What

A server that speaks MCP and exposes one tool: echo. The tool returns the arguments it received. There is no browser, no filesystem, no useful side effect.

Why

Before the browser agent trusts an allowlist, I want a server where the allowlist is the entire program. If I cannot watch a tool call cross the boundary and come back unchanged, I do not understand the boundary.

Architecture

The server advertises a single tool with a tiny schema. A client connects, lists tools, and calls echo. The response is the arguments, plus enough structure to see that the server, not the model, produced it.

Discoveries

The interesting content is not the echo. It is the list. A model can only call what the server published. That sounds obvious, and it is the whole safety property, sitting in a response you can log.

Back to the lab