# MCP Server

An MCP server declaration that a pack can store today, even though the runtime MCP manager does not load this artifact type directly.

**Content format**: YAML with MCP server connection fields.

**How Anteroom uses it today**: Anteroom stores `mcp_server` artifacts in the artifact database and shows them as pack-owned artifacts, but `McpManager` still connects only to servers from resolved `config.mcp_servers`.

!!! warning "Current runtime boundary"
    Do not treat `mcp_server` artifacts as live MCP connections today. If an attached pack affects live MCP connectivity, that happens through `config_overlay` merging into `mcp_servers`, not through this artifact type.

See [How Packs Work](../how-packs-work.md) for the runtime path and [Behavior-Bearing Packs](../behavior-bearing-packs.md) for the future trust model discussion.

**Example**:

```yaml title="mcp_servers/filesystem.yaml"
command: npx
args:
  - -y
  - "@modelcontextprotocol/server-filesystem"
  - "/path/to/allowed/directory"
env:
  NODE_ENV: production
tools_include:
  - "read_file"
  - "write_file"
tools_exclude:
  - "delete_*"
trust_level: untrusted
```

**Directory**: `mcp_servers/`

## Current status

| Surface | Status |
|---|---|
| `mcp_server` artifact in `pack.yaml` | Supported and stored |
| Automatic loading into `McpManager` | Not supported yet |
| Live MCP servers from `config.mcp_servers` | Supported today |

## What to use today

- Use `mcp_server` artifacts when you want the declaration packaged, versioned, and inspectable as part of a pack.
- Use `config_overlay` only if you intentionally want the pack to affect resolved `mcp_servers` today.
- Do not assume a future trust model yet. Pack-owned live MCP declarations are part of the deferred design work in [Behavior-Bearing Packs](../behavior-bearing-packs.md).

**Common mistakes**:

- Assuming this artifact is loaded automatically into the MCP runtime
- Hardcoding absolute paths that differ across team members' machines
- Setting `trust_level: trusted` without understanding the security implications (trusted tools skip defensive prompt envelopes)
- Forgetting `tools_include`/`tools_exclude` filters, exposing more tools than intended
