An MCP endpoint over the app you are already running, with the gate as the permission model.
$ npm i @frontierjs/mcp
One plugin, inside the running API
Stdio would have to boot the app a second time — a second job worker, a second migration check, and an event bus no browser tab is on. Mounted, a tool call is one more caller of the process that is already serving.
import { mcp } from '@frontierjs/mcp'
app.configure(mcp()) // POST/GET/DELETE at {apiPrefix}/mcpTools are computed per standing, not described in a prompt
What an agent may do is the gate it is already graded by. A stranger sees a stranger’s tools; a prompt can be talked out of a rule, and the database layer cannot.
A tool call goes through app.service(name)
The same hooks, transaction and announcement an HTTP or WebSocket call gets, so nothing an agent does is invisible to a browser watching the same rows.
The schema the browser already gets
Each tool’s input is the client-audience JSON Schema, and no call through this package can ask for the system audience — so a protected column cannot reach a tool description.
Nothing is kept between two requests
The projection is rebuilt at the caller’s standing on every request, so nothing an agent was shown outlives a sign-out.
Nothing — there is no common equivalent to swap out.
The rest of the stack