Protocol adapter · MCP
MCP is one protocol Aarmos brokers.
The @aarmos/adapter-mcp package lets you point Aarmos at any Model Context Protocol server. Tool calls route through your local policy gate; every action emits a signed AVAR receipt. No Aarmos-hosted service sits in the MCP path — traffic goes directly from your device to the MCP server you configured.
@aarmos/adapter-mcp.Install
Nothing separate to install — the adapter ships inside the signed CLI artifact. Once the CLI is on your machine, @aarmos/adapter-mcp is available to your policy.
How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in authorizes your workspace for evaluation automatically — no person to wait for — and the software is available the moment you choose to install it. Nothing downloads until you ask for it, and nothing is published to the public npm registry today. The open @avar-standard/* verifier packages are unaffected and remain publicly installable, so anyone can check a receipt without our software.
Wire it into policy
# policy.aarmos.toml
[[adapters.mcp]]
name = "filesystem"
url = "mcp://localhost:7331"
scopes = ["read:~/Documents", "read:~/Projects"]
gates.destructive = "confirm"Run
aarmos run my-agent
▸ tool: mcp://filesystem/read (adapter: mcp) ✓ scoped
✓ AVAR receipt: .aarmos/avar/…What the adapter enforces
- Every MCP tool call is bound to a declared scope.
- Destructive tool metadata triggers the on-device gate.
- Tool responses hash into the AVAR chain — the receipt records what came back, not just what went out.
- No Aarmos server sits in the MCP path. Aarmos brokers locally.
Enforcement runs in this device's runtime. It is tamper-evident (every decision is a signed AVAR entry) but not tamper-resistant against a modified build — see the threat model.