MCP Servers and Tool Policy

Create a strict version-1 MCP configuration and pass it with -mcp-config. Every server needs a valid name, executable command, explicit non-empty allow list, and optional arguments, environment, working directory, and timeout.

The Web runtime filters discovered definitions again and retains only authorized read tools. A server cannot turn an ambiguous tool into a read operation through omission: absent hints map to dangerous.

MCP processes run with the Akritas OS account. Tool-level policy does not restrict what a malicious executable can do with that account; use OS isolation and least privilege.

VictoriaMetrics

The Akritas binary includes a read-only VictoriaMetrics MCP server. Start it as an MCP child through the regular host configuration:

{
  "version": 1,
  "servers": [{
    "name": "victoriametrics",
    "command": "/usr/local/bin/akritas",
    "args": [
      "mcp-victoriametrics",
      "-base-url", "http://victoriametrics:8428/prometheus",
      "-bearer-token-env", "VICTORIAMETRICS_BEARER_TOKEN"
    ],
    "allow": ["read"],
    "timeout_ms": 20000
  }]
}

Set VICTORIAMETRICS_BEARER_TOKEN in the Akritas process environment, then start akritas serve -mcp-config <path>. The child inherits the environment and reads the named variable itself. Do not put the token in args.

For a single-node server, the base URL may be http://victoriametrics:8428/prometheus. For a cluster tenant, use its read root, such as http://vmselect:8481/select/0/prometheus. A vmauth URL is also supported. Any query parameters fixed in the base URL, such as an enforced extra_label, are preserved.

The server exposes five tools:

Tool	Operation
`query`	Instant MetricsQL or PromQL query.
`query_range`	Range query with explicit `start`, `end`, and `step`.
`series`	Bounded series and label-set discovery.
`labels`	Bounded label-name discovery.
`label_values`	Bounded values for one syntactically valid label name.

The model cannot change the endpoint, credentials, tenant headers, HTTP timeout, or maximum response size. It can still submit an expensive MetricsQL expression within those limits, so enforce query and tenant policy in VictoriaMetrics or vmauth as well.

For temporary integration diagnostics, add "-debug" to the child args. Failed VictoriaMetrics HTTP responses then write their status, content type, and a body preview of at most 2 KiB to the MCP process stderr. Akritas does not log request headers, credentials, query arguments, or successful response bodies. Error bodies can still contain operational data, so remove the flag after troubleshooting and protect captured logs.

VictoriaMetrics​

VictoriaMetrics