Expose app-native async tools
Return a KDCubeMCPServer from an app's @mcp surface. MCP tools call the same async domain services the app can expose through API, jobs, chat, or widgets.
MCP support record · verified August 3, 2026
MCP 2026-07-28, served statelessly.
KDCube apps can expose async tool services and connect MCP services to hosted agents. App MCP endpoints support the July 28 discovery and per-request wire path through the official Python SDK v2 while retaining legacy initialization for older clients. Around that wire, KDCube adds per-agent inventories, delegated OAuth, connected accounts, operation-level grants, live revocation, server-side credentials, files, economics, and distributed app serving.
Implemented
2026-07-28 stateless wire path
Modern discovery, self-contained requests, routing headers, result envelopes, and cache hints.
Compatible
Legacy initialize clients
Automatic modern discovery with fallback to the retained 2025-era handshake.
Not yet claimed
Blanket full conformance
Optional extensions and untested base patterns are kept outside the public claim.
Modern wire path
What KDCube serves today
The regression crosses the same KDCubeMCPServer and proc bridge used by app MCP endpoints. It records the actual modern exchange and the retained legacy negotiation path.
| Contract | KDCube behavior | Evidence |
|---|---|---|
| Discovery | server/discover is the modern capability and version entry point. No modern initialize handshake is required. |
Wire test ↗ |
| Per-request metadata | Each modern request carries the protocol version and client capabilities in _meta; KDCube clients also send client information. |
Base protocol ↗ |
| HTTP routing | MCP-Protocol-Version, Mcp-Method, and operation-specific Mcp-Name travel with the request and agree with its body. |
Support boundary ↗ |
| Sessionless dispatch | Modern requests carry no Mcp-Session-Id. Proc workers dispatch requests independently instead of recovering a bundle-local protocol session. |
MCP runtime guide ↗ |
| Results and caching | Ordinary modern results use resultType: complete and server identity metadata. Cacheable lists carry ttlMs and cacheScope. |
Specification ↗ |
| Dual-era client | KDCube consumers use automatic modern discovery and fall back to legacy initialize for older peers. Known legacy endpoints can be pinned explicitly. |
Consumer configuration ↗ |
Complete builder surface
What MCP gains inside KDCube
The common wire is one part of the product. KDCube lets an app provide MCP, consume it for one or many agents, govern the authority crossing each endpoint, and operate the resulting service with the same app lifecycle as every other surface.
Connect and expose
One app can provide MCP, consume MCP, or do both.
Connect hosted agents to MCP
Consumer configuration supports stdio, HTTP and Streamable HTTP, and SSE. Named secret references are resolved on the trusted side rather than copied into agent configuration.
Give each agent its own tool view
Several agents can share one server while receiving different allow-lists. Strategy traits can guide how the resident ReAct harness plans and combines those tools.
Keep both directions independent
An app may consume remote MCP without exposing a server, expose its own tools without consuming another server, or compose both directions in one application.
Serve modern and legacy clients
Modern clients use stateless discovery and self-contained calls. Automatic fallback keeps older initialize clients on the same app tools during migration.
Authorize and protect
The endpoint identifies a caller; current policy authorizes each call.
Choose the authorization owner
Declare a deliberately public surface, let the app own authentication, or use Connection Hub managed authorization. Route visibility and authority remain separate choices.
Register clients three ways
Use descriptor pre-registration, HTTPS Client ID Metadata Documents, or configurable DCR compatibility. Registration establishes caller identity and callbacks; it grants nothing.
Delegate exact authority
A managed grant binds the approving user, caller, concrete resource, tools and operations, claims, selected accounts, identity scope, expiry, and revocation state.
Recheck live authority
Each managed call resolves the current grant and selected operation. OAuth codes, consent state, and refresh rotation use atomic single-consumer transitions, so revocation and narrowing win.
Keep provider credentials server-side
The caller holds a scoped KDCube bearer, never the user's Gmail, Sheets, or Slack token. The connected-account broker resolves the provider credential only after both consent gates pass.
Protect browser grant mutations
OAuth consent uses short-lived, user-bound, single-use CSRF proof. Apps can opt selected cookie-authenticated operation POSTs into the same one-time request-proof pattern.
Operate and extend
The tool surface inherits a production application runtime.
Use three paths into one grant model
A hosted agent can request consent in chat, an external MCP client can complete OAuth, and an operator can issue bounded automation access. All stay inside the same resource ceiling.
Carry the right identity into app code
The runtime projects the external actor, approving grantor, product-data subject, economics subject, grants, and selected operations into request context.
Return bounded data and usable files
Tools can return structured results, pagination, stable object refs, and short-lived download URLs. Resident ReAct tools can also declare files for conversation artifact hosting.
Make large service realms explorable
Optional named services turn broad provider APIs into stable namespaces, progressive schemas, search/get/upsert/action operators, object refs, and downloadable artifacts without a flat catalog of hundreds of tools.
Meter and govern paid work
An app can opt its service into accounting, spend admission, reservation, settlement, and rate policy under the projected economics subject. These controls are configured by the app, not implied by MCP.
Scale without protocol affinity
Stateless requests can land on any proc worker. Product state lives in shared application storage, so scaling the runtime does not require sticky MCP sessions.
