Skip to content

gryt-mcp: let an AI read and act on Gryt servers (GRYT-2005, 2/2) - #19

Merged
grytchat merged 3 commits into
claude/GRYT-2005-sdkfrom
claude/GRYT-2005-mcp
Nov 3, 2026
Merged

grytchat merged 3 commits into
claude/GRYT-2005-sdkfrom
claude/GRYT-2005-mcp

Conversation

@grytchat

@grytchat grytchat commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Second layer of the Gryt MCP stack (GRYT-2005), on top of #18.

gryt-mcp is an MCP server shipped as a bin in this package. An AI client like Claude Code starts it locally, and it joins each --server name=host as a bot, with one key at ~/.config/gryt-mcp/identity.json (0600). It knocks for read_messages, view_members, send_messages, delete_own_messages and view_diagnostics, and the owner unticks what they don't want on each server.

claude mcp add gryt -- npx -y -p @gryt/bot gryt-mcp --server home=chat.example.com

Tools:

  • Read: list_servers, list_channels, read_channel, read_thread, search, list_members, server_status
  • Write: send_message (reply or thread optional), start_thread, delete_own_message

The write tools are annotated readOnlyHint: false, so a client can allowlist the reads and ask before every post. Every read that returns member text starts with a line saying it's data, not instructions. Nothing listens for messages or answers anyone on its own.

The MCP protocol part is about 90 lines in src/mcp/protocol.ts instead of the SDK as a dependency. Initialize, ping, tools/list and tools/call over newline-delimited JSON is all of it this uses.

Look at

  • WANTS in src/mcp/main.ts: what it asks for by default. send_messages is in it, so the owner has to untick it for a read-only setup.
  • The prompt-injection handling is the note in each result plus the client's approval prompt. Nothing in the MCP itself can tell a real request from a planted one.
  • state in main.ts uses the channels event to mark a server ready again after a reconnect, since ready fires once.

Tested

  • yarn test: protocol (initialize, notifications, unknown methods, read-only marking) and tools against a fake bot
  • End to end against a throwaway server from server#358 with a real SFU: knock, approve, then every tool. server_status returned live gryt_sfu_* numbers. Not tested with someone in voice, so the voice room list was empty.

Docs: docs#181.

🤖 Generated with Claude Code

grytchat and others added 3 commits November 3, 2026 11:32
A bin in this package. It joins each server given with --server as a bot
with one key, kept at ~/.config/gryt-mcp/identity.json (0600), and knocks
for read_messages, view_members, send_messages, delete_own_messages and
view_diagnostics. The owner unticks what they don't want on each server.

Tools: list_servers, list_channels, read_channel, read_thread, search,
list_members, server_status, send_message, start_thread,
delete_own_message. The last three are marked not read-only, so a client
that honours readOnlyHint can allowlist the reads and ask before posts.

Every read that returns member text starts with a line saying it's data,
not instructions, and the server instructions say to post only when
asked.

The MCP protocol is about 90 lines here rather than the SDK as a
dependency: initialize, ping, tools/list and tools/call over
newline-delimited JSON on stdio is all of it we use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lank (GRYT-2005)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@grytchat
grytchat added this pull request to stack #20 November 3, 2026 10:38
@grytchat grytchat changed the title claude/GRYT 2005 mcp gryt-mcp: let an AI read and act on Gryt servers (GRYT-2005, 2/2) Nov 3, 2026
@grytchat
grytchat marked this pull request as ready for review November 3, 2026 10:40
@grytchat
grytchat merged commit 76972d9 into main Nov 3, 2026
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant