Skip to content

Model Context Protocol in the Factory

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Revived 2026-10-09

Replaces the archived ConnectSoft MCP Servers Catalog (2025). That page framed MCP servers as optional memory and artifact stores alongside an Azure Event Grid/Service Bus "core". The current framing: MCP is the tool transport through which agents (and external coding agents acting as clients) discover and invoke governed tools; it is neither the Factory's memory layer nor its messaging port (ADR-0012).

Role

  • Inbound: external coding agents and IDE extensions reach Factory capabilities (start a run, read run state, fetch artifacts) through an MCP server hosted by the Factory; every such call enters the same execution port as REST and queue requests.
  • Outbound: agents reach external systems through MCP servers registered as tools; each server's tools carry the descriptor fields of the tool registry (side-effect class, authorization, secret dependencies, timeouts, audit).
  • Governance applies on both sides through the tool policies; MCP transport governance is additional to, not a substitute for, executor policy.

Security notes

Per the MCP security guidance referenced by the 2026-10-08 packet: forwarding arbitrary caller tokens to downstream servers is unsafe; resource-scoped tokens and audience validation belong in the tool credential design. Tool descriptions are untrusted text and cannot grant authority.

Candidate servers (reference, not a selection)

The 2025 catalog listed 22 candidate servers. They remain reference material; registering any of them is a publication decision with a connection, policy and evidence.

Category Candidates
Source control and delivery Azure DevOps, GitHub
Storage and data Azure (Blob, Tables, Cosmos DB, Key Vault), PostgreSQL, MinIO, Amazon S3, Google Cloud Storage, MongoDB, Redis, Elasticsearch, TimescaleDB, Snowflake
Secrets Azure Key Vault, HashiCorp Vault
Messaging (as external systems, not as the Factory bus) Kafka, Azure Service Bus
Browser automation Puppeteer, Playwright
Local development File system

Current implementation

  • ConnectSoft.Extensions.ModelContextProtocol (1.0.22 in the agent host): MCP hosting over HTTP and stdio, automatic tool and prompt discovery via attributes, optional endpoint authorization (requireAuthorization default false), Microsoft.AgentGovernance 5.0.0 integration with policy paths, fail-closed and audit options, DefaultAgentId fallback and RequireAuthenticatedAgentId default false.
  • The agent host maps /mcp without authorization by default and exposes a sample tool that calls the framework agent directly, bypassing the lifecycle library.
  • No Factory MCP server for inbound run control exists; no external MCP server is registered as a governed tool.