mcp

Overview ¶

Command mcp runs one agent against the stock MCP filesystem server with every control in the runtime switched on: reads are allowed, a write stops the run for an operator, and the trace shows what was refused at load, what paused, what was approved, and what executed.

The server is pinned before it is used. `pin` records what each tool presents and prints the server's own annotations, which are the hints the operator classifies against and never the classification itself. `run` reads the operator's rules.json, loads the pinned tools that have a rule, and prints the report: what registered, what was refused and why, and every tool left unclassified, which is fail-closed and the point of the demo.

From a fresh clone, first (once, from the repository root): the consumer modules are pinned to released versions on the module proxy, so running them from the repository root needs a local workspace:

go work init . ./examples/live ./examples/mcp ./mcp ./providers/anthropic ./providers/ollama ./providers/openai

The filesystem server is pinned too, to an exact version and its integrity hash in package.json and package-lock.json beside this file, so what runs is what was reviewed rather than whatever the registry serves that day. Install it once, from the repository root, without running any package's install scripts:

(cd examples/mcp && npm ci --ignore-scripts)

Then:

go run ./examples/mcp pin
go run ./examples/mcp run
go run ./cmd/agentrt -db <path> approve <run>
go run ./examples/mcp run -resume <run>

It needs Node, which runs the installed server as `node examples/mcp/node_modules/@modelcontextprotocol/server-filesystem/dist/index.js <sandbox>`, and a local Ollama server. The sandbox, the manifest, and the database default to fixed names under a per-user cache directory (os.UserCacheDir()/ agentrt, created 0700), so the four commands above address the same run by default but another account on a shared machine cannot pre-create or read any of the three the way it could a fixed name in the shared temporary directory. rules.json is read from this directory, so both commands are run from the repository root. Whoever can write the manifest or the rules chooses how every tool is classified, so run reads either only when it is owned by the current user and writable by nobody else, and refuses it otherwise, naming the path and its mode. The shipped rules.json classifies the tools the server offered when it was written: a server that offers a different set is pinned again and the rules edited, which Load says in as many words rather than silently dropping a tool.

SIGINT and SIGTERM cancel pin or run between steps rather than killing the process outright: the MCP connection and the database are closed in whatever state the last committed step left them, and, for run, once a run has actually been recorded, the exact -resume command is printed on stderr before the process exits non-zero.

Everything the server chose, its tool names and descriptions and the text of its errors, is escaped by trace.Sanitize before it is printed.