FeatureMCP Server
Four tools your agent can ask for. Ten it is refused, by name.
Reality Graph runs a read-only MCP server for coding agents on your machine, over stdio, with no port and no network. Four tools answer questions about the project. The dangerous operations are not missing from the contract, they are in it, named and marked unavailable.
Last updated:
What it answers
Four questions an agent should never have to guess
These are the questions a coding agent asks badly when nobody answers them: what is this project, what may I touch, what is relevant here, and how much room do I have.
| Tool | What it returns |
|---|---|
| get_project_brief | A compact project overview: what this product is, its stack, the active work and the governance boundaries in force. |
| get_relevant_context | The material this task declares, ranked deterministically. No embeddings and no similarity search, so the same task returns the same context. |
| get_safe_next_step | The next step that stays inside the declared boundaries, rather than the next step that sounds ambitious. |
| get_token_budget_plan | How the budget is spent before it is spent, with must-keep items protected and every count labelled exact or estimated. |
The refusal contract
The interesting half of the list is the half that says no
Most tool surfaces publish what they offer. This one publishes what it will not do, one operation at a time, so nobody has to infer a boundary from an absence.
reality_graph tool contract (excerpt)
Example – illustrative excerpt of the shipped contractavailable read_only writes shell network get_project_brief true false false false get_relevant_context true false false false get_safe_next_step true false false false get_token_budget_plan true false false false declared and refused run_shell modify_file delete_file commit_changes write_to_db send_network_request start_agent start_claude approve_own_patch publish_claim
Read the second block slowly, because it is the design. An agent cannot ask this server to run a shell command, edit a file, commit, reach the network, start another agent, approve its own patch, or publish a claim. Not because those tools were left out, but because they are written down and answered with a refusal.
The one that matters most is approve_own_patch. An agent that can approve its own work makes every other control on this site decorative, and the contract closes that door by name.
By design
What this server is, and what it is not
A local tool surface is a small, sharp thing. Claiming more for it would undo the reason it can be trusted.
What it does
- Run locally over stdio, with no port, no listening socket and nothing reachable from another machine.
- Answer four project questions read-only, and stamp every response with the flags proving no write, shell or network call occurred.
- Name every dangerous operation in its contract and refuse it explicitly.
- Rank context deterministically, so the same task returns the same answer.
What it is not
- Full Model Context Protocol compatibility. It is MCP-like, and it says so about itself.
- A complete surface. The remaining contract entries answer NOT_IMPLEMENTED rather than improvising.
- A sandbox around your coding agent. It constrains this server, not your agent's own access.
- A hosted endpoint. Nothing is exposed, and nothing is shared.
What actually reaches a prompt is decided in the context pack, and the public endpoint this website operates for external agents is a different server, documented on the MCP page.
Questions people actually ask
- Why does the contract list tools it will not run?
- Because an absence proves nothing. A reviewer reading a list of four safe tools has to wonder what the fifth one might be; a reviewer reading run_shell, modify_file, commit_changes and start_agent marked unavailable knows the answer. Naming the refusal is a stronger statement than leaving it out, and it survives a version bump.
- Is this full Model Context Protocol compatibility?
- No, and the server says so about itself. It implements tools/list, tools/call and server/manifest as MCP-like JSON-RPC handlers, four tools answer, and every other contract entry returns NOT_IMPLEMENTED rather than improvising. When full compatibility lands, this page changes in one edit.
- Does it open a port?
- No. It is a local stdio server: no network binding, no listening socket, nothing to reach from another machine. Every response carries the same flags stating that no write, no shell and no network call happened during it.
- Does this sandbox my coding agent?
- No, and the distinction matters. It constrains what this server will do when your agent asks. Your agent still has whatever access you gave it, and Reality Graph does not sit between it and your filesystem.
Hand your security reviewer the tool contract
It is one file, it names every operation, and it says no to the ones that matter in writing. That conversation usually takes a week.
Keep going
Step 9 of 9