Skip to content

Tools & MCP Platform — overview

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Tools represent executable capabilities (original handoff §10): repository, files, Git, shell, database, browser, HTTP, cloud, Azure DevOps, GitHub, observability, messaging, email, documents and enterprise systems. The Tools & MCP Platform is where those capabilities are described, classified by risk and executed under one governed pipeline. It was added by the design plan (D22) to give the packet's tool executor, registry, policies and sandbox contracts a platform of their own, and ADR-0022 makes MCP its protocol.
Platform PF-05 Tools & MCP Platform (Capability & Tools)
Bounded contexts BC-08
Services 4 (1 hosts, 2 modules, 1 external, 0 later) — 3 modelled
Gateways GW-05
Status target

Purpose

  • One path. Agents, IDE clients and partner agents reach tools only through the governed executor (GW-05); the raw agent and the unauthenticated MCP sample of the template are closed.
  • Classes decide, not prose. Every descriptor declares a side-effect class (read, sandbox, shared-write, external, production, publication, spend) and a risk class; the environment may raise the class; gated classes need one approval per action bound to the exact request (D21).
  • Sandboxes, not hosts. Shell, file, browser and computer-use tools run in sandboxes with filesystem and network isolation, quotas, timeouts, read-only mounts and temporary credentials; models never receive a root shell, the host filesystem, cloud admin credentials or production secrets.
  • Receipts, not trust. Every call ends with a receipt (request hash, decision, approval, result hash, sandbox, audit); an effect that cannot be confirmed is Uncertain and is never retried automatically.
  • MCP with identity. Servers are registered with authentication on by default, discovered capabilities are bound to descriptors before they are callable.

Bounded contexts and services

Context Owns Services (granularity)
BC-08 Tool Execution Tool descriptors (read model), invocations, receipts, sandbox leases, MCP servers and bindings ToolAdapterService, McpServerRegistryService (modules); McpConnectorService external-canonical (ConnectSoft.Extensions.ModelContextProtocol)
Host Exposed MCP endpoint, protocols, stdio bridge, composition ToolExecutorHost (standalone)
Service Context Granularity Status
McpConnectorService BC-08 external / canonical unmodelled
McpServerRegistryService BC-08 module of host target
ToolAdapterService BC-08 module of host target
ToolExecutorHost BC-08 standalone host target

The pipeline (original handoff §70)

flowchart LR
    M["Model proposes a tool call"] --> V["Schema validation"]
    V --> P["Agent permission"]
    P --> T["Tenant policy"]
    T --> C["Side-effect classification<br/>raised by environment"]
    C --> A{"Gated class?"}
    A -- yes --> Ap["Approval bound to request hash"]
    A -- no --> Cr
    Ap --> Cr["Credential broker"]
    Cr --> S["Sandbox lease"]
    S --> E["Execute"]
    E --> R["Result sanitization"]
    R --> Au["Audit and receipt"]
    Au --> M2["Back to the model as data"]
Hold "Alt" / "Option" to enable pan & zoom

Role in the Factory

flowchart LR
    Mesh["Agent Mesh<br/>attempts"] -- "Invoke with fencing token" --> TP["Tools & MCP<br/>ToolExecutorHost"]
    IDE["IDE clients, partner agents<br/>GW-05"] --> TP
    TP -- "decisions, credentials" --> Gov["Governance"]
    TP -- "approvals, usage, environment class" --> CP["Control Plane"]
    TP -- "sandboxes, workspaces" --> RC["Runtime Cloud<br/>Execution Capacity"]
    TP -- "knowledge and repository tools" --> KM["Knowledge & Memory"]
    TP -- "connections" --> Int["Integration"]
    TP -- "receipts, spans" --> Obs["Observability"]
Hold "Alt" / "Option" to enable pan & zoom

Component view

flowchart LR
    subgraph P["Tools & MCP Platform"]
        ToolExecutorHost["ToolExecutorHost"]
    end
    GW_05{"GW-05 Tool / MCP gateway"} --> P
    P --> IntegrationService["IntegrationService"]
    P --> SecretBrokerService["SecretBrokerService"]
    P --> PolicyEngineService["PolicyEngineService"]
    P --> AgentRegistryService["AgentRegistryService"]
    P --> RunControlService["RunControlService"]
    P --> EnvironmentService["EnvironmentService"]
    P --> AgentPoolManager["AgentPoolManager"]
    P --> RepositoryIntelligenceService["RepositoryIntelligenceService"]
    P --> VectorMemoryService["VectorMemoryService"]
    P --> ArtifactService["ArtifactService"]
    P --> CostUsageService["CostUsageService"]
    P --> GovernanceHost["GovernanceHost"]
    P --> ControlPlaneApi["ControlPlaneApi"]
    P --> RuntimeCloudHost["RuntimeCloudHost"]
    P --> KnowledgeHost["KnowledgeHost"]
    P --> IntegrationHost["IntegrationHost"]
    P --> ext_mcp_library["ext-mcp-library"]
    P --> ext_identity_platform["ext-identity-platform"]
Hold "Alt" / "Option" to enable pan & zoom

Tool catalog

The seeded descriptors (repository read tools, knowledge search and graph query, sandbox write and shell tools, change-set proposal, HTTP, browser and computer-use, deployment, publication, consumed and exposed MCP servers) are in the generated tools catalog with their classes, owner services and limits.

Built from the ConnectSoft estate

Component Use here Status
ConnectSoft.Extensions.ModelContextProtocol MCP hosting, OAuth protected resource, governance toolkit extend (authentication default, registry, bindings)
ConnectSoft.Extensions.AI.AgentsFramework native tools and agents-as-tools behind the lifecycle extend
Microservice template, MessagingModel Orleans adapter, Audit.NET integration host, outbox, audit exists
Sandbox broker, descriptor pipeline, receipts, MCP registry the platform itself develop

Modernization (2 to 3 year horizon)

  • MCP registries and authenticated servers as the norm; cross-organization discovery later.
  • Computer-use and browser agents as sandboxed tools with recordings as artifacts (radar: trial).
  • Agent sandboxes on microVMs with egress policy (radar: adopt for shell and build tools).
  • Tool-call reliability measured per tool and agent and fed into the evaluation gates (D32).

Current implementation

MCP hosting and governance options exist with authorization disabled by default; the agent template's MCP sample calls the raw agent; explicit tools and file skills exist in the agents framework. No executor, descriptor registry, sandbox broker, receipt or MCP server registry exists. See the plane index.

Final-state summary

One host, two modules, one pipeline, one receipt per call; descriptors with classes published as assets; MCP servers registered with identity; sandboxes leased, never hosts shared.