kryos-mcp
Governed code execution for AI agents, backed by the Kryos compiler's capability system. An MCP server that lets any client type-check, run, and capability-verify Kryos code — so an agent can only run code whose reach (network, filesystem, process, crypto, …) is declared and checked at compile time.
Why
Most "run this code" tools give an agent an unconstrained interpreter. kryos-mcp runs code through Kryos, where every function declares its capabilities (@capabilities(net, io)) and the compiler rejects anything that reaches further. verify_capabilities turns that into a governance verdict: ALLOW only if the code type-checks, every declared capability is inside the grant, and every function is annotated. Because Kryos enforcement is opt-in per function, unannotated functions are reported as UNCONSTRAINED rather than waved through.
Tools
| Tool | What it does |
|---|---|
kryos_check(code, files?) |
Type-check without producing artifacts; surfaces type + capability errors. |
kryos_run(code, files?, timeout_ms?) |
Compile and run with a hard timeout; captures stdout/stderr/exit code. |
capability_manifest(code, files?, strict?) |
Per-function capability manifest (JSON). |
verify_capabilities(code, files?, granted[], allow_unannotated?) |
ALLOW/DENY against a capability grant; reports unconstrained functions. |
kryos_audit(code, files?) |
Full audit: capability usage, extern/FFI surface, secret-pattern scan. |
files is an optional map of sibling .kry module files (name → content) so use <mod> resolves.
Install
Requires the Kryos toolchain on PATH (or set KRYOS_BIN).
npm install
claude mcp add kryos --scope user -- node /abs/path/to/kryos-mcp/server.mjs
Verify
node smoke-test.mjs # spawns the server, exercises every tool incl. a DENY and an ALLOW verdict
Capabilities reference
Valid grants (case-insensitive): net, io, ffi, compute, crypto, process, env, term, db, time, all. Notable gotchas the manifest reflects: env_get/exit require process; time_now requires time; network builtins require net.
MIT.
