# MCP tool access report

**Checked:** 2026-09-19, Europe/Berlin

## Executive summary

The current session exposes 72 callable MCP tools across four namespaces:

| Namespace | Exposed tools | Live read-only check |
|---|---:|---|
| `hoppe_brain` | 38 | PASS: `brainStatus` |
| `hoppe_codebox` | 17 | PASS: identity and repository listing |
| `codex_apps` | 14 | PASS: document-session discovery; no sessions connected |
| `node_repl` | 3 | Exposed; not executed for this audit |

H365 is reported as connection-ready, but its `H365MCP-Donny` tool namespace is not loaded in this particular session. Estate, Ops, IdeaHub, and OBS remain unexposed and unverified here.

## Available tools

### Hoppe Brain — 38

`approveSupersession`, `brainExport`, `brainSchemaVersion`, `brainStatus`, `brainVerifyExport`, `createRelationship`, `explainSystem`, `getActiveAlerts`, `getCapabilityReliability`, `getGraph`, `getIdentity`, `getMonitoringSchema`, `getProject`, `getProtocol`, `getScopedGraph`, `getServerHealth`, `learnFromErrors`, `listCapabilities`, `listDocuments`, `listKnowledge`, `listRisks`, `queryMonitoring`, `readNote`, `recordCorrection`, `recordError`, `recordToolExecution`, `reviewBrain`, `reviewDrift`, `reviewSupersessions`, `routeIntent`, `searchBrain`, `setNodeStatus`, `submitDreaming`, `supersedeNode`, `whatChanged`, `whyBroke`, `writeMemory`, `writeNote`.

Read-only status access succeeded. The `getIdentity` check returned an MCP internal error (`-32603: 'name'`), so Brain identity was not independently verified.

### Hoppe Codebox — 17

`codeboxAddComment`, `codeboxCommitFile`, `codeboxCreateBranch`, `codeboxCreateIssue`, `codeboxCreatePullRequest`, `codeboxDeleteFile`, `codeboxGetFile`, `codeboxGetIssue`, `codeboxGetPullRequest`, `codeboxListBranches`, `codeboxListCommits`, `codeboxListFiles`, `codeboxListIssues`, `codeboxListPullRequests`, `codeboxListRepos`, `codeboxUpdateIssue`, `codeboxWhoAmI`.

`codeboxWhoAmI` succeeded and identified the active account as Donny (ID 12, Hoppe.home organization; not a site admin). Repository listing also succeeded. No write or delete operation was performed for this audit.

### Codex Apps — 14

Document control: `codex_document_control_execute_document_command`, `codex_document_control_get_document_tool_schemas`, `codex_document_control_list_document_sessions`.

Plugin management: `plugin_management_get_app_permissions`, `plugin_management_get_plugin_dependencies`, `plugin_management_search_plugins`, `plugin_management_suggest_plugins`, `plugin_management_uninstall_app`, `plugin_management_update_app_permissions`.

Safety settings: `safety_settings_get_family_info`, `safety_settings_get_parental_controls`, `safety_settings_get_trusted_contact`, `safety_settings_prepare_parental_control_update`, `safety_settings_update_parental_control`.

Document-session discovery succeeded, but returned no connected document sessions. No plugin, permission, or safety-setting changes were performed.

### Node REPL — 3

`js`, `js_add_node_module_dir`, and `js_reset` are exposed. They were not executed for this audit.

## Missing or unverified server coverage

The onboarding topology names seven Hoppe.home services:

| Service | Expected endpoint | Dedicated tool namespace in this session | Status |
|---|---|---|---|
| Brain | `https://hoppe.mywire.org/brain/mcp` | `hoppe_brain` | Available; read-only status passed |
| Codebox | `https://hoppe.mywire.org/codebox/mcp` | `hoppe_codebox` | Available; identity and listing passed |
| H365 | `https://hoppe.mywire.org/365/mcp` | `H365MCP-Donny` (not loaded in this session) | Connection reported active; tools unavailable in this session |
| IdeaHub | `https://hoppe.mywire.org/ideahub/mcp` | None | Missing/unverified |
| OBS | `https://hoppe.mywire.org/obs/mcp` | None | Missing/unverified |
| Estate | `https://hoppe.home/api/portal/estate/mcp` | None | Missing/unverified |
| Ops | `https://hoppe-apps.hoppe.home/ops/mcp` | None | Missing/unverified |

## Resources and limitations

The MCP resource inventory exposed two `codex_apps` resources for plugin management and no resource templates. Tool exposure is not proof that every backend is authorized or healthy. Write-capable tools were intentionally not invoked merely to test them.

## Recommended next steps

1. Install/connect the missing H365, IdeaHub, OBS, Estate, and Ops MCP integrations or expose their namespaces in the client configuration.
2. Add a read-only health or identity operation for each service so availability can be tested without changing state.
3. Re-run this audit after configuration changes and record HTTP/MCP initialization results separately from tool exposure.