{"server":{"name":"agentic-ops-mcp-gateway","version":"0.1.3","description":"Deterministic MLOps & SRE Governance Control Plane MCP Server (8 Tools, 5 Knowledge Resources, 20 Starter Prompts)"},"protocol_version":"2024-11-05","transports":{"http_jsonrpc":"/mcp (POST JSON-RPC 2.0)","stdio":"python -m agentic_ops.entrypoints.mcp_server"},"counts":{"tools":8,"resources":5,"starter_prompts":20},"tools":[{"name":"read_console_diagnostic","description":"Reads and executes any live diagnostic phase from the Agentic-Ops Web Console (/console). Returns the compact pytest PASSED results at the top followed by the color-coded cognitive pedagogical guide ([GUIDE:ROLE], [GUIDE:AGENT], [GUIDE:SLACK], [GUIDE:PROD], [GUIDE:HOW_IT_PASSES]).","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"command":{"type":"string","enum":["sandbox_phase_a_vitals","sandbox_phase_b_slack_spoof","sandbox_phase_c_adversarial_worm","sandbox_phase_d_mlops_scenarios","sandbox_phase_e_fsm_governance","pytest_cac_connector","pytest_all","trust_ledger_list","tailscale_status","tailscale_netcheck","redis_ping","system_info"],"description":"The exact diagnostic command from the /console Web UI."},"include_guides":{"type":"boolean","default":true,"description":"If False, strips [GUIDE:...] lines to return pure compact test results."}},"required":["command"]}},{"name":"evaluate_governance_policy","description":"Evaluates a proposed AI agent action against the deterministic PolicyEngine (governance/autonomy_policy.yaml, action_catalog.yaml, risk_register.yaml). Returns ALLOW, REQUIRE_APPROVAL (Slack HITL), or DENY with exact rule IDs (R-001, CAT-001, CAT-002).","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"risk_id":{"type":"string","description":"Risk identifier from risk_register.yaml (e.g. DATA-042, INFRA-005, MODEL-012)."},"action":{"type":"string","enum":["create_issue","investigate","propose_retrain","restart_pod","scale_up","scale_to_zero","rollback","promote_model"],"description":"Action proposed by the cognitive agent."},"target":{"type":"string","default":"service/prediction-api","description":"Target resource URI (e.g. service/prediction-api, model/baac_rf_v2, repo/mlops)."},"upstream_data_severity":{"type":"string","enum":["OK","WARNING","CRITICAL","UNKNOWN"],"default":"OK","description":"Severity of upstream DATA layer (triggers R-001 upstream_masks_service if CRITICAL)."},"recent_executions_last_hour":{"type":"integer","default":0,"description":"Number of times this action ran in the last hour (triggers rate_limit_exceeded if >= limit)."},"target_replicas":{"type":"integer","default":1,"description":"Replica count of target service (computes true blast_radius)."},"target_criticality":{"type":"string","enum":["low","high"],"default":"low","description":"Target criticality tier."}},"required":["risk_id","action"]}},{"name":"run_governed_incident_episode","description":"Executes a full end-to-end governed incident episode through the PolicyEngine and seals the cryptographic record (SHA-256 hash chain + HMAC-SHA512 signature) into the WORM Trust Ledger.","readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false,"read_only_hint":false,"destructive_hint":false,"idempotent_hint":false,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"risk_id":{"type":"string","description":"Risk ID (e.g. DATA-042, INFRA-005)."},"action":{"type":"string","enum":["create_issue","investigate","propose_retrain","restart_pod","scale_up","scale_to_zero","rollback","promote_model"]},"target":{"type":"string","default":"service/prediction-api"},"finding_summary":{"type":"string","default":"Elevated drift / anomaly detected on production telemetry."},"confidence_score":{"type":"number","default":0.92}},"required":["risk_id","action"]}},{"name":"inspect_worm_trust_ledger","description":"Audits the append-only WORM Trust Ledger (ledger.jsonl), verifies the full SHA-256 Merkle chain and HMAC-SHA512 signatures via EvidenceStore.verify_chain(), and returns sealed episodes.","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"episode_id":{"type":"string","description":"Optional specific episode ID (e.g. EP-0001). Omit to list all episodes and verify chain."},"limit":{"type":"integer","default":10,"description":"Max recent episodes to return."