Technical Whitepaper · May 2026

The Agent-Addressable Pipeline

StreamKernel’s embedded MCP control plane for architects and engineers building governed real-time AI systems.
Author IntuitiveDesigns / Steven Lopez
Status Technical Whitepaper
Runtime Java 21 · StreamKernel v6.0
Evidence MCP Smoke · 24 May 2026
MCP JSON-RPC Single JVM Runtime In-Process Inference Transport Agnostic Patent Pending
Runtime Control Plane
SourceKafka · Pulsar · REST · Synthetic
TransformONNX · DJL · Guardrails · Enrichment
PolicySecurityProvider · OPA · PERMIT_ALL
SinkKafka · Mongo · Postgres · Vector
Embedded MCP Control Plane

tools/list · tools/call · resources/read · audit · mutation gate

01

Executive Summary

StreamKernel is a JVM-native event pipeline kernel designed to run governed data movement, transformation, inference, observability, and delivery inside one process. The architectural premise is direct: for many real-time AI and operational data pipelines, splitting ingestion, transformation, inference, policy, and delivery across separate services creates unnecessary network hops, serialization boundaries, failure surfaces, and operational drag.

The embedded MCP control plane extends that runtime with an opt-in, agent-addressable interface. When enabled, a local or authorized MCP-compatible client can inspect the active pipeline, validate configuration, check dependency health, query Kafka offsets, inspect DLQ state, read benchmark summaries, and dry-run or execute guarded operational mutations through JSON-RPC.

Core idea: this is not an external agent gateway, sidecar, or monitoring proxy. The MCP server is embedded inside the same JVM as the active StreamKernel pipeline.

20
MCP tools exposed
15
Read-oriented operations
5
Guarded mutations
PASS
Final smoke baseline
816
Kafka records counted
15
Benchmark matrix entries
0
Mutations enabled in smoke
JSONL
Audit trail format
02

Why This Exists

Most real-time AI systems distribute responsibility across a broker, stream processor, transformation service, model server, sink connector, observability stack, and control plane. That model works, but each boundary adds deployment surface, security policy, serialization overhead, network latency, credentials, monitoring, and failure modes.

Figure 1 — Conventional multi-service path vs. StreamKernel embedded control
CONVENTIONAL MULTI-SERVICE PIPELINE BrokerConsumerModel ServiceSink Connector network hopnetwork hopnetwork hop STREAMKERNEL — SINGLE JVM WITH EMBEDDED MCP JVM process SourceKafka / Pulsar / REST TransformONNX / DJL / Chain PolicySecurityProvider SinkMongo / Kafka / Vector EMBEDDED MCP CONTROL PLANE ObserveValidateDry-runAudit
Runtime componentValidation/inspectionGuarded mutationNetwork hop avoided

StreamKernel’s MCP control plane exists because once the pipeline runtime becomes the place where state, policy, inference, and delivery converge, agents and operators need a safe way to ask operational questions and preflight actions against the live runtime.

03

Architecture Overview

At runtime, StreamKernel loads a pipeline from configuration. A profile declares source type, sink type, transformer chain, cache behavior, metrics provider, security provider, DLQ behavior, and optional MCP settings.

mcp.server.enabled=true
mcp.server.transport=stdio,http
mcp.http.bind.address=127.0.0.1
mcp.mutations.enabled=false
mcp.audit.enabled=true
01

Embedded, not external

The MCP server runs inside the same JVM boundary as the active pipeline rather than in a sidecar, gateway, or external operator service.

02

Shared tool catalog

stdio and HTTP transports expose the same catalog, schema contract, audit behavior, and mutation gates.

03

Mutation-safe by design

Guarded tools support dry-run behavior and fail closed unless mutations are explicitly enabled.

04

Explicit limits

The current implementation exposes one active JVM pipeline and does not yet include a full long-running profile manager.

04

MCP Surface Area

The embedded server supports the expected MCP interaction model: initialize, list tools, call tools, list resources, read resources, and ping the server. The resource catalog exposes bounded read-only snapshots of pipeline, model, health, and metrics state.

