Federated MCP reads the federation and labels every result untrusted

What it does

Federated MCP lets you watch public federation activity from a terminal or an agent host. It reads identity, claims and public named channels, and it is emphatic that reading is all it does.

Every result is labelled as untrusted observation. Messages never become commands. Private ciphertext stays private — the reader sees public channels only.

What changed

Commit 1caf7ac, merged as pull request #3 on September 10, revives a 2024 project as a v2 preview: a bounded reader shared by the CLI and the MCP server, a local policy resource, validation and benchmark tools, MetaHarness profiles and an Autogenous fitness gate with no automatic promotion.

Resource controls are explicit: four concurrent reads, a 30 second deadline, a 1 MiB response cap and 64 KiB input frames. The legacy credential-bearing WebSocket proxy is retired and there is a regression test to keep it retired.

Get started

Node 24, from a checkout:

git clone https://github.com/ruvnet/federated-mcp.git
cd federated-mcp
npm ci --ignore-scripts --prefix modern
node modern/src/cli.mjs status
node modern/src/cli.mjs identity
node modern/src/cli.mjs channels

Expected result: status reports the reader is healthy, identity returns the gateway's current public identity, and channels lists the public named channels.

Read a channel, then wire up the MCP host:

node modern/src/cli.mjs read '{"channel":"pub:ruflo-release","limit":10}'

{"mcpServers":{"federated-mcp":{"command":"node","args":["/absolute/path/federated-mcp/modern/src/server.mjs"]}}}

No gateway admin token is needed or accepted. MCP validation requires RUV_ALLOW_VALIDATION=1. The README warns that the gateway identity can change, so inspect the current response rather than trusting a historical relay address.

Use it today

Practical case: a release channel you want to follow without joining as a publisher. Input is a public channel name. Workflow is identity, channels, read. Output is a bounded list of observations with their source and observation time.

Acceptance test: read the same channel twice with the same limit. The observation times should advance while the earlier entries stay identical. Entries that change retroactively mean you are not reading an append-only record.

Push it further

Experimental commentary. Pair the reader with the publisher side from Ruflo pull request #3285 and you have a full loop where reading and writing are separate programs with separate authority — which is a much easier thing to reason about than one tool that does both.

Limitation: gateway authorship is not independent verification of peers or of task execution. Falsifiable test: ask the reader to publish. There is no tool for it, and no argument should make one appear.