MCP Servers
Model Context Protocol lets Sonny call tools hosted by another process — a database bridge, an internal ticketing tool, a packet-capture appliance, another agent framework — over a small JSON-RPC protocol. Instead of teaching Sonny one integration at a time, you point it at a server that already exposes the API you need.
Two things are true of every MCP connection in Sonny, and they shape the rest of this section:
- A server is a program you chose to run. A
stdioserver executes as you, with your full filesystem access. Sonny treats that as a trust decision, not a configuration detail. - Nothing connects by default. Every server that survives configuration layering must clear an operator-owned allowlist, or it is refused. Runtime enforcement never consumes terminal input, so a prompt cannot be answered by an agent on your behalf.
What you can reach
| Kind | Transport | Typical use |
|---|---|---|
| Local process | stdio | Databases, CLIs, hardware appliances, language bridges |
| Remote endpoint | sse | Hosted integration servers, shared team tooling |
type: http in the server schema — setting it is a configuration error.
streamable_http parses but is never connected: Sonny refuses it with
unsupported server type: streamable_http. Remote MCP is routed through a gateway rather
than direct server-side HTTP.The three-minute version
Declare the server:
# ~/.config/sonny/mcp.yaml
servers:
- name: fs
type: stdio
command: /usr/bin/mcp-server-filesystem
args: ["/srv/docs"]
- name: tracker
type: sse
url: "https://mcp.example.com/sse"
egress:
allow_hosts: ["mcp.example.com"]
allow_ports: [443]
auth:
type: bearer
token: ${TRACKER_TOKEN}
Inspect what Sonny would load:
sonny mcp list
sonny mcp list --format json
sonny mcp list --connect # actually connect and enumerate tools
Approve the ones you trust:
sonny mcp approve server fs --command /usr/bin/mcp-server-filesystem --arg /srv/docs
sonny mcp approve server tracker --url https://mcp.example.com/sse
sonny mcp approve server <name> pins the exact definition. If the command, arguments,
working directory, environment, or URL later changes, the pin no longer matches and the
server stops launching until you approve the new definition. That is the point: an approved
server that gets quietly reconfigured is a supply-chain attack, and a pin turns it into a
visible failure instead of a silent one.
Connect, disconnect, and Sonny as a server
sonny mcp connect <server> # bring one server up in this session
sonny mcp disconnect <server> # drop it again
sonny mcp-server # Sonny itself, speaking MCP to another client
sonny mcp-server is the inverse direction: run Sonny as an MCP server so another MCP
client can use its tools. See the sonny mcp-server CLI reference
.
Where to go next
- Configuration
— the full
mcp.yamlschema, the layering order, and the egress rules. - Trust model — the allowlist, pins, and how recipes can contribute servers.
- Server catalog — the ten CodePros-operated MCP servers and their Go import paths.