Release MCP as part of the app
The MCP surface travels with the app's Git version, descriptor, interface, and tests. Saving a new version or effective props reloads it through the normal app lifecycle.
Keep failures actionable
Managed denials identify the missing resource, tool, claim, account, or consent action. Runtime logs carry non-secret transport, endpoint, tool, run, and final-status evidence.
Governed access
Stateless transport does not mean anonymous access.
A KDCube MCP endpoint can be public, app-owned, or protected by the platform-managed delegated credential path. Managed access keeps caller registration, user consent, current grants, provider credentials, and operation execution as distinct decisions.
01
Discover resourceRFC 9728 metadata and exact MCP URL02
Identify clientPre-registration, CIMD, or configurable DCR03
Approve grantAuthenticated user selects resource, claims, tools, and accounts04
Issue tokenPKCE, issuer binding, resource binding, expiry05
Recheck liveCurrent card and selected operation are resolved again06
Dispatch appOnly the authorized app MCP operation runsModern client registration
HTTPS Client ID Metadata Documents are supported with bounded fetches, address validation, exact client ID and callback matching, and cache controls. Descriptor pre-registration remains available; DCR is a separately configurable compatibility path.
Revocation wins
Managed calls and refresh resolve the current Connection Hub grant. Narrowing, expiry, or revocation takes effect on the next boundary crossing rather than trusting an old embedded authority snapshot.
Credentials stay server-side
The external agent holds a scoped KDCube bearer, not the user's provider token. Provider credentials are resolved only inside the trusted service path after the delegated grant passes.
Browser mutations carry request proof
The OAuth consent form uses a short-lived, user-bound, single-use CSRF token. Selected cookie-authenticated Connection Hub mutation POSTs also require an app-operation token bound to the subject and exact operation. This protection is explicitly enabled with csrf; it is not imposed on bearer clients or every app POST.
Claim boundary
Support is stated feature by feature
MCP separates a required base protocol from independently negotiated extensions. KDCube publishes the capabilities it has exercised instead of turning one passing path into a blanket certification.
Implemented and regression-tested
- Modern
server/discoverand per-request Streamable HTTP exchange. - Required routing headers, self-contained metadata, modern result envelopes, and list cache hints.
- Stateless proc dispatch plus automatic legacy client interoperability.
- Pre-registered, CIMD, and configurable DCR client registration entering one OAuth lifecycle.
- PKCE, issuer/resource binding, consent, atomic single-use OAuth state, refresh, revocation, live grant lookup, and per-operation managed authorization.
- Opt-in, single-use operation CSRF for protected cookie-authenticated Connection Hub mutations.
Still gated or separately owned
- An unqualified full-conformance statement awaits the official runner and live external-client DCR and CIMD journeys.
- The current public wire claim covers app MCP tool surfaces:
server/discover,tools/list, andtools/call. It does not claim the prompts, resources, sampling, elicitation, or logging primitives. - Multi Round-Trip Requests and
requestStateare not included in the current public KDCube support statement. - The optional Tasks extension is not currently claimed.
- Authorization of app-specific handles such as
browser_idorcart_idremains the app's resource policy; a handle is never authority by itself. - No claim on this page implies support for every independently versioned MCP extension.
Why the wording matters: KDCube is ready for the tested July 28 wire and authorization paths described here. “Conforms to every requirement and extension” is a different statement and will be made only with the corresponding evidence.
Primary evidence
Read the contract or run it
The public page is an index. The protocol specification, KDCube canonical docs, implementation tests, and builder recipes remain the sources of depth.
Standard
MCP 2026-07-28 specification ↗ defines the stateless base protocol, per-request metadata, message patterns, authorization, and extension boundary.
KDCube contract
Delegated credential protocol adapter ↗ owns the modern wire and OAuth support boundary.
Executable proof
MCP v2 wire regression ↗ exercises modern and legacy exchanges through the app server wrapper and proc bridge.
Browser request proof
Bundle operation CSRF contract ↗ defines opt-in, single-use request proof for cookie-authenticated operation POSTs and the descriptor override.
Build with it
Expose an MCP service from an app ↗ and delegate it to an external client ↗.
Read next
From protocol rail to working system
These articles move from the infrastructure decision to KDCube's two MCP directions, then follow delegated access end to end and finish with the complete builder configuration.
Industry perspective
MCP Infrastructure: Connecting AI Agents Is the Easy Part
Why inventory, authority, economics, execution, and evidence become the larger operating question around the common wire.
Read article ↗ Engineering mapMCP in KDCube: Connect Any Agent, Expose Any App, Govern Every Call
The complete provider and consumer map: per-agent inventories, app-native surfaces, named services, delegated authority, and economics.
Read article ↗ Delegated accessDelegated MCP, End to End: Three Doorways, Every Fence, Every Phase
Follow a hosted agent, external MCP client, or automation credential through registration, consent, both call-time gates, and credential resolution.
Read article ↗ Builder recipeAuthenticated MCP in KDCube: The Full Chain, Three Ways In
Configure the managed door, resource ceiling, delegable capabilities, client registration, namespace boundary, and connected-account gates.
Read recipe ↗One app surface, current authority at every call
Expose your service through governed MCP.
Keep the app implementation async and framework-neutral. Let the runtime own transport negotiation, delegated access, rate limits, economics, and scale around it.