2026-10-09 校注：文中部署目录、服务、版本和验收计数为各段标注日期的历史记录；当前可验证状态见 current-status-2026-10-09，本次未复跑历史测试或读取私有健康/对话数据。

Humon Read-only Agent MCP v1

Decision

Humon now exposes a local, read-only MCP service through the official Model Context Protocol Python SDK (FastMCP). It uses Streamable HTTP on ${LOCALIP}:8662/mcp and is managed as the hidden WSL user service humon-mcp.service.

The shared context consumers are Windows Codex, WSL Codex, Windows Mano, and WSL Manas. Alaya retains the existing reply-time Hermes hook.

Safety boundary

• The process requires HUMON_READ_ONLY=1.
• Read-only imports skip schema initialization.
• SQLite opens with URI mode=ro plus PRAGMA query_only=ON.
• Missing storage is never created in read-only mode.
• Only humon_perception and humon_readiness are exposed.
• Perception is a fixed whitelist projection.
• Raw conversation, topic text, source references, pending interventions, identifiers, and delivery controls are excluded.
• Historical state cannot authorize an action: suggested_action is always none.
• Unknown inner dimensions must remain unknown.
• The service binds loopback only and uses systemd filesystem, process, address-family, namespace, and IP restrictions.
• Mano and Manas whitelist the two Humon tools and disable MCP resource/prompt utilities.

Verification

• Windows: 89 unit tests passed.
• WSL: 89 unit tests passed.
• Official MCP client listed and called both tools without errors.
• Database hash and relevant row counts were identical before and after live calls.
• Windows input listener: one pythonw.exe, zero visible windows.
• Mano gateway: one pythonw.exe, zero visible windows.
• Mano and Manas both logged exactly two registered Humon tools.
• systemd security exposure score: 3.2 (OK).
• Git commit: f9bb930 feat: expose read-only Humon MCP.

Reuse rationale

The implementation reuses the official modelcontextprotocol/python-sdk instead of maintaining a custom wire protocol. The earlier file named humon_mcp.py was only a subprocess CLI bridge and its default latest operation triggered collection; it was replaced because reading context must never manufacture a new observation.

Next evidence-driven step

Continue natural collection and direct-report coverage. Do not enable proactive delivery until Humon’s operational, longitudinal, ground-truth, personal-baseline, helpfulness, intrusiveness, and privacy gates all pass.