What Is the MCP Core in CyberStrikeAI? Architecture and Implementation Guide

The MCP Core in CyberStrikeAI is the central Model-Centric Protocol 2.0 implementation that provides JSON-RPC server and client abstractions for exposing and consuming tools, prompts, resources, and sampling services across the application.

The MCP Core serves as the protocol engine powering tool orchestration within the Ed1s0nZ/CyberStrikeAI repository. It enables seamless integration between internal agents, external AI services, and the web-based user interface through standardized JSON-RPC communication.

MCP Core Architecture Overview

The MCP Core consists of three tightly-coupled components that together implement the MCP 2.0 specification. These components handle everything from message serialization to transport-layer communication.

MCP Server Component

The MCP Server (internal/mcp/server.go) handles incoming MCP messages across multiple transport protocols including HTTP, Server-Sent Events (SSE), and stdio. It maintains a registry of tool handlers, stores execution records for auditing, and provides built-in prompt and resource management. When an agent needs to execute a tool, it invokes mcpServer.CallTool(...), which runs the registered Go handler, logs the execution to MonitorStorage, updates statistics, and returns a ToolResult that the LLM can consume.

MCP Types and Data Structures

The MCP Types module (internal/mcp/types.go) defines all JSON-RPC-compatible structures used throughout the protocol implementation. This includes message envelopes, request IDs, tool definitions with JSON Schema inputs, prompt and resource schemas, and execution record structures. These types ensure type-safe communication between the server, client, and external MCP endpoints.

MCP Client SDK

The MCP Client SDK (internal/mcp/client_sdk.go) wraps the official model-context-protocol Go SDK and provides fallback HTTP client implementations. It implements the ExternalMCPClient interface through the lazySDKClient struct, enabling CyberStrikeAI to communicate with external MCP servers. The client supports lazy initialization, connecting only when first invoked via Initialize(context.Background()), and handles protocol negotiation for tools/list and tools/call requests.

How the MCP Core Integrates with CyberStrikeAI

The MCP Core acts as a plug-and-play protocol hub, unifying how different parts of the application interact with tools and resources.

• Agent Integration – The internal agent (internal/agent/agent.go) invokes mcpServer.CallTool(...) to execute local tools. The server handles the execution lifecycle, from validation through logging, before returning structured results to the LLM.

• External MCP Connectivity – When users configure remote MCP endpoints through the UI, client_sdk.go creates a lazySDKClient that connects via SSE, HTTP, or JSON-RPC-over-HTTP. The same ExternalMCPClient interface abstracts away transport details, allowing the agent to treat remote tools identically to local ones.

• Web UI Communication – The frontend (web/templates/index.html and web/static/js/*.js) communicates with the MCP Core through HTTP endpoints (/mcp) to list available tools, display real-time MCP status, and view execution statistics including call counts and success rates.

• Persistence Layer – The MonitorStorage interface (implemented by the database layer) persists ToolExecution and ToolStats records. The server uses loadHistoricalData to replay execution history after restarts, maintaining continuity across application lifecycles.

Implementing the MCP Core: Code Examples

Starting the MCP Server

To initialize the MCP Core server with database-backed storage, use the NewServerWithStorage constructor as implemented in internal/app/app.go:

import (
    "context"
    "net/http"
    "go.uber.org/zap"
    "cyberstrike-ai/internal/mcp"
)

func main() {
    logger, _ := zap.NewProduction()
    // Create server with optional DB-backed storage (implements MonitorStorage)
    mcpServer := mcp.NewServerWithStorage(logger, db)
    
    // Register a tool with JSON Schema input validation
    mcpServer.RegisterTool(mcp.Tool{
        Name:        "ping",
        Description: "Simple network ping",
        InputSchema: map[string]interface{}{
            "type": "object",
            "properties": map[string]interface{}{
                "host": map[string]interface{}{
                    "type":        "string",
                    "description": "Target host or IP",
                },
            },
            "required": []string{"host"},
        },
    }, func(ctx context.Context, args map[string]interface{}) (*mcp.ToolResult, error) {
        // Tool implementation logic here
        return &mcp.ToolResult{
            Content: []mcp.Content{{Type: "text", Text: "pong"}},
        }, nil
    })
    
    // Expose HTTP endpoint for web UI integration
    http.HandleFunc("/mcp", mcpServer.HandleHTTP)
    http.ListenAndServe(":8080", nil)
}

