Tutorial · Published 26 August 2026
Integrating the Ujex MCP server in production
From local emulators to agent enrolment, mandate checks, approval-gated tools, signed callbacks, and offline evidence verification.
Prove the golden path locally
Build the workspace, start the Firebase Emulator Suite with the repository script, and run the golden-path smoke test against demo-ujex. Keep production credentials out of the local environment.
The test should enrol an agent, issue a device key, pause an outbound action for approval, append evidence, and verify the bundle offline.
sh scripts/self-host.sh
GCLOUD_PROJECT=demo-ujex make smoke-golden-pathEnrol a bounded client
Create a dedicated agent and device identity per runtime. Store its one-time key in a server-side secret manager and exchange it according to the documented client flow.
Define narrow tool manifests and budgets before connecting the MCP server to a model.
Wire approval and callbacks
Send only stable proposal data into the approval queue. On callback, verify the signature, timestamp, audience, replay identity, and exact proposal digest before advancing state.
Fail closed when trust material is unavailable; do not let a transient verification error become permission.
Export and rotate
Generate an evidence bundle for the integration test, verify it with no live tenant access, and store the verification result with the release evidence. Rotate the device key and prove the old key stops working.
Production readiness also requires tenant-isolation tests, rate limits, alerting, recovery, and a documented authority owner.
Production checklist
- Verify Scoped authority against the deployed environment, not a screenshot.
- Verify Server-side secrets against the deployed environment, not a screenshot.
- Verify Fail-closed verification against the deployed environment, not a screenshot.
- Verify Portable evidence against the deployed environment, not a screenshot.