Protocol adapter · MCP

MCP is one protocol Aarmos brokers.

The MCP adapter is transport: it performs a capability-scope check and submits the tool call to a Model Context Protocol server. It does not take an Aarmos decision, issue or check authority, capture an execution attempt, establish an effect, or write evidence. Governed execution runs in the Aarmos runtime, which decides and durably captures the attempt before anything is dispatched; used on its own, the adapter reaches the tool endpoint without a decision — a route the capability manifest declares as a known bypass. No Aarmos-hosted service sits in the MCP path — traffic goes directly from your device to the MCP server you configured.

Protocol integration illustration. Transport support is distinct from qualified governed execution; adapters do not themselves make the runtime decision or produce evidence.

Stable: Ships with the Aarmos CLI as the MCP adapter.

Install

Nothing separate to install — the adapter ships inside the signed CLI artifact. Once the CLI is on your machine, the MCP adapter is available to your policy.

How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in establishes your account; evaluation access requires approval. Once approved, your evaluation workspace is created and the 30-day evaluation period begins. Nothing downloads until you ask for it. Public npm is not a supported distribution channel for Aarmos product or runtime packages. The open AVAR verification and conformance packages are the supported public npm surface, so anyone can check a receipt without our software.

The CLI is not publicly distributed. Commands and configuration below are reference examples, not instructions you can run today.

Illustrative configuration — not a deployment procedure

The following historical example is illustrative only; it is not a verified configuration contract. Installing or invoking the adapter alone does not establish governed execution.

# policy.aarmos.toml
[[adapters.mcp]]
name = "filesystem"
url  = "mcp://localhost:7331"
scopes = ["read:~/Documents", "read:~/Projects"]
gates.destructive = "confirm"

Illustrative runtime output

aarmos run -- python agent.py

▸ tool: mcp://filesystem/read   (adapter: mcp)   ✓ scoped
✓ AVAR receipt: .aarmos/avar/…

Live enforcement qualification remains limited to governed email-send. It does not automatically qualify MCP or another protocol. A governed deployment must route the agent through the supported runtime entry point and separately control direct target credentials and network access. Browser policy controls and Bridge permissions are distinct.

What the adapter does, and what the runtime does

Adapter (transport): checks the declared capability scope and submits the call to the MCP server.
Runtime (governance): takes the decision, durably captures the attempt before dispatch, and writes the signed AVAR receipt. Tool responses hash into the AVAR chain there — the receipt records what came back, not just what went out.
Effect stops at the tool boundary. No downstream business outcome is established.
No Aarmos server sits in the MCP path. Aarmos brokers locally.

Enforcement runs in this device's runtime. It is tamper-evident (every decision is a signed AVAR entry) but not tamper-resistant against a modified build — see the threat model.

OpenAPI adapter → · Deep-link adapter → · AVAR spec