Real tools, over MCP Shipped
MCP is what turns an agent from a text generator into an operator. Teams grant it per objective; the Hub is itself one of the servers. On main, and consent-gated per team.
Why MCP is the interesting part
An agent that can only emit text can only ever recommend. The Model Context Protocol is the standard that closes that gap: one wire format between an agent and a real capability, so a browser it can click, a test runner it can execute, a database it can query and an API it can call all arrive through the same door. It matters here because a team that can USE the software is a fundamentally different reviewer from one that can only read it — the difference between "this looks wrong" and "I tried it, and here is what happened".
Granted per objective, not per install
The grant is a list of server names on an objective — worker_mcp: ["playwright"] — resolved at dispatch time against a registry you maintain with myteams config mcp add. Scoping it to the objective rather than the team is what keeps the blast radius small: the researcher does not get the browser because some other objective needed one. Grants are additive, so an agent that already carries other wiring keeps it, and an unregistered or disabled server aborts the whole wave BEFORE anything is dispatched — because a team that silently runs without the tool it asked for produces confident findings from an experiment it never actually performed.
Declaring it is not the same as being allowed it
A team asks; you decide. Registering a server does not hand it to anything — consent is a second, separate act, myteams config mcp allow <server> <team>, and a team that has not been named in it is refused at dispatch. That gate is deliberately its own CLI verb rather than a flag on the registry entry, because the first version reused config mcp add and re-adding an existing server silently revoked every consent already granted on it. The membership test is a real set comparison too: it was once a substring check, which meant a consent recorded for devteam also consented dev, and a "*" consented every team on the machine. And a refusal has to be able to stop a run — a refused grant used to be absorbed by the fail-keep filters that let a partial fan-out finish green, so a run could report success having quietly dropped the worker that needed the tool.
The Hub is one of the servers
The Agentic Developer Hub speaks MCP itself, live today: a stateless HTTP endpoint exposing fifty-two curated tools across personas, projects, teams, storage and memory, plus a generic gateway — search the endpoints, describe one, call it — that reaches the rest of the API without a hand-written tool per route. Access is by scoped token, where a scope is a set of path prefixes with an optional read-only suffix, and a deny-list that token minting and account routes can never escape. That is the mechanism by which memory stops being a thing a team is told about and becomes a thing a team can go and read.
And it dials out, too
The same protocol runs the other direction: operator-registered third-party servers are surfaced as tools in their own namespace, forced read-write-unsafe regardless of what the remote claims about itself, and parked for human approval unless that specific grant has been marked autonomous — with every outbound connection filtered against private and metadata addresses. Untrusted by default is the only sane posture for a tool someone else wrote.
Honest status
This landed. The grant, the consent gate and the external-runner builtin that calls down into a deterministic test runner are all on main, and the one team that uses them — a Playwright-driven exploratory pass over a live site — is real and runs. What is still true is that it is not in the box: that team lives in private-teams/, a directory installed by the same installer into the same registry but deliberately not part of the bundled nine, so nothing you get by installing myteams drives a browser today. The capability is shipped; the team that exercises it is not shipped with it.