The server integrates with Authelia for OAuth-based authentication, enabling circle-based access control for HTTP clients.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@boris-mcp how does Boris handle always-on systems?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A public MCP server about Boris Churzin (essl) — what he builds, how he decides, and the ops doctrine he runs on. Point an agent at it and interrogate the judgment instead of parsing a PDF.
uvx boris-mcpOr in an MCP client config:
{
"mcpServers": {
"boris": { "command": "uvx", "args": ["boris-mcp"] }
}
}On always-on systems (design_decisions("dumb-evaluator")):
An always-on process is the one that runs when you are asleep and cannot supervise it. Every capability you give it is a capability that acts unsupervised. So the always-on half evaluates predicates and sends alerts; all judgment lives in the supervised half, which compiles rules for it.
On tracking work (doctrine("ack-is-not-answer")):
An acknowledgment is not an answer, and may be a disguised blocker. Auto-replies arrive in seconds and mean nothing happened.
That's the whole idea: ask the questions, get the reasoning. The rest is how the server serves it safely — which turns out to be the same discipline the answers are about.
Related MCP server: Graph
Nine tools are public — no auth required, callable over stdio (uvx boris-mcp) or anonymously
over HTTP:
Tool | What it gives you |
| Who, what, and the shape of the rest |
| What you can do here, and what to do next |
| Who the server thinks you are, and what that gets you |
| What's shipped since a cursor you keep — poll this at session start |
| Systems built — and what's architecturally notable about each |
| How things were actually decided, and why |
| Personal-ops rules, each with the failure it prevents |
| Languages, patterns, engineering discipline |
| How to reach him |
Beyond these, eight more tools exist behind authentication and the circles-of-trust gate: a
headhunter-tier pair (send_message, my_messages) for leaving the owner a message and
checking for a reply, and an owner-tier set (inbox, reply, grant, revoke,
access_requests, activity) for reading and answering the mailbox and managing who's let
in. See Circles, auth, and the mailbox below.
Public tools are read-only over a public corpus. The consent-carrying set above mutates
access or mailbox state — but only because the caller has already been proven to be the
owner (or, for send_message, an authenticated non-anonymous caller) by a fail-closed gate:
an unmapped or unauthenticated caller resolves to the public tier and nothing more, by
construction, not by policy. Content above the commit boundary — the private corpus — lives
off-repo on the operator's own disk and is served only through that same gate.
Access is a ladder of circles, outer to inner, each one trusted with strictly more than the last; a caller sees content gated at or below its own resolved circle and nothing above it — not even that a deeper circle exists.
flowchart LR
A["agent / caller"] -->|"stdio (uvx): offline, no auth"| P["public tier"]
A -->|"HTTP: OAuth via Authelia"| RC["resolve circle<br/>(a signed claim can only<br/>lower trust, never raise)"]
P --> G{"circle gate<br/>fail-closed"}
RC --> G
G -->|"at / below your circle"| C["public corpus in-repo<br/>+ private corpus off-repo"]
G -->|"above your circle"| D["honest denial<br/>(logged to activity)"]
C --> M["mailbox & event log<br/>pull + cursor, no push"]public is the anonymous default; everything at or above the commit boundary lives only in a
private corpus file on the operator's own disk, never in this repo. The stdio path
(uvx boris-mcp) always resolves to public. Over HTTP, a caller authenticates via OAuth
against an Authelia instance the operator runs, and the server clamps whatever circle the
token claims to what an explicit grant actually gives it — a signed claim can lower your
trust, never raise it. Forget to label a piece of content and it fails closed to owner
(the top of the ladder), hidden from everyone but the operator.
Full picture: docs/ATP.md is the acceptance-test checklist behind every locked decision (published for transparency; it reads like internal QA scaffolding, because it is), and deploy/README.md runs the HTTP + Authelia stack yourself.
The message-passing here is the reference implementation of MCPP — the Model Context
Peering Protocol (docs/MCPP.md), a formal MCP extension (SEP-style) for
agent-to-agent messaging: MCP servers peer with each other the way SMTP MTAs do, with
pull-based delivery and a trust ladder. MCPP is to MCP what SMTP is to TCP — an application
protocol over a transport that already exists. The mailbox tools
(send_message/inbox/reply/my_messages) are what's built and running today;
docs/MESSAGES.md is the implementation-level walkthrough. The spec also
defines a consent-gated ask operation — an agent drafts an answer only from what the
asker is already cleared to see, and a human discloses it — which is specified but not yet
implemented here.
There is no push, and that is deliberate. Call whats_new() at the start of a session; it
returns everything after your cursor and hands you a fresh one. There's also an
Atom feed for anything that isn't an agent.
