Skip to main content
Glama
callisto-syn

nous-portal-mcp

by callisto-syn
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Nous Portal MCP

Portable, read-only first adapter for selected Nous Portal capabilities.

Status: early review scaffold. It is not yet authenticated and cannot invoke paid tools.

The first slice exposes:

  • nous_portal_status — local configuration status without credential output;

  • nous_portal_routes — local derivation of the vendor-specific managed gateway origins with an explicit no-effect receipt.

  • nous_portal_auth_start — request a device code without opening a browser;

  • nous_portal_auth_poll — poll once and atomically persist approved OAuth state without returning token values.

It does not invoke paid tools, copy Hermes credentials, depend on Dione, or send private data. Merely installing the adapter does not start authentication.

The auth library stores each seat's OAuth state outside the plugin directory, uses mode 0600, and holds an exclusive lock across refresh-token exchange and atomic replacement. Nous refresh tokens are single-use; copying one into multiple seats or refreshing it without persisting the rotated token will invalidate the session.

Configuration

Each adopting seat supplies its own credentials:

NOUS_PORTAL_STATE_DIR=<required private local per-seat state directory>
NOUS_PORTAL_CLIENT_ID=<required Portal OAuth client ID>
NOUS_PORTAL_SPEND_LIMIT_USD=<future paid-call ceiling>
TOOL_GATEWAY_DOMAIN=nousresearch.com
TOOL_GATEWAY_SCHEME=https
FIRECRAWL_GATEWAY_URL=<optional vendor-specific override>

NOUS_PORTAL_STATE_DIR has no shared fallback. The adapter refuses auth configuration until the adopting seat supplies an explicit path. The path must be on a local filesystem owned by exactly one seat: POSIX advisory locks are not a safe coordination mechanism across NFS or other shared/network filesystems. Do not distribute access or refresh tokens through a shared .env.

Device login is deliberately two-step. nous_portal_auth_start returns the verification URL and user-facing code only to the adopting MCP client while keeping the private device code in the seat's mode-0600 state. It never opens a browser or sends the code to Discord. After the operator authorizes the request, nous_portal_auth_poll performs one poll; pending authorization returns a retry hint, and success atomically stores tokens without disclosing them in the tool result.

Hermes derives managed origins as <vendor>-gateway.<TOOL_GATEWAY_DOMAIN>, with an optional vendor-specific override. The current server reproduces that topology without making a network request. Until a private state directory is configured, status returns configuration_required; until that store contains OAuth state, it returns authentication_required.

Related MCP server: fallpharm-mcp

Installation surfaces

The same dependency-free Python stdio server supports all clients. Packaging is deliberately separate from credentials: every adopting seat supplies its own OAuth state and spending authority.

Python / generic MCP

Install from a pinned Git commit:

python3 -m pip install \
  "nous-portal-mcp @ git+https://github.com/callisto-syn/nous-portal-mcp@<commit>"

The installed stdio command is:

nous-portal-mcp

See examples/generic-stdio.json.

Claude Code

Install the Python artifact in the construct's image or environment, then add the server entry from examples/claude-code.mcp.json. Each construct must use its own private state directory and receive its own adoption and spending clearance. Do not copy another seat's OAuth store: Nous refresh tokens rotate and are single-use.

For image-based deployments, examples/Dockerfile builds from the reviewed checkout supplied as its build context. Pin the checkout before building.

Codex

The repository is also a Codex plugin. Its .codex-plugin/plugin.json points to the repository-local .mcp.json, which launches the same server source.

Portability acceptance

Portability is not considered proven until a clean environment can:

  1. install a pinned artifact;

  2. start nous-portal-mcp over stdio;

  3. complete an MCP initialize and tools/list handshake;

  4. keep credentials and state outside the installed artifact;

  5. uninstall without removing or exposing another seat's state.

Development

python3 -m unittest discover -s tests

The design and prior-art record lives in docs/step0.md.

Available Tools

4 tools
nous_portal_auth_pollA

Poll a previously started device-code login exactly once. Makes one unmetered external request and atomically stores authorized tokens without returning token values.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses key behaviors: it makes one unmetered external request, atomically stores tokens, and does not return token values. This gives the agent a clear understanding of side effects, though it could mention whether the token retrieval is idempotent or destructive on retry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, with no wasted words. It efficiently conveys the purpose, behavior, and constraints without unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is complete. It covers what the tool does, how it behaves (external request, token storage), and what it returns (nothing). The agent has enough information to use it correctly in the auth flow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema coverage is 100%. Per guidelines, a baseline of 4 is appropriate since the description does not need to explain parameters. The description correctly indicates no parameters are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('poll'), the resource ('a previously started device-code login'), and the scope ('exactly once'). It distinguishes from sibling tools like 'nous_portal_auth_start' (starts flow) and 'nous_portal_status' (general status) by specifying the exact step in the authentication process.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use after 'nous_portal_auth_start' with 'previously started' and constraints polling to exactly once. However, it does not explicitly state when to use this tool versus alternatives (e.g., not to poll repeatedly) or what prerequisites are needed (e.g., having a device code from auth_start).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nous_portal_auth_startA

