Skip to content

MCP Runtime Commands

This page documents the current MCP runtime entry points in Assay.

1) assay mcp (CLI)

assay mcp is the canonical command family for MCP runtime work:

  • assay mcp wrap
  • assay mcp discover
  • assay mcp kill
  • assay mcp config-path
  • assay mcp tool keygen|sign|verify

The previous flat assay discover, assay kill, and assay tool ... spellings remain available as hidden compatibility shims and print a deprecation warning to stderr. Their stdout, exit codes, artifacts, and output formats remain unchanged.

2) assay mcp wrap (CLI)

Wrap a real MCP process and enforce policy decisions inline.

Synopsis

assay mcp wrap [OPTIONS] -- <command> [args...]

Common Usage

# Enforcing mode
assay mcp wrap --policy assay.yaml -- <real-mcp-command> [args...]

# Dry-run mode (log decisions, do not block)
assay mcp wrap --policy assay.yaml --dry-run -- <real-mcp-command> [args...]

Key Options

Option Description
--policy <PATH> Policy file (default: assay.yaml)
--dry-run Log decisions but do not block
--verbose Print decisions to stderr
--label <LABEL> Logical server label for identity tracking
--audit-log <PATH> Write mandate lifecycle events (requires --event-source)
--decision-log <PATH> Write decision events (requires --event-source)
--event-source <URI> CloudEvents source URI, e.g. assay://org/app
-- <command> [args...] Wrapped process (required)

3) assay-mcp-server (separate binary)

Run the MCP server binary directly.

Synopsis

assay-mcp-server --policy-root <DIR>

Key Options

Option Description
--policy-root <PATH> Policy root directory (default: policies)

Agent Integration Note

For agent-side runtime enforcement, prefer assay mcp wrap so the wrapped MCP process is mediated by Assay policy checks.

See also: - MCP Integration - Self-Correction Guide - Policies