DynamicMCP

Inspiration

Autonomous personal agents are fundamentally constrained by the tools human developers manually build for them. Whenever an agent encounters an unfamiliar CLI utility, a fresh SaaS endpoint, or a novel REST service, its execution halts. The conventional remedy, manually authoring a Model Context Protocol (MCP) server, defining Pydantic schemas, setting up network policies, and testing edge cases takes hours of developer toil.

We asked a fundamental question: What if an agent could autonomously write, test, sandbox, and hot-reload its own tools on the fly with zero human intervention and zero credential leakage?

That vision became DynamicMCP: a self-assembling tool factory and runtime for the Personal AI Track of the Nebius x NVIDIA Hackathon.

What it does

DynamicMCP observes unfamiliar API inputs & raw cURL commands, remote OpenAPI specifications, or CLI --help strings and autonomously converts them into verified, sandboxed, and hot-registered FastMCP servers in seconds.

Key capabilities include:

• Autonomous Spec Ingestion: Parses unstructured endpoints, HTTP methods, headers, and parameters into a normalized ToolSpec schema.
• Typed FastMCP Synthesis: Generates complete Python FastMCP servers equipped with typed Pydantic parameter schemas, descriptive docstrings, and robust HTTP exception handling.
• Headless Dry-Run Verification: Executes synthetic mock tests inside isolated Nebius Serverless Jobs before code ever interacts with live user data.
• Automated Self-Healing Loop: Catches syntax errors, import failures, or mock run errors, feeding stack traces back into Nemotron 3 Ultra for iterative correction (up to 3 automated repair cycles).
• Zero-Leakage Sandbox Deployment: Generates declarative NemoClaw policies enforcing Landlock filesystem isolation (read-only root, protected ~/.ssh and .env) and domain-scoped network egress inside NVIDIA OpenShell containers.
• Live Hot-Reloading: Registers newly verified tools into the active FastMCP registry without restarting the agent daemon, routing the original user request immediately to the newly created capability.
• Minimalist Web Studio: Provides a distraction-free developer workspace to paste API contracts, observe real-time code synthesis, and execute tools with sub-second latency telemetry.

How we built it

DynamicMCP operates as a coordinated multi-model pipeline powered by Nebius Token Factory, NVIDIA Nemotron, and NVIDIA OpenShell & NemoClaw:

1. Dual-Model Cognitive Routing:

   • NVIDIA Nemotron Nano 30B (nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B): Fast, low-latency schema extraction. Nano filters high-volume documentation, CLI help text, and query parameters into a normalized JSON contract.
   • NVIDIA Nemotron 3 Ultra 550B (nvidia/Nemotron-3-Ultra-550b-a55b): High-capacity code synthesis and self-healing. Ultra writes typed Pydantic models, server code, and targeted bug-fix patches during healing loops.

2. Algorithmic Cost and Token Efficiency: Decoupling schema extraction from code synthesis produces super-linear token savings. For an input context of length T_in (such as a 20,000-token OpenAPI specification), a monolithic 550B approach costs:

Cost_monolithic = (T_in × Price_ultra) + (T_out × Price_ultra)

DynamicMCP uses Nemotron Nano to distill the contract down to an essential ToolSpec of size T_spec ≪ T_in (typically ~350 tokens), which is then passed to Nemotron 3 Ultra:

Cost_dynamic = (T_in × Price_nano) [Spec Distillation] + (T_spec × Price_ultra + T_out × Price_ultra) [Precision Synthesis]

With Price_nano ≈ (1/10) × Price_ultra and T_spec ≈ 0.02 × T_in, total inference expenditure drops significantly:

Cost_dynamic / Cost_monolithic ≈ (0.1 × T_in + 0.02 × T_in + T_out) / (T_in + T_out) ≈ 0.12 (~88% Cost Reduction)

1. Multi-Stage Deterministic Verification:

   • AST Security Scanner: Inspects the Python Abstract Syntax Tree before execution to block dangerous calls (eval, exec, importlib, ctypes, socket manipulation, and aliased os.system escapes).
   • Nebius Serverless Jobs: Executes headless pytest harnesses in ephemeral containers with mock payloads to verify parameter handling, type conversion, and serialization.

2. Security Boundaries & Sandboxing:

   • Landlock LSM: System directories are mounted read-only; host credential paths are blocked; only /tmp/workspace is writable.
   • Domain-Scoped Egress: Network namespaces restrict outbound packets strictly to the tool's target domain, blocking internal RFC 1918 subnets and cloud metadata endpoints (169.254.169.254).
   • Zero-Trust Credential Injection: API keys and authorization headers are injected at the network proxy boundary rather than residing in plaintext inside code or environment variables.

3. Hot-Reload Architecture & Full-Stack Studio:

   • SQLite Skill Store persists state transitions across the dynamic lifecycle (UNRECOGNIZED_TOOL -> SPEC_PARSING -> CODE_SYNTHESIS -> DRY_RUN_VERIFICATION -> SANDBOX_MOUNT -> REGISTERED -> EXECUTING).
   • Built a distraction-free developer interface using React 18, Tailwind CSS, Geist typography, and a FastAPI backend.