Connecting to External MCP Servers

For integrating third-party MCP services, use the lazy client wrapper defined in internal/mcp/client_sdk.go:

import (
    "context"
    "cyberstrike-ai/internal/mcp"
    "cyberstrike-ai/internal/config"
    "go.uber.org/zap"
)

func loadExternalMCP(cfg config.ExternalMCPServerConfig, logger *zap.Logger) (mcp.ExternalMCPClient, error) {
    // Create lazy client that initializes on first use
    client := mcp.NewLazyClient(cfg, logger)
    if err := client.Initialize(context.Background()); err != nil {
        return nil, err
    }
    return client, nil
}

Invoking Tools Through the Agent

The agent layer forwards tool calls to external MCP endpoints using the standardized interface:

func (a *Agent) invokeExternalTool(name string, args map[string]interface{}) (*mcp.ToolResult, error) {
    client := a.externalMCP // ExternalMCPClient interface
    if client == nil {
        return nil, fmt.Errorf("external MCP not configured")
    }
    // Delegates to client_sdk.go implementation (lines 71-91)
    return client.CallTool(context.Background(), name, args)
}

Querying Available Tools

To discover tools from an external MCP server, typically used by the UI for rendering tool palettes:

func fetchToolsFromExternalMCP(client mcp.ExternalMCPClient) ([]mcp.Tool, error) {
    // Implemented in client_sdk.go for both lazy and simple HTTP clients
    return client.ListTools(context.Background())
}

Key Source Files and Responsibilities

Understanding the file structure of the MCP Core helps when extending functionality or debugging protocol issues:

• internal/mcp/types.go – Core data structures including Message, Tool, Prompt, Resource, Execution, and Stats.

• internal/mcp/server.go – Full MCP server implementation with HTTP/SSE/stdio handling, tool registration via RegisterTool, and execution tracking.

• internal/mcp/client_sdk.go – Adapter for external MCP connections implementing ExternalMCPClient, including lazySDKClient and simple HTTP fallback clients.

• internal/app/app.go – Application bootstrap that instantiates the MCP server via NewServerWithStorage and wires it into the dependency graph.

• cmd/mcp-stdio/main.go – Standalone entry point for running the MCP Core over stdio transport, useful for CLI integrations.

• internal/handler/external_mcp.go – HTTP handlers allowing the UI to manage external MCP configurations (add, edit, delete endpoints).

• web/templates/index.html – Frontend templates displaying MCP status, tool listings, and execution statistics.

Summary

• The MCP Core in CyberStrikeAI implements the Model-Centric Protocol 2.0 specification as a JSON-RPC server and client system.
• It consists of three main components: the MCP Server (server.go), MCP Types (types.go), and MCP Client SDK (client_sdk.go).
• The architecture supports multiple transports (HTTP, SSE, stdio) and abstracts local and external tools behind unified interfaces.
• Tool execution records persist through the MonitorStorage interface, enabling historical replay and statistics tracking.
• The implementation uses lazy initialization for external connections via lazySDKClient to optimize resource usage.

Frequently Asked Questions

What does MCP stand for in CyberStrikeAI?

MCP stands for Model-Centric Protocol. It is a JSON-RPC-based protocol specification (version 2.0) that standardizes how AI agents discover and invoke tools, access prompts and resources, and handle sampling requests across different services.

How does CyberStrikeAI handle external MCP server connections?

CyberStrikeAI uses the ExternalMCPClient interface implemented in internal/mcp/client_sdk.go. The lazySDKClient struct wraps the official MCP SDK or a simple HTTP client and connects lazily on first use via Initialize(context.Background()). This supports SSE, HTTP, and JSON-RPC-over-HTTP transports.

Where are tool execution records stored in the MCP Core?

Execution records are stored via the MonitorStorage interface, which the MCP Server accepts through NewServerWithStorage. This interface persists ToolExecution and ToolStats structures to the database, allowing the server to call loadHistoricalData on restart to restore previous state.

What transport protocols does the MCP Core support?

According to the source code in internal/mcp/server.go and client_sdk.go, the MCP Core supports HTTP (for web UI integration), Server-Sent Events (SSE) for streaming responses, and stdio (standard input/output) for CLI-based integrations as demonstrated in cmd/mcp-stdio/main.go.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}