E7: Governed MCP server

[gnanirahulnutakki]

Goal. expose the federated read and action surface as an MCP server so external agents (Claude Code, Codex, kagent) become clients that inherit exactly the governance a human has — the same PEP, the same PDP, the same closed vocabulary, the same audit — a governed MCP gateway to the whole fleet.

Phase / depends. P3 · Depends on: E2 (reads), E4 (write vocabulary), E5 (PEP/PDP), E6 (audit + ledger). MCP tool annotations shipped in the 2025-03-26 spec and are hints, not guarantees, so enforcement is server-side; Elicitation shipped in the 2025-06-18 spec as the native primitive for human-in-the-loop approval. Implements ADR-0005.

Capabilities: governed MCP server (Claude / Codex compatible); governing LangChain/LangGraph agents as MCP clients of Sith (same PEP).

Features

• F7.1 — MCP read tools
• F7.2 — MCP write tools mapped 1:1 to the closed vocabulary
• F7.3 — elicitation-based approval on writes
• F7.4 — external agent as governed client
• F7.5 — AI safety rules

Exit criteria

• Read tools return workspace-scoped answers with readOnlyHint; write tools map 1:1 to the closed vocabulary with server-side enforcement.
• Writes require single-use, arg-hash-bound elicited approval; elicitation never requests secrets.
• An external MCP client is governed identically to a human (same PEP/PDP, ceiling below human, no credential, fully audited).
• AI safety rules (ground-or-abstain, evidence-gated writes, budgets, separate write rate-limits) are enforced.

---

Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).

Child issues (filed for immediate build — Phase L)

• F7.1: MCP read tools (sith serve --mcp) #37 — F7.1 MCP read tools (sith serve --mcp) — ships in Phase L (shadow-MCP: the sanctioned path must be the easiest).

---

2026-07 research addendum (market research T3 · T4; standards §5.2)

Adopt MCP-2026 authorization hardening (T3, standards §5.2). The MCP 2026-07-28 spec RC is the largest revision since launch: authorization aligned to OAuth 2.1 + OpenID Connect, and clients required to implement RFC 8707 Resource Indicators (audience-bound, tightly-scoped tokens). Add to acceptance criteria:

• MCP tokens are audience-bound (RFC 8707) and OAuth-2.1-scoped; a token minted for one Sith surface cannot be replayed against another.
• Enforce-at-execution, not just discovery — the exact bug class behind CVE-2026-46519 (controls at tools/list, bypassed at tools/call). Every MCP write is re-checked at the tools/call/execution boundary against the closed vocabulary + PEP, independent of what tools/list advertised. (Structural fix mirrors E4 F4.5 E4: Action federation #22.)
• Build to the stable primitives (audience binding, enforce-at-execution) — the RC surface will churn; the authorization intent is stable. standards-alignment.

External agent as governed client (T4). k8sgpt/HolmesGPT/Cleric/Komodor/kagent become clients of Sith's governance: an agent's remediation is a typed-intent plan routed through the identical PEP/PDP a human hits (ceiling below human, no credential, fully audited). This is the "governed MCP server the AI-SRE tools call" position — see E4 #22 (plan→execute handoff) and E14 #46 (the deterministic brain that emits plans). Shadow-MCP lesson: the sanctioned path (F7.1 #37, Phase L) must be easier than npx kubernetes-mcp-server.

Refs: MCP 2026-07-28 RC · MCP authorization · NSA/CISA MCP CSI · CVE-2026-46519 write-up.

[gnanirahulnutakki]

E7 progress: F7.1 #37 is released to main via feature PR #61 and release PR #62.

The local MCP surface now exposes fleet.inventory, fleet.health, fleet.correlate, and fleet.cve-search with read-only annotations, shared workspace scoping, privacy-safe audit events, loopback-only transport, optional short-lived keychain capability tokens, and execution-time audience/expiry checks. CI, real two-cluster kind, no-egress E2E, and pre/post-release CodeQL are green.

Future hub OAuth 2.1 remains deliberately out of this local slice and is recorded in ADR 0007.