}}}},{"name":"search_failure_taxonomy","description":"Searches the foundational 435 MLOps Failure Modes Taxonomy (docs/mlops_failure_modes_taxonomy.md) by keyword, risk ID, dimension, or symptom.","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"query":{"type":"string","description":"Keyword or pattern to search (e.g. 'drift', 'OOM', 'Feast', 'shadow', 'deadlock')."},"max_results":{"type":"integer","default":10,"description":"Maximum matching lines/rows to return."}},"required":["query"]}},{"name":"get_scenario_blueprint","description":"Retrieves the architectural specification from docs/mlops_simulation_scenarios_registry.md and/or the executable YAML scenario contract from tests/scenarios/data/*.yaml.","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{"scenario_id":{"type":"string","description":"Scenario identifier (e.g. 'SC-101', 'SC-102', 'SC-103', 'SC-001', 'SC-003', 'SC-004', 'SC-005', 'SIM-1', 'all')."}},"required":["scenario_id"]}},{"name":"poll_target_mlops_snapshot","description":"Executes a 100% Read-Only HTTP GET pull collection via CacPullCollector across the 5 observability endpoints of the target MLOps platform (jakatt/cac_mlops) over the Tailscale SOCKS5 mesh.","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":true,"inputSchema":{"type":"object","properties":{"use_proxy":{"type":"boolean","default":true},"timeout":{"type":"number","default":3.5}}}},{"name":"inspect_control_plane_vitals","description":"Returns real-time health, socket status (Redis :6379, Tailscale SOCKS5 :1055), Linux cgroup v2 memory telemetry, and active PolicyBundle version hash.","readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false,"read_only_hint":true,"destructive_hint":false,"idempotent_hint":true,"open_world_hint":false,"inputSchema":{"type":"object","properties":{}}}],"resources":[{"uri":"agentic-ops://taxonomy/failure-modes","name":"MLOps 435 Failure Modes Taxonomy","description":"Exhaustive 10-dimension ontology of 435 MLOps failure modes (docs/mlops_failure_modes_taxonomy.md).","mimeType":"text/markdown"},{"uri":"agentic-ops://registry/scenarios","name":"MLOps 20 Scenarios Registry","description":"Foundational specification of the 20 MLOps crisis scenarios SIM-1 to SIM-20 (docs/mlops_simulation_scenarios_registry.md).","mimeType":"text/markdown"},{"uri":"agentic-ops://governance/autonomy-policy","name":"Deterministic Autonomy Policy & Risk Register","description":"Compiled YAML governance bundle (autonomy_policy.yaml, action_catalog.yaml, risk_register.yaml).","mimeType":"application/json"},{"uri":"agentic-ops://governance/known-gaps","name":"Known Gaps & Adversarial Boundary Matrix","description":"Formal registry of adversarial boundaries and test mappings (governance/known_gaps.yaml).","mimeType":"text/yaml"},{"uri":"agentic-ops://console/vitals","name":"Live Control Plane Vitals & Console Commands","description":"Real-time status of Redis, Tailscale SOCKS5, PolicyBundle version, and available /console diagnostics.","mimeType":"application/json"}],"starter_prompts":[{"name":"01_console_grand_slam_audit","description":"[Console Live] Run all 42 Sandbox + CAC tests via /console and verify forbidden_executed=0.","arguments":[],"template":"Call the MCP tool `read_console_diagnostic` with `command='pytest_all'` and `include_guides=True`. Verify that all 42 tests pass (`PASSED`) and that `forbidden_executed=0` across all adversarial scenarios. Provide a structured SRE audit table breaking down Phase C (WORM), Phase D (Scenarios), Phase E (FSM), and Phase F (CAC Pull)."},{"name":"02_console_vitals_and_cgroup_check","description":"[Console Live] Inspect container CPU/RAM cgroup v2 limits, Redis :6379, and Tailscale :1055.","arguments":[],"template":"Call `read_console_diagnostic` with `command='sandbox_phase_a_vitals'` and `inspect_control_plane_vitals`. Analyze the kernel version, CPU model, `/proc/meminfo` vs `cgroup v2` memory usage, and confirm whether Redis (`127.0.0.1:6379`), Tailscale SOCKS5 (`127.0.0.1:1055`), and SQLite WAL (`approvals.db`) are operational."},{"name":"03_console_redteam_slack_spoof","description":"[Console Live] Trigger Phase B Red-Team Slack webhook spoofing attack and verify HTTP 401.","arguments":[],"template":"Call `read_console_diagnostic` with `command='sandbox_phase_b_slack_spoof'`. Explain step-by-step how `agentic_ops/entrypoints/slack_webhook.py` intercepts the forged payload `payload=fake_tampered_attack`, verifies `X-Slack-Signature` (`HMAC-SHA256`), and enforces a Fail-Closed `HTTP 401`."