# ungated-global: servers under every project, before the gate

`ungated-global` is a system project with one special property: **every server
attached to it is exposed under every project's MCP endpoint, in front of the
gate** — its tools are listed and callable before `begin_session`, and the
project's `prompt` is prepended to every project's instructions.

Fresh mcpd instances seed it **once** with the default `calcmcp` server
(scientific calculator, patched fork of
[thinkitpossible/CalcMCP](https://github.com/thinkitpossible/CalcMCP) at
<https://mysources.co.uk/michal/CalcMCP>) and a prompt telling models to never
do math themselves and always use calcmcp.

## Semantics

- **Seed-once, not resurrect**: the first successful mcpd startup writes
  `ungatedGlobalSeeded: true` into the `mcpctl-system-settings` secret. After
  that, nothing is ever re-created — deletions are durable:
  - `mcpctl delete server calcmcp -p ungated-global` detaches the default
    server (delete the server resource itself to also stop its instance);
  - deleting the whole `ungated-global` project turns the feature off.
  To re-create the default by hand there is a `calcmcp` template:
  `mcpctl create server calcmcp --from-template calcmcp`, then attach it to
  a (re-created) `ungated-global` project.
- **Merging** happens in mcpd:
  - `GET /api/v1/projects/:id/servers` appends ungated-global's servers,
    flagged `ungatedGlobal: true`. A server attached to the project directly
    wins (no duplicate, no flag).
  - `GET /api/v1/projects/:id/instructions` prepends ungated-global's
    `prompt` and appends its servers to the server list.
- **Gate exemption** happens in mcplocal: discovery passes the flagged names
  into the gate plugin (`ungatedServers`); while a session is gated,
  `tools/list` returns `begin_session` **plus** the exempt servers' tools, and
  calls to them pass through without triggering the gate intercept or
  ungating the session. Initialize instructions list them under
  "Available immediately (no begin_session required)".

## Editing the prompt

The pre-gate directive lives on the project itself:

```bash
mcpctl patch project ungated-global --prompt "…"
```

Caveat: clients that ignore MCP initialize instructions (e.g. LibreChat uses
config-literal serverInstructions) never see project prompts — for those, the
carrier is the tool/server descriptions themselves, which is why calcmcp's
server description also says "use it for every mathematical calculation".

## Security note

Anything attached to ungated-global is reachable from **every** project by
**every** token that can reach any project endpoint. Only attach servers that
are safe in every context: no secrets, no egress, no side effects. calcmcp is
pure compute (no env, no network).