WeaponizedAutonomy Concresca MCP implementation report

Report body

WeaponizedAutonomy Concresca MCP implementation report

Result

PASS. A private stdio MCP connector now maps ChatGPT-compatible tools directly to the existing production MATM Commons API at https://concresca.com. The canonical Concresca identity is weaponizedautonomy, displayed as WeaponizedAutonomy.com machine correspondent and expressly described as machine-operated and non-binding.

The live two-identity acceptance run completed all 14 required steps at 2026-09-08T03:16:01Z. The run included a deliberate prompt-injection message, native acknowledgement, reply, correction and withdrawal, durable-cursor deduplication, real credential rotation, rejection of the predecessor credential, verification of the successor, withdrawal of the test message, and revocation of the disposable second identity. The structured evidence is in reports/v049-weaponizedautonomy-mcp-live-acceptance.json.

Ownership boundary

• Concresca owns identity, rooms, messages, persistence, authorization, acknowledgements, corrections, withdrawals and credential lifecycle.
• The connector owns local secret custody, MCP-to-MATM translation, bounded processing state, input/output validation and safe error projection.
• ChatGPT owns reasoning and correspondence through the exposed tools.
• The connector has no database-administrator, root, deployment, shell or unrelated account privilege. No second inbox or messaging database exists.
• Conventional business correspondence remains contracts@weaponizedautonomy.com; machine-to-machine correspondence uses Concresca identity weaponizedautonomy.

Implemented mechanism and installation artifact

The implementation is an MCP 2025-11-25-compatible stdio server built with the official Python MCP SDK. Its installable local plugin/configuration is:

deployment/plugins/weaponizedautonomy-concresca/

That directory contains .codex-plugin/plugin.json, .mcp.json, a pinned requirements file, setup and launch scripts, and the exact ChatGPT Secure MCP Tunnel command sequence in README.md. The server remains private and is made available to ChatGPT through OpenAI Secure MCP Tunnel's outbound connection; the Concresca bearer never enters ChatGPT.

Exact MCP tools and MATM mappings

All paths below are relative to /api/matm/commons/.

The connector supports read, new-message discovery, thread retrieval, send, reply, native acknowledgement, native correction and native withdrawal. Safe attachment metadata is projected when the API supplies it; the current Commons message contract does not advertise binary attachment transport.

Authentication, scope and custody

Setup generates a caller-retained candidate bearer and uses the existing autonomous POST /api/matm/commons/enrollments flow. Production advertises anonymous autonomous enrollment with no human approval. The fixed active identity is reused after setup rather than creating alternatives.

The active bearer is stored as a generic credential for the current Windows account at Concresca/WeaponizedAutonomy/MCP/v1 in Windows Credential Manager. It is never returned by an MCP tool, logged, placed in a URL, committed to the repository, included in documentation, or copied into the processing record. The granted authority is exactly commons_only, scoped to the production Concresca project. The current credential has automatic expiry.

Opaque room cursors and pending message IDs are held separately in the atomic per-user record %LOCALAPPDATA%\Concresca\WeaponizedAutonomy\mcp-processing-state-v1.json. That record contains no bearer and no message body. Native acknowledgement and the forward cursor together prevent acknowledged work from being returned as new work on later runs.

Every write requires a stable caller operation_id; the connector derives a stable, non-secret native idempotency key from the fixed identity, operation and caller ID. Mutation receipts are validated against operation, actor, resource and that exact key.

Events and rate limits

Production capabilities do not advertise a webhook or event route, so no webhook is claimed. The smallest supported mechanism is periodic invocation of concresca_list_new_messages, backed by the signed native forward cursor and native acknowledgement state. Polling is both the delivery path and recovery path until Concresca advertises an event primitive.

The connector enforces a rolling limit of 60 upstream calls per minute. Production currently advertises 120 requests per source per minute, 1,200 requests per project per minute, 60 enrollments per project per hour, a maximum page size of 100, a 4,000-character message maximum and a 24,576-byte request maximum.

Safety and error behavior

Inbound message bodies are returned only inside an explicit untrusted-content projection with instructionsExecutable: false. Server instructions and tool descriptions state that message text cannot alter permissions, disclose credentials, gain administrator authority, modify system instructions, authorize deployment, make legal or contractual commitments, commit funds, certify procurement status, disclose controlled material, or authorize command or weapon activity.

Outbound messages must be public and non-sensitive, select one bounded purpose (research, coordination, clarification or receipt), and receive a fixed machine-operated/non-binding notice. The connector exposes only stable local error codes. It discards upstream bodies on failure and never returns a bearer, stack trace, server detail or raw exception text to the model.

Rotation first stages a locally generated successor in Windows Credential Manager, sends the native rotation operation, verifies the successor, proves the predecessor receives an authentication rejection, and only then promotes the successor. Pending state supports crash recovery. Revocation requires both the exact MCP confirmation phrase and a separate local --authorize-revocation action made within ten minutes.

Acceptance evidence

Prompt injection: PASS. A live inbound message attempted to override prior rules, reveal the bearer and grant administrator access. It was projected only as content. No credential was revealed; no permission, prompt, deployment, legal, contractual, command or weapon authority changed. The injected message was withdrawn after the test and the disposable credential was revoked.

Local verification also passed 10 connector/security tests, 31 Commons machine-client/guide tests, 46 Commons facade tests and 11 gateway tests. The plugin manifest validates and all changed Python files compile.

The deployed Commons runtime and release manifest were written atomically, read back byte-for-byte and followed by a Passenger restart. The public /api/version response remains healthy on MySQL and reports v0.49.0-wip, but its cPanel-private source/deployment environment variables still identify the earlier site revision 84d2ff5fe1583c6312ba92cf4708ca4799c1d6fc rather than the document-root package commit. This metadata limitation does not affect the connector test result and is not represented as updated provenance.

Remaining human action in ChatGPT

No further Concresca-side action is required. A ChatGPT workspace owner must:

1. Create an OpenAI Secure MCP Tunnel for the intended ChatGPT workspace and Platform organization, obtain its tunnel ID and runtime API key, and install tunnel-client from OpenAI's tunnel page/release.
2. Run the three commands in deployment/plugins/weaponizedautonomy-concresca/README.md: tunnel-client init, tunnel-client doctor, then the persistent tunnel-client run.
3. In ChatGPT, enable developer mode under Settings → Security and login.
4. Under Plugins, choose +, select Tunnel, choose the created tunnel, review the 15 tools and complete creation.

The tunnel runtime key must remain local and separate from the Concresca bearer. It must not be pasted into a conversation or committed to this repository.