Spaces:
Running
Running
feat(loop): operational RAG->tool-call->policy/trust gate->signed-receipt loop + canonical live MCP at /mcp/ + /ask-and-act consumer UI; de-advertise retired hatun-mcp Space on /hatun-mcp page
633838b verified | <html lang="en"><head><meta charset="utf-8"> | |
| <meta name="viewport" content="width=device-width,initial-scale=1"> | |
| <title>a11oy · Hatun-MCP — agentic MCP server</title> | |
| <!-- SPDX-License-Identifier: Apache-2.0 · © 2026 SZL Holdings · Doctrine v12 additive · Signed: Yachay · Co-author: Perplexity Computer Agent --> | |
| <style> | |
| :root{--bg:#0a0b10;--panel:#12141d;--panel2:#171a25;--ink:#e8eaf0;--mut:#9aa0b4;--gold:#d9b35c;--line:#252938;--grn:#3fb950;--amb:#d29922;--red:#f85149;} | |
| *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--ink);font:15px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif} | |
| a{color:var(--gold);text-decoration:none}a:hover{text-decoration:underline} | |
| header{border-bottom:1px solid var(--line);padding:14px 22px;display:flex;align-items:center;gap:14px;background:linear-gradient(180deg,#10121b,#0a0b10)} | |
| header .brand{font-weight:700;letter-spacing:.5px;color:var(--gold);font-size:18px} | |
| header .tag{color:var(--mut);font-size:12px} | |
| nav{display:flex;flex-wrap:wrap;gap:8px;padding:10px 22px;border-bottom:1px solid var(--line);background:var(--panel)} | |
| nav a{font-size:12.5px;padding:4px 10px;border:1px solid var(--line);border-radius:999px;color:var(--mut)} | |
| nav a:hover{border-color:var(--gold);color:var(--gold);text-decoration:none} | |
| nav a.active{background:var(--gold);color:#0a0b10;border-color:var(--gold);font-weight:600} | |
| main{max-width:1040px;margin:0 auto;padding:28px 22px 60px} | |
| h1{font-size:26px;margin:0 0 4px;color:#fff}h2{font-size:18px;margin:28px 0 10px;color:var(--gold)} | |
| .sub{color:var(--mut);margin:0 0 18px;font-size:13.5px} | |
| .card{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:18px 20px;margin:14px 0} | |
| .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(230px,1fr));gap:14px;margin:16px 0} | |
| .grid a.tile{display:block;background:var(--panel2);border:1px solid var(--line);border-radius:12px;padding:16px;color:var(--ink)} | |
| .grid a.tile:hover{border-color:var(--gold);text-decoration:none} | |
| .grid a.tile .t{color:var(--gold);font-weight:600;margin-bottom:4px}.grid a.tile .d{color:var(--mut);font-size:12.5px} | |
| table{width:100%;border-collapse:collapse;margin:12px 0;font-size:13.5px} | |
| th,td{text-align:left;padding:8px 10px;border-bottom:1px solid var(--line);vertical-align:top} | |
| th{color:var(--mut);font-weight:600;font-size:12px;text-transform:uppercase;letter-spacing:.4px} | |
| code,pre{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12.5px} | |
| pre{background:#0d0f17;border:1px solid var(--line);border-radius:10px;padding:14px;overflow:auto;color:#cdd3e3} | |
| .pill{display:inline-block;padding:2px 9px;border-radius:999px;font-size:11.5px;font-weight:600} | |
| .g{background:rgba(63,185,80,.15);color:var(--grn)}.a{background:rgba(210,153,34,.15);color:var(--amb)}.r{background:rgba(248,81,73,.15);color:var(--red)}.n{background:#1c2030;color:var(--mut)} | |
| .note{border-left:3px solid var(--gold);padding:8px 14px;background:rgba(217,179,92,.06);color:#d8dbe6;font-size:13.5px;margin:14px 0;border-radius:0 8px 8px 0} | |
| footer{border-top:1px solid var(--line);color:var(--mut);font-size:11.5px;padding:18px 22px;line-height:1.7} | |
| .kbd{background:#1c2030;border:1px solid var(--line);border-radius:6px;padding:1px 7px;font-family:ui-monospace,monospace;font-size:12px} | |
| .statline{display:flex;flex-wrap:wrap;gap:18px;align-items:center;font-size:13.5px} | |
| .statline b{color:var(--ink)} | |
| .tag2{display:inline-block;background:#1c2030;color:var(--mut);border:1px solid var(--line);border-radius:6px;padding:1px 7px;font-size:11px;margin-left:6px} | |
| .st{color:var(--amb);font-weight:600} | |
| </style></head><body> | |
