MCP
A Model Context Protocol server exposing PolicyVault's REST API as tools for MCP-speaking agent runtimes.
PolicyVault ships an MCP (Model Context Protocol) server (mcp/) that lets MCP-speaking agent runtimes call PolicyVault as a set of tools, over JSON-RPC 2.0 on stdio.
What it is, precisely
The MCP server is a thin adapter. Every tool call is translated into an ordinary authenticated HTTP request to the same /api/v1 surface every other client uses. It implements no financial authority, no policy semantics, no successor-state derivation, no verification, no signing, and no broadcasting, and it holds no keys. If a scope the calling credential doesn't hold would block a request, that refusal comes from the server — the MCP layer has no privileged path around it. If the MCP process is absent, crashed, or compromised and then killed, core PolicyVault safety and function are unaffected.
Protocol details
- JSON-RPC 2.0 over stdio, one message per line, UTF-8, no embedded newlines. Batch arrays are refused.
- Implements the MCP
2025-11-25/2025-06-18lifecycle:initialize(must be first),notifications/initialized,ping,tools/list(returns the whole catalog in one page),tools/call. - Invalid tool arguments come back as a tool execution error (
isError: true), not a protocol-level error — this lets a calling model see what was wrong and self-correct, rather than treating every input mistake as a hard failure.
Tool catalog is derived, never hand-maintained
At startup, the server fetches the same public capability-discovery document any client can fetch (GET /api/v1/capabilities) and fails closed if that document is missing, malformed, or of an unrecognized schema version. A tool is only activated if every scope it requires appears in that document and the relevant feature flag is enabled — there is no static fallback catalog that could silently drift from what the server actually supports.
Credential handling
Configuration is environment-only: a server URL and a bearer machine credential. The token is read once, removed from the process environment, held behind a closure, and never logged or echoed in any error message — tested by grepping every byte of the process's stdout and stderr across success, refusal, and failure paths. The only anonymous call the adapter ever makes is the public capabilities fetch.
Status
IMPLEMENTED, unit-tested (protocol conformance and adversarial suites against a mock API), and integration-proven against a real running PolicyVault server over real HTTP with a real machine identity and a real subprocess speaking actual stdio. It has not yet been broadcast on a live network directly (no tool it exposes broadcasts on its own — broadcasting happens through the same request pipeline every client uses), and it has not yet gone through a dedicated hostile-AI/prompt-injection review.
See also: Agent API, Machine identities and capabilities.