Model Context Protocol (MCP)

Sythoria can connect to MCP servers over stdio, SSE, and Streamable HTTP. An MCP server is software you choose to run or contact. Review its code, permissions, and data policy separately from Sythoria.

Transports#

Transport	How it connects	Common use
stdio	Starts a local process and exchanges messages through standard input and output	Local CLI tools and development servers
SSE	Connects to an HTTP server that returns server-sent events	Existing remote MCP services
Streamable HTTP	Uses the current HTTP MCP transport	Local or remote services

Sythoria stores MCP credentials and configured environment values in encrypted local secret storage. The root encryption key is kept in the operating system credential vault.

Stdio environment#

Stdio processes start with a cleared environment. Sythoria adds a small runtime allowlist and the variables you explicitly configure for that server. It does not copy every variable from your login shell, and it does not automatically forward every name ending in _API_KEY or _TOKEN.

An explicitly configured variable may use any valid environment-variable name. Treat each value as a secret if the child process can read it.

A local stdio process can still open files, start child processes, or use the network under your user account. "Local" describes where the process starts; it is not a sandbox.

Tool approval#

New servers are untrusted by default.

For an untrusted server, Sythoria shows a native confirmation before each tool call. Approval is single-use and expires after 60 seconds. It is bound to the server connection, tool name, arguments, and conversation, so it cannot be reused for a different call.

Marking a server as trusted removes that approval step. Do this only when you are willing to let the selected model call every enabled tool from that server without another prompt.

Tool names and results#

Sythoria prefixes tool names with the server name to avoid collisions, for example serverName__toolName. Tool descriptions are included in the model request while the server is selected.

MCP results can contain text and images. Returned images are displayed in the conversation and may be sent back to the model on a later tool-loop step.

Local and private addresses#

Loopback, private, link-local, and other local destinations are blocked by default for HTTP-based MCP connections. Add an exact local endpoint grant only when you intend to connect to that address. A block-list entry still takes precedence over a grant.

Before enabling a server#

Check the executable or URL, tool list, arguments, environment values, and trust setting. Keep the server untrusted while testing it. Stop and disconnect it if a tool asks for unrelated credentials or broader access than the task needs.