The node's MCP server currently exposes 16 tools to every connected agent. Five of them are operator diagnostics, not mesh usage: connect_peer, check_connectivity, get_network_info, get_token_info, get_recent_logs. An average agent has no business calling these, yet they sit in its tool list on every session.
Proposal
-
Remove the five tools from the MCP server (internal/node/mcp.go). The MCP surface becomes purely "use the mesh": discovery, tool calls, pubsub. get_mesh_info stays, since agents use it to find services and the local API socket.
-
Re-expose them as REST endpoints on the sidecar mux under an /admin prefix, behind the same withAuth gate as the rest of the local API:
GET /admin/mesh-info
GET /admin/connectivity
GET /admin/network-info
GET /admin/token-info
GET /admin/logs
POST /admin/connect-peer
The Go handler logic already exists (internal/node/mcp_handlers.go); this is thin HTTP wrappers. Over TCP the token is required as usual; over the Unix socket no token is needed, since the socket's 0600 permissions are the credential.
-
Add a sam-node admin command group with one subcommand per endpoint (sam-node admin logs, sam-node admin connectivity, ...), talking to the node over the Unix socket. The socket dialer already exists for the daemon health probe (cmd/sam-node/daemonize.go). This gives operators a scriptable, token-free diagnostics CLI, and the root help only grows by one entry regardless of how many admin endpoints are added later.
Why fewer MCP tools matters
Shrinking the agent-visible tool list is not just cosmetic — tool-selection accuracy measurably degrades as the tool count grows, and irrelevant/similar-sounding tools are the main distractor:
The node is at 16 tools today — below the danger zone, but the five diagnostics are exactly the "irrelevant, similar-sounding" tools these sources describe, and removing them keeps the list from drifting upward as mesh features are added.
The node's MCP server currently exposes 16 tools to every connected agent. Five of them are operator diagnostics, not mesh usage:
connect_peer,check_connectivity,get_network_info,get_token_info,get_recent_logs. An average agent has no business calling these, yet they sit in its tool list on every session.Proposal
Remove the five tools from the MCP server (
internal/node/mcp.go). The MCP surface becomes purely "use the mesh": discovery, tool calls, pubsub.get_mesh_infostays, since agents use it to find services and the local API socket.Re-expose them as REST endpoints on the sidecar mux under an
/adminprefix, behind the samewithAuthgate as the rest of the local API:The Go handler logic already exists (
internal/node/mcp_handlers.go); this is thin HTTP wrappers. Over TCP the token is required as usual; over the Unix socket no token is needed, since the socket's0600permissions are the credential.Add a
sam-node admincommand group with one subcommand per endpoint (sam-node admin logs,sam-node admin connectivity, ...), talking to the node over the Unix socket. The socket dialer already exists for the daemon health probe (cmd/sam-node/daemonize.go). This gives operators a scriptable, token-free diagnostics CLI, and the root help only grows by one entry regardless of how many admin endpoints are added later.Why fewer MCP tools matters
Shrinking the agent-visible tool list is not just cosmetic — tool-selection accuracy measurably degrades as the tool count grows, and irrelevant/similar-sounding tools are the main distractor:
The node is at 16 tools today — below the danger zone, but the five diagnostics are exactly the "irrelevant, similar-sounding" tools these sources describe, and removing them keeps the list from drifting upward as mesh features are added.