08/MCP Orchestration

Catalog, Hierarchies & Scope

Server registration, the gate mechanic, binding scope, and the non-production preview.

#Catalog

The Catalog is the registry of MCP servers that can be added to a Hierarchy. Each server uses one of four transports: `stdio`, `http`, `sse` or `docker` (docker servers keep their image in the runner's cache and can be refreshed with "Re-pull"). A server can be one this product generated, or a fully external one; both sit in the same list, tagged by source.

#Hierarchies & the gate

A Hierarchy composes catalog servers into a nested tree and produces a SINGLE MCP endpoint. The Hierarchies page itself puts it exactly this way: "Compose catalog servers into one gated MCP endpoint — nested servers unlock only after their parents have been used." Calling a locked tool does not raise an error on the Trellis session; it returns readable text naming which parent is required first (see the previous page, "The request never drops").

gate refusal (verbatim to the model)

⛔ Hierarchy gate blocked "docker.run"  [after: "docker.ps"]

#Binding scope

A Binding's target uses the SAME shared scope vocabulary as System Prompts: `mapping`, `model`, `node`, `group` (shown as "model group" in the panel), `workspace`, `user`, `global`. A request can match several scopes at once; the NARROWEST one wins — the order is `mapping > model > node > group > workspace > user > global` (global makes no distinction at all, the widest scope). Creating a second binding for the same (scope_type, scope_value, owner_username) triple returns a 409.

An "mcp"-type node in a flow graph can carry its own MCP decision; if it does, that decision WINS outright and the binding resolution above never runs for that request (see Flow Routing). This is a separate, advanced configuration path — the Bindings page does not surface it.

#The Playground preview ≠ the production path

The Knowledge → Playground page's "agentic" mode runs a Hierarchy once, without ever creating a binding, and shows the turn-by-turn trace — it exists for trying things out, needs no binding, and writes NOTHING permanent. It deliberately does not touch the production security model: the composition to run comes only from this admin request's own body, never from a client header.