# M2MTF MCP server

The library exposes a read-only **machine-to-machine TrustFortress** MCP endpoint
for Claude, Goose, Cursor, Codex, and other MCP clients. It is labelled **M2MTF** so it
does not get confused with the human admin worker.

- **Endpoint:** `https://lib.trustfortress.ai/mcp`
- **Authenticated endpoint:** `https://lib.trustfortress.ai/internal/mcp`
- **Server name:** `m2mtf-resource-library`
- **Protocol:** MCP **2026-07-28** (legacy pins accepted: 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05)
- **Transport:** Streamable HTTP, JSON-RPC 2.0 over `POST`, stateless (SEP-2575).
- **Discovery:** `server/discover` (preferred). `initialize` kept for older clients.
- **Routable headers:** `MCP-Protocol-Version`, `Mcp-Method`, `Mcp-Name` (SEP-2243).
- **Batching:** not supported. Send one JSON-RPC message per `POST`.
- **Public access:** public tools return only public-safe collections, claims, and CUB fields.
- **IP access:** source packs, proof snapshots, work evidence, non-public
  whitepaper material, transcripts, recovery bundles, and other IP collections
  require the unified Cloudflare Access email gate. The owner-approved clean v6
  whitepaper evidence collection is public.

The public endpoint exposes 8 public collections. Authorized server-side clients
use `/internal/mcp` for the complete 20-collection view (8 public plus 12
email-gated). The protected endpoint accepts the signed identity asserted by
Cloudflare Access. Headless callers present the paired
`CF-Access-Client-Id`/`CF-Access-Client-Secret` service-token headers to the
Access edge, which validates them and injects the signed assertion consumed by
the Worker. Never place those credentials in browser JavaScript; use a Worker,
Pages Function, or another trusted backend. Public routes remain
credential-insensitive and never expand beyond the public collection view.

## Centralized CUB rule

All CUB theorem and implementation-status lookups must go through the centralized
registry. Do not infer live status from one repository CSV, a paper snapshot, or a
claim page.

- Authoritative full explorer: `https://registry.trustfortress.ai/registry`
- Public-safe API: `https://lib.trustfortress.ai/api/cubs`
- Public-safe exact lookup: `https://lib.trustfortress.ai/api/cubs/CUB-1921`
- Public code-integrity index: `https://lib.trustfortress.ai/api/cubs/CUB-1921/code`
- Public-safe metadata: `https://lib.trustfortress.ai/api/cubs/meta`

The generated registry payload exists once in the existing `packet-tracer` D1
used by `registry.trustfortress.ai`. The library reads those same D1 rows through
the `REGISTRY_DB` binding and exposes a reduced public projection. An optional
`CUB_REGISTRY` Worker service binding remains configured for RPC migration, but
there is no second theorem database. The public projection includes reproduction
paths, full file hashes, execution anchors, and proof-status notes so agents can
verify the published proof/code binding. Internal operational fields remain
private.

## Tools

| Tool | Args | Public behavior | Authenticated behavior |
|---|---|---|---|
| `list_entrypoints` | none | Lists the canonical human and machine entry points for Watch, datasets, CUBs, the agent index, and MCP. | Same public entry points. |
| `get_cub` | `id` | Exact public-safe CUB record from the central registry. | Same public-safe projection; use the authenticated registry for private fields. |
| `search_cubs` | `query`, filters?, `limit?` | Searches IDs, statements, modules, crates, and use cases. | Same public-safe projection. |
| `list_cubs` | filters?, `limit?` | Lists central-registry records with bounded output. | Same public-safe projection. |
| `get_registry_meta` | none | Freshness, source heads, reconciliation counts, proof scope, invocation, and crate coverage. | Same public-safe projection. |
| `search_library` | `query`, `prefix?` | Searches visible public collections. | Also searches email-gated IP collections. |
| `ask_library` | `question`, `prefix?` | Answers from public catalog + public AI Search chunks. | Can answer from gated prefixes/chunks too. |
| `ai_search` | `query` | Filters out chunks whose source key is email-gated. | Returns public + email-gated chunks. |
| `list_collections` | none | Lists public collections with `access: "public"`. | Also lists `access: "email-gated"` collections. |
| `list_claims` | none | Public-safe claims catalog; gated URLs are labelled `email-gated`. | Same public-safe claims catalog. |
| `get_claim` | `id` | One public-safe claim. | Same public-safe claim. |
| `read_object` | `key` | Reads public text objects up to 80 KB. | Reads email-gated text objects too. |

Use the CUB tools for theorem status and wiring. Use the claim tools for public
claims, evidence downloads, and reproduction context. A claim can cite CUBs, but
it is not a substitute for the live per-CUB registry record.

## Connect from Claude Desktop

```json
{
  "mcpServers": {
    "m2mtf-resource-library": {
      "url": "https://lib.trustfortress.ai/mcp"
    }
  }
}
```

Clients that only speak stdio can bridge with:

```bash
npx mcp-remote https://lib.trustfortress.ai/mcp
```

For email-gated IP access, connect through the Cloudflare Access application used
for `lib.trustfortress.ai`. Browser-based clients get the Access JWT after
sign-in. Headless clients should use a Cloudflare Access service token for the
same app so Cloudflare injects `Cf-Access-Jwt-Assertion` before the Worker sees
the request. Send authenticated MCP calls to `/internal/mcp`; public `/mcp`
intentionally remains anonymous and returns only the public collection view.

## Raw JSON-RPC

```bash
curl -sS https://lib.trustfortress.ai/mcp \
  -H 'content-type: application/json' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: server/discover' \
  -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{}}'

curl -sS https://lib.trustfortress.ai/mcp \
  -H 'content-type: application/json' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}'

curl -sS https://lib.trustfortress.ai/mcp \
  -H 'content-type: application/json' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/call' \
  -H 'Mcp-Name: get_cub' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_cub","arguments":{"id":"CUB-1921"}}}'

curl -sS https://lib.trustfortress.ai/mcp -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"ask_library","arguments":{"question":"where is the Data Center Stakeholder FAQ?"}}}'
```

Each `tools/call` returns `{ content: [{ type: "text", text: "...JSON..." }] }`.

## Generation model and AI Search

`ask_library` uses keyword retrieval plus Gemma 4
(`@cf/google/gemma-4-26b-a4b-it`) via Workers AI, routed through AI Gateway when
configured. `ai_search` adds Cloudflare AI Search semantic recall. Public calls
filter email-gated source keys before chunks are returned or sent to the model.
CUB tools do not invoke a model; they are deterministic reads from the shared
central registry data plane.