Behavior MCP

An experimental local MCP server for authoring and using persistent Behavior systems through structured data. Behavior IR owns model meaning and lowering; Behavior Core owns evaluation, commit and replay. This package supplies transport, artifact storage, host authorization and independent deployment/state boundaries.

The implemented authoring profile supports bounded RequestFlow and StateMachine definitions, including composition in one module. Proposals, admitted definitions, verification evidence, activation and committed state are separate artifacts and operations. Agents do not generate application source code or receive filesystem, SQL or process tools.

Supported Environment

Linux x86_64, Python 3.13+, the exact Behavior 0.14.0 released wheel and bundled Core 0.15.0. The pinned Nix shell supplies Python 3.13.14, uv, native Ruff and Z3 4.16.0. Python dependencies and build tools use uv.lock. See compatibility for identities and limits.

Run the same quality gate used by CI and release checks:

nix develop --command ./scripts/check

This bootstraps the locked environment, checks released dependency bytes/public interfaces, formatting, lint, strict types, deterministic tests, Core backend conformance and physical recovery. The package installation test also checks the built distribution outside the checkout. Validated wheel/source artifacts remain in dist/.

Related MCP server: Mission

Use

A trusted operator installs a bounded delegation policy and starts one workspace owner:

nix develop --command uv run --locked behavior-mcp-admin install-policy \
  --workspace /absolute/workspace \
  --trusted-config /absolute/admin.local.json \
  --document specs/001-agent-native-systems/contracts/example-host-policy.json
nix develop --command uv run --locked behavior-mcp serve \
  --workspace /absolute/workspace \
  --host-config /absolute/launcher.local.json

Operations describes the trusted configuration, activation policy, recovery and storage assumptions. This local trust boundary does not isolate an unrestricted process running as the same OS user.

An MCP client discovers models, proposes structured data, validates an exact proposal revision, creates an inactive system and explicitly activates its exact definition. It then discovers actual generated capabilities, evaluates a request and separately commits the returned token. Multiple systems share immutable artifacts while keeping mutable state, history, activation and request authority isolated by SystemId. Restart does not depend on an agent session, a note client or Git.

• Tool contracts and schemas

• Generic proposal example

• Delegated host authority

• Acceptance journey

• Capability gaps

Canonical model documents do not contain every authoring body in this release. The server therefore retains complete original authoring data/context alongside canonical documents, Wire modules and lowering receipts. Schema-changing activation, arbitrary expressions, command execution, cross-system workflows and authored Approval/WorkQueue models remain unsupported. Admission, a matching hash, or a successful test is never approval or a general safety proof.