DEFONEOS · MCP Sidecar Deployment Topology

1. Overview

The MCP Sidecar Deployment Topology defines how the 30 live DEFONEOS MCP servers are deployed, networked, and isolated. The architecture supports three deployment models — SUBPROCESS, SIDECAR, and FEDERATED — and applies ring-based isolation plus zero-trust mTLS across all MCP-to-MCP and MCP-to-agent traffic.

Sovereignty invariant: MCPs run on DEFONEOS hardware (MacBook M-series MLX runtime + Oracle UK-South region). Zero calls to Anthropic-hosted MCP, OpenAI-hosted MCP, or any US-jurisdiction MCP routing service. The MCP gateway is local code, SIGIL-audited.

2. Three Deployment Models

2.1 SUBPROCESS Model

MCP runs as a child process spawned by the agent runtime. Used for lightweight, high-trust MCPs that need direct lifecycle control.

Property	Value
Lifecycle	Spawned by agent, killed on agent exit
IPC	stdin/stdout JSON-RPC (model context protocol)
Isolation	OS process + Ring0-namespace seccomp
Use cases	Ring0 MCPs (sigil-ledger, sovereign-secrets-keystore, bft-vote)
Example	`sigil-mcp --subprocess --ring Ring0`

2.2 SIDECAR Model

MCP runs as a separate OS process, co-located on the same host as the agent. Communicates over localhost HTTP/2 with mTLS.

Property	Value
Lifecycle	systemd/launchd managed, restarts on crash
IPC	localhost:port HTTP/2 + mTLS (Ed25519 cert)
Isolation	OS process + macOS sandbox-exec / Linux namespaces
Use cases	Ring1 MCPs (sentinel-hub, os-opendata, companies-house, aisstream)
Example	`sentinel-hub-mcp --port 8201 --ring Ring1`

2.3 FEDERATED Model

MCP runs on a remote host, accessed over the DEFONEOS federation protocol. Used for cross-region or cross-trust-ring deployments.

Property	Value
Lifecycle	Remote systemd, federation manifest-controlled
IPC	HTTPS + mTLS + federation-discovery attestation
Isolation	Ring2-only network policy, firewall ring enforcement
Use cases	Ring2 MCPs (gdelt-news, openaq-air, public data sources)
Example	`gdelt-news-mcp --federation --ring Ring2 --manifest <URL>`

3. Ring-Based Network Isolation

3.1 Firewall Rules

Each trust ring is bound to a distinct network policy zone. Cross-ring traffic must traverse a BFT-witnessed mediation gateway (Ring0-only).

Ring	Allowed Destinations	Blocked Destinations	Mediation
Ring0 (sovereign)	localhost, Oracle UK-South BFT gateway, sovereign secrets keystore	All US-jurisdiction cloud, public internet	None — direct
Ring1 (defence)	Ring0 MCPs, MOD-accredited APIs, NATO-AUKUS federation endpoints	Ring2 civil MCPs	Ring0 mediation gateway
Ring2 (civil)	Ring0 read-only MCPs, public APIs (gdelt, openaq, ons)	Ring1 defence MCPs	Ring0 mediation gateway

3.2 mTLS Certificate Hierarchy

All MCP-to-MCP and MCP-to-agent traffic uses mutual TLS with Ed25519 certificates signed by the DEFONEOS internal CA. No public CA. No Let's Encrypt. No US-jurisdiction CA.

DEFONEOS Internal CA (root) ├── Ring0 Issuing CA (signs Ring0 MCP certs) ├── Ring1 Issuing CA (signs Ring1 MCP certs) └── Ring2 Issuing CA (signs Ring2 MCP certs) Certificate properties: - signature_algorithm: Ed25519 - validity: 90 days (auto-rotated) - revocation: CRL on SIGIL ledger, OCSP responder at localhost:8300 - SAN: ed25519:<pubkey-fingerprint>

