Tools and MCP

Akritas starts configured MCP stdio processes, discovers their tools, validates schemas, and maps annotations to read, write, or dangerous. Missing or ambiguous annotations map pessimistically.

For an investigation, the model receives only the authorized read-only catalog, including tool descriptions and input schemas. It submits exact tool names and arguments in a structured plan. The host rejects tools outside that catalog and executes accepted checks through the same policy and validation boundary. A runbook can help the model choose a tool, but runbook prose never registers or authorizes one.

A tool needs both an allowed permission in its MCP server configuration and admission into the active named policy. The Web runtime copies only read-only definitions. Write and dangerous tools are not shown to its model loop even when another policy authorized them.

Every call is bounded by argument, result, and timeout limits. The host validates arguments before invoking the remote server.