SMERC | MCP Runtime Governance

Recoverability-aware permission for agent tool calls

MCP-style systems help agents connect to tools. SMERC adds a pre-execution governance question: even when a tool call is technically authorized, is it recoverable enough to execute now?

ALLOW THROTTLE FREEZE DENY ESCALATE
MCP adapter docs Try MCP scanner Microsoft-style replay Microsoft review note GitHub repo

Where It Fits

SMERC sits between agent intent and tool execution

Identity and policy can determine whether an agent is allowed to call a tool. SMERC evaluates whether this specific call should execute now based on reversibility, containment, rollback latency, evidence validity, anomaly pressure, and impact scope.

Agent MCP client or runner SMERC evaluation Execution route Tool call or block

Current Artifact

A metadata-only adapter already exists

The reference adapter maps MCP-style tool-call metadata into a SMERC posture, Governance Routing Workbench route state, recommended client/proxy behavior, reason codes, controls, and replayable evidence boundary. In the reference implementation, this layer is called SPARTa.

Inspect adapter Scan a tool definition Example tool calls Adapter tests

Complement, Not Replacement

Designed to sit beside existing controls

SMERC does not replace MCP, OAuth, IAM, OPA, AI gateways, prompt defenses, Microsoft security tools, approval workflows, or human accountability. It adds recoverability scoring and route evidence before side effects occur.

call_toolExecute when recoverability and evidence are strong.
call_with_constraintsProceed with size, scope, latency, or approval controls.
require_approvalEscalate when human review is required.
block_tool_callDeny high-impact or low-recoverability calls.

Reviewer Ask

What we want Microsoft and MCP reviewers to challenge

  • Is recoverability a useful runtime signal for AI-agent tool calls?
  • Should the first integration sit in an MCP proxy, agent runner, workflow engine, API gateway, or CI/CD gate?
  • Which existing identity, security, GitHub, or platform controls must SMERC integrate with first?
  • What existing tool already solves enough of this problem that SMERC should narrow its scope?

Evidence Boundary

Current status

SMERC is pilot-grade software for technical review and shadow-mode pilot discussion. It is not Microsoft-certified, marketplace-listed, production-attested, or proven to reduce incidents in live customer environments.