AyA-MCP v0.2

Universal deterministic MCP core from AYA / De Bruin Sistemas.

v0.2 expands the project to all areas of the company: web systems, APIs, SaaS, ecommerce, websites, mobile/desktop, games, AI, Brazilian tax, payments, communications, data, security, automation, and infrastructure.

Pre-1.0 line. The package.json uses 0.2.0 per SemVer/npm; the public version is v0.2.

Goal

Reduce how much an LLM needs to remember, interpret, and improvise. Whenever an important rule can become code, gate, tool, resource, schema, evidence, or policy, AyA-MCP should prefer that over a loose textual instruction.

Related MCP server: mcp-tool-server

Integration with the Agents package

The private Agentes de IA package is a functional source for v0.2. Configure:

AYA_FRAMEWORK_AGENTS_ROOT=/caminho/Agentes-de-IA

The MCP inventories and routes runtimes, agents, skills, specialized packs, templates, and vendor skills without loading thousands of files into context.

Proprietary Agents content is not copied into this public repository.

Agents rules transformed into behavior

• backup before editing -> aya_arquivo_escrever_seguro;

• immediate logging -> aya_execucao_log_registrar;

• UTF-8 without BOM -> aya_arquivo_encoding_validar;

• continuity -> aya_memoria_agents_inicializar + checkpoint/handoff;

• evidence before done -> aya_evidencia_*;

• two identical failures -> aya_loop_falha_registrar generates a block;

• routing/skills/packs -> aya_framework_*;

• framework governance -> aya_framework_governanca_auditar;

• template-first -> aya_template_primeiro_planejar;

• model privacy -> aya_modelo_privacidade_avaliar;

• weak LLM -> aya_modelo_perfil_execucao + selective toolsets/context.

Games

Games are a first-class domain.

Initially detected engines:

• Godot;

• Unity;

• Unreal Engine;

• Phaser;

• Three.js/WebGL;

• Flutter/Flame;

• libGDX;

• GameMaker;

• Defold;

• Ren'Py;

• LÖVE2D.

Tools:

• aya_games_detectar_engine;

• aya_games_assets_inventariar;

• aya_games_validar;

• aya_games_checklist.

The Games layer will be further expanded within v0.2 with specialized integrations when available.

Persistent memory

v0.2 combines two models:

1. operational/checkpoint/handoff memory for continuity between LLMs;

2. project graph memory, inspired by the Memory MCP server.

Resource:

aya://projeto/memoria-grafo

Tools:

• aya_memoria_grafo_ler;

• aya_memoria_grafo_buscar;

• aya_memoria_grafo_abrir;

• aya_memoria_grafo_upsert;

• aya_memoria_grafo_observar;

• aya_memoria_grafo_relacionar;

• aya_memoria_grafo_remover.

Hmm wait, I made a typo. Let me correct:

• aya_memoria_grafo_ler;

• aya_memoria_grafo_buscar;

• aya_memoria_grafo_abrir;

• aya_memoria_grafo_upsert;

• aya_memoria_grafo_observar;

• aya_memoria_grafo_relacionar;

• aya_memoria_grafo_remover.

Secrets are sanitized before persisting observations.

Code and context economy

Inspired by Serena and mcp-language-server, AyA-MCP gained a lightweight native layer:

• aya_codigo_outline;

• aya_codigo_referencias;

• aya_codigo_editar_linhas;

• aya_codigo_semantico_planejar.

The native outline/references are deliberately lexical. For semantically correct definition/rename/diagnostics/call hierarchy, prefer approved LSP/Serena. AyA-MCP does not call LSP regex.

Toolsets

By default, all capabilities are registered:

AYA_TOOLSETS=all

For a smaller LLM, reduce schemas:

AYA_TOOLSETS=games,codigo,arquivos,memoria,seguranca,evidencias,equipe,agents

Available toolsets:

• specforge;

• agents;

• games;

• codigo;

• arquivos;

• memoria;

• seguranca;

• mcps;

• evidencias;

• templates;

• equipe.

Use aya_toolsets_sugerir to assemble a minimal set per task.

External MCPs researched

v0.2 studied open projects to absorb best practices:

• modelcontextprotocol/servers;

• github/github-mcp-server;

• docker/mcp-gateway;

• oraios/serena;

• isaacphi/mcp-language-server;

• microsoft/playwright-mcp;

• ChromeDevTools/chrome-devtools-mcp;

• googleapis/mcp-toolbox;

• crystaldba/postgres-mcp;

• upstash/context7;

• wonderwhy-er/DesktopCommanderMCP.

Details in docs/MCPs-ABERTOS-APROVEITADOS-v0.2.md and config/mcps-abertos-pesquisados-v0.2.json.

AyA does not install unknown MCPs automatically.

Security

• workspace fixed at AYA_WORKSPACE_ROOT;

• read-only by default;

• writing requires AYA_MODO_ESCRITA=true;

• path traversal blocked;

• framework symlinks do not escape the authorized root;

• .git, node_modules, vendor, and vendor skills protected from generic writes;

• backup before editing;

• SHA-256 as an optional/required precondition in surgical edits;

• logs/audit sanitize secrets;

• static audit looks for hardcoded secrets, dangerous shell, eval, insecure TLS, CORS, and lockfiles;

• external content is treated as untrusted data;

• no unrestricted shell in v0.2.

Universal multi-agent team

aya_agentes_planejar_equipe assembles roles according to the project. In addition to Orchestrator, Analyst, Architect, Executor, Reviewer, Tester, Continuity, and Critic, it can add specialists in:

• data;

• backend;

• frontend;

• mobile;

• game design;

• engine/performance;

• security;

• DevOps;

• Brazilian tax;

• payments;

• communications;

• AI/LLM;

• evidence/consent.

SpecForge

SpecForge remains a privileged consumer of AyA-MCP, but the MCP does not depend on it to exist.

The REQ/RN/CT/T tools, traceability, queue, quality, agents, and aya_validacao_aprovar_saida are in the specforge toolset.

Local execution

npm install
npm run build
AYA_WORKSPACE_ROOT=/caminho/do/projeto npm start

With Agents:

AYA_WORKSPACE_ROOT=/caminho/do/projeto \
AYA_FRAMEWORK_AGENTS_ROOT=/caminho/Agentes-de-IA \
npm start

VPS / remote

npm run start:http

Outside loopback, configure token and host allowlist according to .env.exemplo.

Quality

npm run verificar

GitHub Actions runs the TypeScript build and tests on each push/PR.

Main documents

• docs/V0.2-ESCOPO.md

• docs/INTEGRACAO-AGENTS.md

• docs/GAMES.md

• docs/MCPs-ABERTOS-APROVEITADOS-v0.2.md

• docs/SEGURANCA.md

• docs/ROADMAP.md

• CHANGELOG.md

• VERSIONAMENTO.md