57 lines
2.7 KiB
Markdown
57 lines
2.7 KiB
Markdown
|
# ungated-global: servers under every project, before the gate
|
||
|
|
|
||
|
|
`ungated-global` is a system project with one special property: **every server
|
||
|
|
attached to it is exposed under every project's MCP endpoint, in front of the
|
||
|
|
gate** — its tools are listed and callable before `begin_session`, and the
|
||
|
|
project's `prompt` is prepended to every project's instructions.
|
||
|
|
|
||
|
|
Fresh mcpd instances seed it **once** with the default `calcmcp` server
|
||
|
|
(scientific calculator, patched fork of
|
||
|
|
[thinkitpossible/CalcMCP](https://github.com/thinkitpossible/CalcMCP) at
|
||
|
|
<https://mysources.co.uk/michal/CalcMCP>) and a prompt telling models to never
|
||
|
|
do math themselves and always use calcmcp.
|
||
|
|
|
||
|
|
## Semantics
|
||
|
|
|
||
|
|
- **Seed-once, not resurrect**: the first successful mcpd startup writes
|
||
|
|
`ungatedGlobalSeeded: true` into the `mcpctl-system-settings` secret. After
|
||
|
|
that, nothing is ever re-created — deletions are durable:
|
||
|
|
- `mcpctl delete server calcmcp -p ungated-global` detaches the default
|
||
|
|
server (delete the server resource itself to also stop its instance);
|
||
|
|
- deleting the whole `ungated-global` project turns the feature off.
|
||
|
|
To re-create the default by hand there is a `calcmcp` template:
|
||
|
|
`mcpctl create server calcmcp --from-template calcmcp`, then attach it to
|
||
|
|
a (re-created) `ungated-global` project.
|
||
|
|
- **Merging** happens in mcpd:
|
||
|
|
- `GET /api/v1/projects/:id/servers` appends ungated-global's servers,
|
||
|
|
flagged `ungatedGlobal: true`. A server attached to the project directly
|
||
|
|
wins (no duplicate, no flag).
|
||
|
|
- `GET /api/v1/projects/:id/instructions` prepends ungated-global's
|
||
|
|
`prompt` and appends its servers to the server list.
|
||
|
|
- **Gate exemption** happens in mcplocal: discovery passes the flagged names
|
||
|
|
into the gate plugin (`ungatedServers`); while a session is gated,
|
||
|
|
`tools/list` returns `begin_session` **plus** the exempt servers' tools, and
|
||
|
|
calls to them pass through without triggering the gate intercept or
|
||
|
|
ungating the session. Initialize instructions list them under
|
||
|
|
"Available immediately (no begin_session required)".
|
||
|
|
|
||
|
|
## Editing the prompt
|
||
|
|
|
||
|
|
The pre-gate directive lives on the project itself:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
mcpctl patch project ungated-global --prompt "…"
|
||
|
|
```
|
||
|
|
|
||
|
|
Caveat: clients that ignore MCP initialize instructions (e.g. LibreChat uses
|
||
|
|
config-literal serverInstructions) never see project prompts — for those, the
|
||
|
|
carrier is the tool/server descriptions themselves, which is why calcmcp's
|
||
|
|
server description also says "use it for every mathematical calculation".
|
||
|
|
|
||
|
|
## Security note
|
||
|
|
|
||
|
|
Anything attached to ungated-global is reachable from **every** project by
|
||
|
|
**every** token that can reach any project endpoint. Only attach servers that
|
||
|
|
are safe in every context: no secrets, no egress, no side effects. calcmcp is
|
||
|
|
pure compute (no env, no network).
|