Connect your
MCP client.

One governance service

aaesmcp is a facade over the daemon, not a standalone governance service. Policy, capability registrations, and application credentials remain in the daemon. The facade forwards calls using an operator-issued bearer token.

The credential resolves the tenant. Callers do not supply a tenant ID. On brokered paths, AAES uses the configured application credential without intentionally handing it to the model. Validate that downstream results, errors, logs, and client behavior do not expose credentials; this is not a guarantee against leakage through those channels.

The aaesmcp binary ships in the evaluation or deployment package. Remaining protocol notes ship with that package.

Authenticate with a token file

For the stdio process, provide the operator-issued bearer token in a local file with permissions 0600 or 0400. The token is never a flag and is never printed. The -token-file flag accepts the file path, not the token itself.

chmod 0600 /path/to/aaes-token

Replace /path/to/aaes-token with the file your operator gave you. Keep the token out of prompts and client configuration JSON. Only its file path belongs in the launch configuration.

Connect over stdio

After you receive the package, launch the facade against the local daemon. Point the command at the binary on your host:

/path/to/aaesmcp -daemon http://127.0.0.1:8090 -token-file /path/to/aaes-token

For an MCP client that uses a mcpServers configuration object:

{
  "mcpServers": {
    "aaes": {
      "command": "/path/to/aaesmcp",
      "args": [
        "-daemon",
        "http://127.0.0.1:8090",
        "-token-file",
        "/path/to/aaes-token"
      ]
    }
  }
}

http://127.0.0.1:8090 is the default daemon address. Match -daemon to your deployment's platformd -listen address.

Streamable HTTP: POST only

Add a listener to expose the MCP endpoint locally:

/path/to/aaesmcp \
  -daemon http://127.0.0.1:8090 \
  -token-file /path/to/aaes-token \
  -listen 127.0.0.1:8765

Configure the client to send MCP requests to http://127.0.0.1:8765/mcp using POST.

tools/call over HTTP requires Authorization: Bearer with an operator-issued token. The process -token-file authenticates the stdio process to the daemon; it is not a fallback for HTTP.

Use a client that can operate with POST-only MCP requests, or use stdio.

Tool discovery

The facade lists these eight built-in tools in the following order, then the capabilities this caller may use.

Keep requestability separate from entitlement. The daemon's catalogue describes what a caller may ask for. Its capabilities describe what that caller may use.

my_surfaces currently refuses. The daemon has no GET /v1/surfaces route, so the tool reports that fact rather than returning an empty list.

approval_status maps to the access-request read operation and expects an access-request identifier; it is not a general /v1/approvals/{id} lookup. The eight built-in tools do not include manager-card operations; agent managers read their inbox through the HTTP API or SDK.

Resources

The facade also lists caller-scoped resources. resources/list publishes aaes://entitlements and aaes://catalogue, rendered from the daemon's capability and catalogue reads. resources/templates/list publishes aaes://work/{work_id}, aaes://receipts/{receipt_id}, and aaes://policies/{capability_id}. Work and receipt templates resolve to the daemon's reads and refuse by name when the identifier is absent. The policy template resolves with the policy's own fields, rendered from the daemon's catalogue, when the daemon publishes the capability as requestable to this caller; otherwise the read refuses with the daemon's reason. resources/subscribe is not served: the daemon has no change feed, so the facade refuses it by name rather than promising notifications it cannot send. Identity is the operator-issued bearer token; resource URIs do not name a tenant or actor.

The facade also serves two prompts, justify_access_request and explain_refusal. Each is grounded in the daemon's own answers at prompts/get time; when the daemon cannot be read, the prompt says so and instructs the model not to invent a justification.

Verify exported records offline

receipt_verify_pointer returns the command to run locally. Use aaesctl verify against an export and public key from your evaluation install:

aaesctl verify --export <export.jsonl> --pubkey <key.pub>

This audit operation needs no running service. See the CLI reference for the offline audit commands.

Follow the daemon contract

The facade forwards to the HTTP API. Daemon refusals are JSON with a reason, plus a remedy when the daemon can name the smallest change that would satisfy the refusal.

The daemon contract is the public OpenAPI 3.1 schema. The operator console is served by the AAES process on a separate listener and is not part of that contract.

A local check uses official Python MCP SDK 1.28.1 over stdio and stateless HTTP; other clients, SSE, sessions, and OAuth are not implied.

Back to developer documentation · Request an evaluation