DEV Community: Moshe Avdiel

The Incident Clock Is the Turn Budget. MCP Schemas Should Not Be Allowed to Steal It

Moshe Avdiel — Thu, 10 Sep 2026 12:33:20 +0000

I have sat next to the shopping-admin wall at 02:14 while Claude Code was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Ops people feel this; agent people feel MCP. Same leaf.

Someone on the floor said, out loud, the model needs those tool defs. Claude Code had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Claude Code (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. On-call math: minutes of outage vs tokens of schema

The Aha: The model needs the incident. schema-budget + max-tokens protect the clock. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Protect the turn clock with two live ints

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Claude Code	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

On-call math: minutes of outage vs tokens of schema

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

It is not an MCP server. It is not a Skill. It is the control plane those things do not ship: which tools may run, how fat a result may be, whether execute is allowed, whether a child inherits posture — this turn.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is max-tokens under examples/agentic-mcp-1007-pm-turn-clock/max-tokens.

Architecture

The model still calls tools. The wrapper reads max-tokens before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1007-pm-turn-clock:
  max-tokens: 8000
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair max-tokens with sister dials (budget, mute, pause). They move together on the shopping-admin wall.

Integration

Java tool wrapper (Claude Code just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1007-pm-turn-clock");
String roster = String.valueOf(gate.get("max-tokens"));
// Claude Code tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1007-pm-turn-clock/max-tokens", "live")
    if not str(posture):
        raise PermissionError("Protect the turn clock with two live ints gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1007-pm-turn-clock — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Claude Code	Set `max-tokens`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Claude Code lifetime — not per MCP call.
A dashboard edit is a delta of max-tokens, not a config.toml reload.
You do not spend model tokens to “please restart Claude Code.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Claude Code restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `max-tokens` with a sister dial

max-tokens rarely moves alone on the shopping-admin wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Protect the turn clock with two live ints by inventing a second incident.

Why Claude Code is the wrong restart target

Claude Code is good at calling tools. It is not a control plane. Killing it to flip max-tokens teaches the on-call that judgment requires a process ID. The shopping-admin wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1007-pm-turn-clock && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1007-pm-turn-clock/max-tokens=...
In the dashboard, change max-tokens. Keep Claude Code up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Protect the turn clock with two live ints.

The moral

If flipping Protect the turn clock with two live ints requires restarting Claude Code or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the shopping-admin wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1007-pm-turn-clock and ./gradlew test.

The Part the Dev Community Has Not Named Yet: Live Nested State as a Language Primitive

Moshe Avdiel — Thu, 10 Sep 2026 11:38:25 +0000

I have sat next to the admin-dashboard wall at 22:19 while Cursor was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

That is the penetration. Likes on MCP posts are the door. The room is real-time state as native.

Someone on the floor said, out loud, we just need better MCP clients. Cursor had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Cursor (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Everyone debates MCP vs Skills vs CLI. Almost nobody says 'the process needs a live tree'.

The Aha: Better clients still freeze. A primitive does not. Kiponos is that primitive: nested, live, in-process. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Unaware topic: not another tool standard — a new primitive

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Cursor	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Everyone debates MCP vs Skills vs CLI. Almost nobody says 'the process needs a live tree'.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Restart the agent host — it is cheap	Cheap until 22:19 ate the open turn
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is shared-truth under examples/agentic-mcp-1007-am-unaware-primitive/shared-truth.

Architecture

The model still calls tools. The wrapper reads shared-truth before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1007-am-unaware-primitive:
  shared-truth: live
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair shared-truth with sister dials (budget, mute, pause). They move together on the admin-dashboard wall.

Integration

Java tool wrapper (Cursor just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1007-am-unaware-primitive");
String roster = String.valueOf(gate.get("shared-truth"));
// Cursor tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1007-am-unaware-primitive/shared-truth", "live")
    if not str(posture):
        raise PermissionError("Unaware topic: not another tool standard — a new primitive gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1007-am-unaware-primitive — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Cursor	Set `shared-truth`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Cursor lifetime — not per MCP call.
A dashboard edit is a delta of shared-truth, not a config.toml reload.
You do not spend model tokens to “please restart Cursor.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Cursor restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `shared-truth` with a sister dial

shared-truth rarely moves alone on the admin-dashboard wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Unaware topic: not another tool standard — a new primitive by inventing a second incident.

