Chio/Docs
LOGIN · JOIN

chio mcp

Serve an MCP edge backed by the kernel over stdio or HTTP, or wrap an existing MCP server so its calls are admitted.

Reference chio@5f63e6e

On this page

All command families · Global flags

chio mcp

Serve an MCP-compatible edge backed by the Chio kernel.

Command synopsistext
chio mcp [OPTIONS] <COMMAND>
  • chio mcp wrap Wrap a stdio MCP server with verdict gating and emit IDE configs.
  • chio mcp governed-sim Run a single governed MustPrepay call through an ephemeral kernel.
  • chio mcp serve Wrap an MCP server subprocess and expose a secured MCP edge over stdio.
  • chio mcp serve-http Wrap an MCP server subprocess and expose a secured MCP edge over Streamable HTTP.

chio mcp wrap

Wrap a stdio MCP server with verdict gating and emit IDE configs.

Command synopsistext
chio mcp wrap [OPTIONS] [COMMAND]...
  • [COMMAND]... The wrapped MCP server command and its arguments. Required unless --tools-fixture is supplied (the test-only path).
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside the inferred manifest scaffold. Default mcp.
  • --manifest <MANIFEST> Optional path to the user’s manifest scaffold. When absent the command renders the inferred scaffold to stdout instead of running the wrap loop.
  • --print-scopes Print the inferred capability-scope manifest scaffold and exit.
  • --emit-config <EMIT_CONFIG> IDE target for --emit-config. When set, the command prints the paste-ready config for the requested IDE and exits without spawning the wrapped child. Values cursor, claude-desktop, continue, zed.
  • --display-name <DISPLAY_NAME> Display name surfaced inside emitted IDE config blobs.
  • --tools-fixture <TOOLS_FIXTURE> Render the manifest scaffold from a JSON tools/list fixture file instead of spawning the wrapped child. Used by the scope inference and emit-config tests so they stay hermetic on shared CI runners.
  • --e2e-fixture <E2E_FIXTURE> Drive the wrap loop against an in-process JSON-RPC fixture (a JSON object with tools and responses arrays). Reads JSON-RPC frames from stdin and emits framed responses on stdout, gated by the manifest scaffold. Used by the e2e test so the stdio-orchestration round-trip can run without a real wrapped child.
  • --self-test-attestation <SELF_TEST_ATTESTATION> Self-test mode for the attestation header. Prints the "Chio-verified" attestation block for the given tool name as JSON and exits.
  • --strict-execution-nonce Execute allowed tool calls through a kernel path that mints and presents strict execution nonces before invoking the wrapped server.
Additional behavior

Spawns the wrapped server, gates each tools/call through the manifest scaffold, and (when --emit-config is set) prints a paste-ready blob for Cursor / Claude Desktop / Continue / Zed.

chio mcp governed-sim

Run a single governed MustPrepay call through an ephemeral kernel.

Command synopsistext
chio mcp governed-sim [OPTIONS] --out <OUT>
  • --payment-adapter <PAYMENT_ADAPTER> Payment adapter: sim (deterministic no-broadcast) or none (absent, deny path). Default sim.
  • --governed-mustprepay Run a governed MustPrepay tool call through the kernel.
  • --out <OUT> Path to write the receipt bundle JSON. Required.
Additional behavior

Builds a local kernel, wires the selected payment adapter (sim or none), executes one governed MustPrepay tool call, and writes the signed receipt bundle to --out. Exits nonzero on denial. Used by the no-key CI lane.

chio mcp serve

Wrap an MCP server subprocess and expose a secured MCP edge over stdio.

Command synopsistext
chio mcp serve [OPTIONS] <COMMAND>...
  • <COMMAND>... The wrapped MCP server command and its arguments. Required.
  • --policy <POLICY> Path to the policy YAML file. Mutually exclusive with --preset.
  • --preset <PRESET> Bundled policy preset to use instead of --policy. Available presets: * code-agent -- zero-config policy for coding agents (Claude Code, Cursor, MCP filesystem/git/shell servers). Allows safe file reads, denies .env / .git/** / .ssh/** writes, denies git push --force.
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside Chio. Default mcp.
  • --server-name <SERVER_NAME> Human-readable name for the wrapped MCP server.
  • --server-version <SERVER_VERSION> Version string for the wrapped MCP server.
  • --manifest-public-key <MANIFEST_PUBLIC_KEY> Override the public key embedded in the synthetic manifest.
  • --page-size <PAGE_SIZE> Page size for paginated tools/list responses. Default 50.
  • --tools-list-changed Whether the edge should advertise notifications/tools/list_changed.
  • --signed-manifest <PATH> Publisher-signed manifest of the wrapped server, verified against --manifest-public-key.
  • --cage-policy <PATH> Canonical signed native-launch policy for the wrapped server.
  • --cage-policy-signer <PUBLIC_KEY> Independently pinned public key for the native-launch policy signer.

chio mcp serve-http

Wrap an MCP server subprocess and expose a secured MCP edge over Streamable HTTP.