},{"name":"04_console_live_pull_cac_mlops","description":"[Console Live] Poll the 5 remote observability endpoints of jakatt/cac_mlops over Tailscale.","arguments":[],"template":"Call `poll_target_mlops_snapshot` with `use_proxy=True` and `timeout=3.5`. Report the connectivity status of each of the 5 remote targets (`FastAPI`, `Evidently`, `MLflow`, `Prometheus`, `Grafana`). If `status='REMOTE_TARGET_OFFLINE'`, explain how the Fail-Safe read-only degradation protects the Control Plane."},{"name":"05_policy_veto_corrupted_sensor","description":"[PolicyEngine] Prove how CAT-001 blocks model retraining on corrupted upstream data (DATA-042).","arguments":[{"name":"risk_id","description":"Risk ID (default DATA-042)","required":false}],"template":"Call `evaluate_governance_policy` with `risk_id='DATA-042'`, `action='propose_retrain'`, `target='model/baac_classifier'`, and `upstream_data_severity='CRITICAL'`. Explain why the deterministic PolicyEngine returns `DENY` (`risk_register_forbids` / `CAT-001`) even if the LLM agent is 99% confident that retraining will fix the drift."},{"name":"06_policy_veto_thrashing_cooldown","description":"[PolicyEngine] Prove how rate-limiting and R-001 prevent Kubernetes pod restart storms (INFRA-005).","arguments":[],"template":"Call `evaluate_governance_policy` twice for `risk_id='INFRA-005'`, `action='restart_pod'`, `target='service/api'`: first with `recent_executions_last_hour=0` and `upstream_data_severity='OK'`, then with `recent_executions_last_hour=5` and `upstream_data_severity='CRITICAL'`. Compare the two verdicts and explain rules `R-001` and `rate_limit_exceeded`."},{"name":"07_policy_hitl_slack_escalation","description":"[PolicyEngine] Demonstrate L2/L3 Human-in-the-Loop Slack escalation on model rollback.","arguments":[],"template":"Call `evaluate_governance_policy` with `risk_id='MODEL-012'`, `action='rollback'`, `target='model/baac_rf_v2'`, `target_replicas=2`, `target_criticality='high'`. Explain how the computed blast radius and action catalog level (`L2`/`L3`) force the state machine into `AWAITING_APPROVAL` with an interactive Slack Block Kit payload."},{"name":"08_policy_l1_autonomy_fastpath","description":"[PolicyEngine] Verify zero-touch L1 autonomy fast-path for safe non-mutating ticketing.","arguments":[],"template":"Call `evaluate_governance_policy` with `risk_id='DATA-042'`, `action='create_issue'`, `target='repo/mlops-incidents'`. Show why `create_issue` (`mutating=False`, `blast_radius=0`, `level=L1`) is immediately granted `ALLOW` without human friction."},{"name":"09_worm_ledger_chain_verification","description":"[WORM Forensics] Verify the SHA-256 Merkle chain and HMAC-SHA512 signatures of all episodes.","arguments":[],"template":"Call `inspect_worm_trust_ledger` with `limit=20`. Verify whether `chain_valid` is `True`, inspect the `previous_hash -> hash` cryptographic links across episodes, and explain how `agentic_ops/core/crypto.py` signs canonical JSON payloads with `HMAC-SHA512`."},{"name":"10_worm_simulate_and_seal_episode","description":"[WORM Forensics] Execute a live incident episode and seal its cryptographic proof in the ledger.","arguments":[{"name":"risk_id","description":"Risk ID (default DATA-042)","required":false},{"name":"action","description":"Action (default create_issue)","required":false}],"template":"Call `run_governed_incident_episode` with `risk_id='DATA-042'`, `action='create_issue'`, `target='repo/mlops-incidents'`, and `finding_summary='PSI drift 0.42 > 0.25 on feature an_nais'`. Then call `inspect_worm_trust_ledger` on the newly created `episode_id` and display its full cryptographic proof."},{"name":"11_worm_tamper_detection_audit","description":"[WORM Forensics] Run the 9 adversarial & WORM security tests from Phase C and explain tamper detection.","arguments":[],"template":"Call `read_console_diagnostic` with `command='sandbox_phase_c_adversarial_worm'`. Analyze the 9 security tests (`test_evidence_integrity.py`, `test_idempotency_and_rate.py`, `test_prompt_hygiene.py`, `test_executor.py`) and explain how a 1-byte modification on disk breaks `verify_chain()`."},{"name":"12_worm_eu_ai_act_compliance_report","description":"[WORM Forensics] Generate an EU AI Act Article 14 (Human Oversight & Traceability) audit report.","arguments":[],"template":"Read resource `agentic-ops://governance/autonomy-policy` and call `inspect_worm_trust_ledger`. Draft a formal compliance assessment mapping Agentic-Ops controls (Deterministic PolicyEngine, Slack HITL `AWAITING_APPROVAL`, WORM `HMAC-SHA512` Trust Ledger) to EU AI Act Articles 12 (Record-Keeping) and 14 (Human Oversight)."