Start a Nous Portal device-code login. Makes one unmetered external request, stores the private device code locally, and never opens a browser or sends the code to another channel.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses key behaviors: makes one unmetered external request, stores private device code locally, and never opens a browser or sends the code. However, it does not describe the return value or what to do with the stored code. Missing details about the authentication state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, each providing essential information. The first sentence states the action, and the second elaborates on key behaviors. No wasted words, and the verb 'Start' is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and no output schema, the description covers the main behavioral aspects. However, it does not explain what the tool returns, how to use the stored code (e.g., with auth_poll), or potential errors. For a start tool, it is adequate but could guide the next steps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters with 100% coverage (none exist). According to guidelines, high schema coverage gives a baseline of 3. The description adds no parameter semantics because there are no parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Start a Nous Portal device-code login.' It distinguishes from sibling tools like nous_portal_auth_poll, which handles polling, and nous_portal_status, which likely shows status. The verb 'Start' plus the resource 'device-code login' is specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage in headless/automated contexts by stating it never opens a browser or sends the code elsewhere. However, it does not explicitly mention when to use this tool vs. siblings or when not to use it. The context signals indicate no parameters, so it's straightforward.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nous_portal_routesA

List locally derived Nous Portal vendor gateway routes. Makes no external request and invokes no paid tool.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description provides valuable behavioral disclosure: 'Makes no external request and invokes no paid tool.' This assures the agent of no side effects or costs, beyond the basic listing functionality.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundancy. It front-loads the main action and adds critical behavioral context efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with no parameters and no output schema, the description provides all necessary information: what it does, that it is local, and that it has no cost or external dependencies.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema coverage is 100%. For 0 parameters, the baseline score is 4. The description correctly omits parameter details as none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists locally derived Nous Portal vendor gateway routes. It uses a specific verb ('list') and resource ('routes'), and contrasts with siblings by noting it makes no external request and is free.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (when listing local routes without external calls). Sibling tools (status, auth start, auth poll) have different purposes, so context is clear, though no explicit when-not-to-use instructions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nous_portal_statusB

Report whether the portable Nous Portal adapter is configured. Never reveals credentials.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description adds the key behavioral note 'Never reveals credentials', which is important for safety. However, it does not disclose other traits like response format, potential errors, or latency. It is adequate but not thorough.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using two short sentences with no filler. Every word adds meaning, and the key point is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 params, no output schema), the description conveys the core function and a critical behavioral trait. However, it may lack detail about what 'configured' means or what the output looks like, leaving some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and schema coverage is 100%. The description adds value by clarifying the purpose and the credential constraint, meeting the baseline for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Report' and resource 'portable Nous Portal adapter configured status'. It clearly indicates the tool's function without ambiguity, though it does not explicitly differentiate from sibling tools beyond context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like nous_portal_routes or nous_portal_auth_start. The description only states what it does, omitting usage context or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observednous_portal_auth_poll
    • First observednous_portal_auth_start
    • First observednous_portal_routes
    • First observednous_portal_status
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.1/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clear, distinct purpose: checking configuration, listing routes, starting device-code login, and polling for authentication. No ambiguity or overlap exists.

Naming Consistency5/5

All tool names follow a consistent snake_case pattern with 'nous_portal_' prefix, making them predictable and easy to understand.

Tool Count5/5

With 4 tools covering status, routes, and the auth flow (start + poll), the count is well-scoped for the server's purpose without being too thin or excessive.

Completeness4/5

The tool surface covers essential operations for the adapter (status, routes, authentication start and poll). Minor gaps like logout or token refresh are missing, but the core workflow is complete.

Maintenance

ActivitySlowing
ResponsivenessUnresponsive

Resources

Related MCP Connectors

Related MCP Servers

  • SkyStage MCP Test Server

    mallikarjun-angadi
    F
    license
    Not graded
    quality
    D
    maintenance
    Minimal MCP server for testing SkyStage's self-auth auto-detection feature. It includes tools like ping, echo, server_info, and read_secret, and uses a mock OAuth provider for login.
    -

  • fallpharm-mcp

    sjgant80-hub
    A
    license
    Not graded
    quality
    C
    maintenance
    Provides a sovereign, MIT-licensed MCP server for professional-service workflows, running entirely on your infrastructure with Ed25519 cryptographic signing for every action.
    MIT

  • Terraform Cloud MCP

    Jackdaw16
    A
    license
    Not graded
    quality
    B
    maintenance
    A read-only MCP server for inspecting and diagnosing HCP Terraform workspaces, runs, and plan summaries from ChatGPT and other MCP clients. It provides tools to list workspaces, inspect runs, and summarize plans without exposing sensitive data.
    MIT

  • Intune Assignment Checker MCP

    ugurkocde
    A
    license
    A
    quality
    A
    maintenance
    A local, read-only MCP server that inspects and explains Microsoft Intune assignments through Microsoft Graph /beta, with delegated sign-in and secure token caching.
    6
    6 npm
    3
    MIT