mcp reference · Sorus

Source snapshot, not a live availability guarantee. Use the client and release supplied during onboarding. Contributor build instructions below refer to the source workspace; they are not a public package installer. Version notes.

sorus-mcp is a Model Context Protocol server generated from the operation catalogue. It runs beside an agent with that agent’s credential, exposes one tool per operation the credential’s scopes permit, holds no state of its own and performs no operation the API refuses.

installation

Build the binary from the workspace: cargo build --release -p sorus-mcp. Mint a credential in the dashboard settings or with cargo sorus credential create.

Environment:

SORUS_TOKEN: the agent credential; or SORUS_CREDENTIAL_FILE: a file holding it.
SORUS_ENDPOINT: the API origin; the default is https://app.lathe.run.
SORUS_MCP_HTTP_TOKEN: the caller token the HTTP transport requires from callers beyond this host, 32 characters or more; without it the transport serves loopback only.

stdio, for a client that starts the server:

{
  "mcpServers": {
    "sorus": {
      "command": "sorus-mcp",
      "args": ["stdio"],
      "env": { "SORUS_TOKEN": "lathe_agent_..." }
    }
  }
}

streamable HTTP, for a client that connects: sorus-mcp http 127.0.0.1:8765 serves POST /mcp; the client sends each JSON-RPC message as a request body and receives the response as JSON. Every message runs under the server’s credential, so the listener serves this host only: an address beyond loopback is refused unless SORUS_MCP_HTTP_TOKEN (32 characters or more) is set, and every request then presents that token as Authorization: Bearer; a request without it is refused with HTTP 401.

tools

Each tool’s input schema is the operation’s request: path parameters, query parameters and body members as one object, plus idempotency_key for a keyed mutation. The result is the operation’s response document; a refused operation is a refused tool whose result carries the typed refusal.

tool	operation	scope
`identity_current`	`identity.current`	`read`
`onboarding_surface`	`onboarding.surface`	`read`
`onboarding_claim`	`onboarding.claim`	`admin`
`jobs_list`	`jobs.list`	`read`
`jobs_submit`	`jobs.submit`	`submit`
`jobs_get`	`jobs.get`	`read`
`jobs_evidence`	`jobs.evidence`	`read`
`jobs_artifacts`	`jobs.artifacts`	`read`
`jobs_logs`	`jobs.logs`	`read`
`jobs_cancel`	`jobs.cancel`	`submit`
`jobs_retry`	`jobs.retry`	`submit`
`repositories_admission`	`repositories.admission`	`submit`
`repositories_list`	`repositories.list`	`read`
`repositories_get`	`repositories.get`	`read`
`repositories_settings_get`	`repositories.settings.get`	`submit`
`repositories_settings_write`	`repositories.settings.write`	`settings`
`repositories_advisories_dismiss`	`repositories.advisories.dismiss`	`settings`
`repositories_lineages_purge`	`repositories.lineages.purge`	`admin`
`tenant_settings_get`	`tenant.settings.get`	`read`
`tenant_settings_write`	`tenant.settings.write`	`settings`
`tenant_registry_credential_replace`	`tenant.registry_credential.replace`	`credentials`
`cli_tenant`	`cli.tenant`	`read`
`usage_report`	`usage.report`	`read`
`usage_export`	`usage.export`	`read`
`credentials_list`	`credentials.list`	`credentials`
`credentials_revoke`	`credentials.revoke`	`credentials`
`audit_list`	`audit.list`	`read`

resources

lathe://jobs/{id}: the authoritative job record (jobs.get)
lathe://jobs/{id}/evidence: the job’s evidence report (jobs.evidence)
lathe://jobs/{id}/logs: the job’s durable log page (jobs.logs)
lathe://repositories/{owner}/{name}: one repository’s lineages and advisories (repositories.get)
lathe://usage: the current period’s usage report (usage.report)

prompts

submit-and-wait: submit a captured Cargo workspace and follow the job to its terminal state, then report the evidence
diagnose-a-failure: read a failed job’s evidence and logs and name the failing phase, test or provisioning cause with the next step
onboard-a-repository: check the installation claim, confirm the repository is onboarded and run the first job