TOOLS & MCP
Connect any MCP server, show agents only what fits
MCP servers, skills, and your own Python tools in one registry. An agent sees a tool only when it fits the task and it holds a grant for it.
Tools in Cambrian CoreMCP, skills, @tool
// configs/mcp.json
{
"mcp": {
"call_timeout_ms": 60000,
"servers": [
{
"id": "filesystem",
"transport": "stdio",
"endpoint": "./bin/reference-fs-mcp",
"args": ["--root", "/data/shared"],
"auth": { "type": "none" },
"tools": [
{ "name": "read_file", "dangerous": false },
{ "name": "list_directory", "dangerous": false }
]
},
{
"id": "crm",
"transport": "http",
"endpoint": "https://mcp.example.com/mcp",
"auth": { "type": "bearer", "token_env": "CRM_MCP_TOKEN" },
"classification_tags": ["sales"],
"tools": [{ "name": "update_deal", "dangerous": true }]
}
]
}
}Tool sources
Three ways to give agents tools
Exampleconfigs/mcp.json
{
"id": "crm",
"transport": "http",
"auth": { "type": "bearer", "token_env": "CRM_MCP_TOKEN" },
"classification_tags": ["sales"],
"tools": [{ "name": "update_deal", "dangerous": true }]
}Security
Secure by design, not by checklist
Cambrian has no certifications yet. What it has is an architecture where access is enforced in the kernel, every decision is explained, and you run it yourself.
Self-hosted
No grant, no tool
Explained denials
Least privilege, delegated
Open source
FAQs
System tools for reading and writing files and for running shell commands and Python. Running commands and Python counts as dangerous, so each call waits for a person to approve it. Everything else comes from MCP servers, skills, or your own @tool methods.