OpenMHS family: mcp-proxy

MCP servers through McpClientDriver (finite controlled tool contract)

Generated by MHS/registry/build_registry.py on 2026-10-20T00:00:00Z from 91 registry records and their task cards. A plan, not a conformance claim.

• bridge_status: available
• helper: McpClientDriver
• exemplar: MHS/drivers/labs/mattjax16__rigol-dho-mcp

Launch

Every driver package starts the same way; per-repo configuration (environment id, model path, port, baud rate, VISA resource) lives in the package's driver.py, never in launch flags:

mhs serve <driver-dir>

A package is done when python3 -m mhs.driver check <driver-dir> --backend fake exits 0 (evidence contract_checked; a fake never yields an MHS-Device level).

Registry coverage

• Repos: 91
• Decisions: bridge-runtime 1, family-config 1, reference 72, skip 17
• Waves: 2: 1, 9: 90
• Dispatchable now: 0
• Modes: hardware 2

Applicability

Repositories whose device interface is an MCP server: triage rule 9, family:mcp-client. The implemented McpClientDriver is a configuration-only, finite tool contract over an injected controlled peer. It does not talk to a live MCP server: every non-fake backend refuses before any import, process start or connection, so a package passes on its fake (contract_checked) and states its native gaps in RESULT.json notes. Exemplar: gh.mattjax16/rigol-dho-mcp (thirteen tools of a Rigol oscilloscope server as sixteen bindings).

Configuration surface. mcp_config["source"] names one file, its SHA-256, the pinned commit and the decorator receiver. mcp_config["tools"] has one entry per selected tool: input (closed object schema; every array has maxItems, every free string maxLength), output (kind json with schema, text, or png, each with max_bytes), effectful, source_ref, defaults, and optionally error_prefixes, result_matches and prerequisite. Optional safety declares the protective transaction; request_timeout_ms, stop_timeout_ms, max_message_bytes and owned_transport bound the client. On the class: commands (every tool needs exactly one primary command; arguments and select add projections), an explicit Action per command whose inline output schema equals the tool's, reads with parameters, mode = "hardware", and backends = {"fake": ".fake:connect", "hardware": ".native:connect"}. The fake returns a peer with exchange(message, *, timeout_ms, lane) that answers tools/list and tools/call; native.py refuses. No writes, safety_bindings, safe_state=True action, estop_physical_ref or method overrides; numeric inputs need a sourced or operator-required Limit. See the MCP client guide.

What it cannot express today: a hardware device at R2 or R3 (SAFE-045 wants a physical-stop reference or a safe-state action, and McpClientDriver allows neither), tools registered with add_tool(...) or through a low-level Server tool table (G7 proves literal decorators only), list or mixed content results (a JPEG preview beside metadata), tools that run caller-supplied code, and primary data the server itself drops before returning. Stop with blocked HELPER_MISSING or NEEDS_ARTIFACTS and name the source lines, or record a source-verified DEVIATION FROM THE CARD to another helper that matches the device's real interface.

Capability mapping

Class ids come from python3 -m mhs.driver catalog search <words>. The deprecated classes cap.device.describe.v1, cap.world.state.v1, cap.world.snapshot.v1 and cap.world.restore.v1 are replaced by the protocol methods mhs.devices.get, mhs.resource.read, mhs.snapshot and mhs.restore.

Safety

The risk floor of a device is the highest catalogue risk_class of its classes (CAP-017); a driver may declare a higher risk, never a lower one. Hardware at R1 or above needs the mcp_config["safety"] protective transaction (it is the e-stop; @estop methods are not allowed) and a non-empty safe state; R2 and R3 cannot pass SAFE-045 with this helper today. Risk follows the device behind the server (MHS/spec/04-safety.md hazard table), never the tool names. Remote descriptions, titles and annotations are untrusted text and grant no authority. A successful-looking reply, MCP cancellation, a closed pipe or a process exit is not a device stop: the safe state is only the declared protective command plus a fresh matching observation, and an unconfirmed effect blocks new effects until an e-stop and reset settle it.

Fidelity

A controlled peer yields contract_checked evidence only. The SDK's controlled profile is not FastMCP's native wire: FastMCP lists pydantic-generated schemas and can add structuredContent beside string results, which the bridge refuses; numbers in the fake are placeholders.

Pitfalls

Tools named get_* can write (select, then query). One tool issues several device calls, so timeouts do not retire it. Error text often comes back as normal content (error_prefixes). Summaries can replace the primary array. Optional raw-command tools stay unexposed.

First task cards

• gh.mattjax16/rigol-dho-mcp: family-config, wave 2, rank 64, MHS/registry/tasks/labs/mattjax16__rigol-dho-mcp.json
• gh.tarrysingh/artificial-intelligence-deep-learning-machine-learning-tutorials: skip, wave 9, rank 129, MHS/registry/tasks/labs/tarrysingh__artificial-intelligence-deep-learning-machine-learning-tutorials.json
• gh.robotmcp/ros-mcp-server: reference, wave 9, rank 165, MHS/registry/tasks/robots/robotmcp__ros-mcp-server.json
• gh.pku-yuangroup/openai4s: reference, wave 9, rank 213, MHS/registry/tasks/labs/pku-yuangroup__openai4s.json
• gh.extelligence-ai/bagel: reference, wave 9, rank 246, MHS/registry/tasks/robots/extelligence-ai__bagel.json

Sources

• Task cards: MHS/registry/tasks/<track>/<owner>__<repo>.json (schema/taskcard.schema.json).
• Triage rules and the helper table: MHS/registry/triage.py; curated decisions: MHS/registry/overrides/.
• Driver API and gate: MHS/sdk/docs/driver-authoring.md; exemplars: MHS/drivers/.
• MCP client guide and driver authoring.
• Rigol exemplar driver, fake, tests, facts and result notes.