Skip to main content
Glama
canonical-vault-mcp-server

canonical-vault-mcp-server

canonical-vault-mcp-server

M8ven Verified

M8ven Score

MCP server that exposes the canonical-vault GitHub repo to any MCP client — GitHub Copilot, Claude, Grok, ChatGPT, or anything else that speaks Streamable HTTP MCP.

Five read-only tools, always available, scoped to kushkillerjsixx66/canonical-vault:

Tool

Purpose

vault_list_directory

List files/dirs at a path

vault_get_file

Fetch a file's decoded text content

vault_get_file_history

Lineage — commit history for a path

vault_get_commit

Full detail + diff stats for one commit

vault_search_files

Code search across the repo

Plus two write tools, registered only when GITHUB_WRITE_TOKEN is set — otherwise they don't exist on the server at all:

Tool

Purpose

vault_propose_change

Create/update one file on a governed branch (never main, never a prohibited path)

vault_open_pr

Open a PR from a governed branch into main — never merges

Scope is fixed by the Model Contribution Contract (00_governance/contracts/model-contribution.md) and canonical_merge_authority: false: no direct writes to the canonical branch, no path in a prohibited zone, no merge tool anywhere in this server.

The Lattice

This server is part of the Lattice — a governance-first cognitive architecture for AI ("cognitive constitution"): layered gates (coherence · attention budget · reversibility), mandatory per-signal lineage, and refusal on insufficient evidence treated as a governed success.


Related MCP server: GitHub MCP

1. Deploy to Vercel

npm install -g vercel
cd canonical-vault-mcp-server
vercel login
vercel --prod

MCP endpoint:

https://canonical-vault-mcp-server.vercel.app/api/mcp

Environment variables

Variable

Required

Default

Notes

GITHUB_TOKEN

Strongly recommended

none

Read PAT (or public_repo). Raises rate limit to 5000/hr.

GITHUB_OWNER

No

kushkillerjsixx66

GITHUB_REPO

No

canonical-vault

GITHUB_DEFAULT_REF

No

main

GITHUB_WRITE_TOKEN

No — write tools off without it

none

Sensitive. Fine-grained PAT: Contents R/W on canonical-vault only.

GITHUB_WRITE_BRANCH_ALLOWLIST

No

grok,claude,chatgpt,gemini,copilot,muse,notion

Shared multi-model surface. Must never include main.

MODEL_WRITE_SCOPE

No

unset

Hard lock. e.g. grok → this deployment may only write to branch grok. Overrides the multi-model allowlist. Use one deployment per model for true isolation.

After changing env vars, redeploy production.


1b. Write tools — branch sovereignty

Enforcement layers:

  1. MODEL_WRITE_SCOPE (recommended per model) — Set MODEL_WRITE_SCOPE=grok on the Grok deployment, =claude on Claude’s, =muse on Muse’s, etc. Client cannot pick another branch.

  2. Path/branch coherence — Paths under vault/<model>/, runtime/<model>/, or 00_governance/<model>/ require branch === <model>. Blocks e.g. writing vault/claude/... while targeting branch grok.

  3. Allowlist — Without MODEL_WRITE_SCOPE, only listed model branches are writable; main is never writable.

  4. Path denylist — Constitution, IP/legal, protected manifests.

  5. No merge tool — vault_open_pr opens only; humans merge on GitHub.

Recommended production config (Grok endpoint):

GITHUB_WRITE_TOKEN=<secret>
MODEL_WRITE_SCOPE=grok
GITHUB_WRITE_BRANCH_ALLOWLIST=grok

Setup:

  1. Fine-grained PAT: Contents: Read and write on canonical-vault only → GITHUB_WRITE_TOKEN (Sensitive).

  2. Set MODEL_WRITE_SCOPE to the model this URL serves.

  3. Protect main on GitHub: require PR, no force-push, exclude write PAT from bypass.

  4. Redeploy.


2. Connect clients

{
  "servers": {
    "canonical-vault": {
      "type": "http",
      "url": "https://canonical-vault-mcp-server.vercel.app/api/mcp"
    }
  }
}

Always pass branch / head matching the model when the deployment is not hard-locked.


