MCP readiness and admission plan

Source review dated 2026-11-05. The machine-readable source is mcp-readiness.json. It reconciles all 51 catalog IDs: 13 bundled contracts, 8 configured connectors and 30 platform entrypoints. All 30 platform entrypoint paths were checked on disk. No personal credentials were opened and no deployment or provider call was performed by this audit.

verified_shared_subset means prior recorded Hub acceptance exists for a limited operation set, not that every catalog-declared tool is exposed. deployed_runtime_verified means the bounded adapter is installed and Linux runtime/dependency checks passed; authenticated browser/provider acceptance is recorded separately. source_only means an executable entrypoint exists, not that its dependencies are installed or it is safe for multiple users. catalog_only means a contract/configuration is inventoried; its executable availability has not been established in this review. discovery_only does not authorize public deployment/admin tools. Cleaning was subsequently deployed with a bounded preview-only subset; see deployment evidence.

The matrix includes schema source pointers, dependency closure, credential requirement, cost class and a concrete next gate for each ID. Platform source pointers are relative to the separate platform repository; they are not exported files in this Hub repository. Full runtime tools/list capture and nested-schema validation remain required for every newly enabled adapter. Empty tool-name arrays mean not verified, never “no tools.” No source inspection proves tenant isolation.

First expansion wave

Cleaning preview: existing local Go/Python implementation, no provider key. Expose only bounded clean_preview initially; approval-bound clean_execute is a separate capability. Require authenticated owner, isolated per-call runtime, output/time/rate caps and no stored input.
Paragraph chunker: selected fixed component export, no provider key. Permit only the pinned paragraph implementation with bounded UTF-8 input and output; do not forward client execution/configuration options.
Daedro Dataset Builder (datasets): actual embedded dataset_build implementation tested behind bounded adapter. Three splits, 3–60 records,64KiB content and explicit owner-attested permission. Produces JSONL/manifest without training. Linux runtime checks passed; authenticated browser acceptance remains pending.
Daedro Archive Reader (offline-ingest): actual embedded parsers tested for text, Markdown, Telegram JSON and WhatsApp text, with64KiB input/200segments and private temporary assets. Linux runtime checks passed; authenticated browser acceptance remains pending. This does not connect a live account.
Daedro Telegram (daedro-telegram): typed Secret credentials and MFA staging, in-memory SQLite session import and isolated auth-status/dialog-list adapter implemented. Tests use synthetic credentials and fake transport. Real Telegram API and owner MFA import are still unverified; no messaging or phone/QR enrollment is exposed.

Privacy replace/restore, local search and lifecycle tools are stateful, even when they use no external API. Their SQLite indexes/mappings/ledgers require ownership, retention and backup policies. Generation, embedding and training need actual model/license/RAM/latency evidence; mock or fixture success is not model execution. PostgreSQL coordinators and destructive retention/cleanup tools need explicit principal propagation and negative cross-user tests across every downstream adapter.

Shared admission contract

Keep Google identity and profile authoritative in the Hub. Source packages accepting principal, permissions, workspace, source IDs or local paths were built for trusted callers; accepting those fields unchanged from the browser is unsafe.
Each adapter must have an immutable tool allowlist, strict input/output schema, per-call deadline, bounded concurrency/bytes and a safe error envelope. No generic command, URL, MCP-method or filesystem proxy.
Personal credentials must be imported only through Daedro Secret with action-bound Authenticator confirmation. Typed S3 and Telegram bundles now have separate scoped delivery paths; other provider keys and social sessions still require their own typed bundles and grants. Credential requirement is independent of whether a key happens to exist on a developer laptop.
Workload grants authorize explicit operations under finite lifetime/use budget. Human changes, reveal (if introduced), grant/revoke and secret metadata remain step-up protected. Failure to reach the secret service must fail closed.
Before public availability: reproducible isolated packaging, service health, actual allowed tool call, two-account/two-profile denial tests (including guessed IDs and cursors), rate/time/resource failure tests, cleanup/retention behavior and UI states. A catalog badge is not acceptance evidence.

Cost ceiling

The user ceiling is $100/month for Google Cloud. This audit does not authorize new machines, model downloads or paid API traffic. Infrastructure admission must reserve the existing VM, disks, IP, backup and network costs first, then allocate a measured CPU/memory/storage/egress allowance per adapter. Use bounded queues and reject work beyond quota. Google billing alerts are notifications, not a hard stop. External provider charges and personal-device services need separate explicit caps; a free CPU adapter can still consume storage or egress.

