Local Agent web surface
Hitspec is the only model-visible web abstraction. Tavily is an internal, replaceable provider selected by the server operator; do not register Tavily as another MCP server for Local Agent.hitspec_search_web discovers candidate
sources, hitspec_fetch reads without persistence, and
hitspec_capture_webpage creates durable page evidence.
hitspec_list_requests and hitspec_validate remain workspace tools. Search
returns a provider-neutral kind: "discovery" document capped at 64 KiB;
capture returns a compact stash receipt with the durable content hash.
Save a response in file.cheap
Use an explicit file handoff so the artifact is reviewable before persistence:hitspec-response, format:raw|text|markdown|json, a safe
request name, and status:<code>. Do not put credentials, tokens, cookies, or
URL query parameters in names, tags, or source metadata.
The same reviewable CLI handoff remains useful for humans. For agents, start the
Hitspec MCP server with a fixed --fcheap-path; hitspec_capture_webpage
performs the handoff inside a private temporary directory and returns a compact
receipt. hitspec_fetch never persists. The model cannot choose the executable,
stash directory, or output path.
Register both servers in MCPHub
hitspec__hitspec_search_web,
hitspec__hitspec_fetch, hitspec__hitspec_capture_webpage, and
fcheap__fcheap_search. Verify the catalog before changing an agent config:
FCHEAP_*
configuration; web-provider credentials are not inherited.
vault_only limits the values tvault adds to the Hitspec child process. It does
not remove TAVILY_API_KEY if that variable is already exported by MCPHub’s
parent process, so do not export the key globally. The model cannot supply the
provider, endpoint, API key, authorization header, file.cheap executable, stash
directory, or output path as tool arguments.
Approval policy
AUTO does not grant private-network access or weaken SSRF, redirect, body-size,
or workspace checks.
Safe rollout
Before replacing a binary already connected to MCPHub, record its executable, checksum, and complete tool schemas. If it already exposeshitspec_capture_webpage, preserve that public name and compatible inputs before
cutover; rebuilding from a checkout with a smaller catalog is a regression.
Build a candidate without replacing the active binary, then require:
mcphub doctor --server hitspec --probeshows all five tools: search, fetch, webpage capture, list, and validate.- A canary completes
hitspec_search_web→hitspec_capture_webpage→fcheap search, with the expected normalized source and hashes. - AUTO and approval behavior matches the table above and no secret appears in process arguments, logs, results, or file.cheap child environment.
tvault boundary
The MCPHub/tvault process wrapper above is the external injection boundary. Native tvault resolution inside Hitspec remains deferred: Hitspec has no vault-specific request syntax and never writes fetched credentials back to an environment automatically. Until a separate secret-reference contract is defined:- inject required values into the Hitspec process environment outside the request or tool arguments;
- do not place secret values in
.httpfiles, MCPHub YAML, URL query strings, output filenames, tags, logs, or Markdown provenance; and - keep MCPHub’s
vault/vault_onlyprocess wrapper as the boundary rather than teaching Hitspec to read a vault ad hoc.