3. Local testing

npm install && npm run build
npx @modelcontextprotocol/inspector node dist/index.js
# or
vercel dev   # http://localhost:3000/api/mcp

Notes

  • Stateless per-request Streamable HTTP (api/mcp.ts).

  • Lineage tools map to GitHub commit history.

  • GitHub code search indexes the default branch only (propagation delay possible).

4. Governance enforcement boundary

This MCP server is a Canonical Vault access and proposal interface, not by itself the full Lattice runtime governance engine.

The server's TypeScript entry point creates createServer(), which registers repository read tools, canonical document resources, and optional governed-branch proposal tools. It does not instantiate the Python 05_runtime/governance/boundary.py GovernanceBoundary or call its AuthoritativeGovernanceEngine.

Keep these controls distinct:

  • MCP scope controls: repository allowlisting, branch allowlisting / MODEL_WRITE_SCOPE, path restrictions, and PR-only writes constrain what this service can propose.

  • Lattice runtime governance: canonical-state retrieval, revision-pinned authority resolution, transition evaluation, authorization, drift revalidation, and post-decision enforcement are provided by the separate Python runtime when that runtime is actually invoked.

  • GitHub merge authority: vault_open_pr proposes a change; it does not authorize or perform a merge.

Consequently, connecting an MCP client to this endpoint does not establish that every tool call has passed through the Python Lattice governance boundary. Do not describe this endpoint as enforcing the full Lattice runtime unless an explicit, authenticated integration is implemented and verified.

Any future integration must define the request and response contract, caller identity, exact target/scope/effect, pinned canonical revision, decision evidence, timeout and provider-failure behavior, and fail-closed semantics. Integration tests must exercise the actual mutation boundary. Production enforcement claims additionally require verifying deployment configuration and running a live smoke test against the deployed path.

Tracked follow-up: Define and verify the runtime governance enforcement boundary.

Available Tools

5 tools
vault_get_commitGet Vault Commit DetailA
Read-onlyIdempotent

Get full detail for a single commit in canonical-vault: message, author, stats, and the list of files it changed (with per-file diff stats).

Args:

  • sha (string): Full or abbreviated commit SHA (get one from vault_get_file_history)

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "sha": string, "message": string, "author": string, "date": string, "stats": {...}, "files": [{ "filename": string, "status": string, "additions": number, "deletions": number }] }

Examples:

  • Use when: "What exactly changed in commit a1b2c3d?" -> sha="a1b2c3d"

  • Don't use when: You just want the commit list for a path (use vault_get_file_history instead)

Error Handling:

  • Returns "Error: ... not found" if the SHA doesn't exist in this repo

Inputs: sha (required), response_format.

vault_get_fileGet Vault FileA
Read-onlyIdempotent

Fetch the decoded text content of a single file from the canonical-vault repository (kushkillerjsixx66/canonical-vault).

Args:

  • path (string): File path relative to repo root, e.g. 'governance/CONSTITUTION.md'

  • ref (string): Branch, tag, or commit SHA (default: 'main')

Returns: The raw file text, prefixed with a small header (path, ref, sha, size). Binary or oversized files (> 500000 bytes) return an error instead of garbled content.

Examples:

  • Use when: "Read me the current Constitution" -> path="governance/CONSTITUTION.md"

  • Use when: "What does vara.py look like right now?" -> path="vara.py"

  • Don't use when: You just want to know if a file exists or how big it is (use vault_list_directory instead)

Error Handling:

  • Returns "Error: ... not found" if the path doesn't exist on that ref

  • Returns an error for directories (use vault_list_directory instead) or binary files

Inputs: path (required), ref.

vault_get_file_historyGet Vault File/Path LineageA
Read-onlyIdempotent

Get the commit lineage (history) affecting a file or directory in canonical-vault — i.e. every commit that touched that path, most recent first.