Command synopsistext
chio mcp serve-http [OPTIONS] --policy <POLICY> --server-id <SERVER_ID> <COMMAND>...
  • <COMMAND>... The wrapped MCP server command and its arguments. Required.
  • --policy <POLICY> Path to the policy YAML file. Required.
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside Chio. Required.
  • --server-name <SERVER_NAME> Human-readable name for the wrapped MCP server.
  • --server-version <SERVER_VERSION> Version string for the wrapped MCP server.
  • --manifest-public-key <MANIFEST_PUBLIC_KEY> Override the public key embedded in the synthetic manifest.
  • --page-size <PAGE_SIZE> Page size for paginated tools/list responses. Default 50.
  • --tools-list-changed Whether the edge should advertise notifications/tools/list_changed.
  • --shared-hosted-owner Use one shared wrapped MCP subprocess for all remote sessions.
  • --listen <LISTEN> Socket address to bind the remote MCP edge to. Default 127.0.0.1:8931.
  • --auth-token <AUTH_TOKEN> Static bearer token required for remote MCP session admission. Prefer CHIO_AUTH_TOKEN env over the argv form so the bearer does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_AUTH_TOKEN.
  • --auth-jwt-public-key <AUTH_JWT_PUBLIC_KEY> Public key used to verify externally issued JWT bearer tokens.
  • --auth-jwt-discovery-url <AUTH_JWT_DISCOVERY_URL> OIDC discovery URL used to resolve issuer metadata and JWT JWKS keys.
  • --auth-introspection-url <AUTH_INTROSPECTION_URL> OAuth2 token introspection endpoint used to validate opaque bearer tokens.
  • --auth-introspection-client-id <AUTH_INTROSPECTION_CLIENT_ID> Client ID used when calling the token introspection endpoint.
  • --auth-introspection-client-secret <AUTH_INTROSPECTION_CLIENT_SECRET> Client secret used when calling the token introspection endpoint. Prefer CHIO_MCP_AUTH_INTROSPECTION_CLIENT_SECRET env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_MCP_AUTH_INTROSPECTION_CLIENT_SECRET.
  • --auth-jwt-provider-profile <AUTH_JWT_PROVIDER_PROFILE> Optional provider profile used for principal mapping and default OIDC discovery behavior. Values generic, auth0, okta, azure-ad.
  • --auth-server-seed-file <AUTH_SERVER_SEED_FILE> Local auth-server signing seed file. When set, serve-http can issue JWTs itself.
  • --identity-federation-seed-file <IDENTITY_FEDERATION_SEED_FILE> Persistent seed file used to derive stable Chio subjects from authenticated OAuth bearer principals.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Optional file-backed enterprise provider registry shared with trust-control.
  • --auth-jwt-issuer <AUTH_JWT_ISSUER> Expected bearer-token issuer for remote MCP session admission.
  • --auth-jwt-audience <AUTH_JWT_AUDIENCE> Expected bearer-token audience for remote MCP session admission.
  • --admin-token <ADMIN_TOKEN> Optional static bearer token for remote admin APIs. Prefer CHIO_ADMIN_TOKEN env over the argv form so the bearer does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_ADMIN_TOKEN.
  • --public-base-url <PUBLIC_BASE_URL> Public base URL used when constructing protected-resource metadata URLs.
  • --auth-server <AUTH_SERVERS> Authorization server URL advertised via protected-resource metadata.
  • --auth-authorization-endpoint <AUTH_AUTHORIZATION_ENDPOINT> OAuth authorization endpoint advertised in colocated auth-server metadata.
  • --auth-token-endpoint <AUTH_TOKEN_ENDPOINT> OAuth token endpoint advertised in colocated auth-server metadata.
  • --auth-registration-endpoint <AUTH_REGISTRATION_ENDPOINT> Optional dynamic client registration endpoint advertised in auth-server metadata.
  • --auth-jwks-uri <AUTH_JWKS_URI> Optional JWKS URI advertised in auth-server metadata.
  • --auth-scope <AUTH_SCOPES> Scope hint advertised in protected-resource challenges and metadata.
  • --auth-subject <AUTH_SUBJECT> Subject to embed in locally issued auth-server access tokens. Default operator.
  • --auth-code-ttl-secs <AUTH_CODE_TTL_SECS> Authorization-code lifetime for the hosted auth server. Default 300.
  • --auth-access-token-ttl-secs <AUTH_ACCESS_TOKEN_TTL_SECS> Access-token lifetime for the hosted auth server. Default 600.
  • --trust <FILE> Trust file whose issuer pins admit presented capabilities. Defaults to ~/.chio/trust.toml. Reads CHIO_TRUST.
  • --computer <COMPUTER> Attach to a Computer’s kernel state: verify the grants its kernel issued, read the policy in force, consult its revocations and budgets, and append receipts to its history. Replaces the individual store options.

Read more in Wrap an MCP server.

PreviousCLI task index