mcps.yaml

# roster/mcps.yaml — closed MCP catalogue for the Eidolons nexus.
# Managed by the nexus; do NOT add third-party MCPs here (NG6).
# Schema: schemas/mcp-catalogue.schema.json
# Companion lockfile: eidolons.mcp.lock (project-level; commit to VCS).
# catalogue_version 1.1: adds grants_to_eidolons + exposes_tools fields (additive).
# catalogue_version 1.2: adds wiring_mode field (optional, default "allowlist").
#   wiring_mode: transport — MCP registered in .mcp.json only; never injected
#   into agent tools: allowlists (e.g. junction, a project-level bus).
catalogue_version: "1.2"
updated_at: "2026-07-12"
mcps:
  - name: atlas-aci
    display_name: "Atlas-ACI"
    scope: system
    kind: oci-image
    # Auto-sync: when wired, the nexus harness hook (cli/src/harness_hook.sh)
    # fires a detached, deduplicated, incremental `atlas-aci index --since`
    # reindex on SessionStart + every UserPromptSubmit, reusing the exact
    # pinned digest from .mcp.json below — on by default, opt-out only via
    # eidolons.yaml `.harness.atlas_sync.enabled: false`. No field here
    # controls it; this is a doc pointer, not a behavioral catalogue entry.
    description: "Stdio MCP server exposing structural codebase intelligence (graph + symbol index)."
    use_cases:
      - "Cross-language symbol search inside an MCP-capable host."
      - "ATLAS subagent's per-project codegraph backend."
    related_eidolons: [atlas]
    grants_to_eidolons: [atlas, kupo, vivi]
    exposes_tools:
      # Tool namespace is HYPHEN (mcp__atlas-aci__*) — it derives from the .mcp.json
      # server key "atlas-aci"; the host (Claude Code) exposes tools verbatim as
      # mcp__atlas-aci__<tool>. ATLAS's commands/aci.sh already emits the hyphen form;
      # the generic grant driver injects THIS glob, so it must match the real tools or
      # the grant is inert (the underscore form mcp__atlas_aci__* matched nothing).
      glob: "mcp__atlas-aci__*"
      list:
        - mcp__atlas-aci__view_file
        - mcp__atlas-aci__search_symbol
        - mcp__atlas-aci__search_text
        - mcp__atlas-aci__list_dir
        - mcp__atlas-aci__graph_query
        - mcp__atlas-aci__test_dry_run
        - mcp__atlas-aci__memex_read
    source:
      type: ghcr
      image: "ghcr.io/rynaro/atlas-aci"
      build:
        git_url: "https://github.com/Rynaro/atlas-aci.git"
        context: "mcp-server"
        default_ref: "main"
    versions:
      latest: "2.0.0"
      pins:
        stable: "2.0.0"
      releases:
        "0.2.2":
          digest: "sha256:386677f06b0ce23cb4883f6c0f91d8eac22328cd7d9451ae241e2f183207ad96"
          released_at: "2026-04-30T00:00:00Z"
        "0.2.3":
          digest: "sha256:86f82c454d21378ba99ce7ef92494c34ad533e82bc76e6ea7affa4a8056326b3"
          released_at: "2026-06-02T00:00:00Z"
