Universal MCP Lab

Minimal proof of concept to validate dynamic capability acquisition behind a stable MCP surface.

Hypothesis

An agent starts with six stable tools. It connects an OpenAPI service, discovers new internal capabilities, inspects them, and invokes them without modifying the published MCP catalog.

Planned stable surface:

• services.connect

• services.disconnect

• services.list

• capabilities.list

• capabilities.describe

• capabilities.invoke

The PoC does not provide raw access to the machine, does not expose arbitrary shell, and does not store credentials.

Related MCP server: openapi-mcp

Run the local test

python -m unittest discover -s tests -v
python scripts/demo.py

Real MCP over stdio

Phase 3 incorporates a real MCP server with the six stable tools. Install the declared dependency and let an MCP host start the process:

pip install -e .
python -m entradas.mcp.server

The process does not show an interface nor should it write to stdout: it waits for MCP messages on stdin. The test tests/test_mcp_protocol.py acts as a real MCP client, verifies tools/list, connects the synthetic OpenAPI, and confirms the public catalog does not change.

This local transport is deliberately limited: it does not publish HTTP, does not include OAuth, does not connect the PC, and does not enable write approvals.

To enable an HTTP read in the lab, configure a local allowlist before startup. The OpenAPI document sent via MCP cannot modify that destination:

$env:UNIVERSAL_MCP_READ_BASE_URLS = '{"customers":"https://api.example.test"}'
python -m entradas.mcp.server

Only GET requests to configured services are executed; there is a timeout, size limit, mandatory JSON, no redirects or retries. The suite does not use the Internet: it spins up a temporary local endpoint to verify this flow.

Owner's local node

The PC node is a separate local MCP process, not a remote control function. Only the machine owner can start it and set an explicit folder:

$env:UNIVERSAL_MCP_OWNER_ALLOWED_ROOT = 'C:\carpeta-autorizada'
python -m entradas.pc_node.server

Its only tool is pc.read_text(relative_path). It does not include shell, writing, disk exploration, browser, processes, or network listeners. The tunnel and authentication between the gateway and this node belong to a later phase.

Action Boundary for writes

A write does not accept approved=true. The first request returns a confirmation reference; a trusted human interface must approve that exact action outside MCP. The resulting authorization is single-use, bound to the same arguments, and consumed before the executor. This does not yet enable writes on the PC node.

Status

Architecture + lab core + deep ECA prepared. See STATUS.md and docs/PLAYBOOK.md.