4. Multi-Stage Deterministic Verification:

   • AST Security Scanner: Inspects the Python Abstract Syntax Tree before execution to block dangerous calls (eval, exec, importlib, ctypes, socket manipulation, and aliased os.system escapes).
   • Nebius Serverless Jobs: Executes headless pytest harnesses in ephemeral containers with mock payloads to verify parameter handling, type conversion, and serialization.

5. Security Boundaries & Sandboxing:

   • Landlock LSM: System directories are mounted read-only; host credential paths are blocked; only /tmp/workspace is writable.
   • Domain-Scoped Egress: Network namespaces restrict outbound packets strictly to the tool's target domain, blocking internal RFC 1918 subnets and cloud metadata endpoints ($169.254.169.254$).
   • Zero-Trust Credential Injection: API keys and authorization headers are injected at the network proxy boundary rather than residing in plaintext inside code or environment variables.

6. Hot-Reload Architecture & Full-Stack Studio:

   • SQLite Skill Store persists state transitions across the dynamic lifecycle (UNRECOGNIZED_TOOL -> SPEC_PARSING -> CODE_SYNTHESIS -> DRY_RUN_VERIFICATION -> SANDBOX_MOUNT -> REGISTERED -> EXECUTING).
   • Built a distraction-free developer interface using React 18, Tailwind CSS, Geist typography, and a FastAPI backend.

Challenges we ran into

1. AST Obfuscation and Dynamic Evasion: Detecting direct invocations of os.system is straightforward, but LLM-generated code can alias imports (import os as my_os; my_os.popen(...)), import dangerous functions directly (from os import system), or access dunder attributes (().__class__.__base__.__subclasses__()). We hardened our SecurityNodeVisitor to track alias bindings across import nodes and block dangerous attribute lookups.
2. SSRF and DNS Rebinding in Remote Spec Fetching: When users pass remote URLs to ingest OpenAPI specifications (such as raw GitHub specs), requests could inadvertently target cloud metadata endpoints ($169.254.169.254$) or private networks. We implemented strict pre-request socket resolution with ipaddress.is_global validation, hop-by-hop redirect verification (max 3 hops), and a 5 MB payload ceiling.
3. Runtime FastMCP Hot-Reloading Without Daemon Restarts: Standard FastMCP servers instantiate tools at boot. We engineered dynamic runtime registration using namespace prefixes (dynamic__<tool_name>), runtime module loading via importlib.util.spec_from_file_location, and automatic Pydantic dict-to-model coercion during execution.

Accomplishments that we're proud of

• Autonomous End-to-End Pipeline: Successfully demonstrated live ingestion, synthesis, verification, and execution across diverse real-world APIs—from Open-Meteo Weather and NASA InSight Mars Weather to World Bank Data360 OpenAPI and CoinGecko Crypto prices.
• Zero Token Leakage Architecture: Ensured that host credentials, environment variables, and authentication tokens never leak into generated code, container environments, or execution logs.
• Autonomous Self-Healing: Built an automated loop that captures execution stack traces, feeds targeted diagnostics to Nemotron 3 Ultra, and successfully repairs syntax and logic errors in under 3 iterations.
• Super-Linear Efficiency: Slashed inference costs by roughly 88% by utilizing Nemotron Nano as an upfront schema filter before invoking Nemotron 3 Ultra.
• Robust Quality Gate: Maintained 100% test pass rate across 25 unit, integration, security, and REST server test suites.

What we learned

• Specialized Routing Trumps Monolithic Prompts: Delegating schema extraction to Nemotron Nano and code synthesis to Nemotron 3 Ultra dramatically improves latency, reliability, and token economics compared to relying on a single monolithic model.
• Defense-in-Depth Is Essential for Agentic Tool Creation: Giving autonomous agents the ability to generate and execute code is unsafe without rigorous containment. Marrying AST validation with declarative NemoClaw policies and Landlock LSM filesystem sandboxing provides provable zero-leakage security.
• Dynamic Tool Creation Unlocks Personal AI: Pre-building static integrations cannot scale to the long tail of personal APIs, internal corporate services, and developer scripts. DynamicMCP proves agents can safely construct their own tools on demand.

What's next for DynamicMCP

• Autonomous Tool Discovery via Web Search: Enabling agents to search developer documentation, discover OpenAPI specifications for missing capabilities, and synthesize tools completely unprompted.
• WebSocket and GraphQL Schema Ingestion: Expanding beyond REST and cURL to support real-time streaming tools, GraphQL queries, and bidirectional event subscriptions.
• Decentralized Multi-Agent Skill Sharing: Synchronizing verified, sandboxed tools across multi-agent fleets so that a skill created by one agent is instantly accessible to an entire team.

Built With

• curl
• fastapi
• fastmcp
• hermes-agent
• model-context-protocol
• nebius
• nemoclaw
• nemotron
• nvidia
• openapi
• openshell
• pytest
• python
• react
• sqlite
• tailwind-css
• vite