| <header><span class="brand">a11oy</span><span class="tag">Brand Orchestration Layer · the one place to see everything</span></header> | |
| <nav><a href="/hub">Hub</a><a href="/a11oy.code">a11oy.code</a><a href="/docs">Docs</a><a href="/pricing">Pricing</a><a href="/api-keys">API Keys</a><a href="/sdk">SDK</a><a href="/status">Status</a><a href="/hatun-mcp" class="active">Hatun-MCP</a><a href="/observability">Observability</a><a href="/security">Security</a><a href="/compliance">Compliance</a><a href="/cued-engagement">Cued Engagement</a><a href="/uds">UDS</a><a href="/counter-uas">Counter-UAS</a><a href="/evidence">Evidence</a><a href="/upgrades">Upgrades</a><a href="/audit">Audit</a><a href="/gap-report">Gap Report</a></nav> | |
| <main> | |
| <h1>Hatun-MCP — agentic MCP server</h1> | |
| <p class="sub"><b>Hatun</b> (Quechua: <i>great / sovereign</i>) is the Model Context Protocol gateway that exposes SZL's governed flagship capabilities to any MCP client (Claude Desktop, Cursor, custom agents). Every tool invocation passes the Yuyay-13 governance gate and emits a signed Khipu receipt. Anonymous calls are governed-but-declined (OWASP MCP07) — provide an SZL API key to execute. This tab probes the live server directly from your browser.</p> | |
| <div class="card"> | |
| <div class="statline"> | |
| <span>Live status: <span id="health"><span class="pill n">probing…</span></span></span> | |
| <span>Signer: <b id="signer">—</b></span> | |
| <span>Khipu chain: <b id="chain">—</b></span> | |
| <span>Protocol: <b id="proto">—</b></span> | |
| <span>Probe latency: <b id="lat">—</b></span> | |
| </div> | |
| <p class="sub" style="margin:12px 0 0">Endpoint: <code>https://szlholdings-a11oy.hf.space/mcp/</code> (canonical, live, same-origin) · Transport: JSON-RPC over Streamable HTTP (<code>POST /mcp/</code>) · MCP revision <code>2024-11-05</code><br><b>Note:</b> the standalone hatun-mcp Space is retired; a11oy now serves the canonical MCP directly at <code>/mcp/</code>.</p> | |
| </div> | |
| <h2>Tools exposed (<span id="toolcount">16</span>)</h2> | |
| <p class="sub">Loaded live from the canonical <code>GET /mcp/</code> discovery card on this Space. These are the real governed tools exposed by the live MCP (call them with <code>POST /mcp/</code> JSON-RPC <code>tools/call</code>).</p> | |
| <table><thead><tr><th>Tool</th><th>Backend flagship</th><th>Class</th></tr></thead><tbody id="tools"></tbody></table> | |
| <h2>Recent invocations</h2> | |
| <p class="sub">Each MCP call appends a Khipu receipt (continuum hash + DSSE signature) to the governance chain. Recent receipts are summarized here from the server's invocation feed; if the feed endpoint is unreachable cross-origin it shows the honest interim message below.</p> | |
| <table><thead><tr><th>Time (UTC)</th><th>Tool</th><th>Outcome</th><th>Continuum hash</th></tr></thead><tbody id="inv"><tr><td colspan="4" class="sub">loading…</td></tr></tbody></table> | |
| <h2>Connect a client</h2> | |
| <div class="card"> | |
| <p style="margin:0 0 8px">Claude Desktop — add to <code>claude_desktop_config.json</code> (uses the <code>mcp-remote</code> bridge, pointing at a11oy's live canonical <code>/mcp/</code>):</p> | |
| <pre>{ | |
| "mcpServers": { | |
| "szl-a11oy": { | |
| "command": "npx", | |
| "args": ["-y", "mcp-remote", "https://szlholdings-a11oy.hf.space/mcp/"] | |
| } | |
| } | |
| }</pre> | |
| <p class="sub" style="margin:8px 0 0">Quick test: <code>curl -s https://szlholdings-a11oy.hf.space/mcp/</code> (discovery card) or <code>curl -s -X POST https://szlholdings-a11oy.hf.space/mcp/ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'</code> · public key: <a href="/cosign.pub" target="_blank" rel="noopener">/cosign.pub</a> · try the loop: <a href="/ask-and-act">/ask-and-act</a></p> | |
| </div> | |
| <div class="note">This tab probes a11oy's own canonical, same-origin <code>/mcp/</code> endpoint — no cross-origin CORS, no dead Space. The tool list and protocol version below are read live from <code>GET /mcp/</code>.</div> | |
| <p class="sub">Source: szl_agentic_loop.py (canonical MCP + governed loop) · live probe of <code>/mcp/</code></p> | |