},{"name":"13_taxonomy_deep_search_drift","description":"[Knowledge Base] Search the 435 Failure Modes Taxonomy for Data/Concept Drift & Skew risks.","arguments":[{"name":"query","description":"Search term (default drift)","required":false}],"template":"Call `search_failure_taxonomy` with `query='drift'` and `max_results=15`. Group the discovered failure modes by MLOps Dimension, highlight their early warning signals, and map them to deterministic `PolicyEngine` rules."},{"name":"14_scenario_lineage_sim1_to_sc001","description":"[Knowledge Base] Trace the code lineage from SIM-1 in the Scenarios Registry to SC-001 YAML.","arguments":[],"template":"Call `get_scenario_blueprint` with `scenario_id='SC-001'` and `scenario_id='SIM-1'`. Demonstrate the exact lineage between the prose architectural specification in `mlops_simulation_scenarios_registry.md`, the declarative test contract in `tests/scenarios/data/sc_001_bad_retrain.yaml`, and `risk_register.yaml`."},{"name":"15_scenario_adversarial_triad_analysis","description":"[Knowledge Base] Deep-dive into adversarial scenarios SC-101, SC-102, and SC-103.","arguments":[],"template":"Call `get_scenario_blueprint` for `SC-101`, `SC-102`, and `SC-103`, then call `read_console_diagnostic` with `command='sandbox_phase_d_mlops_scenarios'`. Explain how the 3 adversarial traps (Prompt Injection, Alert Storm Thrashing, Corrupted Sensor Drift) attempt to trick the LLM (`forbidden_proposed=6`) and why `forbidden_executed` remains strictly `0`."},{"name":"16_design_new_scenario_sim9_to_sim20","description":"[Knowledge Base] Synthesize a new executable YAML scenario contract from SIM-9..SIM-20.","arguments":[{"name":"sim_id","description":"Scenario ID from registry (e.g. SIM-9)","required":false}],"template":"Call `get_scenario_blueprint` with `scenario_id='SIM-9'` and `search_failure_taxonomy` with `query='Feast'`. Generate a complete, ready-to-run YAML test file following the exact schema of `tests/scenarios/data/sc_001_bad_retrain.yaml` including `signal`, `events`, `llm_scripted`, and `expected` assertions."},{"name":"17_secops_prompt_injection_audit","description":"[SecOps] Audit indirect prompt injection defenses (PromptGuard + PolicyEngine veto on scale_to_zero).","arguments":[],"template":"Call `get_scenario_blueprint` with `scenario_id='SC-101'` and `evaluate_governance_policy` with `risk_id='INFRA-005'`, `action='scale_to_zero'`, `target='service/prediction-api'`. Explain the Defense-in-Depth architecture: Layer 1 (`PromptGuard` sanitization) and Layer 2 (`PolicyEngine` hard veto on `scale_to_zero`)."},{"name":"18_secops_tool_sandboxing_verification","description":"[SecOps] Verify OS-level multiprocessing.Process sandboxing and 15s SIGKILL timeout (Phase E).","arguments":[],"template":"Call `read_console_diagnostic` with `command='sandbox_phase_e_fsm_governance'`. Explain why Python `ThreadPoolExecutor` timeouts cannot kill hung I/O threads, and how `AgentTool` in `agentic_ops/tools/base.py` isolates every tool call inside a dedicated `multiprocessing.Process` with `process.terminate()`."},{"name":"19_sre_tailscale_mesh_diagnostics","description":"[SRE Mesh] Audit Tailscale userspace WireGuard tunnel, DERP relays, and PII auto-redaction.","arguments":[],"template":"Call `read_console_diagnostic` with `command='tailscale_status'` and `command='tailscale_netcheck'`. Analyze the userspace WireGuard mesh state, nearest DERP relay latencies, `TS_STATE_B64` persistence across Render serverless cold starts, and verify that `_redact_pii()` masks all personal hostnames/emails."},{"name":"20_executive_jury_defense_briefing","description":"[Jury Defense] Generate a 5-point Executive Defense Briefing from live telemetry & 42 tests.","arguments":[],"template":"Execute `inspect_control_plane_vitals`, `read_console_diagnostic(command='pytest_all', include_guides=False)`, and `inspect_worm_trust_ledger(limit=5)`. Synthesize a punchy 5-point Executive Jury Briefing proving: (1) Architectural Agnosticism, (2) Deterministic Safety (`forbidden_executed=0`), (3) Cryptographic WORM Auditability, (4) Zero-Trust Tailscale Mesh Connectivity, and (5) Foundational Knowledge Lineage (`435 Failure Modes` -> Code)."}]}