Short version of why: MCP notifications are session-scoped and non-durable, a stdio server has no inbound network path, and the clients that matter don't implement subscriptions anyway — so push would drop any event fired while you had no session open, which is most of them. A cursor makes polling exact. The long version has the spec citations.
The reusable half lives in src/boris_mcp/_engine/ — the event log
with cursor semantics, and Atom feed generation. It knows nothing about me: a test walks its
import graph and scans its code for personal nouns, so it stays extractable
(tests/test_engine_boundary.py).
The tool surface deliberately isn't abstracted. about() / projects() /
design_decisions() is a good convention and a bad framework — a photographer wants a
portfolio, a writer wants a bibliography. Abstract the plumbing, template the surface.
Today that means: fork this, replace content.py and events.json, keep _engine/.
It'll be extracted as an installable package when someone actually wants that — see docs/GENERIC-SPLIT.md for the full split and why the repo keeps a personal name while the engine won't.
Two linter families for personal-ops text, both built and tested in
_engine/opslint/. leak is a deterministic pre-publish
check for anyone running a public server like this one — because the dangerous part of
publishing a personal MCP isn't the code, it's the day you paraphrase something you
shouldn't — and it's already wired in as scripts/leak_check.py,
run by hand before every push. hygiene flags outbound items with no follow-up date,
acknowledgments recorded as answers, statuses older than their own chase dates, and
prepared-but-unsent work; the engine and its tests exist, but it isn't exposed as a callable
MCP tool yet — that's what's coming.
This repo is a personal instance, not a framework. The instance layer (content.py,
events.json, the tool surface) is meant to be forked, not contributed to — see
CONTRIBUTING.md. Genuine bug reports against the generic engine
(_engine/) are welcome.
MIT
Who Boris is and what he builds. Start here.
Tier: public.
Inputs: no named parameters.
Who has asked for access and what happened to them.
Every authenticated subject the server has never seen before gets one line here, once,
the first time it calls anything. status defaults to 'pending' — the ones still
waiting on you; pass status="" for the full history including your own grants and
revocations.
since is a cursor with the same semantics as whats_new(): pass back the cursor from
a previous call (the id of the last request in that page) and get only what arrived after
it, oldest first. Keep polling while count == limit to drain the whole backlog gap-free.
Tier: owner.
Inputs: limit, since, status.
The shenanigans log: every denied tool call, and every access decision you made.
This is the signal that somebody is probing the edges — a caller repeatedly asking for things above their circle shows up here as a run of denials with their subject on it. Nothing is redacted; the denial the caller received was deliberately vaguer than the line written here.
kind filters: 'denial' | 'assignment' | 'revocation'. since is a cursor (the id of the
last entry in the previous page); pass it back to get only what arrived after it, oldest
first, and keep polling while count == limit to drain the whole backlog gap-free.
Tier: owner.
Inputs: kind, limit, since.
How to reach Boris.
Tier: public.
Inputs: no named parameters.
How Boris actually decided things, and why — an ADR corpus rather than a resume. Call with no topic to list them all; pass a topic key for one. Topics: dumb-evaluator, circuit-breakers-in-code, autonomy-tiers, structural-not-promised, containment-by-subtraction, state-in-files, receipt-is-not-outcome, value-not-quantity.
Tier: public.
Inputs: topic.
The personal-ops doctrine: rules for running your life or your agents out of files
without threads dying quietly. Each rule carries why it exists and what a linter would
check. Call with no argument for all. This is the rule set ops-lint's hygiene family
enforces against tracker files.
Tier: public.
Inputs: rule.
Assign a subject to a circle. Consent-carrying: calling this IS the approval.
subject is the sub claim exactly as it appears in access_requests(). The assignment
takes effect on that subject's next call and outranks whatever circle claim their token
carries — the mapping file is the operator's word, the claim is only the issuer's.
Tier: owner.
Inputs: circle (required), subject (required).
What you can do here, and what to do next — the front door to self-awareness.
Derived entirely from the live tool registry (gate.TOOL_TIERS / gate.REGISTRATIONS), so it can never describe a tool the gate would refuse, or leave out one it would allow. whoami() answers "who am I"; this answers "what can I do, and what's my next step." The one caller who reaches every circle additionally gets a live operational runbook — pending access requests with copyable grant() calls, a shenanigans signal, private- corpus content health, and the publish/deploy checklist.
Tier: public.
Inputs: no named parameters.