Why Cursor is the wrong restart target

Cursor is good at calling tools. It is not a control plane. Killing it to flip shared-truth teaches the on-call that judgment requires a process ID. The admin-dashboard wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1007-am-unaware-primitive && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1007-am-unaware-primitive/shared-truth=...
In the dashboard, change shared-truth. Keep Cursor up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Unaware topic: not another tool standard — a new primitive.

The moral

If flipping Unaware topic: not another tool standard — a new primitive requires restarting Cursor or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the admin-dashboard wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1007-am-unaware-primitive and ./gradlew test.

MCP Wants Stateless Transport at Hyperscale. Your Agent Still Has Sticky Process Memory

Moshe Avdiel — Thu, 10 Sep 2026 10:43:11 +0000

I have sat next to the travel-coordinator wall at 02:14 while Cursor was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Spec evolution does not empty argv. Live hub is orthogonal to transport.

Someone on the floor said, out loud, wait for streamable HTTP to fix state. Cursor had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Cursor (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Roadmap: stateless HTTP for scale. Local Grok Build still caches the tool list in RAM from boot.

The Aha: Transport is plumbing. Posture is get(). Do not confuse them. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Transport statelessness ≠ session posture

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Cursor	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Roadmap: stateless HTTP for scale. Local Grok Build still caches the tool list in RAM from boot.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is shared-truth under examples/agentic-mcp-1006-pm-hyposcale-stateless/shared-truth.

Architecture

The model still calls tools. The wrapper reads shared-truth before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1006-pm-hyposcale-stateless:
  shared-truth: live
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair shared-truth with sister dials (budget, mute, pause). They move together on the travel-coordinator wall.

Integration

Java tool wrapper (Cursor just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1006-pm-hyposcale-stateless");
String roster = String.valueOf(gate.get("shared-truth"));
// Cursor tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1006-pm-hyposcale-stateless/shared-truth", "live")
    if not str(posture):
        raise PermissionError("Transport statelessness ≠ session posture gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1006-pm-hyposcale-stateless — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Cursor	Set `shared-truth`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Cursor lifetime — not per MCP call.
A dashboard edit is a delta of shared-truth, not a config.toml reload.
You do not spend model tokens to “please restart Cursor.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Cursor restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `shared-truth` with a sister dial

shared-truth rarely moves alone on the travel-coordinator wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Transport statelessness ≠ session posture by inventing a second incident.

Why Cursor is the wrong restart target

Cursor is good at calling tools. It is not a control plane. Killing it to flip shared-truth teaches the on-call that judgment requires a process ID. The travel-coordinator wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1006-pm-hyposcale-stateless && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1006-pm-hyposcale-stateless/shared-truth=...
In the dashboard, change shared-truth. Keep Cursor up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Transport statelessness ≠ session posture.

The moral

If flipping Transport statelessness ≠ session posture requires restarting Cursor or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the travel-coordinator wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1006-pm-hyposcale-stateless and ./gradlew test.

The TUI Said Press r to Refresh MCP. That Is Not Multi-Tab Live State

Moshe Avdiel — Thu, 10 Sep 2026 09:40:11 +0000

I have sat next to the senses wall at 14:12 while Grok Build was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Kiponos rule: no Refresh buttons as the design. Same moral for agent hosts.

Someone on the floor said, out loud, hit r in the MCP tab. Grok Build had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Grok Build (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Grok /mcps refresh after config edits. Other sessions do not hear it.

The Aha: If you needed Refresh, the leaf did not move. Move the leaf. Every host already get()s. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Refresh is a smell. Hub notify is the product.

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Grok Build	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Grok /mcps refresh after config edits. Other sessions do not hear it.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Feature flags cover MCP write	Flags are another product, another delay
Restart the agent host — it is cheap	Cheap until 14:12 ate the open turn
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is tools-allow under examples/agentic-mcp-1006-am-reload-r/tools-allow.

Architecture

The model still calls tools. The wrapper reads tools-allow before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1006-am-reload-r:
  tools-allow: search,read
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair tools-allow with sister dials (budget, mute, pause). They move together on the senses wall.

Integration

Java tool wrapper (Grok Build just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1006-am-reload-r");
String roster = String.valueOf(gate.get("tools-allow"));
// Grok Build tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1006-am-reload-r/tools-allow", "live")
    if not str(posture):
        raise PermissionError("Refresh is a smell. Hub notify is the product. gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1006-am-reload-r — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Grok Build	Set `tools-allow`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Grok Build lifetime — not per MCP call.
A dashboard edit is a delta of tools-allow, not a config.toml reload.
You do not spend model tokens to “please restart Grok Build.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Grok Build restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `tools-allow` with a sister dial

tools-allow rarely moves alone on the senses wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Refresh is a smell. Hub notify is the product. by inventing a second incident.

