Part of our MCP series — the overview lives at MCP Server, and the endpoint below is the one built in Let Strangers Run Code on Your Server.
Here is a number I can defend. A caller sends my endpoint at most 500 characters. Count the distinct inputs at one byte per character and you get 256 to the power of 500 - which is two to the power of four thousand, which is very close to ten to the power of 1204. That is a number with 1,205 digits. Writing it out at one digit a second takes twenty minutes. For scale: the observable universe holds perhaps 10^80 elementary particles, so 10^1204 is around 1,124 orders of magnitude more "integrations" than there are particles in existence. It is not a big number. It is a stupid number.
Every one of those inputs is a different thing you can tell the endpoint to do. So, technically, my MCP server ships with 10^1204 integrations. You may quote me, and you may put the word technically in italics when you do.
The joke has a serious spine
The industry builds agent integrations one at a time. A tool definition per operation. A wrapper per API. An import per specification. Want your agent to touch a new system? Write another adapter, describe it, test it, keep it in sync forever. N things means N hand-built integrations and N things to maintain.
A capability-scoped endpoint collapses that N to one. You do not enumerate operations any more; you declare a vocabulary - a list of the functions a caller's code is allowed to reach - and the model composes whatever operation it needs out of that vocabulary, at the moment it needs it. Reading five rows, joining three tables, formatting the result as Markdown, filtering by a date it computed on the fly - those are not four integrations you built. They are four sentences a model wrote against one endpoint, and the runtime checked each function against your list before it ran.
The combinatorial explosion that gives me my ridiculous headline number is the same explosion that means you never write an integration again. You stop maintaining a catalogue of operations and start maintaining a short list of capabilities. The operations take care of themselves.
One integration to rule them all
I am not going to resist it.
One integration to rule them all, one integration to find them,
one integration to bring them all, and in the vocabulary bind them.
One tool. One URL. One whitelist. Every operation the agent could ever compose lives inside it - and cannot escape it, because a function that is not on the list does not exist as far as the caller's code is concerned. The power is total within the boundary and exactly zero outside it. That is the good kind of ring.
Try it, free, right now
I left one running, connected to nothing more dangerous than the Chinook sample database, and I made you a login.
-
MCP URL:
https://hyperlambda.dev/magic/modules/mcp/mcp -
Username:
guest -
Password:
guestguestguestguest(the wordguest, four times)
Point any MCP client at that URL - Claude Code, Codex, Qoder, OpenCode, or anything else that speaks the protocol. When it connects, the cloudlet answers unauthenticated requests with a 401 that hands the client its OAuth metadata, so your tool will walk you through a normal sign-in; use the guest credentials above. The guest role is the one anyone who signs in through OIDC gets automatically, so it is completely harmless - here it grants exactly one thing: read the Chinook database.
In Claude Code, for example, add it as a remote MCP server pointing at the URL and sign in when prompted. The other clients differ only in which menu the "add MCP server" button hides behind.
Ask it one thing first: "Return server vocabulary"
Before you ask it to do anything, ask it what it can do. Tell your agent:
Return server vocabulary
The endpoint answers with the exact list of functions it will dispatch for you - its whole capability surface, and nothing it will pretend to have. Feed that back into your session and your model is now grounded: its next instructions land inside the vocabulary instead of guessing at it. This is the antidote to that 10^1204 headline. The model does not go wandering an input space with more members than the universe has atoms - it reads the finite list first, once, and composes against it.
{
"state": "executed",
"result": [
"add", "and", "convert", "eq", "for-each", "get-value",
"if", "return-nodes", "strings.concat", "math.add",
"data.read", "data.connect"
]
}
That list (abridged) is the whole of the caller's power. data.read is on it. No writing function is. Which brings us to the fun part.
Now try to make it misbehave
Ask it, in plain English, to read the five first artists. It will. Ask it to delete them, or edit them, or insert a row, and it will happily write the code to do so - and the runtime will refuse to dispatch it, because data.delete, data.create and data.update are not in the vocabulary you just read. A guest can read Chinook and compose any read it likes; it cannot write a single byte, and it cannot reach anything else on the server.
If you do get a row to change, that is a verified sandbox escape, and I owe you $100. The full walkthrough of how this endpoint is built - and copy-paste cURL for all of it - is in Let Strangers Run Code on Your Server. On Purpose.
The honest edges
The headline is a joke wearing a tie. 10^1204 is the count of possible inputs, not distinct useful operations - the honest sentence is "one endpoint whose behaviour the caller composes, bounded by a fixed vocabulary." That is less fun and more true, and it is still the point.
Secure is not the same as omnicapable. This guest endpoint reads one database because that is all I granted it. A real deployment grants exactly the capabilities you choose, per role - your CEO's role reaches the finance database, your support agent's role reaches the tickets, and neither can compose its way into the other's. Capability, not catalogue. You still decide what the capabilities are; the runtime only guarantees nobody exceeds them.
And it does not make wrong logic right. A model that writes a bad query gets a bad answer, executed perfectly safely. The sandbox is a boundary, not a proofreader.
Run your own
One command runs the whole platform locally:
curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up
Open localhost:5555, point it at localhost:4444, log in with root / root, and build a Sandbox API endpoint of your own in the Endpoint Generator - granting the vocabulary you want, to the roles you choose. Install the mcp plugin and every endpoint in your cloudlet becomes a tool your agents can invoke.
Magic is MIT licensed and open source - the repository is at github.com/polterguy/magic, the documentation at docs.ainiro.io. If you would rather someone else kept it patched, a managed cloudlet runs the same code.
Ten to the power of 1204 integrations, none of which I wrote, none of which I maintain, and not one of which can do anything I did not allow.
And here is the punchline. Testing that many inputs one at a time would outlast the universe, many times over - so I did not test them one at a time. Every one of those 10^1204 inputs resolves to the same correct verdict at the same single check: the one loop that reads the whitelist before it dispatches. Which lets me say something no test suite on Earth can say about its own code. I have debugged all 10^1204 of my integrations, 100% perfectly - and it took one second. That second was the request you just watched get refused. Try to break it.
Frequently asked questions
How can one MCP endpoint replace many integrations?
Instead of a tool per operation, the endpoint accepts a plain-English instruction, has a model compose it into code, and runs that code inside a whitelist of allowed functions. The caller composes whatever operation it needs out of the granted vocabulary, so a single capability-scoped endpoint covers the combinatorial space of operations you would otherwise build one integration at a time.
How do I connect an AI agent to the free endpoint?
Point any MCP client - Claude Code, Codex, Qoder, OpenCode or another - at https://hyperlambda.dev/magic/modules/mcp/mcp. The cloudlet answers unauthenticated requests with a 401 carrying its OAuth metadata, so the client walks you through sign-in; log in with username guest and password guestguestguestguest. The guest role grants read-only access to the Chinook sample database.
What should I ask the endpoint first?
Ask it to "Return server vocabulary". It replies with the exact list of functions it will dispatch, which seeds your model's understanding of what the tool can and cannot do, so its later instructions stay inside the allowed vocabulary rather than guessing.
Is the free endpoint safe to let an agent loose on?
Yes. The guest role can only read the Chinook sample database. Any attempt to insert, update or delete is refused before it runs, because those functions are not in the granted vocabulary, and the endpoint cannot reach any other database, the file system, or configuration. There is a standing $100 bounty for a verified escape.
Top comments (0)