003 / research
mcp-echo
A tiny MCP server whose only tool repeats what it was asked, so the protocol is the point.
What
A server that speaks MCP and exposes one tool: echo. The tool returns the arguments it received. There is no browser, no filesystem, no useful side effect.
Why
Before the browser agent trusts an allowlist, I want a server where the allowlist is the entire program. If I cannot watch a tool call cross the boundary and come back unchanged, I do not understand the boundary.
Architecture
The server advertises a single tool with a tiny schema. A client connects, lists tools, and calls echo. The response is the arguments, plus enough structure to see that the server, not the model, produced it.
Discoveries
The interesting content is not the echo. It is the list. A model can only call what the server published. That sounds obvious, and it is the whole safety property, sitting in a response you can log.