Args:

  • path (string): File or directory path to trace (default: "" for whole-repo history)

  • ref (string): Branch, tag, or commit SHA to start from (default: 'main')

  • limit (number): Max commits to return, 1-100 (default: 20)

  • offset (number): Commits to skip for pagination (default: 0)

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "path": string, "count": number, "commits": [{ "sha": string, "message": string, "author": string, "date": string, "url": string }], "has_more": boolean }

Examples:

  • Use when: "How has VARA_SPEC_1.0 evolved?" -> path="system-specs/VARA_SPEC_1.0.md"

  • Use when: "What's the recent commit lineage for the whole vault?" -> path=""

  • Don't use when: You need the full diff of one specific commit (use vault_get_commit instead)

Error Handling:

  • Returns "Error: ... not found" if the path or ref doesn't exist

Inputs: ref, path, limit, offset, +1 more.

vault_list_directoryList Vault DirectoryA
Read-onlyIdempotent

List the files and subdirectories at a given path in the canonical-vault repository (kushkillerjsixx66/canonical-vault).

Args:

  • path (string): Directory path relative to repo root (default: "" for root)

  • ref (string): Branch, tag, or commit SHA (default: 'main')

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "path": string, "ref": string, "entries": [{ "name": string, "path": string, "type": "file"|"dir", "size": number }] }

Examples:

  • Use when: "What's in the governance directory?" -> path="governance"

  • Use when: "Show me the top-level structure of the vault" -> path=""

  • Don't use when: You need the actual contents of a file (use vault_get_file instead)

Error Handling:

  • Returns "Error: ... not found" if the path doesn't exist on that ref

  • Returns a rate limit message if GitHub's API limit is exceeded (set GITHUB_TOKEN to raise it)

Inputs: ref, path, response_format.

vault_search_filesSearch Vault FilesA
Read-onlyIdempotent

Search file names and contents across the canonical-vault repository (kushkillerjsixx66/canonical-vault) using GitHub code search.

Args:

  • query (string): Search terms. Supports GitHub code search qualifiers like 'path:governance' or 'extension:md'

  • limit (number): Max results, 1-50 (default: 20)

  • offset (number): Results to skip for pagination (default: 0)

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "total": number, "count": number, "results": [{ "path": string, "url": string }], "has_more": boolean }

Examples:

  • Use when: "Where is Coherence defined?" -> query="Coherence path:governance"

  • Use when: "Find every mention of vara.py" -> query="vara.py"

  • Don't use when: You already know the exact path (use vault_get_file instead)

Error Handling:

  • Returns "No files found matching ''" if the search returns empty

  • GitHub code search only indexes the default branch and repos under ~size limits; very new commits may lag briefly

Inputs: query (required), limit, offset, response_format.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A4.7/5.0

    Scored across 5 tools

    Disambiguation5/5

    Each tool has a distinctly separate purpose: listing a directory, reading a file, tracing commit history, inspecting a single commit, and searching the repository. The descriptions even include explicit 'Don't use when' guidance to prevent confusion.

    Naming Consistency5/5

    All tools follow a uniform `vault_` prefix with a verb_noun pattern (list_directory, get_file, get_file_history, get_commit, search_files). Naming is idiomatic, consistent, and immediately signals the action and target.

    Tool Count5/5

    Five tools is a well-scoped set for a read-only repository browsing server. Each tool covers a core operation without redundancy or bloat, making the surface easy to grasp and use.

    Completeness5/5

    For a read-only vault browsing use case, the set fully covers the necessary operations: navigating (list), reading content (get file), exploring change history (history/commit), and searching. There are no obvious missing capabilities that would block an agent.

    Maintenance

    ActivityMaintained
    ResponsivenessOutdated data

    Related MCP Connectors

    Related MCP Servers