ops-mcp — an internal admin panel as an MCP server

Sixteen tools for a SaaS company's support desk: look up a customer, read their invoices, read a support ticket, issue a refund — and a few things nobody should let an agent do unsupervised.

This is one half of a pair:

Deploy this, register its URL on platform.armoriq.ai as an MCP named ops-mcp, and point the agent at it.

There is no security in this code

That is deliberate, and it is the most important thing to understand here.

No permission checks, no role lookups, no policy. Every tool does exactly what it is asked, by whoever asks. That is how most internal admin tooling actually works, and it is precisely why governance has to live at the agent layer instead.

The destructive tools are real. Run the agent with enforcement disabled and export_all_customers really does "send" the whole customer table. The example is worthless otherwise — a stubbed-out attack proves nothing.

Related MCP server: Support Agent MCP

The tools

Sixteen tools in four tiers. The tiers exist so there is something for policy to act on: each tier wants a different rule.

Tier 1 — reads → allow

Tier 2 — low-risk writes → allow

Tier 3 — sensitive / money → hold for a human

Tier 4 — destructive → block

How ArmorIQ finds the money

This is the detail most likely to cost you an hour.

ArmorIQ's policy engine scans a tool's arguments for a field named amount, value, total, price or cost. That is why the money fields above are named the way they are.

apply_discount is the instructive one. Its natural field is percent, but a percentage is invisible to that scan — so the tool also takes value, the total dollars given away over the term. That is both what the policy reads and what a deal desk would actually approve on.

If your tool has to call it something else, like total_cents, register semantic metadata for the MCP so ArmorIQ knows which field holds the number and what unit it is in. Otherwise the threshold silently never fires.

The tickets

Four tickets, because the interesting thing about a support queue is that you cannot tell by looking which messages are hostile.

Demo TKT-4482 first to show normal operation, then TKT-4471. The contrast is the point.

The injection text lives in src/data.ts in plain sight rather than hidden, because the whole exercise is watching an agent read it and comply.

Files

Run it

npm install
npm start          # http://localhost:8788/mcp

Check it:

curl -s http://localhost:8788/health

curl -s -X POST http://localhost:8788/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

POST /reset restores the fake data so you can run a demo more than once. Without it, the second run reports "already refunded".

Deploy it

Render

render.yaml is a Blueprint for this repo. New > Blueprint, point it here, done. No root directory to set — this repo is one service.

On Render's free plan a service spins down when idle. The first request after a quiet period can take ~30 seconds, which looks exactly like the agent hanging. Use a paid instance if you are demoing live.

Cloud Run, Fly, or anything Docker

gcloud run deploy ops-mcp --source . --region us-central1 --allow-unauthenticated

The service reads PORT from the environment, which is what these platforms set.

Then register it

On platform.armoriq.ai, MCP Registry → Add MCP:

The name must match the agent's ARMORIQ_MCP_NAME exactly, and the URL must be public HTTPS — the platform calls it directly, so localhost will not do.

Notes

There is no authentication on this server. Deployed with --allow-unauthenticated, anyone who finds the URL can call delete_account directly — bypassing ArmorIQ entirely, because enforcement is at the agent layer, not here. Acceptable for a local example; not acceptable in production. Add a bearer token and register it as the MCP's auth on the platform, which supports bearer and api_key.

tsx is a runtime dependency, not a dev one. This service runs TypeScript directly rather than compiling first — one less build step to get wrong. That means tsx must be in dependencies; in devDependencies any npm install --omit=dev produces a deploy with no tsx, and the container will not boot.

Stateless by design. A fresh MCP server is built per request, so any instance can serve any request and the service scales horizontally.

GET /mcp returns 405. A stateless server has no server-initiated event stream, and the MCP spec says to answer 405. Express would otherwise return 404, which makes clients log a confusing transport error.