All catalog entries

ID	Evidence state	Cost class	Concrete next gate / supported subset
`daedro-mcp-hub`	discovery_only	operator	Only catalog discovery is public; managed instance/admin APIs are a separate authority boundary.
`cleaning`	verified_shared_subset	cpu	Bounded whitespace-only clean_preview v1 deployed and probed on Linux; clean_execute remains unavailable.
`text-stats`	verified_shared_subset	cpu	Existing authenticated bounded word_count only; preserve no input persistence.
`daedro-control`	catalog_only	operator	Never expose deployment/admin authority as a communal MCP; explicit operator-only UI and policy required.
`daedro-s3`	verified_shared_subset	external_storage	Only list buckets/list objects/object metadata are approved; object body download remains unavailable. Each connection and cursor must retain owner binding.
`daedro-chunker`	catalog_only	cpu	Add bounded typed component_execute adapter; operator chooses implementation/config, reject user paths and executable options.
`daedro-data`	catalog_only	database	Bind all sources/snapshots/materialization to authenticated owner; migrations, retention and storage budgets required.
`daedro-embedding`	catalog_only	model_cpu	Pin model/license and measure resident RAM/latency; finite tokens/batches/concurrency; model download is not inference verification.
`daedro-qdrant`	catalog_only	database	Per-owner collections or enforced filters, ingestion ownership, deletion and cross-owner search tests required.
`daedro-providers`	catalog_only	paid_external	Secret supports S3 and Telegram; model-provider credentials still require typed provider secret grants, permitted model/provider, money cap and zero fallback required; offline fixture is not hosted execution.
`daedro-voice`	verified_shared_subset	cpu	Existing pilot local-only bounded audio upload/job/result; no customer provider tokens or paid STT enabled.
`daedro-video`	verified_shared_subset	cpu	Existing pilot bounded video upload/job/result; owner assertion must propagate into voice.
`telegram-archive`	catalog_only	cpu_upload	Legacy archive service is not connected; bounded Telegram JSON parsing is available through Daedro Archive Reader.
`daedro-text`	catalog_only	cpu	Locate deployable artifact/version and tool schema; implement signed owner assertion before user text transfer.
`daedro-whatsapp-archive`	catalog_only	cpu_upload	Validate artifact/schema and text upload limits; owner-scope archive, jobs and retention.
`daedro-youtube`	catalog_only	network_media	Allowlisted acquisition, SSRF protection, terms/access review, byte/duration egress budgets and owner-bound jobs required; never share personal session.
`discord-read`	catalog_only	external_api	Verify executable dependency closure and tool schemas; read-only guild/channel grants and secret type missing; no shared operator token.
`adspower-local-api`	catalog_only	personal_device	Needs explicit owner device bridge with profile/cookie isolation; never communal browser session.
`daedro-telegram`	deployed_runtime_verified	cpu_network	Typed encrypted per-account/profile credentials, action-bound MFA, private SQLite session import and separate read-only worker/ticket delivery implemented and tested synthetically. Installed and dependency-probed; real owner MFA import and Telegram API acceptance remain unverified. Phone/QR enrollment and messaging are unavailable.
`factory`	catalog_only	operator	Enumerate tool permissions and executable closure; withhold admin/process/file actions from public users.
`agent-factory`	catalog_only	operator	Enumerate tool permissions; run ownership, approval authority and resource caps absent from shared adapter.
`bootstrap-skills`	source_only	operator	Selected plan/verify can spawn privileged adapters; export dependency closure, immutable operator config and tool allowlist required.
`business-extraction`	source_only	database	Default status/fixture is not production extraction; real provider/record contract, owner authority and durable budget required.
`business-controlled`	source_only	database	Server-derived principal/policy, separate corporate source ownership and release review; default engine unavailable.
`source-connectors`	source_only	external_api	No arbitrary executable/config from browser; per-source schema/egress/credential grants and owner authorization required.
`dataset-recipes`	source_only	database	Owner-bound recipes/sources, migration and bounded materialization; unavailable without selected config.
`datasets`	deployed_runtime_verified	cpu	Real embedded dataset_build MCP executes with synthetic test coverage. Accepts 3–60 owner-attested records, all three splits,64KiB input; produces bounded JSONL/manifest without training or persistence. Linux runtime checks passed; authenticated deployed acceptance pending.
`documents`	source_only	cpu_upload	Sandbox untrusted files, remove inherited host env, cap decompression/CPU/output, manifest must contain only owner upload.
