Governed MCP ops surface: agent-native, fail-closed, hash-sealed control-plane tools

[mdheller]

Problem (competitive gap #1)

Agent-native MCP ops surfaces are now table stakes (Qovery, Port, Render, Railway, Coolify, Heroku, Backstage, Kratix). Continuum exposes nothing MCP-shaped — an agent can operate Qovery conversationally but not sourceos-continuum. This is the #1 ranked gap in the DevSecOps intelligence register.

Scope (owned by continuum; superiority-march move #1)

A minimal, dependency-free MCP server (stdio JSON-RPC) exposing continuum's OWNED surface as agent-callable tools: list CapD capabilities, lifecycle status, list/read the per-action evidence bundle, and run the promotion gate. Our differentiators over the SaaS incumbents, all shipped here:

• Fail-closed by default: read tools run; guarded (mutating) tools refuse unless explicitly policy-granted (deliberate switch), never execute-then-audit.
• Hash-sealed receipt on EVERY tool call emitted to the evidence bundle — a cryptographically sealed ledger, not an audit log.
• Fully open: MIT, self-hosted, stdio (works with Claude Code / Cursor), no SaaS, no external dependency, scale-to-zero (spawned on demand).

NOT in scope (consumed)

The review verdict (prophet-platform); source/registry (Gitea/zot). The MCP server orchestrates + governs; it does not reimplement.

Acceptance

• make validate passes; MCP server handles initialize / tools/list / tools/call.
• Read tools return data; a guarded tool is REFUSED fail-closed without a grant and RUNS with one.
• Every call emits a sealed receipt (tamper-evident). Tested both ways.