Connect c6s over MCP

c6s mcp is a local stdio server. The MCP client launches the process and owns its lifetime; c6s does not install a daemon or open a network listener.

Use the absolute path to the executable:

{
  "mcpServers": {
    "c6s": {
      "command": "/Users/you/.local/bin/c6s",
      "args": ["mcp"]
    }
  }
}

Replace /Users/you with your actual home directory. Do not place tokens, recovery material, or secret values in the MCP configuration.

Current tools

The current surface reports non-sensitive capabilities, verifies and inspects the public synthetic approval fixture, reports local-vault status, and lists or inspects item metadata. It can also list and inspect value-redacted remote requests, create one exact immutable request, and execute that same request after a trusted device has approved it and issued a short-lived one-time grant.

Local-vault results include IDs, titles, kinds, revisions, field labels, and policies only. Values are omitted by the shared application layer, and MCP has no reveal or approval tool. c6s_create_request is a state-changing preparation step but cannot use a secret. c6s_execute_approved_request is separately marked destructive: it atomically consumes the existing grant and runs only the already approved executable, arguments, working directory, and bindings with bounded secret-redacted output.

The MCP process is pinned to the c6s profile selected when it starts. Restart the MCP client after changing the default profile, or start it with an explicit global --profile selection. Do not switch shared profile state as part of an agent action.

Process contract

• JSON-RPC frames use standard output.
• Diagnostics use standard error.
• Closing standard input stops the server.
• MCP calls pass through the same validation and redaction boundary as CLI commands.
• No MCP tool can enroll or approve a device, approve or broaden a request, extend a grant, reveal a field, or silently retry a failed execution.