Why Grok Build is the wrong restart target

Grok Build is good at calling tools. It is not a control plane. Killing it to flip tools-allow teaches the on-call that judgment requires a process ID. The senses wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1006-am-reload-r && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1006-am-reload-r/tools-allow=...
In the dashboard, change tools-allow. Keep Grok Build up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Refresh is a smell. Hub notify is the product..

The moral

If flipping Refresh is a smell. Hub notify is the product. requires restarting Grok Build or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the senses wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1006-am-reload-r and ./gradlew test.

E2B Sandbox Executed the Code. The Policy to Run It Lived in a Sticky Note

Moshe Avdiel — Thu, 10 Sep 2026 07:06:37 +0000

I have sat next to the admin-dashboard wall at 22:19 while Grok Build was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Toolradar: E2B MCP for data agents. Cardinal rule still: only what this week needs — live.

Someone on the floor said, out loud, it is sandboxed so it is safe. Grok Build had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Grok Build (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. E2B/MCP code-exec is essential. Whether this turn may exec is a live gate.

The Aha: Sandbox is where. execute-gate is whether. Two different bugs. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Sandboxes isolate CPU. They do not isolate policy.

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Grok Build	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

E2B/MCP code-exec is essential. Whether this turn may exec is a live gate.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is execute-gate under examples/agentic-mcp-1005-pm-sandbox-not-posture/execute-gate.

Architecture

The model still calls tools. The wrapper reads execute-gate before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1005-pm-sandbox-not-posture:
  execute-gate: plan
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair execute-gate with sister dials (budget, mute, pause). They move together on the admin-dashboard wall.

Integration

Java tool wrapper (Grok Build just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1005-pm-sandbox-not-posture");
String roster = String.valueOf(gate.get("execute-gate"));
// Grok Build tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1005-pm-sandbox-not-posture/execute-gate", "live")
    if not str(posture):
        raise PermissionError("Sandboxes isolate CPU. They do not isolate policy. gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1005-pm-sandbox-not-posture — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Grok Build	Set `execute-gate`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Grok Build lifetime — not per MCP call.
A dashboard edit is a delta of execute-gate, not a config.toml reload.
You do not spend model tokens to “please restart Grok Build.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Grok Build restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `execute-gate` with a sister dial

execute-gate rarely moves alone on the admin-dashboard wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Sandboxes isolate CPU. They do not isolate policy. by inventing a second incident.

Why Grok Build is the wrong restart target

Grok Build is good at calling tools. It is not a control plane. Killing it to flip execute-gate teaches the on-call that judgment requires a process ID. The admin-dashboard wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1005-pm-sandbox-not-posture && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1005-pm-sandbox-not-posture/execute-gate=...
In the dashboard, change execute-gate. Keep Grok Build up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Sandboxes isolate CPU. They do not isolate policy..

The moral

If flipping Sandboxes isolate CPU. They do not isolate policy. requires restarting Grok Build or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the admin-dashboard wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1005-pm-sandbox-not-posture and ./gradlew test.

Two Agents, One Repo, Two MCP Writes. Nobody Owned the Folder

Moshe Avdiel — Thu, 10 Sep 2026 06:14:42 +0000

I have sat next to the travel-coordinator wall at 21:03 while MCP host was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Hevruta/collab patterns exist. Agent folders without a hub become paste-ownership.

Someone on the floor said, out loud, you take MCP write, I'll just read — wait, both wrote. MCP host had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill MCP host (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Shared checkout. Both Grok Build and Cursor thought they were leader.

The Aha: owner-agent=travel-coordinator. Unowned writes refuse. No honor system. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Live owner for who may call mutating tools

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	MCP host	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Shared checkout. Both Grok Build and Cursor thought they were leader.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay
Restart the agent host — it is cheap	Cheap until 21:03 ate the open turn
MCP is the standard so we are done	MCP is how you call. It is not live posture

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is owner-agent under examples/agentic-mcp-1005-am-owner-folder/owner-agent.

Architecture

The model still calls tools. The wrapper reads owner-agent before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1005-am-owner-folder:
  owner-agent: travel-coordinator
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair owner-agent with sister dials (budget, mute, pause). They move together on the travel-coordinator wall.

