69 lines
4.6 KiB
Markdown
69 lines
4.6 KiB
Markdown
# MCP tool access report
|
|
|
|
**Checked:** 2026-09-19, Europe/Berlin
|
|
|
|
## Executive summary
|
|
|
|
The current session exposes 72 callable MCP tools across four namespaces:
|
|
|
|
| Namespace | Exposed tools | Live read-only check |
|
|
|---|---:|---|
|
|
| `hoppe_brain` | 38 | PASS: `brainStatus` |
|
|
| `hoppe_codebox` | 17 | PASS: identity and repository listing |
|
|
| `codex_apps` | 14 | PASS: document-session discovery; no sessions connected |
|
|
| `node_repl` | 3 | Exposed; not executed for this audit |
|
|
|
|
H365 is reported as connection-ready, but its `H365MCP-Donny` tool namespace is not loaded in this particular session. Estate, Ops, IdeaHub, and OBS remain unexposed and unverified here.
|
|
|
|
## Available tools
|
|
|
|
### Hoppe Brain — 38
|
|
|
|
`approveSupersession`, `brainExport`, `brainSchemaVersion`, `brainStatus`, `brainVerifyExport`, `createRelationship`, `explainSystem`, `getActiveAlerts`, `getCapabilityReliability`, `getGraph`, `getIdentity`, `getMonitoringSchema`, `getProject`, `getProtocol`, `getScopedGraph`, `getServerHealth`, `learnFromErrors`, `listCapabilities`, `listDocuments`, `listKnowledge`, `listRisks`, `queryMonitoring`, `readNote`, `recordCorrection`, `recordError`, `recordToolExecution`, `reviewBrain`, `reviewDrift`, `reviewSupersessions`, `routeIntent`, `searchBrain`, `setNodeStatus`, `submitDreaming`, `supersedeNode`, `whatChanged`, `whyBroke`, `writeMemory`, `writeNote`.
|
|
|
|
Read-only status access succeeded. The `getIdentity` check returned an MCP internal error (`-32603: 'name'`), so Brain identity was not independently verified.
|
|
|
|
### Hoppe Codebox — 17
|
|
|
|
`codeboxAddComment`, `codeboxCommitFile`, `codeboxCreateBranch`, `codeboxCreateIssue`, `codeboxCreatePullRequest`, `codeboxDeleteFile`, `codeboxGetFile`, `codeboxGetIssue`, `codeboxGetPullRequest`, `codeboxListBranches`, `codeboxListCommits`, `codeboxListFiles`, `codeboxListIssues`, `codeboxListPullRequests`, `codeboxListRepos`, `codeboxUpdateIssue`, `codeboxWhoAmI`.
|
|
|
|
`codeboxWhoAmI` succeeded and identified the active account as Donny (ID 12, Hoppe.home organization; not a site admin). Repository listing also succeeded. No write or delete operation was performed for this audit.
|
|
|
|
### Codex Apps — 14
|
|
|
|
Document control: `codex_document_control_execute_document_command`, `codex_document_control_get_document_tool_schemas`, `codex_document_control_list_document_sessions`.
|
|
|
|
Plugin management: `plugin_management_get_app_permissions`, `plugin_management_get_plugin_dependencies`, `plugin_management_search_plugins`, `plugin_management_suggest_plugins`, `plugin_management_uninstall_app`, `plugin_management_update_app_permissions`.
|
|
|
|
Safety settings: `safety_settings_get_family_info`, `safety_settings_get_parental_controls`, `safety_settings_get_trusted_contact`, `safety_settings_prepare_parental_control_update`, `safety_settings_update_parental_control`.
|
|
|
|
Document-session discovery succeeded, but returned no connected document sessions. No plugin, permission, or safety-setting changes were performed.
|
|
|
|
### Node REPL — 3
|
|
|
|
`js`, `js_add_node_module_dir`, and `js_reset` are exposed. They were not executed for this audit.
|
|
|
|
## Missing or unverified server coverage
|
|
|
|
The onboarding topology names seven Hoppe.home services:
|
|
|
|
| Service | Expected endpoint | Dedicated tool namespace in this session | Status |
|
|
|---|---|---|---|
|
|
| Brain | `https://hoppe.mywire.org/brain/mcp` | `hoppe_brain` | Available; read-only status passed |
|
|
| Codebox | `https://hoppe.mywire.org/codebox/mcp` | `hoppe_codebox` | Available; identity and listing passed |
|
|
| H365 | `https://hoppe.mywire.org/365/mcp` | `H365MCP-Donny` (not loaded in this session) | Connection reported active; tools unavailable in this session |
|
|
| IdeaHub | `https://hoppe.mywire.org/ideahub/mcp` | None | Missing/unverified |
|
|
| OBS | `https://hoppe.mywire.org/obs/mcp` | None | Missing/unverified |
|
|
| Estate | `https://hoppe.home/api/portal/estate/mcp` | None | Missing/unverified |
|
|
| Ops | `https://hoppe-apps.hoppe.home/ops/mcp` | None | Missing/unverified |
|
|
|
|
## Resources and limitations
|
|
|
|
The MCP resource inventory exposed two `codex_apps` resources for plugin management and no resource templates. Tool exposure is not proof that every backend is authorized or healthy. Write-capable tools were intentionally not invoked merely to test them.
|
|
|
|
## Recommended next steps
|
|
|
|
1. Install/connect the missing H365, IdeaHub, OBS, Estate, and Ops MCP integrations or expose their namespaces in the client configuration.
|
|
2. Add a read-only health or identity operation for each service so availability can be tested without changing state.
|
|
3. Re-run this audit after configuration changes and record HTTP/MCP initialization results separately from tool exposure.
|
