Skip to main content

Proof capsule

Matías Context MCP

Agent context, security boundaries, and fail-closed startup

A local, read-only MCP gateway exposing bounded, provenance-rich context to tools that need it.

Inspect repositoryRead the v0.3 contractBack to Engineering

Problem

An agent context layer can become arbitrary filesystem access if paths, source roots, and startup assumptions are implicit. Useful context needs a narrow authority model that is inspectable before a server starts.

What I built

I built a Python stdio MCP server exposing named, configured resources through logical URIs. Reads are bounded to registered roots, return provenance and hashes, and reject path or symlink escapes. Startup preflight fails closed when the configured profile is unsafe or incomplete.

My role and ownership

  • Defined the v0.3 gateway contract and resource-only server boundary.
  • Implemented bounded UTF-8/JSON reads, named source resolution, provenance, and root-containment checks.
  • Added kernel, startup-preflight, and server-contract tests around security and protocol seams.

Key decisions

Expose resources only: no arbitrary tools, prompts, writes, or remote HTTP server.

Tradeoff: Less flexible, but the authority surface is easier to reason about.

Resolve logical URIs through a named source registry rather than accepting raw paths.

Tradeoff: Requires profile configuration, but prevents arbitrary filesystem selection.

Run preflight checks and reject symlink/root escapes before serving.

Tradeoff: Misconfiguration stops startup instead of being repaired implicitly.

Reliability & testing

Tests cover the kernel, startup preflight, and server contract. They are repository-defined checks; no hosted runtime or user-adoption result is claimed.

  • tests/test_kernel.py: bounded reads, provenance, and path handling.
  • tests/test_startup_preflight.py: configured profile and fail-closed startup.
  • tests/test_server_contract.py: resource-only MCP behavior.

Recovery: Unsafe paths and incomplete profiles fail closed rather than widening access.

What this proves

  • Build a bounded context interface for agent workflows.
  • Use least privilege, provenance, and fail-closed checks as product behavior.
  • Make security tradeoffs explicit instead of implying a general-purpose agent platform.