The capability broker and MCP

An agent holding your GitHub token can do everything your token can do, indefinitely, and you will find out afterwards. Phase 6 exists so that sentence stops being true.

Discovery is not authority

An MCP server advertises tools, with names, descriptions and schemas. All of that is information supplied by the server, and none of it grants anything:

• a discovered tool is not a callable tool
• a tool description is not a permission
• a schema is not a policy
• a claimed effect is not a verified effect

Tools become invocable by being registered in BitShout with an exact identity. An unapproved discovered tool is denied.

Security invariants

For contained processes:

Unknown capability            → deny
Unapproved discovered tool    → deny
No matching grant for a
  grantable deny              → deny
Credential mismatch           → deny
Malformed protocol            → deny
Oversized result              → fail closed

Processes outside an active containment session are denied broker authority rather than being treated as ordinary host callers. Unresolved containment and stale process identity are non-overridable denials.

The invocation path

The trusted service is the only broker entry point. One invocation runs, in order:

1. resolve the caller PID through Phase 1 process identity
2. resolve containment-session membership
3. load the registered capability server and the exact tool registration
4. normalise the request parameters
5. evaluate capability policy
6. evaluate Phase 4 grants when the base denial is overridable
7. retrieve broker-owned credentials only after authority is established

Step 7 is the one that matters. The credential is fetched after the decision, used by the broker, and never handed onward. What returns to the agent is the sanitised result of one approved operation.

Effects are labels, not adjectives

Every capability carries an explicit effect: read, write, create, delete, administrative, mixed, or unknown. A tool that reports an unknown or unexpected effect is not promoted to authority because its name or description sounds harmless. Read and write are different authority, and a tool that claims both gets neither by default.

What the broker deliberately does not expose

There is no generic HTTP proxy, no generic credential proxy, no arbitrary shell command endpoint, no raw token retrieval API, and no “reveal secret” operation. Each of these would be a single call that collapses the whole model, and none of them exists to be found.

Transport

Local stdio MCP brokering is implemented and proven against a fixture that exercises discovery, invocation, schema handling, malformed responses, oversized results and credential isolation. Remote HTTP and streaming HTTP endpoint identity are represented in the domain model; live remote transport and commercial-provider verification are not part of the proven path and are not claimed.