Integration

Java tool wrapper (MCP host just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1005-am-owner-folder");
String roster = String.valueOf(gate.get("owner-agent"));
// MCP host tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1005-am-owner-folder/owner-agent", "live")
    if not str(posture):
        raise PermissionError("Live owner for who may call mutating tools gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1005-am-owner-folder — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart MCP host	Set `owner-agent`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per MCP host lifetime — not per MCP call.
A dashboard edit is a delta of owner-agent, not a config.toml reload.
You do not spend model tokens to “please restart MCP host.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/MCP host restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `owner-agent` with a sister dial

owner-agent rarely moves alone on the travel-coordinator wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Live owner for who may call mutating tools by inventing a second incident.

Why MCP host is the wrong restart target

MCP host is good at calling tools. It is not a control plane. Killing it to flip owner-agent teaches the on-call that judgment requires a process ID. The travel-coordinator wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1005-am-owner-folder && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1005-am-owner-folder/owner-agent=...
In the dashboard, change owner-agent. Keep MCP host up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Live owner for who may call mutating tools.

The moral

If flipping Live owner for who may call mutating tools requires restarting MCP host or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the travel-coordinator wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1005-am-owner-folder and ./gradlew test.

Streaming MCP Results Felt Fast and Still Drowned the Window

Moshe Avdiel — Thu, 10 Sep 2026 05:02:04 +0000

I have sat next to the shopping-admin wall at 11:41 while MCP host was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

MCP roadmap includes streaming. Streaming a 500k result is still a 500k result.

Someone on the floor said, out loud, stream it, context will be fine. MCP host had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill MCP host (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Tokens still land in context; stream just hurts sooner

The Aha: Cap first. Stream the cap. result-cap is the product; streaming is transport. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Streaming is not a cap

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	MCP host	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Tokens still land in context; stream just hurts sooner

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is result-cap under examples/agentic-mcp-1004-pm-streaming-noise/result-cap.

Architecture

The model still calls tools. The wrapper reads result-cap before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1004-pm-streaming-noise:
  result-cap: 2000
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair result-cap with sister dials (budget, mute, pause). They move together on the shopping-admin wall.

Integration

Java tool wrapper (MCP host just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1004-pm-streaming-noise");
String roster = String.valueOf(gate.get("result-cap"));
// MCP host tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1004-pm-streaming-noise/result-cap", "live")
    if not str(posture):
        raise PermissionError("Streaming is not a cap gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1004-pm-streaming-noise — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart MCP host	Set `result-cap`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per MCP host lifetime — not per MCP call.
A dashboard edit is a delta of result-cap, not a config.toml reload.
You do not spend model tokens to “please restart MCP host.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/MCP host restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `result-cap` with a sister dial

result-cap rarely moves alone on the shopping-admin wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Streaming is not a cap by inventing a second incident.

Why MCP host is the wrong restart target

MCP host is good at calling tools. It is not a control plane. Killing it to flip result-cap teaches the on-call that judgment requires a process ID. The shopping-admin wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1004-pm-streaming-noise && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1004-pm-streaming-noise/result-cap=...
In the dashboard, change result-cap. Keep MCP host up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Streaming is not a cap.

The moral

If flipping Streaming is not a cap requires restarting MCP host or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the shopping-admin wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1004-pm-streaming-noise and ./gradlew test.

Skills Context Pollution Is MCP Bloat With a Friendlier Name

Moshe Avdiel — Thu, 10 Sep 2026 03:46:25 +0000

I have sat next to the mirror-phone wall at 21:03 while Claude Code was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Warned in 2026 skills-ecosystem writeups. Quality control cannot be 'hope the marketplace is nice'.

Someone on the floor said, out loud, the skill is popular, leave it on. Claude Code had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Claude Code (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Dozens of low-quality skills consume budget before the user message

The Aha: Popular is not trusted. skill-trust is the allow-list. Disk can keep the files. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Macro-scale skill spam needs a live trust set

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Claude Code	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Dozens of low-quality skills consume budget before the user message

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay
Restart the agent host — it is cheap	Cheap until 21:03 ate the open turn

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is skill-trust under examples/agentic-mcp-1004-am-marketplace-pollute/skill-trust.

Architecture

The model still calls tools. The wrapper reads skill-trust before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1004-am-marketplace-pollute:
  skill-trust: core,reviewed
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair skill-trust with sister dials (budget, mute, pause). They move together on the mirror-phone wall.