MethodPurpose
initializeReturns server metadata and capabilities.
tools/listLists StreamKernel MCP tools and input schemas.
tools/callInvokes a named operational tool.
resources/listLists JSON resources for pipeline, model, health, and metrics.
resources/readReads a StreamKernel JSON resource.
pingLightweight health response.
Resource URIResource
streamkernel://pipeline/currentCurrent pipeline status snapshot.
streamkernel://model/statusCurrent model status snapshot.
streamkernel://health/summaryPipeline health summary.
streamkernel://metrics/snapshotPoint-in-time metric values.
05

Tool Catalog — 20 Operations

The tool catalog exposes 15 read-oriented operations and 5 guarded mutations. This split matters because the operational surface is useful to agents even when mutation execution remains disabled.

ToolTypeEngineering purpose
streamkernel.pipeline.listreadReturns active pipeline profiles and sink configuration.
streamkernel.pipeline.statusreadReturns source, transformer, sink, and security status for the active pipeline.
streamkernel.model.statusreadReports loaded model and inference health state.
streamkernel.model.historyreadReads recent model transition records from MCP audit history.
streamkernel.health.summaryreadReports health, DLQ depth, record loss counters, and uptime.
streamkernel.sink.throughputreadReports average records per second and cumulative sink count.
streamkernel.dlq.inspectreadReports DLQ counts and error classifications.
streamkernel.lineage.queryreadQueries MCP control-plane audit records by tool and time range.
streamkernel.metrics.snapshotreadReturns a point-in-time metrics snapshot.
streamkernel.auth.statusreadReports security identity, auth cache state, and control posture.
streamkernel.config.validatereadValidates the active profile and MCP hardening posture.
streamkernel.dependency.healthreadChecks TEI-compatible embedding endpoint health and dimensionality.
streamkernel.kafka.topic.countsreadUses Kafka AdminClient to estimate topic record counts from offsets.
streamkernel.benchmark.matrix.discoverreadDiscovers benchmark matrix CSV entries.
streamkernel.benchmark.last_run.summaryreadSummarizes latest benchmark CSV evidence.
streamkernel.pipeline.startmutateStarts a named pipeline profile when a profile manager is available.
streamkernel.pipeline.stopmutateRequests graceful shutdown of the active pipeline.
streamkernel.model.promotemutateUpdates MLflow alias or stage for a model version.
streamkernel.model.rollbackmutateRolls back MLflow alias or stage to a prior model version.
streamkernel.auth.refreshmutateExpires the authorization cache so checks refresh through the security provider.
06

Schema Contract and Error Semantics

Every tool response uses a common envelope with ok, tool, timestamp, and correlation_id. Errors return typed StreamKernel-style codes instead of exposing raw JVM stack traces.

OK

Successful response

{
  "ok": true,
  "tool": "streamkernel.health.summary",
  "timestamp": "2026-05-24T23:13:49Z",
  "correlation_id": "health-001"
}
ERR

Blocked mutation

{
  "ok": false,
  "tool": "streamkernel.auth.refresh",
  "error": {
    "code": "SK_MCP_MUTATIONS_DISABLED"
  }
}

Why architects should care: stable envelopes and typed errors make agent workflows deterministic. Agents can branch on response fields instead of scraping logs or parsing exception strings.

07

Security and Hardening Model

The embedded MCP control plane is opt-in and intentionally conservative. The local smoke profile is evidence-focused, not a production security template. It binds MCP HTTP and Prometheus to loopback, disables mutations, and enables audit.

Server disabled unless mcp.server.enabled=true.
HTTP is opt-in; stdio is the default transport.
HTTP binds to 127.0.0.1 by default.
Remote allowlist starts with loopback addresses.
Request body size is capped by mcp.http.max.request.bytes.
Mutations fail closed unless mcp.mutations.enabled=true.
HTTP bearer/header authentication is available.
Tool-level SecurityProvider authorization is available.
MCP audit JSONL is enabled by default.
Raw tool arguments are intentionally excluded from audit records.

Production note: before exposing MCP outside local-only usage, enable HTTP auth, tool-level authorization, bounded request sizes, audit retention, and network controls.

08

Evidence Baseline

The final local smoke run established the current MCP evidence baseline. This is a control-plane smoke test, not a long-duration load test or production resilience claim.

