> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-438-byo-agent-mcp-foundation.md).

# NS-438 · Bring Your Own Agent MCP foundation

## Outcome

Turn the existing proposal-only Agent Pro primitives into the first usable NIGHTSHIFT Bring Your Own Agent vertical slice. An operator can issue one expiring MCP connection for exact tools, symbols and public account scopes; an MCP-capable client can read governed market/account/risk context, register a strict advisory proposal and inspect only its own status/activity.

This milestone does not add a model provider or collect model credentials. It does not expose execution, signing, cancellation, retry, funding, transfer, withdrawal or arbitrary HTTP capability.

## Contract and transport boundary

* Publish a separately versioned MCP/OpenAPI artifact without mutating the existing Agent API v1 or automation API v2 operations.
* Implement strict JSON-RPC 2.0 `initialize`, `notifications/initialized`, `ping`, `tools/list` and `tools/call` behavior over Streamable HTTP.
* Bound request and response bytes, reject batches and unknown members, advertise a fixed supported protocol version and return protocol-correct errors without internal detail.
* Require a maximum-24-hour credential on loopback or HTTPS. Reject remote use unless the separately disabled remote-MCP gate and hosted-auth evidence are active.
* Keep credentials out of URLs, cookies, local storage, prompts, logs and retained MCP session state.

## Authorization boundary

* Bind each connection to exact tool scopes, exact market symbols and zero or more exact venue/lowercase-address scopes.
* Require explicit account scope even for publicly readable addresses because an external-model disclosure is a privacy decision.
* Re-evaluate expiry, entitlement, revocation, scope and quota for every tool call.
* Preserve immediate individual and global revocation.
* Return only credential-owned fixed-code activity. Never expose another connection, private proposal body or provider-native account/order identifiers.

## Tool boundary

* `nightshift.get_market_context` returns one exact allowlisted provider-normalized market row and freshness evidence.
* `nightshift.get_account_context` returns a redacted summary for one exact granted account.
* `nightshift.get_portfolio_risk` returns deterministic completeness, gross-notional, margin and concentration evidence and is explicitly not an execution review.
* `nightshift.create_trade_proposal` reuses existing strict mandate, durable quota and proposal lifecycle registration.
* `nightshift.get_proposal_status` and `nightshift.list_agent_activity` return only the calling connection's projection.
* No tool name contains or aliases an order, signer, wallet, transfer, withdrawal, funding, cancel, retry or arbitrary fetch operation.

## Verification

* Contract tests prove strict tool names/inputs/outputs, local references and additive artifact compatibility.
* Store tests prove legacy migration, exact scopes, expiry, entitlement, individual/global revocation and bounded audit retention.
* Route tests prove authentication, HTTPS/loopback policy, protocol negotiation, scope rejection, malformed input, upstream unavailable/stale state, quota, proposal lifecycle conflict and prompt-injection strings remaining inert data.
* Security tests prove account/order identifiers and credentials do not enter public health, logs or unrelated connection output.
* Interoperability tests exercise initialize, list and calls through a small independent MCP client fixture.

## Release boundary

This ticket enables local read/proposal interoperability. Hosted remote MCP remains disabled until NS-440 supplies customer-owned OAuth 2.1/PKCE authorization, managed secrets, abuse controls and exact-release security evidence. No execution flag changes.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-438-byo-agent-mcp-foundation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.