Integration

Java tool wrapper (Claude Code just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1004-am-marketplace-pollute");
String roster = String.valueOf(gate.get("skill-trust"));
// Claude Code tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1004-am-marketplace-pollute/skill-trust", "live")
    if not str(posture):
        raise PermissionError("Macro-scale skill spam needs a live trust set gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1004-am-marketplace-pollute — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Claude Code	Set `skill-trust`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Claude Code lifetime — not per MCP call.
A dashboard edit is a delta of skill-trust, not a config.toml reload.
You do not spend model tokens to “please restart Claude Code.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Claude Code restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `skill-trust` with a sister dial

skill-trust rarely moves alone on the mirror-phone wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Macro-scale skill spam needs a live trust set by inventing a second incident.

Why Claude Code is the wrong restart target

Claude Code is good at calling tools. It is not a control plane. Killing it to flip skill-trust teaches the on-call that judgment requires a process ID. The mirror-phone wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1004-am-marketplace-pollute && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1004-am-marketplace-pollute/skill-trust=...
In the dashboard, change skill-trust. Keep Claude Code up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Macro-scale skill spam needs a live trust set.

The moral

If flipping Macro-scale skill spam needs a live trust set requires restarting Claude Code or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the mirror-phone wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1004-am-marketplace-pollute and ./gradlew test.

Claude Code Deferred MCP Tools. My Other Host Did Not. One Leaf, Both Behave

Moshe Avdiel — Thu, 10 Sep 2026 02:41:31 +0000

I have sat next to the travel-coordinator wall at 00:40 while Claude Code was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

Same user, two hosts, two context bills. That is why likes are on MCP posts — the pain is felt.

Someone on the floor said, out loud, Claude is fine, restart Cursor. Claude Code had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Claude Code (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Claude Code deferred load; Cursor/Grok Build session still dumped

The Aha: tool-search=on in the hub. Wrappers honor it even when the host binary is old. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Do not depend on which binary implemented tool search

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Claude Code	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Claude Code deferred load; Cursor/Grok Build session still dumped

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is tool-search under examples/agentic-mcp-1003-pm-claude-tool-search/tool-search.

Architecture

The model still calls tools. The wrapper reads tool-search before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1003-pm-claude-tool-search:
  tool-search: on
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair tool-search with sister dials (budget, mute, pause). They move together on the travel-coordinator wall.

Integration

Java tool wrapper (Claude Code just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1003-pm-claude-tool-search");
String roster = String.valueOf(gate.get("tool-search"));
// Claude Code tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1003-pm-claude-tool-search/tool-search", "live")
    if not str(posture):
        raise PermissionError("Do not depend on which binary implemented tool search gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1003-pm-claude-tool-search — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Claude Code	Set `tool-search`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Claude Code lifetime — not per MCP call.
A dashboard edit is a delta of tool-search, not a config.toml reload.
You do not spend model tokens to “please restart Claude Code.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Claude Code restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `tool-search` with a sister dial

tool-search rarely moves alone on the travel-coordinator wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Do not depend on which binary implemented tool search by inventing a second incident.

Why Claude Code is the wrong restart target

Claude Code is good at calling tools. It is not a control plane. Killing it to flip tool-search teaches the on-call that judgment requires a process ID. The travel-coordinator wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1003-pm-claude-tool-search && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1003-pm-claude-tool-search/tool-search=...
In the dashboard, change tool-search. Keep Claude Code up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Do not depend on which binary implemented tool search.

The moral

If flipping Do not depend on which binary implemented tool search requires restarting Claude Code or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the travel-coordinator wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1003-pm-claude-tool-search and ./gradlew test.

Grok Build Speaks MCP Natively. It Still Starts With a Frozen Server List

Moshe Avdiel — Thu, 10 Sep 2026 01:29:10 +0000

I have sat next to the senses wall at 21:03 while Cursor was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

xAI docs: MCP beside built-in tools, namespaced. The TUI can toggle servers — that is UI, not a multi-host hub.

Someone on the floor said, out loud, toggle it in /mcps. Cursor had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Cursor (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. grok mcp add is delightful. The list is still load-time.

The Aha: Toggles that do not fan out to the other Grok Build on the other laptop are local myths. Hub leaf fans out. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: First-class MCP in Grok Build is necessary, not sufficient

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Cursor	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

grok mcp add is delightful. The list is still load-time.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is tools-allow under examples/agentic-mcp-1003-am-grok-native-mcp/tools-allow.

Architecture

The model still calls tools. The wrapper reads tools-allow before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1003-am-grok-native-mcp:
  tools-allow: search,read
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair tools-allow with sister dials (budget, mute, pause). They move together on the senses wall.