Figure 2 — MCP smoke sequence
MCP ClientHTTP worker 1HTTP worker 2Runtime / Kafka 1 health.summary 2 pipeline.status 3 config.validate 4 dependency.health 5 kafka.topic.counts816 records 6 benchmark.matrix.discover 7 benchmark.last_run.summary 8 dry_run mutation 9 blocked mutation → SK_MCP_MUTATIONS_DISABLED
Evidence itemObserved value
StatusPASS
Run IDmcp-smoke-20260524-231344
Tool count20
Pipeline statusRUNNING
Config validtrue
Dependency healthtrue
Kafka healthtrue
Kafka topicarena-bench-test
Kafka estimated records816
Benchmark matrix entries15
Latest result fileresults_20260524_1828.csv
Blocked mutation codeSK_MCP_MUTATIONS_DISABLED
09

Operational Use Cases

A

Agent-assisted readiness check

An agent can read health, status, config validation, dependency health, Kafka topic counts, and benchmark summaries before a demo, deployment, or benchmark.

B

Evidence-backed benchmark review

Benchmark matrix discovery and latest-run summaries expose engineering evidence through a formal tool instead of manual file copying.

C

Guarded model lifecycle

A release agent can dry-run model promotion or rollback before a human-approved mutation path is enabled.

D

Security posture validation

Platform teams can validate whether profiles are loopback-bound, whether request caps exist, and whether mutation posture fits the environment.

10

Current Limits

The current implementation exposes one active JVM pipeline. It does not yet include a general profile manager capable of cold-starting arbitrary profiles inside one long-running process. Because of that, streamkernel.pipeline.start fails explicitly with a single-process unsupported error unless a future profile manager is registered.

streamkernel.lineage.query currently reads MCP control-plane audit records. It does not query full data-plane lineage records. Data-plane lineage remains stamped onto emitted records as part of the pipeline, but it is not indexed by the embedded MCP server in this implementation.

Evidence boundary: the smoke run proves MCP readiness and operational behavior. It does not claim long-duration resilience, high-throughput control-plane performance, multi-tenant isolation, or production-grade remote exposure.

11

Recommended Production Profile

For production or shared environments, harden beyond the local smoke profile. Keep MCP local unless remote access is explicitly required, protect HTTP when enabled, keep mutations closed by default, and enable tool-level authorization in controlled environments.

mcp.server.enabled=true
mcp.server.transport=stdio,http

mcp.http.bind.address=127.0.0.1
mcp.http.allowed.remote.addresses=127.0.0.1,::1,localhost

mcp.http.auth.enabled=true
mcp.http.auth.header.name=X-StreamKernel-MCP-Secret
mcp.http.auth.header.value=${STREAMKERNEL_MCP_SECRET}

mcp.mutations.enabled=false
mcp.authorization.enabled=true
mcp.audit.enabled=true
mcp.audit.max.read.records=1000
mcp.audit.max.read.bytes=4194304

metrics.prometheus.bind.address=127.0.0.1
12

Architect’s Decision Summary

StreamKernel’s embedded MCP control plane is architecturally interesting because it places a standard agent interface directly inside a governed event and inference runtime. The control surface is bounded, schema-described, auditable, and mutation-gated.

QuestionAnswer
Is this a sidecar?No. The MCP server is embedded inside the StreamKernel JVM.
Can agents inspect runtime state?Yes, through read-oriented MCP tools and JSON resources.
Can agents mutate production state by default?No. Mutations are disabled unless explicitly enabled, and guarded tools support dry runs.
Is this a replacement for every stream processor?No. It is strongest for governed, model-aware, policy-aware real-time pipelines where fewer runtime boundaries matter.
What is proven?A control-plane smoke baseline: tool exposure, runtime status, dependency checks, Kafka counts, benchmark discovery, dry-run mutation, and blocked mutation path.
13

Conclusion

StreamKernel’s embedded MCP control plane turns a single-process event and inference runtime into an agent-addressable operational surface. It allows agents and automation to observe health, inspect configuration, check dependencies, query Kafka state, read evidence, and safely preflight operational changes without deploying a separate control service.

The design is most compelling for teams that care about governed real-time AI, low-latency in-process inference, air-gapped deployment, and operational auditability. Its value is not only that agents can call tools. Its value is that those tools are close to the runtime they control.

Final takeaway: in systems where every additional service is another security review, failure boundary, and operational burden, embedding the control plane inside the pipeline kernel is a pragmatic architectural tradeoff.