        # 0.3.0 / 0.3.1 / 0.4.0 shipped upstream but were never recorded here — the
        # catalogue sat on 0.2.3 for three releases. Backfilled with the digests
        # resolved from ghcr at the 2.0.0 bump so `mcp use <ver>` can reach them.
        "0.3.0":
          digest: "sha256:8a76ba166c517c47562c742bd977084b2b7b163a0fd7e244f6bceb3b27610d09"
          released_at: "2026-06-20T22:26:41Z"
        "0.3.1":
          digest: "sha256:13e5ace5d89611e51eea4cb90b357a94fdcd93a71e6a81ea31901dad53f3ce49"
          released_at: "2026-06-20T22:43:27Z"
        "0.4.0":
          digest: "sha256:fc27c54a87ac6a4fac27712778ee5a7d8582799915bca67863c60e2d91c845dc"
          released_at: "2026-07-08T01:39:20Z"
        "2.0.0":
          digest: "sha256:e2542ef8d569882c560065f0bcaed9ef2a7398e7e61765e25b142a3c93ec7cf7"
          released_at: "2026-07-10T12:22:33Z"
    install:
      hosts_wired:
        - ".mcp.json"
        - ".cursor/mcp.json"
        - ".github/agents/*"
        - ".codex/config.toml"
      template: "cli/templates/mcp/atlas-aci.mcp.json.tmpl"
    health:
      probes:
        - docker_cli
        - docker_daemon
        - image_local
        - registry_reachable

  - name: junction
    display_name: "Junction"
    scope: system
    kind: binary
    description: "Container-isolated agent harness with ReasoningStep / plan.json dispatch."
    use_cases:
      - "Sandbox APIVR-Delta implementation work in a Docker container."
      - "Run multi-stage agent pipelines with plan.json."
    related_eidolons: []
    grants_to_eidolons: all
    wiring_mode: transport
    exposes_tools:
      glob: "mcp__junction__*"
      list:
        - mcp__junction__harness_run
        - mcp__junction__harness_verify
        - mcp__junction__plan_dispatch
        - mcp__junction__reasoning_step
    source:
      type: github_release
      repo: "Rynaro/Junction"
      install_url: "https://raw.githubusercontent.com/Rynaro/Junction/main/install.sh"
    versions:
      latest: "0.4.0"
      pins:
        stable: "0.4.0"
      releases:
        "0.4.0":
          # harness.inject implemented (ISE gates: S-1 shape, S-2 authorization,
          # S-3 high-trust); trace root migrated to ECL §5 (.eidolons/.trace/),
          # JUNCTION_TRACE_ROOT env now honored; legacy read-fallback retained.
          archive_sha256: ""
          released_at: "2026-07-03T00:00:00Z"
        "0.3.0":
          archive_sha256: ""
          released_at: "2026-06-10T00:00:00Z"
        "0.2.0":
          archive_sha256: ""
          released_at: "2026-05-19T00:00:00Z"
    install:
      cache_path: "$EIDOLONS_HOME/cache/junction@<version>/"
      marker: ".eidolons/harness/manifest.json"
    health:
      probes:
        - binary_present
        - binary_version
        - docker_daemon_optional

  - name: crystalium
    display_name: "CRYSTALIUM"
    scope: system
    kind: oci-image
    description: "Portable memory harness — four-layer crystal lattice (Episodic/Semantic/Procedural/Execution) with gated writes, hybrid retrieval, and async consolidation."
    use_cases:
      - "Cross-session memory recall (mission history, project conventions, verified skills)."
      - "Gated semantic promotion (≥k corroboration or human-confirm)."
      - "Verifier-sandboxed procedural skill admission."
      - "Bi-temporal updates (invalidate-old + write-new; never hard-delete)."
    related_eidolons: []
    grants_to_eidolons: all
    exposes_tools:
      glob: "mcp__crystalium__*"
      list:
        - mcp__crystalium__recall
        - mcp__crystalium__commit
        - mcp__crystalium__update
        - mcp__crystalium__ingest
        - mcp__crystalium__skill_invoke
        - mcp__crystalium__plan_checkpoint
        - mcp__crystalium__plan_replan
        - mcp__crystalium__session_end
    source:
      type: ghcr
      image: "ghcr.io/rynaro/crystalium"
    versions:
      latest: "1.8.0"
      pins:
        stable: "1.8.0"
      releases:
        "1.8.0":
