By default this is a thin control-plane bridge and nothing more. Point `ENOCH_WORKER_PROBES_JSON` or `ENOCH_WORKER_PROBES_FILE` at a lane map and it also reaches CPU and GPU workers directly — worker-gate URLs first, SSH only as a fallback, and only for fixed diagnostic commands with bounded output. User-supplied run and project ids are restricted to safe identifier characters, and the recommended deployment is a read-only worker user or a forced-command policy.
A local stdio bridge to a running Enoch FastAPI control plane. It registers tools for the control-plane, Dashboard V1 and core endpoints, attaches your bearer token to each request, and returns the API's own responses.
- Typed tools over the Enoch API, with read-only tools carrying MCP read-only annotations and mutating tools flagged as such with approval metadata
- Safe defaults for dry-run operations
- Optional worker diagnostics: API health, worker-gate dashboard status, active process markers, bounded log tails, disk space, and whether expected artifacts are present
- A deliberately narrow surface — no raw shell tool, no arbitrary SSH commands, no direct reads or writes of local artifact files, and no path around Enoch's own authentication
A running Enoch API — the default is `http://localhost:8787` — and a bearer token for it. The PyPI package enoch-mcp, version 0.1.3, runs as `uvx enoch-mcp`, taking `--api-url` and `--api-token` or the environment variables `ENOCH_API_URL` and `ENOCH_API_TOKEN`. The token is required: without it, calls fail before any HTTP request is made. Python 3.11 or newer.
One command plus a key — uvx enoch-mcp --api-url http://localhost:8787 --api-token '<token>', then supply credentials