[P2][mcp] Native MCP server exposing the 18 sdlc_* tools (reaches Claude Code, Cursor, Codex, Hermes, enterprise)

[richard-devbot]

Summary

Ship a native MCP server exposing the 18 sdlc_* tools (stdio + HTTP). This is the highest interop-per-effort move available: one surface lets Claude Code, Cursor, Codex, Hermes, and any MCP client drive a governed RStack run without a bespoke per-harness adapter. The README already flags this as a "future slice" (README line ~431: "a native MCP/A2A server is still a future slice").

Priority note (Richardson, 2026-07-13): extensions/plugins stay the primary integration path for now; MCP is the next wave (P2), because the agent-prompt/skill/plugin library needs a deliberate exposure design first (see "Prompt/skill/plugin exposure" below). This issue is the design + build for that wave.

Why MCP, and why now-ish

• One protocol reaches everything. The bridge already proves the tool surface is host-free (all 18 tools run against a mock Pi). MCP is the standard, lower-maintenance alternative to N Python adapters.
• Hermes is MCP/ACP-native (mcp_serve.py with FastMCP + @mcp.tool(); acp_adapter/ with a real permission/approval bridge). An MCP server is the front door to Hermes (tracked separately) and to the enterprise MCP ecosystem.
• Composes with the guard — MCP tool calls can be gated the same way (the guard already parses the Claude Code PreToolUse shape); a server-side can_use_tool-style hook enforces before execution.

Design considerations (must be resolved in this issue)

1. Transport: stdio (local clients) + streamable HTTP (remote/enterprise), auth-gated on the HTTP path reusing the dashboard token discipline (RSTACK_*_TOKEN, timing-safe, CSRF/origin on writes).
2. Enforcement on the MCP path: every mutating tool call routes through the same destructive gate + validator sandbox; no second policy engine.
3. Prompt/skill/plugin exposure (the fine-tuning Richardson called out): MCP exposes tools, not the agent .md library. The orchestrator/builder/validator prompts, the 69 skills, the specialist agents, and the model: frontmatter tag in each agent .md need a deliberate exposure path — candidates: MCP prompts + resources for the agent/skill catalog, and folding the routing/prompt-assembly into the tool descriptions and sdlc_delegate output. Decide what is a tool vs. a prompt vs. a resource, and how model: selection is honored when the client's model runs the loop.
4. Conformance: add an MCP conformance test analogous to tests/bridge-conformance.test.js so the MCP tool surface can't drift from the Pi registry.

Acceptance criteria

• rstack-agents mcp (or a rstack-mcp bin) serves the 18 sdlc_* tools over stdio and HTTP.
• A real MCP client (Claude Code / Cursor) can run a governed loop: start → plan → build_next → validate → approve, with the destructive gate enforced.
• HTTP transport is auth-gated; writes carry the same token/CSRF discipline as the dashboard.
• Agent/skill catalog + model: handling exposed via MCP prompts/resources per the design decision above.
• MCP conformance test pins the tool surface to the Pi registry.
• RFC written first (design decisions above) before implementation.

Source: docs/audits/2026-07-13-feasibility-standalone-vs-extensions.md §5. Sequenced after the P0/P1 enforcement + parity wave.

[richard-devbot]

Part of the harness-parity epic #376.