          # One-shot `ingest` CLI verb (third verb of the out-of-session CLI
          # pairing: recall 1.4.0 -> commit 1.7.0 -> ingest 1.8.0) — parity with
          # the MCP crystalium_ingest tool via the shared _handle_ingest core.
          # Unblocks the nexus ECM session-handoff canary (AC-4/AC-9).
          # `consolidate` re-deferred to 1.9. 9 tools (MCP surface unchanged).
          digest: "sha256:a83469675b21ea74db68f8ea143841073667d1cf75a67df25039fa66f244e8e9"
          released_at: "2026-07-07T00:00:00Z"
        "1.7.0":
          # One-shot `commit` CLI verb (write half of the out-of-session CLI
          # pairing; unblocks the nexus round-trip memory canary) + install.sh
          # version stamp single-sourced from pyproject.toml (was stale 1.0.0).
          # `consolidate` deferred to 1.8. 9 tools (MCP surface unchanged).
          digest: "sha256:b6978817f06706c23a7b9134bb235a57ccc2f5c0bdafd318b2a6b41fc6719b07"
          released_at: "2026-07-04T00:00:00Z"
        "1.6.0":
          # Memory diagnosability + guards: canonical scope keys, summary quality
          # gate, recall --explain, doctor arm/status stats, never-deprecate-last-
          # checkpoint guard; serverInfo version fix. 9 tools.
          digest: "sha256:66e17627164dbcec76b6daac7d28caafdd2ec0e6108974a9b3cff5e19e212e8f"
          released_at: "2026-07-03T00:00:00Z"
        "0.1.0":
          digest: "sha256:f524654407dc50409713bfb156cb1e473597d81ab87a3f84730afa629f21d88d"
          released_at: "2026-05-28T00:00:00Z"
        "1.2.0":
          digest: "sha256:84d450ed7488ad79ed8f1b56e6a47d92e95d92e4c6de34cc79cc876630cdb3e5"
          released_at: "2026-06-01T00:00:00Z"
        "1.2.1":
          # Multi-arch index (linux/amd64 + linux/arm64). Supersedes the
          # amd64-only 1.2.0 digest so Apple Silicon hosts can pull.
          digest: "sha256:d8da22cbb89ba0f225ed276e07d1d8c705f65be9cea3037e864e243ac7f07fbb"
          released_at: "2026-06-02T00:00:00Z"
        "1.3.0":
          # Multi-arch index (linux/amd64 + linux/arm64). CRYSTALIUM T1 correctness
          # + T2 ablations (EVB + pattern-completion earned ON) + kuzu max_db_size cap.
          digest: "sha256:9f49f98bdb8a6628fec92d554a34680edc32c4034e293512dcc1004486252894"
          released_at: "2026-06-05T00:00:00Z"
        "1.4.0":
          # Multi-arch index (linux/amd64 + linux/arm64). One-shot `recall` CLI
          # for out-of-band memory pre-flight (GAP-2) + index Redactor fix.
          digest: "sha256:778167053c55cea71c1f6d7a12f8a11d904c00715aaa72ac47aec90b3d3fdf2f"
          released_at: "2026-06-11T00:00:00Z"
        "1.5.1":
          # Multi-arch index (linux/amd64 + linux/arm64). Harness-agnostic
          # provenance.source coercion in crystalium.commit (+ created_at
          # tolerance + observable advisory); no schema/ECL-envelope change.
          digest: "sha256:773c4b00e36f6cfef6e5ae01c53a4bfb199315dfa3b0fc1728835b99ebca4754"
          released_at: "2026-06-29T00:00:00Z"
    install:
      hosts_wired:
        - ".mcp.json"
        - ".cursor/mcp.json"
        - ".github/agents/*"
        - ".codex/config.toml"
      template: "cli/templates/mcp/crystalium.mcp.json.tmpl"
    health:
      probes:
        - docker_cli
        - docker_daemon
        - image_local
        - registry_reachable

  - name: tonberry
    display_name: "tonberry"
    scope: system
    kind: oci-image
    description: "Official ESL (Eidolons Spec Lifecycle) implementation — composes change artifacts and drives the lifecycle; verify is byte-identical to the canonical bash conformance checker."
    use_cases:
      - "Compose + validate ESL change manifests under .spectra/changes/<change_id>/."