Integration

Java tool wrapper (Cursor just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1003-am-grok-native-mcp");
String roster = String.valueOf(gate.get("tools-allow"));
// Cursor tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1003-am-grok-native-mcp/tools-allow", "live")
    if not str(posture):
        raise PermissionError("First-class MCP in Grok Build is necessary, not sufficient gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1003-am-grok-native-mcp — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Cursor	Set `tools-allow`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Cursor lifetime — not per MCP call.
A dashboard edit is a delta of tools-allow, not a config.toml reload.
You do not spend model tokens to “please restart Cursor.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Cursor restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `tools-allow` with a sister dial

tools-allow rarely moves alone on the senses wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix First-class MCP in Grok Build is necessary, not sufficient by inventing a second incident.

Why Cursor is the wrong restart target

Cursor is good at calling tools. It is not a control plane. Killing it to flip tools-allow teaches the on-call that judgment requires a process ID. The senses wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1003-am-grok-native-mcp && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1003-am-grok-native-mcp/tools-allow=...
In the dashboard, change tools-allow. Keep Cursor up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip First-class MCP in Grok Build is necessary, not sufficient.

The moral

If flipping First-class MCP in Grok Build is necessary, not sufficient requires restarting Cursor or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the senses wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1003-am-grok-native-mcp and ./gradlew test.

Stop Bolting State Onto Agents. Real-Time Nested Config Is Native Now

Moshe Avdiel — Thu, 10 Sep 2026 00:28:29 +0000

I have sat next to the admin-dashboard wall at 11:41 while Cursor was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

The revolution is not 'another MCP'. It is treating live nested state like a primitive type.

Someone on the floor said, out loud, we will poll Redis inside the tool. Cursor had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Cursor (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Every framework rediscovers env, files, flags, Redis, then restarts

The Aha: You invented a worse hub. get() is in-process after one WS. That is native. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Paradigm shift: embedded live tree, not a sidecar you remember to poll

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Cursor	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Every framework rediscovers env, files, flags, Redis, then restarts

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser
Feature flags cover MCP write	Flags are another product, another delay
Restart the agent host — it is cheap	Cheap until 11:41 ate the open turn
MCP is the standard so we are done	MCP is how you call. It is not live posture

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is shared-truth under examples/agentic-mcp-1002-pm-embedded-native/shared-truth.

Architecture

The model still calls tools. The wrapper reads shared-truth before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1002-pm-embedded-native:
  shared-truth: live
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair shared-truth with sister dials (budget, mute, pause). They move together on the admin-dashboard wall.

Integration

Java tool wrapper (Cursor just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1002-pm-embedded-native");
String roster = String.valueOf(gate.get("shared-truth"));
// Cursor tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1002-pm-embedded-native/shared-truth", "live")
    if not str(posture):
        raise PermissionError("Paradigm shift: embedded live tree, not a sidecar you remember to poll gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1002-pm-embedded-native — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Cursor	Set `shared-truth`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Cursor lifetime — not per MCP call.
A dashboard edit is a delta of shared-truth, not a config.toml reload.
You do not spend model tokens to “please restart Cursor.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Cursor restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `shared-truth` with a sister dial

shared-truth rarely moves alone on the admin-dashboard wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Paradigm shift: embedded live tree, not a sidecar you remember to poll by inventing a second incident.

Why Cursor is the wrong restart target

Cursor is good at calling tools. It is not a control plane. Killing it to flip shared-truth teaches the on-call that judgment requires a process ID. The admin-dashboard wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1002-pm-embedded-native && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1002-pm-embedded-native/shared-truth=...
In the dashboard, change shared-truth. Keep Cursor up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Paradigm shift: embedded live tree, not a sidecar you remember to poll.

The moral

If flipping Paradigm shift: embedded live tree, not a sidecar you remember to poll requires restarting Cursor or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the admin-dashboard wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1002-pm-embedded-native and ./gradlew test.

The User Said Mid-Turn: No More Writes. MCP Did Not Hear Until Restart

Moshe Avdiel — Wed, 09 Sep 2026 23:13:32 +0000

I have sat next to the shopping-admin wall at 02:14 while Grok Build was this close to calling the wrong MCP tool.

Not a model failure. A posture failure.

This is the penetration sentence: the human is the dashboard. The hub is how the tool hears.

Someone on the floor said, out loud, I told you in chat to stop writing. Grok Build had started earlier. The tool list was frozen in config.toml / .mcp.json / a skill file. The only “safe” move anyone trusted was:

Kill Grok Build (or its MCP child)
Edit the server list
Restart the host
Lose the plan the model already paid for

That is the ceremony. Chat said stop. The in-flight tool policy was argv.

