Kāhea MCP server

Kāhea

Website · Documentation · Releases · Agent plugin · MCP metadata

Kāhea is a local-first, deterministic API invocation kernel for coding agents.

Intent may be probabilistic. The call must be exact.

It turns OpenAPI descriptions, request captures, Arazzo workflows, and finite WebSocket sessions into integrity-sealed plans. Invocation is a separate operation guarded by exact capability grants; responses and inbound frames become typed observations and content-addressed evidence.

Install Kāhea

Choose the pathway that matches your host. Claude Code, OpenAI Codex, and direct MCP clients all reach the same four local MCP tools and the same inspect → plan → grant → invoke → evidence safety contract.

1. Install the native binary

Download the archive for your operating system and architecture from GitHub Releases. Every archive is accompanied by a SHA-256 checksum, a CycloneDX SBOM, and GitHub build provenance. Verify the checksum before installing and verify provenance with:

gh attestation verify kahea-ARCHIVE --repo copyleftdev/kahea

Kāhea does not run an installer or modify shell configuration. Extract the archive and place the kahea binary somewhere on PATH.

Tagged archives are built and tested on GitHub-hosted Linux, macOS, and Windows runners for the runner architecture. See the finite WebSocket guide for the exact WebSocket support and release-gate statement.

2a. Claude Code

Add this repository as a marketplace, then install the plugin:

claude plugin marketplace add copyleftdev/kahea
claude plugin install kahea@kahea

2b. OpenAI Codex

Add the same repository marketplace and canonical plugin package:

codex plugin marketplace add copyleftdev/kahea
codex plugin add kahea@kahea

Both plugins require the verified kahea binary on PATH. They add the canonical agent-use skill and start the local stdio MCP server without downloading code or credentials at runtime. The shared host package lives in plugins/kahea; no host-specific copy of the safety workflow is maintained.

2c. Any MCP client

Configure the client to start Kāhea over stdio:

command: kahea
args: mcp serve --stdio

Tagged releases also publish self-contained, checksummed MCPB bundles and register io.github.copyleftdev/kahea with the official MCP Registry.

Build from source

To build from source, install Rust 1.95 or newer:

cargo build --release -p kahea

Build and verify

The repository pins the release toolchain in rust-toolchain.toml.

scripts/gates.sh
# Requires cargo-mutants; run locally, not in CI.
scripts/mutation-gate.sh

The release gate also launches the seeded loopback WebSocket oracle, plans its generated finite session through the public CLI, invokes it with the plan's exact grants, and verifies both the client observation and the oracle's reproducible seed/case observation. Replay that lifecycle with scripts/websocket-oracle-smoke.sh; select an individual fault with kahea-test-server --protocol websocket --websocket-fault FAULT --seed SEED.

Shortened. The full README is on GitHub.