app.osint-mcp

OSINT MCP

Contract-derived MCP tools for all OSINT operations and an optional governed self-improvement composition. The host must resolve authenticated contexts; tool calls enforce the same grants as REST.

By default the standalone service uses the same managed OIDC, fresh-authority, FORCE-RLS PostgreSQL handler as REST. HTTP callers provide exact scope headers; local stdio uses the separately configured OSINT_MCP_STDIO_ACTOR_ID and OSINT_MCP_STDIO_GRANTS workload scope. Deployments may instead set an allowlisted OSINT_MCP_COMPOSITION_MODULE matching @lssm-tech/integration.osint-mcp-*. It serves authenticated, stateless Streamable HTTP at /mcp by default, or local stdio when OSINT_MCP_TRANSPORT=stdio. Both modes reuse the contract-derived tool and resource registry, propagate cancellation, and invoke the same scoped headless handler as REST and the worker. OSINT_DEPLOYMENT_PROFILE_ID optionally pins a managed deployment profile. Known isolated deployment IDs are always inferred from the authenticated or stdio scope, so MCP cannot expose a vertical disabled by that profile.

When selfImprovement is present, HTTP resolves both contexts concurrently and stdio resolves two explicit workload contexts before connecting. The same MCP session then exposes all generated improvement tools and program/candidate/replay resources. If either configured identity cannot be resolved, connection fails closed; the MCP app never translates OSINT grants into improvement authority.

The managed MCP host enables the concrete governed runtime with the same SELF_IMPROVEMENT_CONTROL_URL, workload token, and optional authority URL as the API. Local stdio additionally requires SELF_IMPROVEMENT_STDIO_WORKSPACE_ID and SELF_IMPROVEMENT_STDIO_GRANTS; actor identity defaults to the explicit OSINT stdio actor and an optional SELF_IMPROVEMENT_STDIO_PROGRAM_ID restricts both scope and allowed program identifiers. Readiness verifies the FORCE-RLS store tables before accepting production traffic.