phionyx-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PHIONYX_TRACE_ID | No | Optional trace ID for the session. If not set, read from file or generated. | |
| PHIONYX_MCP_AUDIT_ROOT | No | Root directory for audit log storage. Default: ~/.phionyx/mcp_audit/ | |
| PHIONYX_ACTIVE_TRACE_FILE | No | Path to file containing active trace ID. Default: ~/.phionyx/active_trace |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| verify_tool_descriptorA | Capability 1 + 2: hash an MCP tool descriptor (Q3 semantics — full descriptor INCLUDING protocolVersion) and compare against the user-approved baseline. Returns the current hash and a change_detected flag. Hosts SHOULD call this before forwarding a tool call to detect post-approval descriptor drift (tool poisoning / rug pull defense per arXiv:2512.06556). |
| record_tool_callA | Capability 4 + 7: record a tool call (input + output hashes) as a signed RGE v0.2 envelope with the mcp_tool_audit block populated. Appends to the trace's audit chain and returns the new envelope's integrity hash. The envelope is persisted under ~/.phionyx/mcp_audit//.json by default (configurable via PHIONYX_MCP_AUDIT_ROOT). |
| verify_chain_integrityB | Capability 8: walk the persisted envelope chain for |
| query_audit_historyA | Read the audit chain for |
| record_user_approvalB | Capability 5 (stub in v0.1.0-dev): capture user approval state for a tool. Full implementation lands when the host-side UX surface is defined; current returns a structured 'not_implemented' marker that callers can detect. |
| flag_anomalyC | Capability 6 (stub in v0.1.0-dev): forward an anomaly observation from the host into the audit envelope's runtime_anomaly_flag field. Will pull live scores from phionyx_core.pipeline.blocks.behavioral_drift_detection in v0.5. |
| audit_record_decisionA | Catch-all decision logger — append a runtime decision (release/block/defer/redact) to the audit chain without populating mcp_tool_audit. Useful for non-MCP policy events the host wants to record alongside MCP calls. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: recording decisions, flagging anomalies, querying history, recording tool calls, recording approvals, verifying chain integrity, and verifying descriptors. No two tools overlap in function.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., audit_record_decision, verify_chain_integrity). The naming is uniform and predictable.
With 7 tools covering the core audit and integrity verification operations, the count is well-scoped for the server's purpose. No unnecessary tools are present, and the set is not too small.
The tool set covers recording, reading, and verifying the audit chain, as well as descriptor verification. A minor gap is the lack of a tool to list or manage traces, but this appears intentional for immutability.