MCP Tool & Skill Developer · working example
Governed MCP tools and skills for AI agents, running live on Azure and AWS.
Beast Assist is a small version of an enterprise agent platform: MCP servers in Python and FastAPI, SKILL.md skills with a registry, OPA authorization, Entra ID tokens through Azure API Management, a LangGraph coordinator on Amazon Bedrock, and RAG on PostgreSQL + pgvector. Everything on this page is live: the buttons below make real calls through every one of those layers.
Built by Bryan Ruiz
Governed MCP tools and skills for AI agents: FastAPI MCP servers, SKILL.md registry, OPA, Entra ID + Azure APIM, LangGraph on Bedrock, pgvector RAG, Kubernetes
- Loading from GitHub…
Live status
checking…Every service this platform runs on, checked by the app serving this page: Azure every minute, Bedrock every five minutes (each Bedrock check is a real model call). Each light shows its last check underneath.
The walkthrough
Every component, how it is wired, and how it was tested. About nine minutes, two narrators.
Narration uses Piper text-to-speech voices (synthetic, AI-generated audio). Captions are available in the player.
Live console
Each button sends one real MCP call. This page asks its own backend (an Azure Container App) to get an Entra ID token and call Azure API Management, which forwards to the MCP server, which asks OPA. The trace shows every hop, the exact JSON-RPC sent, and who answered.
Ask the agent
The LangGraph coordinator from the repo, running in Azure, with its model on Amazon Bedrock. It resolves a skill from the registry, loads only that skill's tools over MCP, and follows the skill's workflow. Its token is read-only, so write tools are refused. Limited to a few questions an hour.
Where it runs
Measured live by the app serving this page, not typed in. Refreshes on load.
This page and its backend
- Loading
- …
Each hop, health-checked from Azure
- Loading
- …
Architecture, as deployed
docs/diagrams/live.mmd). Select it to open full size.The path of one tool call
- Browseryou
- demo appAzure Container Apps
- Entra IDclient-credentials token
- API Managementvalidate-jwt, skill header
- MCP serverAzure Container Apps
- OPAskill allowed_tools
- Registry + pgvectorAzure Database for PostgreSQL
- ModelAmazon Bedrock
What is not in the cloud: the two systems the tools wrap, the Scarlet Beast agile board and Scarlet College, which are existing Scarlet Beast web apps on their own server. They play the part Jira and Confluence play for SmartAssist: systems of record behind the MCP servers, reached over HTTPS. The platform itself (the MCP servers, policy, registry, database, gateway, identity, agent, and this page) runs in Azure, and the model runs in AWS.
Proposal · 4 pages
Scope of Work
How this work would be delivered for SmartAssist: objectives, what is in and out of scope, nine deliverables with acceptance criteria, a phased timeline, assumptions, and roles.
- 1–3Purpose, background, objectives
- 4–6Scope, out of scope, deliverables D1–D4
- 6–10Deliverables D5–D9, timeline, acceptance, assumptions
- 10–12Roles, change control, commercial terms
What was built, against the job description
| The role asks for | Beast Assist has |
|---|---|
| MCP servers in Python/FastAPI, one backend each, tools auto-discovered | agile-mcp and college-mcp on the MCP Python SDK 2.2, generated from mcp-template/; tools are files in src/tools/ found at startup |
| Tool design for LLMs | bootstrap_guide first, slim rows, input checked before the backend, errors as code: message. Next: hint |
| SKILL.md: allowed_tools, inputs, lifecycle, workflow | 3 skills (board-standup, college-tutor, study-plan-from-job) with validate, audit and upload scripts |
| Skills Registry on PostgreSQL | FastAPI registry: list, resolve by alias, publish behind the Skills.Publish role; serves the OPA bundle |
| Authorization with OPA | Rego: a skill may call only its allowed_tools, its lifecycle must fit the environment, writes need Tools.Write; 6 policy tests |
| Entra ID, Azure API Management | 4 app registrations with app roles; APIM Consumption with validate-jwt and a required skill header; servers verify the token again |
| LangGraph, Bedrock | Coordinator graph: resolve skill → preflight → specialist ReAct agent with only that skill's tools; Bedrock Converse |
| RAG | Scarlet College lessons chunked by heading, embedded (bge-small or Titan V2), pgvector HNSW, cited answers; hit@k and MRR eval |
| Docker, Kubernetes, certificates, health | One image; Kustomize dev/prod overlays with HPA, PDB, NetworkPolicy, cert-manager; /healthz and /readyz everywhere |
| Evaluation, observability, CI | 13 benchmark scenarios; OpenTelemetry traces and one log line per tool call; GitHub Actions test, lint, image |
Verified
- 32 unit tests (servers over real MCP HTTP), 3 agent integration tests
- 6/6 Rego policy tests; 3/3 skills valid; audit passes
- 13/13 benchmark scenarios locally and through Azure API Management with real Entra tokens
- RAG retrieval: bge-small hit@1 1.00, MRR 1.00; Titan V2 hit@1 0.88, MRR 0.92 (8 questions)
- Kubernetes overlays pass kubeconform; CI green on GitHub