      - "Drive the lifecycle: propose -> right_size -> transition -> verify -> drift_check -> archive."
      - "Mechanical conformance (C1-C6 MUST + C7 EARS advisory); maker != checker + drift-before-archive enforced."
      - "Project-scope escalation assessment (advisory -> block for bigger projects)."
    related_eidolons: [spectra, vivi, kupo, vigil, idg]
    grants_to_eidolons: [spectra, vivi, kupo, vigil, idg]
    wiring_mode: allowlist
    exposes_tools:
      glob: "mcp__tonberry__*"
      list:
        - mcp__tonberry__propose
        - mcp__tonberry__right_size
        - mcp__tonberry__transition
        - mcp__tonberry__compose_manifest
        - mcp__tonberry__compose_envelope
        - mcp__tonberry__verify
        - mcp__tonberry__drift_check
        - mcp__tonberry__archive
        - mcp__tonberry__list
        - mcp__tonberry__status
        - mcp__tonberry__assess
    source:
      type: ghcr
      image: "ghcr.io/rynaro/tonberry"
    versions:
      latest: "0.5.2"
      pins:
        stable: "0.5.2"
      releases:
        "0.5.2":
          # Container-UID write-failure diagnostic (tonberry#4). New internal/fsdiag
          # ownership detector: when the process euid (distroless-nonroot UID 65532)
          # differs from the bind-mount owner (host UID, e.g. 1000), a bare EACCES on
          # propose/transition/archive/compose_* now names both UIDs and suggests
          # --user "$(id -u):$(id -g)". DAC/UID cause, distinct from #3's SELinux/MAC.
          # 11 tools; ESL_VERSION 1.1 (diagnostic-only, no tool/parity change).
          digest: "sha256:55dd2fed08070461e1f3b92c303128a0ae1f3c1b62165fd07d0c327e7b1f94f9"
          released_at: "2026-07-08T00:25:04Z"
        "0.5.1":
          # SELinux-label write-failure diagnostic (tonberry#3). New internal/fsdiag
          # SELinux detector (fires only when /sys/fs/selinux/enforce == "1"): turns
          # the silent read-ok/write-EACCES asymmetry of an unlabeled `user_home_t`
          # bind mount into an actionable hint (add ":z" to the -v flag, or
          # --security-opt label=disable). Complements the nexus template's :z default
          # (shipped 2.3.0). 11 tools; ESL_VERSION 1.1 (diagnostic-only).
          digest: "sha256:d2b6f426bc3363cab43e72cad1bd587680ed0a58eb5c54ed9adaf8c5075f51dc"
          released_at: "2026-07-08T00:20:57Z"
        "0.5.0":
          # ESL 1.1 re-vendor (closes the eidolons-esl#2 parity drift): C8 fresh-
          # context attestation at byte-parity, memory_preflight accepted end-to-end.
          # 11 tools; ESL_VERSION 1.1.
          digest: "sha256:f78d1dc94cb5f4d05d607e86a1e83fc32daff1c73b3b2336e38ef504243e1bdf"
          released_at: "2026-07-03T00:00:00Z"
        "0.3.0":
          # Multi-arch index (linux/amd64 + linux/arm64). 11 tools — lifecycle ops
          # + EARS C7 advisory; verify byte-identical to the ESL bash checker.
          digest: "sha256:cb898ab1ba4cf8a31ff6b82963ba4d5e2cbf2f3f9f66670fcc043d37b9e407da"
          released_at: "2026-06-25T00:00:00Z"
        "0.3.1":