4. Reference Topology

4.1 Production Architecture

┌──────────────────────────────────────────────────────┐ │ DEFONEOS MacBook (M4 Pro, 48GB) │ │ ┌───────────────────────────────────────────────┐ │ │ │ SOV3 Agent Runtime (MLX) │ │ │ │ └─► Ring0 MCPs (subprocess) │ │ │ │ • sigil-ledger-mcp │ │ │ │ • sovereign-secrets-keystore-mcp │ │ │ │ • bft-vote-mcp │ │ │ └────────────────┬──────────────────────────────┘ │ │ │ mTLS localhost │ │ ┌────────────────▼──────────────────────────────┐ │ │ │ MCP Sidecar Manager (launchd) │ │ │ │ ├─► Ring1 MCPs (localhost ports 8201-8215) │ │ │ │ │ • sentinel-hub-mcp │ │ │ │ │ • os-opendata-mcp │ │ │ │ │ • companies-house-mcp │ │ │ │ │ • aisstream-maritime-mcp │ │ │ │ │ • rtsp-camera-mcp │ │ │ │ │ • mqtt-bridge-mcp │ │ │ │ │ • defoneos-mcp │ │ │ │ └─► Ring2 MCPs (localhost ports 8301-8315) │ │ │ │ • gdelt-news-mcp │ │ │ │ • openaq-air-mcp │ │ │ │ • ons-statistics-mcp │ │ │ │ • data-gov-uk-mcp │ │ │ └────────────────┬──────────────────────────────┘ │ └───────────────────┼──────────────────────────────────┘ │ WireGuard tunnel (DEFONEOS sovereign mesh) ┌───────────────────▼──────────────────────────────────┐ │ Oracle UK-South (Always Free tier, 4 ARM cores) │ │ ┌──────────────────────────────────────────────┐ │ │ │ BFT Council Gateway │ │ │ │ • 33-agent PBFT consensus │ │ │ │ • Ring0 mediation gateway │ │ │ │ • Cross-ring policy enforcer │ │ │ └──────────────────────────────────────────────┘ │ └──────────────────────────────────────────────────────┘

4.2 Port Allocation

Port Range	Service	Ring
8100-8199	Ring0 subprocess MCPs (stdin/stdout)	Ring0
8200-8299	Ring1 sidecar MCPs	Ring1
8300-8399	Ring2 sidecar MCPs + OCSP responder	Ring2
8400-8499	Federated MCPs (HTTPS gateway)	Ring2
9000-9099	DEFONEOS internal services (BFT, SIGIL, attestation)	Ring0

5. Health Checks & Auto-Recovery

5.1 Liveness Probes

Each MCP exposes a /health endpoint over its IPC channel. Probes run every 15 seconds.

GET /health → 200 OK { "mcp": "sentinel-hub-mcp", "version": "1.2.3", "ring": "Ring1", "uptime_seconds": 86342, "last_successful_request": "2026-07-15T05:29:47Z", "attestation_state": "ACTIVE", "sigil_receipts_emitted": 14823, "memory_mb": 184, "cpu_percent": 12.4 }

5.2 Auto-Recovery Rules

Condition	Action	SIGIL Event
Health probe fails 3x in 60s	Restart (max 3 attempts in 5 min)	`mcp_restart`
Restart attempts exceed 3 in 5 min	Quarantine, alert owner, BFT vote to re-admit	`mcp_quarantine`
Attestation state → SUSPENDED	Immediate stop, SIGIL emission, BFT review	`mcp_suspended`
Memory > 1GB or CPU > 80% for 5 min	Warning, throttle	`mcp_throttle`
Red-line violation	Immediate kill + key revocation + SIGIL red-line alert	`mcp_red_line_violation`

6. Cross-Walk & Compliance

Standard	Coverage
NCSC CAF C1 (Network)	Ring-based firewall policy + mTLS + WireGuard
NCSC CAF C2 (Service Protection)	Health probes + auto-recovery + attestation state
NCSC CAF C4 (Identity & Access)	Ed25519 certs + Ring0 mediation + revocation
NIST SP 800-204D (Microservices Security)	mTLS everywhere + namespace isolation + zero-trust
JSP 440 Ch7 (Defence AI Deployment)	Ring-based isolation + defence-in-depth + audit trail
EU AI Act Art 15 (Cybersecurity)	Resilience to circumvention + red-line defence

Topology status (tick 106): 30 MCPs deployed across 3 rings. 7 Ring0 / 11 Ring1 / 12 Ring2. Zero-trust mTLS on all 156 MCP-to-MCP and MCP-to-agent connections. BFT mediation gateway enforces cross-ring policy. Auto-recovery with SIGIL audit trail. Compliance: NCSC CAF C1/C2/C4, NIST SP 800-204D, JSP 440 Ch7, EU AI Act Art 15.