> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artbucket.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 0003: One core, with REST and MCP as adapters

> Accepted, v0.4.

## Context

An MCP server bolted on beside an app drifts from it: it checks permissions
its own way, validates less, and falls behind on features.

## Decision

All logic lives in `src/lib/core/`. The REST routes, the MCP server
(`POST /api/v1/mcp`) and the CLI are thin adapters over it: they parse, call
core, and shape the answer. MCP is hand-rolled, stateless JSON-RPC over
Streamable HTTP, not the SDK: tools and resources are all it serves.

## Consequences

* A permission is checked once, in core, for every door.
* An MCP tool is usually a few lines over an existing core function.
* Prompts, subscriptions or server-initiated messages would need the SDK;
  that is the trigger to take it.