Every inbound message, oldest-first within a page. This is the owner's read of the mailbox strangers' agents write into with send_message() — cursored the same way whats_new() and access_requests() are.
since is a cursor from a previous call (the id of the last message in that page); pass it
back to see only what is new, oldest first. Keep polling while count == limit to drain
the whole backlog gap-free.
Tier: owner.
Inputs: limit, since.
Replies addressed to you, oldest-first within a page. Poll this at the start of a session, the same way whats_new() polls the event log — if the owner answered a message you sent, it shows up here, never pushed.
since is a cursor: pass back the cursor a previous call returned (the id of the last
reply in that page) and get only what arrived after it, oldest first. Keep polling while
count == limit to drain the whole backlog gap-free. Isolation is structural, not a filter
you can turn off: this only ever returns replies whose to matches your own resolved
subject, which this server derives from your verified caller identity, never from an
argument.
Tier: headhunter.
Inputs: limit, since.
Systems Boris has built. Each entry says what it is and — more usefully — what is architecturally notable about it. Set include_private=False for public repos only.
Tier: public.
Inputs: include_private.
Answer a message. Consent-carrying, like grant(): there is no queue or draft state — calling this IS the send, because the caller has already been proven to be the owner by the gate.
to is the from subject exactly as it appeared in inbox(); the reply lands in that
subject's my_messages() on their next poll. thread should echo the thread you are
answering so the conversation stays together; a blank thread starts a fresh one.
Tier: owner.
Inputs: to (required), body (required), thread.
Remove a subject's circle assignment. Consent-carrying: calling this IS the approval.
The subject does not become unknown again — their request line stays in the log, and they fall back to whatever an unmapped authenticated caller gets. Revoking somebody who was never assigned is a no-op that still records the intent.
Tier: owner.
Inputs: subject (required).
Leave a message for the owner. Pull-based, like whats_new(): there is no push, the owner reads this via inbox() on their own schedule, and any reply shows up in my_messages() the next time you poll it.
body is stored and returned as opaque text — write whatever you want a human to read.
It is capped at 4000 characters and is never interpreted, templated, or executed by this
server or by anything that displays it.
thread is a conversation key you choose; leave it blank to start a new one and reuse
the value you get back to keep a conversation together. Sending is rate-limited per
caller so one subject cannot bury the owner's inbox before they have looked at it once.
Tier: headhunter.
Inputs: body (required), thread.
Languages, architectural patterns, and engineering discipline — the checkable kind.
Tier: public.
Inputs: no named parameters.
What Boris has shipped or published, oldest-first within a page. THIS IS THE SUBSCRIBE-EQUIVALENT: call it once when a session starts, and again whenever you want to catch up. It is a forward log, not a "most recent N" snapshot.
since is a cursor — pass either an event id or an ISO-8601 timestamp from a previous
call, and you get only what came after it, OLDEST first. Every response includes a cursor
field (the id of the last event in THIS page); keep it and pass it back next time. To drain
a backlog, keep polling with the returned cursor while count == limit — a full page means
more unseen events remain behind it. Passing nothing returns the OLDEST limit events,
then poll forward to reach the present.
kind optionally filters: 'release' | 'project' | 'writing' | 'note'.
There is deliberately no push/subscribe mechanism — see the delivery field in the
response, and docs/EVENTS.md. Poll this on session start; that is the intended use.
Tier: public.
Inputs: kind, limit, since.
Who this server thinks you are, and what that gets you.
Returns the subject your token carries — or "anonymous", which covers both a local
stdio session and an authenticated HTTP call whose token simply carries no subject
claim — the circle you resolved to, and whether an access request is on file for you.
circles lists the ones your own circle reaches — there may be others, and if there
are, the response says so without naming them.
Tier: public.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 17 tools
Each tool targets a distinct resource or action: informational (guide, about, whoami), knowledge (projects, design_decisions, doctrine), messaging (send_message, my_messages, inbox, reply), and administration (access_requests, grant, revoke, activity). No two tools have overlapping purposes.
All tool names follow a consistent pattern of lowercase snake_case, with single words or underscore concatenations (e.g., design_decisions, send_message, access_requests). No mixing of conventions like camelCase or PascalCase.
17 tools is slightly above the typical well-scoped range (3-15), but each tool covers a necessary function for the server's stated purpose (personal knowledge, updates, messaging, access control). The count feels justified given the comprehensive scope.
The tool set covers all apparent use cases: getting to know Boris (guide, about, projects, design_decisions, doctrine, stack), staying updated (whats_new), communicating (send_message, my_messages, inbox, reply), and managing access (access_requests, activity, grant, revoke). No critical gaps are present.
An MCP server for deep research or task groups
MCP server for agentverse documentation, generated by doc2mcp.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
