[abhiabhijit]

Routes agents' remote MCP servers through Ring Zero, so you can switch individual tools on and off, with kernel enforcement that agents can't route around.

What this adds

• Gateway: in the daemon, at http://127.0.0.1:7700/mcp/<id>, loopback only.
  • A switched-off tool disappears from the agent's tool list.
  • A call to a switched-off tool is refused with a JSON-RPC error the agent can read.
  • Every call, allowed or refused, is recorded in the commentary and Security history.
• Kernel: agents are refused a direct connection to a managed or held server, so editing the config back does not get past the gateway. People on the machine are not affected.
• rz mcp adopt | release | list | tool: password-gated. Adopt rewrites each agent's MCP config to point at the gateway, with a backup.
• New servers are held by default. A remote server added to an agent's config later is held until an administrator approves it.
• Discovery:
  • lists a remote server's tools
  • per-tool switches for managed servers
  • Approve for held servers
• README: describes what Ring Zero does now.

Testing

• On Ubuntu 26.04 (kernel 7.0), with opencode against DeepWiki and Context7, I checked:
  • adopt
  • tool use through the gateway
  • hiding and refusing a switched-off tool
  • kernel refusal of direct access by an agent (not by a person)
  • holding a newly added server, then approving it
• Workspace tests pass (daemon: 357). The eBPF object loads under the verifier; formatting and licence headers are clean.

Known gaps

• New servers are noticed within about 10 s.
• Codex TOML and .jsonc configs are not adopted yet.
• A URL's query string is dropped on adopt.