4.6 KiB
MCP tool access report
Checked: 2026-09-19, Europe/Berlin
Executive summary
The current session exposes 72 callable MCP tools across four namespaces:
| Namespace | Exposed tools | Live read-only check |
|---|---|---|
hoppe_brain |
38 | PASS: brainStatus |
hoppe_codebox |
17 | PASS: identity and repository listing |
codex_apps |
14 | PASS: document-session discovery; no sessions connected |
node_repl |
3 | Exposed; not executed for this audit |
H365 is reported as connection-ready, but its H365MCP-Donny tool namespace is not loaded in this particular session. Estate, Ops, IdeaHub, and OBS remain unexposed and unverified here.
Available tools
Hoppe Brain — 38
approveSupersession, brainExport, brainSchemaVersion, brainStatus, brainVerifyExport, createRelationship, explainSystem, getActiveAlerts, getCapabilityReliability, getGraph, getIdentity, getMonitoringSchema, getProject, getProtocol, getScopedGraph, getServerHealth, learnFromErrors, listCapabilities, listDocuments, listKnowledge, listRisks, queryMonitoring, readNote, recordCorrection, recordError, recordToolExecution, reviewBrain, reviewDrift, reviewSupersessions, routeIntent, searchBrain, setNodeStatus, submitDreaming, supersedeNode, whatChanged, whyBroke, writeMemory, writeNote.
Read-only status access succeeded. The getIdentity check returned an MCP internal error (-32603: 'name'), so Brain identity was not independently verified.
Hoppe Codebox — 17
codeboxAddComment, codeboxCommitFile, codeboxCreateBranch, codeboxCreateIssue, codeboxCreatePullRequest, codeboxDeleteFile, codeboxGetFile, codeboxGetIssue, codeboxGetPullRequest, codeboxListBranches, codeboxListCommits, codeboxListFiles, codeboxListIssues, codeboxListPullRequests, codeboxListRepos, codeboxUpdateIssue, codeboxWhoAmI.
codeboxWhoAmI succeeded and identified the active account as Donny (ID 12, Hoppe.home organization; not a site admin). Repository listing also succeeded. No write or delete operation was performed for this audit.
Codex Apps — 14
Document control: codex_document_control_execute_document_command, codex_document_control_get_document_tool_schemas, codex_document_control_list_document_sessions.
Plugin management: plugin_management_get_app_permissions, plugin_management_get_plugin_dependencies, plugin_management_search_plugins, plugin_management_suggest_plugins, plugin_management_uninstall_app, plugin_management_update_app_permissions.
Safety settings: safety_settings_get_family_info, safety_settings_get_parental_controls, safety_settings_get_trusted_contact, safety_settings_prepare_parental_control_update, safety_settings_update_parental_control.
Document-session discovery succeeded, but returned no connected document sessions. No plugin, permission, or safety-setting changes were performed.
Node REPL — 3
js, js_add_node_module_dir, and js_reset are exposed. They were not executed for this audit.
Missing or unverified server coverage
The onboarding topology names seven Hoppe.home services:
| Service | Expected endpoint | Dedicated tool namespace in this session | Status |
|---|---|---|---|
| Brain | https://hoppe.mywire.org/brain/mcp |
hoppe_brain |
Available; read-only status passed |
| Codebox | https://hoppe.mywire.org/codebox/mcp |
hoppe_codebox |
Available; identity and listing passed |
| H365 | https://hoppe.mywire.org/365/mcp |
H365MCP-Donny (not loaded in this session) |
Connection reported active; tools unavailable in this session |
| IdeaHub | https://hoppe.mywire.org/ideahub/mcp |
None | Missing/unverified |
| OBS | https://hoppe.mywire.org/obs/mcp |
None | Missing/unverified |
| Estate | https://hoppe.home/api/portal/estate/mcp |
None | Missing/unverified |
| Ops | https://hoppe-apps.hoppe.home/ops/mcp |
None | Missing/unverified |
Resources and limitations
The MCP resource inventory exposed two codex_apps resources for plugin management and no resource templates. Tool exposure is not proof that every backend is authorized or healthy. Write-capable tools were intentionally not invoked merely to test them.
Recommended next steps
- Install/connect the missing H365, IdeaHub, OBS, Estate, and Ops MCP integrations or expose their namespaces in the client configuration.
- Add a read-only health or identity operation for each service so availability can be tested without changing state.
- Re-run this audit after configuration changes and record HTTP/MCP initialization results separately from tool exposure.
