Tool plane and model boundary

Separate suggestion from execution

A model can draft a tool call, but its text is not authorization. A Tool resource points to a named capability on an MCPServer; the operator resolves referenced resources, while the runtime talks to the external MCP service. The server must validate identity, tenant, inputs, and requested side effects independently of the Agent prompt. A ModelEndpoint similarly describes an existing OpenAI-compatible service and is not a tool, Agent, or model deployment.

Discover, snapshot, invoke

The Rust ToolPlane registers MCP clients by server name, refreshes advertised ToolContracts, and can hand snapshots to a ToolContractSink. Each contract contains server name, tool name, version, description, and JSON input/output schemas. invoke_tool finds a registered contract and client, wraps the call in a timeout, attempts to bound large results, and emits ToolInvoked, ToolFinished, or ToolFailed timeline events with a correlation ID. The in-memory contract sink and timeline store are examples, not a guarantee of persistent audit history in every deployment.

Names have different jobs

• Tool.metadata.name is the Kubernetes resource name referenced by Agent.spec.tools[].name.
• Tool.spec.toolName is the MCP-advertised name checked by the operator against Agent.spec.allowedTools when the allowlist is non-empty.
• MCPServer.metadata.name is the resource referenced by Tool.spec.mcpServerRef.
• The current operator execution contract explicitly selects searxng_web_search and web_url_read for search and reading. A registered arbitrary Tool is not automatically exposed to the Job runtime by this path; verify support in your installed runner.

Security and observability limits

ToolPlane attempts to truncate outputs above a threshold, but serialized Unicode and envelope overhead mean it is not a strict 64 KiB guarantee. Treat upstream service limits as the hard boundary. Retries may cause duplicate writes; use idempotency keys and human approval for irreversible actions. Contract discovery and a Run timeline improve explainability, but an MCP contract cannot ensure a safe server implementation.

Source

See engine/crates/kaigents-core/src/tool_plane.rs (ToolPlane, ToolContract, HttpMcpClient), engine/crates/kaigents-core/src/model_serving.rs (ModelClient and ModelPlane), and operator/internal/controllers/run_controller.go (reference resolution and Job contract). The Tool and MCPServer chart CRDs are in charts/kaigents-operator/crds.