| <script> | |
| const BASE=""; // same-origin: a11oy serves the canonical /mcp/ directly | |
| // Static authoritative tool list (mirrors server-card.json); refreshed live below when CORS permits. | |
| const TOOLS=[ | |
| ["szl_a11oy_code_chat","a11oy.code","read"], | |
| ["szl_killinchu_detect","vessels / killinchu","read"], | |
| ["szl_killinchu_cue","vessels / killinchu","2-person"], | |
| ["szl_sentra_scan","sentra","read"], | |
| ["szl_rosie_reason","rosie","read"], | |
| ["szl_khipu_verify","governance","read"], | |
| ["szl_lean_verify","lean / formal-verification","read"], | |
| ["szl_puriq_evaluate","puriq","read"], | |
| ["szl_yachay_dome_predict","yachay-dome","read"], | |
| ["szl_wayra_recent","wayra","read"], | |
| ["szl_anatomy_3d_render","anatomy","read"], | |
| ["szl_doctrine_lookup","governance / doctrine","read"], | |
| ["szl_yuyay_score","yuyay-v3","read"], | |
| ["szl_thesis_query","thesis","read"], | |
| ["szl_drone_lookup","uds / counter-uas","read"], | |
| ["szl_formula_evaluate","puriq / formal math","read"]]; | |
| function paintTools(list){const tb=document.getElementById('tools');tb.innerHTML=''; | |
| list.forEach(([n,b,c])=>{const tr=document.createElement('tr'); | |
| const cls=c==='2-person'?'a':'n'; | |
| tr.innerHTML=`<td><code>${n}</code></td><td>${b}</td><td><span class="pill ${cls}">${c}</span></td>`;tb.appendChild(tr);}); | |
| document.getElementById('toolcount').textContent=list.length;} | |
| paintTools(TOOLS); | |
| // Live probe of the canonical, same-origin /mcp/ discovery card | |
| const t0=performance.now(); | |
| fetch(BASE+"/mcp/").then(r=>r.json().then(j=>({r,j}))).then(({r,j})=>{ | |
| const ms=Math.round(performance.now()-t0); | |
| document.getElementById('lat').textContent=ms+' ms'; | |
| document.getElementById('health').innerHTML=(r.ok&&j.canonical)?'<span class="pill g">LIVE</span>':'<span class="pill a">'+r.status+'</span>'; | |
| document.getElementById('signer').textContent='in-image ECDSA-P256 (see /cosign.pub)'; | |
| document.getElementById('chain').textContent='hash-chained receipts ✓'; | |
| document.getElementById('proto').textContent=j.protocolVersion||'—'; | |
| // refresh the tool table from the live card's real governed tools | |
| if(j&&Array.isArray(j.tools)&&j.tools.length){ | |
| paintTools(j.tools.map(t=>[t.name, (t.title||'governed tool'), 'governed'])); | |
| } | |
| }).catch(()=>{document.getElementById('health').innerHTML='<span class="pill r">unreachable</span>';}); | |
| // Recent invocations feed (optional endpoint; honest fallback if absent/blocked) | |
| fetch(BASE+"/api/hatun/invocations",{mode:'cors'}).then(r=>r.ok?r.json():Promise.reject()).then(rows=>{ | |
| const tb=document.getElementById('inv');tb.innerHTML=''; | |
| if(!rows||!rows.length){tb.innerHTML='<tr><td colspan="4" class="sub">No recent invocations recorded.</td></tr>';return;} | |
| rows.slice(0,12).forEach(x=>{const tr=document.createElement('tr'); | |
| const ok=x.outcome==='success'; | |
| tr.innerHTML=`<td>${x.ts||'—'}</td><td><code>${x.tool||'—'}</code></td><td><span class="pill ${ok?'g':'a'}">${x.outcome||'—'}</span></td><td><code>${(x.continuum_hash||'').slice(0,16)}</code></td>`;tb.appendChild(tr);}); | |
| }).catch(()=>{document.getElementById('inv').innerHTML='<tr><td colspan="4" class="sub">Run a governed agent at <a href="/ask-and-act">/ask-and-act</a> — each run produces a signed, hash-chained receipt you can re-verify in the browser (chain + signature). The MCP <code>tools/call</code> path drives the same governed pipeline.</td></tr>';}); | |
| </script> | |
| </main> | |
| <footer>Doctrine v12 (PURIQ) additive · v11/v12 LOCKED: 749 declarations · 14 axioms · 163 sorries · 13-axis yuyay_v3 · lutar-v18.0.0 @ c7c0ba17 · SLSA L1 (honest) · Khipu signature = DSSE/cosign PLACEHOLDER<br>HfApi direct push only · IP-HOLD a11oy#57 untouched · ADDITIVE / zero-regression · Khipu receipt on every action · Signed <b>Yachay</b> · Co-author Perplexity Computer Agent</footer> | |
| </body></html> | |