          # Hardening: release-manifest index-digest capture, vendored-oracle drift
          # guard (CI), gofmt gate, CLI arg consistency, Version-string fix. 11 tools.
          digest: "sha256:3b2a01947c01ea3a3f3345073e198113964adb6e9b4629287da92622076aa856"
          released_at: "2026-06-25T00:00:00Z"
        "0.4.0":
          # Lifecycle-op UX fixes from the ESL dogfood: has_code-from-manifest,
          # persist-by-default (transition/right_size/drift_check + --dry-run),
          # archive moves (not copies). 11 tools; verify byte-identical (parity frozen).
          digest: "sha256:ea24ab5eb599ac4774f394091866829c8467be63cfaa53efc480528d82ed7321"
          released_at: "2026-06-25T00:00:00Z"
    install:
      hosts_wired:
        - ".mcp.json"
        - ".cursor/mcp.json"
        - ".github/agents/*"
        - ".codex/config.toml"
      template: "cli/templates/mcp/tonberry.mcp.json.tmpl"
    health:
      probes:
        - docker_cli
        - docker_daemon
        - image_local
        - registry_reachable

  - name: atomos
    display_name: "atomos"
    scope: system
    kind: oci-image
    description: "ECM (Eidolons Context Management) compose/verify executor — composes the session-handoff brief + ECL envelope and verifies envelope integrity / pin survival, byte-identical to the canonical `eidolons context` bash kernel. An alternate surface, never the sole path."
    use_cases:
      - "Compose a session-handoff brief + ECL INFORM / ecm/handoff-brief envelope at byte/SHA parity with the kernel."
      - "Verify ECL envelope integrity (the full SHA-256 verdict matrix) at a receiver gate."
      - "Probe pin-set survival after a lossy context operation."
    related_eidolons: []
    grants_to_eidolons: []
    wiring_mode: transport
    exposes_tools:
      # Orchestrator/host-facing (transport) — the kernel verbs (`eidolons context`)
      # remain what Eidolons use; atomos is the MCP-surface alternate for hosts that
      # prefer a tool call. Tool namespace derives from the .mcp.json key "atomos".
      glob: "mcp__atomos__*"
      list:
        - mcp__atomos__compose_handoff
        - mcp__atomos__verify_envelope
        - mcp__atomos__verify_pins
        - mcp__atomos__compose_externalize_manifest
    source:
      type: ghcr
      image: "ghcr.io/rynaro/atomos"
    versions:
      latest: "0.2.0"
      pins:
        stable: "0.2.0"
      releases:
        "0.1.0":
          # MVP: 3 compose/verify tools at byte-parity with the eidolons kernel
          # (T1 brief + T2 envelope byte-exact); closed-registry + source deny-list
          # fence; distroless multi-arch INDEX digest. ATOMOS_VERSION 0.1.0; commit 5c10193.
          digest: "sha256:ff2449e92cae030e8cb25796c2b9e06ad4814e59ac6db8fc19beffc5606d8a73"
          released_at: "2026-07-07T00:00:00Z"
        "0.2.0":
          # Feature-complete: compose_externalize_manifest is the FOURTH and final
          # tool of the closed set (atomos ADR §2, deferred to v0.2 by §2.4). The
          # file-floor identifier manifest at byte/SHA parity with `eidolons context
          # externalize` — it NEVER reaches durable memory: the kernel's persist
          # chain (context_externalize.sh:154-196), the budget ledger, and the meter
          # read all stay permanently out of fence. atomos writes one file and stops.
          # exposes_tools.list above gained the 4th entry and was verified against
          # tools/list served by THIS digest, not assumed.
          # ATOMOS_VERSION 0.2.0; commit dee3550; multi-arch INDEX digest (amd64+arm64).
          digest: "sha256:b3f67b4ef64230ebe91aa37efea14e386f178950a2750e0c26c8d29d7ea4a639"
          released_at: "2026-07-12T14:32:27Z"
    install:
      hosts_wired:
        - ".mcp.json"
        - ".cursor/mcp.json"
        - ".github/agents/*"
        - ".codex/config.toml"
      template: "cli/templates/mcp/atomos.mcp.json.tmpl"
    health:
      probes:
        - docker_cli
        - docker_daemon
        - image_local
        - registry_reachable