Quickstart Verification Kane MCP Agents Evidence Security

Local MCP, default read-only.

The MCP server speaks stdio to a coding agent. Inspection and contract tools work before Kane login. Verification stays off until you opt in.

Start the server

Terminal

node src/cli.mjs mcp --repo .

The process waits for the coding agent over stdio. Point the client at the same command, then restart the client.

MCP client config

{
  "mcpServers": {
    "elenchos": {
      "command": "node",
      "args": [
        "/path/to/elenchos/src/cli.mjs",
        "mcp",
        "--repo",
        "/path/to/project"
      ]
    }
  }
}

Tools

elenchos_inspect

Inspect the repository, application candidates, agent candidates, and Kane readiness. Writes nothing.

Read-only

elenchos_load_task

Load and normalize a repository-local task JSON file without exposing its absolute source path.

Read-only

elenchos_contract

Return task and Kane test hashes for a repository-local contract. Does not run Kane.

Read-only

elenchos_status

Read a sanitized run summary. Raw Kane output, local evidence paths, and credential-bearing fields are omitted.

Read-only

elenchos_verify

Run Kane against the current implementation. Disabled by default. Requires confirm: true. Does not launch a coding agent or edit source.

Opt-in

Enable verification

`elenchos_verify` stays disabled unless local config sets `mcp.allowVerify` to true or the MCP process has `ELENCHOS_MCP_VERIFY_ENABLED=1`. Each call also requires `confirm: true`.

It can start the configured application.
It can make network requests and consume Kane credits.
It writes `.elenchos` evidence.
It never launches a coding agent or edits source files through MCP.

Doctor handshake

`elenchos doctor` performs a real stdio MCP child-process handshake and lists the registered tools. Basic MCP tools do not need Kane authentication or GitHub settings.

Terminal

npx elenchos doctor --repo .

Maintainer GitHub Actions

`.github/workflows/verification.yml` belongs to the Elenchos maintainer repository. End users do not need those secrets to use MCP. The Kane job is manual-only and attached to a `kane-verification` environment.

Setting	Role
ELENCHOS_KANE_ENABLED	Repository variable. Must be true for the Kane job.
KANE_USERNAME	Secret, authentication step only.
KANE_ACCESS_KEY	Secret, authentication step only.
KANE_PROJECT_ID	Optional secret.
KANE_FOLDER_ID	Optional secret.