://github.com/Teddy563)
- **Source:** [Teddy563/mcwrench](https://github.com/Teddy563/mcwrench)
- **License:** MIT
- **Homepage:** https://mcwrench.teddy.bar

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-teddy563-mcwrench-permissions-helper
- Seller: https://agentstack.voostack.com/s/teddy563
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.