`local-generation`	source_only	model_cpu	No generic tenant trust in principal/permissions fields; derive server-side; benchmark model memory and max128 generated tokens.
`offline-ingest`	deployed_runtime_verified	cpu_upload	Real embedded ingest_parse MCP tests cover txt,markdown,telegram_json,whatsapp_txt with64KiB input/200segments and private temporary assets. Linux runtime checks passed; authenticated deployed acceptance pending.
`lifecycle`	source_only	database	Trusted local mutation API needs tenant-bound source IDs, tombstone/restore semantics and scoped database.
`lifecycle-cleanup`	source_only	database	Destructive cleanup/restore requires explicit authorization, per-owner origin/target proofs and tested retry semantics.
`lifecycle-bridge`	source_only	database	Durable revision domains, owner-bound target mapping, idempotent retries and target credentials required.
`local-transcript`	source_only	model_cpu	Not the same deployment as live voice: export and benchmark selected runtime; owner uploads/duration bounds and model license gate.
`media-processing`	source_only	cpu_upload	Owner-scoped allowlisted assets, duration/format sandbox and downstream dependency closure; do not alias to live video automatically.
`media-objects`	source_only	database	Owner-bound assets/objects and source authority; enforce storage quotas, lifetimes and no cross-owner lookup.
`media-recipes`	source_only	database	Owner-bound source registration, previews/commit/results, explicit downstream grants and capped durable jobs.
`privacy-analysis`	source_only	database	policy/replace/restore trust caller principal and permissions locally; derive server-side, encrypt and partition reversible mappings; no shared mapping IDs.
`privacy-release`	source_only	database	Explicit release/consent and source ownership, approved restore grants, encrypted mappings; offline transport must not imply paid provider ready.
`recipe-jobs`	source_only	database	Owner-authenticated submit/status/cancel, lease fencing, per-profile job quota and cancellation cost controls.
`controlled-recipes`	source_only	database	Review/approve and admit-answer permissions must remain separate; server-derived principal, source scope and release audit required.
`recipe-coordinator`	source_only	database	Export closure and tenant policy across every step; no global workspace or inherited principal; bounded retry/budget and provenance.
`records`	source_only	database	Per-owner record/source keys, typed operations, retention/delete semantics; trusted local caller is not hub authorization.
`local-search`	source_only	database	Per-owner index or proven filters, bounded source ingestion/deletion and source authority; lexical mode is not vector inference.
`source-acquisition`	source_only	external_api	Per-source access consent, egress/SSRF budgets and owner-scoped assets; default engine unavailable.
`source-sync`	source_only	database	Synthetic Telegram feed is not live Telegram; real owned source adapter, schedule quota and deletion synchronization required.
`training`	source_only	model_cpu	Default mock is not training; real training needs measured RAM/device budget, sandboxed per-owner outputs, license and retention; keep off current shared pilot.
`web-search`	source_only	external_api	Default unconfigured/offline fixture is not search; approved endpoint/egress, content SSRF guard, per-profile request/cost limits required.
`data-derived`	source_only	database	Server-derived principal/workspace, migrations and owned derived provenance; cross-tenant materialization tests.
`data-families`	source_only	database	Family membership/query boundaries and owned purge permissions; migrations and tenant negative tests.
`data-retention`	source_only	database	Destructive purge must have scoped authorization and approved retention policy; dependency-aware deletion and retry proof.

Deployment update — November 5, 2026

The existing VM now advertises Daedro Dataset Builder, Daedro Archive Reader and Daedro Telegram. Actual dataset generation, all four parsers and concurrent admission tests passed on Linux under the unprivileged Hub user in a 192 MiB test cgroup. The Hub service cap is 256 MiB to allow its Go process alongside bounded Python children. This is a cap, not a memory reservation or VM resize.

Telegram's pinned dependencies and private worker probe passed. The worker has a separate OS identity and credential delivery socket, 128 MiB memory cap and explicit Telegram-IP egress allowlist. Real user-session import and provider API acceptance remain separate pending actions. No existing personal session was copied, stopped or connected by this rollout. A private encrypted-state snapshot was taken before updating Secret. Once Telegram records exist, do not roll Secret back to binaries that do not preserve their credential fields.