<p align="center">
  <img src="docs/assets/openxnet-server-cover.svg" alt="OpenXnet Server - SynapXnet enterprise agent collaboration and governance backend" width="100%">
</p>

<p align="center">
  <a href="./README_ZH.md">简体中文</a> ·
  <strong>English</strong> ·
  <a href="./README_JA.md">日本語</a>
</p>

<p align="center">
  <a href="https://github.com/synapxnet/openxnet-server/releases/tag/goai-v1.1.0"><img src="https://img.shields.io/badge/release-goai--v1.1.0-14b8a6" alt="GOAI v1.1.0"></a>
  <img src="https://img.shields.io/badge/MCP-2026--07--28-2496ed" alt="MCP 2026-07-28">
  <img src="https://img.shields.io/badge/Python-3.12-3776ab" alt="Python 3.12">
  <a href="./LICENSE"><img src="https://img.shields.io/badge/license-AGPL--3.0-4c1" alt="AGPL-3.0"></a>
</p>

# OpenXnet Server

OpenXnet is SynapXnet's enterprise AI employee collaboration and governance platform. This repository contains its server-side MCP gateway, stable tool contracts, workspace-scoped evidence resources, approval controls, and auditable action records.

XnetAIOps, XnetDataOps, and XnetMLOps are product capabilities of the same SynapXnet ecosystem. They are connected through governed MCP adapters; they are not presented here as unrelated third-party products.

> This public branch is the hardened GOAI competition server component. The full desktop experience lives in [synapxnet/OpenXnet](https://github.com/synapxnet/OpenXnet).

## End-to-end role

```mermaid
flowchart LR
    Input["Enterprise task input<br/>alert · ticket · data · model"] --> Team["AgentTeams<br/>role orchestration and state tracking"]
    Team --> Skill["OpenXnet Skills<br/>reusable task capability"]
    Skill --> Gateway["OpenXnet Server<br/>MCP gateway and governance"]
    Gateway --> AIOps["XnetAIOps<br/>service and infrastructure evidence"]
    Gateway --> DataOps["XnetDataOps<br/>quality, lineage and workflow evidence"]
    Gateway --> MLOps["XnetMLOps<br/>model, probe and deployment actions"]
    AIOps --> Evidence["Evidence chain and shared context"]
    DataOps --> Evidence
    MLOps --> Evidence
    Evidence --> Decision["Neural-symbolic decision<br/>rules · risk · confidence · constraints"]
    Decision --> Approval["Human approval for high-risk actions"]
    Approval --> Verify["Independent verification · audit · rollback"]
    Verify --> Memory["Review, memory and Skill evolution"]
```

The separation is intentional: AgentTeams coordinates roles, Skills describe reusable capabilities, MCP connects external tools, and OpenXnet enforces workspace, permission, approval, evidence, and audit boundaries.

## What this repository implements

| Capability | Implementation |
| --- | --- |
| MCP transport | Streamable HTTP and single-request SSE using protocol `2026-07-28` |
| Identity and access | OAuth issuer, audience, time and scope validation; tool visibility filtered by least-privilege scopes |
| Tool contracts | Versioned JSON Schema for requests, responses, errors, manifests, and audit receipts |
| Evidence resources | Workspace-bound Trace, Evidence, Action, Approval, and Audit indexes |
| Controlled execution | Dry Run, parameter digest, resource-version checks, idempotency, separation of duties, and rollback records |
| Adapter boundary | Bounded response size, timeout control, redirect denial, and no external bearer-token forwarding |
| Persistence | SQLite for the competition/single-instance control plane; replace with shared transactional storage for multi-replica production |

## Governed tool surface

The frozen `1.0.0` manifest exposes ten tools:

| Domain | Read and verification tools | Controlled write |
| --- | --- | --- |
| XnetAIOps | Alert evidence, service health, Kubernetes workload | - |
| XnetDataOps | Quality report, schema snapshot, lineage, workflow instance | - |
| XnetMLOps | Deployment evidence, inference probe | Deployment rollback with approval |

The high-risk rollback path requires an approval created by one subject and approved by another, plus `expectedResourceVersion`, `reason`, `dryRun`, `idempotencyKey`, and a matching parameter digest.

## Repository layout

```text
openxnet_mcp_gateway/   MCP protocol, security, registry, adapters and stores
contracts/              Canonical schemas, tool manifest and MCP fixtures
docs/goai-competition/  Handoff, test report and reproducible E2E trace sample
tests/                  Gateway protocol, governance and security tests
GOAI-RELEASE.md         Release component boundary and shared suite contract
SECURITY.md             Vulnerability reporting and secret-handling policy
```

## Quick start

Requirements: Python `3.12` and `uv`.

```bash
git clone https://github.com/synapxnet/openxnet-server.git
cd openxnet-server
git switch GOAI-Competition
uv sync --python 3.12
uv run python -m openxnet_mcp_gateway
```

The gateway fails closed when signing secrets or the internal control token are absent. Supply credentials through the runtime secret manager, never through committed `.env` files. Adapter endpoints and all supported environment keys are documented in the [implementation handoff](./docs/goai-competition/HANDOFF-GOAI-COMPETITION-1.0.0.md).

## Verification

```bash
uv run python -m unittest tests.test_openxnet_mcp_gateway -v
```

The gateway suite covers protocol versioning, scopes, origins, header/body confusion, token non-forwarding, single-tool delegation, approval separation, workspace isolation, SSE, response limits, timeouts, Dry Run, resource versions, parameter digests, idempotency, and process recovery. See the [test report](./docs/goai-competition/TEST-REPORT-1.0.0.md) for passed checks and remaining production gates.

## SynapXnet ecosystem

| Product | Responsibility |
| --- | --- |
| [OpenXnet](https://github.com/synapxnet/OpenXnet) | Enterprise AI employees, workspaces, collaboration, Skills, memory, and governed execution experience |
| [XnetAIOps](https://github.com/synapxnet/XnetAIops) | Infrastructure, service, Kubernetes, alert, and recovery capabilities |
| [XnetDataOps](https://github.com/synapxnet/XnetDataops) | Data integration, development, quality, lineage, governance, and data services |
| [XnetMLOps](https://github.com/synapxnet/XnetMLops) | Data processing, training, evaluation, registry, deployment, inference, and model governance |

## Release and security

- Release: [OpenXnet GOAI Competition Suite `goai-v1.1.0`](https://github.com/synapxnet/openxnet-server/releases/tag/goai-v1.1.0)
- Component manifest: [GOAI-RELEASE.md](./GOAI-RELEASE.md)
- Security policy: [SECURITY.md](./SECURITY.md)
- Third-party inventory: [CycloneDX SBOM](./sbom.cdx.json)
- License: [GNU Affero General Public License v3.0](./LICENSE)

The competition fixtures are reproducible samples and must not be represented as live production execution. External OIDC/JWKS rotation, shared transactional storage, browser integration tests, controlled real rollback, and performance sampling remain deployment acceptance gates.