The README makes claims. This file backs them up.
BoJ (Bundle of Joy) is a unified MCP server that consolidates all hyperpolymath tooling into a single endpoint — GitHub, GitLab, Cloudflare, Vercel, Verpex, Gmail, Calendar, browser automation, research, ML, and 50+ open-source cartridges.
This is the Model-Controller-Processor pattern: cartridges are pluggable service wrappers (90+ total), the MCP bridge translates Claude tool calls to cartridge invocations, and a REST API provides non-MCP access.
Location: mcp-bridge/lib/cartridge-loader.ts (TypeScript cartridge discovery and initialization)
How verified: The cartridge loader scans cartridges/*/cartridge.json, reads tool schemas from each, and registers them dynamically with the MCP server. README (§Features) claims "50+ open-source cartridges." The loader validates each manifest, checks for required name, version, tools fields, and prevents duplicate tool names. This enables the "unified endpoint" claim: a single MCP server exposes the union of all cartridges' tools without hardcoding each one.
Caveat: Auto-discovery is runtime dynamic; there is no compile-time verification that all cartridge schemas are valid JSON Schema. A malformed cartridge.json will error at MCP startup, not build time. The authoritative manifest format is Nickel (closed decision boj-cartridge-manifest-format-dd.md); migration from JSON is future work.
Location: panll/lib/autowire.ts (ReScript panel autowiring with constraint solver)
How verified: The PanLL framework defines panels (UI widgets) with declared dependencies. The autowire module runs a topological sort + constraint satisfaction solver to bind panel inputs to outputs from other panels. README’s panll/ subdir documents the "workspace layer" that orchestrates 108 panels into coherent layouts. The solver validates connectivity before rendering and rejects cycles.
Caveat: Constraint solver is heuristic-based (greedy), not formally verified to find optimal layouts. May fail on complex interdependent panels.
| Technology / Pattern | Role in boj-server | Also Used In |
|---|---|---|
Idris2 ABI + Zig FFI standard |
|
gossamer, burble, ephapax, hypatia, verisimdb, typed-wasm — universal ABI/FFI pattern across the estate |
Pluggable cartridge architecture |
96 cartridge directories ( |
echidna (prover orchestration as cartridges), hypatia (rule composition), gitbot-fleet (bot cartridges per service) |
PanLL ReScript workspace layer |
|
idaptik (game UI panels), gossamer-powered SPAs, PanLL monorepo panels estate-wide |
panic-attack security gate |
Pre-commit |
Every RSR repo in the estate; panicbot wraps it in CI |
Deno runtime |
MCP bridge ( |
nextgen-languages (Deno test runner), standards (Deno axel-protocol tests), 0-ai-gatekeeper-protocol (Deno 36 tests) |
| Path | What’s There |
|---|---|
|
MCP server entry point; JSON-RPC stdio transport for Claude Code |
|
Prompt injection detection, rate limiting, input validation, error sanitization |
|
GitHub, GitLab API passthroughs and BoJ REST API wrappers |
|
MCP tool schema definitions for all cartridge tools |
|
Structured JSON logging to stderr |
|
Single source of truth for server name and version |
|
Static cartridge catalogue for offline/inspection mode |
|
96 cartridge directories, each with abi/, ffi/, adapter/ structure |
|
Idris2 ABI definitions (Protocol, Domain, Catalogue, Safety, etc.) |
|
ReScript/TEA panel framework for UI workspace layer |
-
Security module:
tests/security_test.js— injection detection, unicode bypass prevention, rate limiting, input validation -
Smoke tests:
tests/smoke_test.ts— CLI, MCP protocol, health check, cartridge schemas -
E2E tests:
tests/e2e_mcp_test.ts— MCP server lifecycle, tool invocation, error handling -
Property tests:
tests/p2p_cartridge_properties_test.ts— cartridge invariants, schema compliance -
Aspect security:
tests/aspect_security_test.ts— injection, sandboxing, credential handling, SSRF prevention -
Integration:
tests/integration.sh— end-to-end MCP server ↔ cartridge invocation