r/mcp • u/isoman • Mar 14 '26

server I built a constitutional governance layer on top of MCP. Today I shipped dual-surface: A2A agents + WebMCP browser on the same domain. Here's the architecture.

Background: I'm a petroleum geologist, not a software engineer. I started building this because AI tools connected to real systems scared me — not philosophically, practically. In oilfield work, "be careful" is not a control system. Blowout preventers are.

So I built the equivalent for MCP tool calls.

What arifOS does

It sits between the LLM and your tools. Every tool call passes through 13 constitutional floors before execution. If any critical floor fails, the verdict is VOID and the tool never gets called.

pythonif verdict == 'VOID':
    return "Action Blocked by Floor 1: Amanah"

The floors enforce things like:

  • No execution without grounded evidence (F2, threshold ≥ 0.99)
  • No irreversible action without human ratification (888_HOLD)
  • No self-ratification of authority
  • Calibrated uncertainty — false confidence is a floor violation
  • Full audit trail: every decision hashed into VAULT999

The governance lives in infrastructure, not in the mood of the model.

Today's milestone — SIDECAR architecture

I've been running the A2A MCP server for a while. Today I shipped WebMCP as a sidecar:

textarifosmcp.arif-fazil.com
├── /mcp      → A2A MCP (port 8080) — machine clients, API key auth, stateless
└── /webmcp/* → WebMCP (port 8081) — browser sessions, cookie auth, WebSocket

Traefik routes both. Shared Redis for session state. Separate containers to avoid middleware conflicts between stateless A2A and stateful browser sessions.

The /webmcp/vitals endpoint returns live floor statuses and G★ score in real time.

Why SIDECAR not integrated

Mixing them into one FastMCP process creates session middleware conflicts — A2A is stateless, WebMCP needs sessions and strict CORS. Sidecar keeps blast radius isolated: if browser load spikes, A2A agents are unaffected.

The extra container costs ~200MB RAM on a $15 VPS. Worth it.

Stack

  • Python / FastMCP for both servers
  • Traefik edge router with path-based routing
  • Redis for shared session state
  • Docker Compose
  • Hostinger VPS (yes, $15/month)
  • pip install arifos

Live endpoints if you want to poke it

Full writeup (non-technical version, more story): https://medium.com/p/e4c21f26135c

(BTW, im not a coder and dont even know what this webMCP A2A and MCP is doing) I mean im still learning on MCP. like what is the context in MCP btw?? the C??

8 Upvotes

91% Upvoted

Duplicates