Simon Stirling.Download CVContact
All projects
05 / INDEPENDENT ENGINEERING DEMONSTRATORPublic without sign-in
MCP & controlled tool authority

Workflow LabGive tools access. Keep authority explicit.

Investigate synthetic orders through real MCP tools, inspect the proposed follow-up and approve one bounded, replay-safe task write.

Open live demoView repository
Workflow Lab showing investigation and approval controls for a synthetic operational task.
The public application with synthetic example data.
01 / FUNCTION & ABILITIES

Give tools access. Keep authority explicit.

01

Use genuine MCP tools

Discover strict schemas, look up an order, read untrusted error history and draft a deterministic follow-up over real MCP HTTP calls.

02

Inspect the exact proposal

Review the task body, fixed queue, source order version, actor, resource, payload digest and ten-minute approval window.

03

Enforce the write boundary

Separate capabilities govern reading, execution, proposal requests and review. The server rejects pending, rejected, stale, tampered and unscoped writes.

04

Verify what happened

Run five live denial probes, inspect captured protocol bodies and verify a hash-linked audit and six-file evidence export.

02 / PLANNED BOUNDARIES, VISIBLE FLOW

From the whiteboard
to a working application.

Play a scenario, step through the decisions or select a component to inspect its responsibility. The diagrams follow the implemented design.

THE ARCHITECTURE BOARD05 / Workflow Lab
Illustrated flow
MCP integration & controlled workflow demo: architecture and data flowThis is a fixed investigator plan using real MCP. The lower lane shows a separate demo review capability, not a second verified person. Animation illustrates the design, not live server telemetry. Select a component or use the readable step list below.READ FIRST / RETRIEVED CONTENT IS DATASEPARATE REVIEW CAPABILITY / BOUNDED EXECUTIONreal MCP callsread-only toolsknown referencesproposal only / no write authorityreview keydecisioncreate_followup + approval ID + digestbinding checksThe official SDK client follows a deterministic read/read/draft plan. It does not run an autonomous language model.Guided investigatorFixed tool planStreamable HTTP negotiates modern MCP and exposes four strict tools. MCP cannot issue capabilities or approve proposals.MCP SDK endpointAudience + scope checksRead-only tools return order records and external-looking error messages. Injection text is preserved as data without instruction authority.Synthetic evidenceOrders + untrusted errorsAn allowlisted template produces a fixed-queue proposal. It does not create a task or grant permission.Bounded task draftPayload + SHA-256One visitor owns separate controller and reviewer capabilities. A reasoned decision is explicit, but separate human identity is not claimed.Demo review UIRequest / reviewer switchThe control plane revalidates the proposal and requires approval:decide for an explicit reviewer decision.Separate review APIRequest or decide scopeApproval stores the exact payload hash, workspace, actor, MCP resource, source order version, status and expiry.Immutable approvalBindings + ten-minute expiryThe sole operational write rechecks all bindings and atomically consumes approval, creates one task and appends its audit. Replay returns that task.Task policy + SQLTask / consume / auditfollow the evidence, then the decision
Step 1 / 8 · click any component
FOLLOW THE FLOW

Connect with read scope

The SDK negotiates MCP and uses the reader capability for investigation.

Read all 8 steps without animation

A proposed action acquires authority only through a separate explicit decision.

This is a fixed investigator plan using real MCP. The lower lane shows a separate demo review capability, not a second verified person. Animation illustrates the design, not live server telemetry. Arrows and moving dots are an explanation of the implementation, not live telemetry.
03 / A FIVE-MINUTE WALKTHROUGH

Try it for yourself.

Keep the live demo open
  1. 01

    Investigate ORD-2048

    Run Investigate order. Inspect the source errors, exact task payload and real request/response bodies in the MCP wire inspector.

  2. 02

    Send the proposal for review

    Select Send for approval. Try Execute MCP call while pending and observe the server denial. A Controller approval attempt also fails.

  3. 03

    Approve the bounded action

    Switch the demo review capability to Reviewer, enter a reason and select Approve exact task. Approval itself does not execute the write.

  4. 04

    Execute and replay

    Execute the MCP call to create the synthetic internal task. Replay the same call and confirm that it returns the existing task.

  5. 05

    Challenge the boundaries

    Run Security checks, then investigate ORD-2057's untrusted injection fixture. Download the evidence ZIP and verify its evidence.json through the file chooser.

04 / ENGINEERING JUDGEMENT

Why it works this way.

Separate data from authority

Partner error text is displayed as untrusted evidence. A fixed template uses allowlisted identifiers and codes; retrieved text cannot grant permissions.

Bind approval to the exact action

The immutable proposal binds payload hash, workspace, actor, resource, source version and expiry. Execution revalidates every binding.

Commit once, replay safely

One optimistic SQL update consumes the approval, creates the task, advances the order version and appends its audit. Replay reads the existing task.

05 / INSPECT THE EVIDENCE

Tested behaviour.
Explicit limits.

  • 40 unit tests and 34 HTTP scenarios per local/public target exercise audience, scope, malformed input, rejection, tampering, staleness and concurrent execution.

  • 20 local and 14 public browser checks include actual download, independent extraction, evidence re-import and mobile layout.

  • Local restart and public redeployment checks retain the original capability, task, proposals and complete audit state.

Read the recorded validation