MCP

MCP is a native Ax execution surface. Attach a live AxMCPClient with mcp; AxGen, AxAgent, and AxFlow retain the owning session, qualified tool identity, structured content, tasks, cancellation, and tracing. The compatibility-only function adapter is lossy and is not used by native execution.

flowchart LR
  Server["MCP server"] --> Session["AxMCPClient session"]
  Session --> Program["AxGen, AxAgent, or AxFlow"]
  Session --> Events["AxMCPEventSource"]
  Events --> Inbox["AxEventRuntime inbox"]
  Inbox --> Program

Native Tools

The client negotiates capabilities once and Ax maps native tool definitions at each model step. Catalog-change notifications refresh only the affected definitions.

Source

Python

mcp = AxMCPClient(AxMCPStreamableHTTPTransport(endpoint), {"namespace": "inventory"})
    catalog = mcp.inspect_catalog()
    {"mcp": mcp},
    mcp.close()

Subscriptions Can Wake Programs

AxMCPEventSource converts protocol notifications into normal event ingress. A notification is durable before acknowledgement when the configured store supports it. Nothing wakes a model until an explicit authenticated route selects wake.

The endpoint is only the address. inspectCatalog() discovers server-owned resource names and URIs, while an explicit none/all/URI/selector policy decides what the source maintains. See MCP Subscriptions for catalog selection, URI templates, ownership, reconnect, and troubleshooting.

Source

Python

transport = AxMCPStreamableHTTPTransport(
source = AxMCPEventSource(
    resource_subscriptions="all",
runtime.start()
if not completed.wait(60):

MCP sessions do not establish application tenant identity. Supply identity from the OAuth-token or account mapping. Unmapped notifications remain anonymous and cannot match routes requiring authentication.

Tasks Resume Continuations

Task progress and logs default to observe. An input_required or terminal task event correlates as namespace:taskId and can atomically consume the continuation owned by a prior AxFlow or Agent run. Polling remains available because MCP task notifications are optional.

Source

Python

task_id = client.call_tool("start_reindex", {"scope": "all"})["task"]["taskId"]
started.publish(
if not completed.wait(60):

Transports, Authentication, And Server Requests

Ax supports stdio, Streamable HTTP, legacy HTTP/SSE, resumable SSE, and custom WebSocket transports. Native clients also expose prompts, resources, templates, subscriptions, completions, roots, sampling, elicitation, progress, cancellation, experimental tasks, OAuth, MCP Apps, client credentials, and enterprise-managed authorization.

Transport listeners are supervised and nonblocking. Reconnect restores logical subscriptions; caller-owned clients remain caller-owned and must be closed.

Safety

Treat prompt and resource content as attributed, untrusted context.
Require application identity for tenant routes; never derive it from an MCP session id.
Authorize side-effecting tools from annotations, arguments, task context, and caller identity.
Do not blindly replay an uncertain post-side-effect failure.
Use recording/replay or a sandbox for optimization and evaluation.

See MCP Subscriptions, Event Runtime, Tools, ax() generation, and agent() agents.