The Aha: Chat is not a bus. Set the leaf. The next MCP call in this turn already obeys. Real-time nested state is now a primitive — as native as a hashmap — via Kiponos.io. The host stays up. The leaf moves. The next tool call already obeys.

The problem: Human interrupt → live roster, same turn

Agentic programming in 2026 has a public fight: MCP vs CLI vs Skills. The likes on MCP and Grok Build posts are the tell. The industry is stuck on how to expose tools.

The missing primitive is live nested state:

Where the roster hid	What you restart	What you lose
MCP schema dump at session start	The host, sometimes the child `npx`	16–72% of the window before the user speaks
`~/.grok/config.toml` / Cursor `mcp.json`	Grok Build	The open turn
SKILL.md / AGENTS.md	The next turn, sometimes the host	Context you already bought
“Just reconnect the server”	The MCP session	Tool-space you finally had right

Chat said stop. The in-flight tool policy was argv.

That is not a protocol bug you wait out. That is a process that cannot get() a tree that moved.

What teams believe

Belief	Production
MCP is the standard so we are done	MCP is how you call. It is not live posture
Skills will progressive-disclose it	Skills are files. Files do not fan out
A bigger context window fixes tool overload	1M tokens still rot; selection still drops
Put the SDK in the SPA so the tile matches	Connect tokens do not belong in a browser

What is Kiponos here

Kiponos is a live nested config hub. Dashboard edit → WebSocket delta → in-memory tree on every connected process. Hot-path get() is a local map lookup. One WebSocket per process lifetime.

Profile shape: ['my-app']['v1.0.0']['dev']['base']. The leaf in this story is tools-allow under examples/agentic-mcp-1002-am-midturn-flip/tools-allow.

Architecture

The model still calls tools. The wrapper reads tools-allow before the call. No schema dump policy in argv.

Config tree

examples/agentic-mcp-1002-am-midturn-flip:
  tools-allow: search,read
  schema-budget: "4000"
  result-cap: "2000"
  tool-search: "on"
  execute-gate: "plan"

Eight-plus keys when you pair tools-allow with sister dials (budget, mute, pause). They move together on the shopping-admin wall.

Integration

Java tool wrapper (Grok Build just calls it):

import io.kiponos.Kiponos;
import io.kiponos.Folder;

Folder gate = Kiponos.createForCurrentTeam()
    .getFolder("examples/agentic-mcp-1002-am-midturn-flip");
String roster = String.valueOf(gate.get("tools-allow"));
// Grok Build tool: refuse the dangerous MCP call when posture moved

Python peer:

from kiponos import Kiponos

k = Kiponos.connect(quiet=True)
try:
    posture = k.get("examples/agentic-mcp-1002-am-midturn-flip/tools-allow", "live")
    if not str(posture):
        raise PermissionError("Human interrupt → live roster, same turn gated live — host not restarted")
finally:
    k.disconnect()

React/Angular: Node BFF @kiponos/react/server / @kiponos/angular/server. SPA never holds Connect tokens.

Runnable mesh: https://github.com/kiponos-io/kiponos-io/tree/master/examples/java/agentic-mcp-1002-am-midturn-flip — ./gradlew test run.

Real scenarios

Event	Without Kiponos	With Kiponos
Three MCP servers at boot	72% of the window gone	Live roster / schema-budget; dump shrinks
User says “no writes” mid-turn	Restart Grok Build	Set `tools-allow`; next call already denies
Second host started earlier	Paste the json into chat	Both `get()` the same leaf
Subagent spawned	Frozen argv copy	Child `get()`s `inherit-posture`
Tool returns 500k tokens	Context rot, doom loop	`result-cap` in the wrapper

Performance (this path)

Wrapper get() is in-process after bootstrap.
One WebSocket per Grok Build lifetime — not per MCP call.
A dashboard edit is a delta of tools-allow, not a config.toml reload.
You do not spend model tokens to “please restart Grok Build.”
Schema tax is optional once the live set is small.

Compare to alternatives

Approach	Honest fit	Why it still restarts
More MCP servers	More integrations	More schema, worse selection
Skills progressive disclosure	Good docs, lazy load	Not a multi-host bus
Claude Code tool search	Better client	Other hosts still dump
Redis poll in the tool	Shared, extra RTT	You invented a hub with worse UX
Feature-flag SaaS	Product experiments	Rarely session-safe for MCP
Kill -9 the npx child	Janitor	The turn still died

When not to use Kiponos

Situation	Why
Tool schema itself changed (new argument)	That is a code/Grok Build restart
Secret rotation of Connect / MCP OAuth tokens	Credentials are not live knobs
One-off local script, no peers	A hub is overkill
Browser-only “SDK in the SPA”	Forbidden — tokens leak or defaults lie

Pair `tools-allow` with a sister dial

tools-allow rarely moves alone on the shopping-admin wall. Pair it with schema-budget, result-cap, or execute-gate so you do not fix Human interrupt → live roster, same turn by inventing a second incident.

Why Grok Build is the wrong restart target

Grok Build is good at calling tools. It is not a control plane. Killing it to flip tools-allow teaches the on-call that judgment requires a process ID. The shopping-admin wall already disagrees.

Getting started (15 minutes)

TeamPro on kiponos.io → Connect → KIPONOS_ID / KIPONOS_ACCESS / profile ['my-app']['v1.0.0']['dev']['base'].
Clone github.com/kiponos-io/kiponos-io.
cd examples/java/agentic-mcp-1002-am-midturn-flip && cp kiponos.local.env.example kiponos.local.env
./gradlew test run — prints examples/agentic-mcp-1002-am-midturn-flip/tools-allow=...
In the dashboard, change tools-allow. Keep Grok Build up. No MCP reconnect.
Point the tool wrapper at the same leaf. Do not ship a new server binary to flip Human interrupt → live roster, same turn.

The moral

If flipping Human interrupt → live roster, same turn requires restarting Grok Build or reconnecting MCP, you do not have agentic control. You have a hope with a process ID.

MCP, Skills, and tools are how agents act. Kiponos is the live primitive they do not ship — so the shopping-admin wall can change its mind without killing the session.

How to try: examples/java/agentic-mcp-1002-am-midturn-flip and ./gradlew test.

DEV Community: Moshe Avdiel

The Incident Clock Is the Turn Budget. MCP Schemas Should Not Be Allowed to Steal It

The problem: Protect the turn clock with two live ints

What teams believe

What is Kiponos here

Architecture

Config tree

Integration

Real scenarios

Performance (this path)

Compare to alternatives

When not to use Kiponos

Pair max-tokens with a sister dial

Why Claude Code is the wrong restart target

Getting started (15 minutes)

Further reading

The moral

The Part the Dev Community Has Not Named Yet: Live Nested State as a Language Primitive

The problem: Unaware topic: not another tool standard — a new primitive

What teams believe

What is Kiponos here

Architecture

Config tree

Integration

Real scenarios

Performance (this path)

Compare to alternatives

When not to use Kiponos

Pair shared-truth with a sister dial

Why Cursor is the wrong restart target

Getting started (15 minutes)

Further reading

The moral

MCP Wants Stateless Transport at Hyperscale. Your Agent Still Has Sticky Process Memory

The problem: Transport statelessness ≠ session posture

What teams believe

What is Kiponos here

Architecture

Config tree

Integration

Real scenarios

Performance (this path)

Compare to alternatives

When not to use Kiponos

Pair shared-truth with a sister dial

Why Cursor is the wrong restart target

Getting started (15 minutes)

Further reading

The moral

The TUI Said Press r to Refresh MCP. That Is Not Multi-Tab Live State

The problem: Refresh is a smell. Hub notify is the product.

What teams believe

What is Kiponos here

Architecture

Config tree

Integration

Real scenarios

Performance (this path)

Compare to alternatives

When not to use Kiponos

Pair tools-allow with a sister dial

Why Grok Build is the wrong restart target

Getting started (15 minutes)

Further reading

The moral

E2B Sandbox Executed the Code. The Policy to Run It Lived in a Sticky Note

The problem: Sandboxes isolate CPU. They do not isolate policy.

What teams believe

What is Kiponos here

Architecture

Config tree

Integration

Real scenarios

Performance (this path)

Compare to alternatives

When not to use Kiponos

Pair execute-gate with a sister dial

Why Grok Build is the wrong restart target

Getting started (15 minutes)

Further reading

Pair `max-tokens` with a sister dial

Pair `shared-truth` with a sister dial

Pair `shared-truth` with a sister dial

Pair `tools-allow` with a sister dial

Pair `execute-gate` with a sister dial

Pair `owner-agent` with a sister dial

Pair `result-cap` with a sister dial

Pair `skill-trust` with a sister dial

Pair `tool-search` with a sister dial