Eclipse Loft MCP

Name: Eclipse Loft MCP
Brand: Cyan Eclipse Technologies

Governed design-to-print authority for agents — signed provenance from model to machine, safety envelopes at the bridge, evidence for every print.

status: in-developmentclass: mcpFabrication GovernanceTrust & Receipts

Vendor: Cyan Eclipse Technologies

What it does

Fabrication authority exists only inside a Herald-grammar signed mandate pinning agent × printer serial × design pin × slicer build × profile hash × material × thermal/volume/duration/budget envelope × site class × window, enforced at a site bridge holding the only printer credentials
The bridge re-slices the pinned inputs at dispatch and canonical-hash-matches the toolpath before any printer contact — hand-edited toolpaths, tampered or poisoned profiles, slicer drift, config drift and material swaps all refuse by name before heat
Every print and every refusal seals into a Blackbox-form evidence pack; Loft Proof verifies packs offline, re-deriving the chain — and only against a trusted signer anchor supplied by the verifier (registry / expected fingerprint)
No raw G-code surface exists (T2 refused through P2) and config writes are permanently refused — no tool, no path around; design registration proposes only, pin activation is a human-principal signed act (AGENT_SELF_PIN_REFUSED)
Loft Gauge statically checks mandates and profiles for envelope soundness before any session opens; site class fails closed — anything not exactly ATTENDED or UNATTENDED_RATED drops the session to attended-required

Tools

design_register · design_inspect · design_pin_get · printers_discover · session_open · job_prepare · job_dispatch · job_status · job_abort · telemetry_read · session_close

Platforms

MCP over stdio

Certification

Bench verdict: CERTIFIED(simulator)

Certified scope: CERTIFIED(simulator) — Eclipse Bazaar Test Bench 2026-10-25, scoped re-bench r3 (standing): 12 pass, 0 na of 12 checks — the D2-only scope (key-substitution attack D2X + V3/V4/V5 tamper set + genuine packs with and without anchor, library and CLI). D1/D3–D10 were closed in scoped re-bench r2 and carried, not re-probed, per scope. History, all cards retained append-only: bench 1 FAILED (35 of 45 checks — test-bench/results/eclipse-strata-mcp-2026-10-25.json); scoped re-bench r2 FAILED (25 of 26 — eclipse-strata-mcp-2026-10-25-r2.json) on the sole remaining HIGH, D2. Scope — read exactly: SIMULATOR ONLY. P0 printers are host-shaped simulators (OctoPrint virtual + virtual Klipper/Moonraker, in-process) behind the production interface, with a deterministic simulated slicer; NO live printer was exercised at any point in any bench run, no heat exists in this bench, and no hardware claim of any class is made. TRUSTED SIGNER ANCHOR: Strata Proof verifies a pack only against a verifier-supplied registry / expected fingerprint; a pack's embedded key and self-consistent fingerprint never suffice — unanchored packs and unknown signers report PRINT_UNVERIFIED (UNVERIFIED_SIGNER) by design, never a silent verify. That anchor is what closed D2: in r2 an attacker who minted their own keypair, tampered the mandate (material swap, +365d expiry), re-signed and re-sealed produced PRINT_VERIFIED; in r3 the byte-for-byte same attack is refused solely on UNVERIFIED_SIGNER under a genuine anchor, under a genuine expected fingerprint, and with no anchor. GEOMETRY, narrowed in fix round D7 and consistent across spec, README, manifest and tool surface: declared_geometry_only — design_inspect returns the caller-declared bounding box plus arithmetic over it; manifold / triangle / wall-thickness facts are null, never echoed as verified; no geometry-kernel claim is made. BAMBU posture (spec): a Bambu adapter is P2+ and owner-Developer-Mode-only — the enablement act is documented as the owner's; there is no Bambu path, bypass, or claim at P0. NAME CONDITIONAL pending trademark screen (Stratasys shared root, same industry); fallbacks on record: Eclipse Sinter, then Eclipse Loft. N-CHECK: NOVELTY_PROVEN (bench 1, retained) — renamed-verb overlap 55% (<80%); a Kiln-shaped fixture printing a hand-edited +15 °C toolpath and an unbound job was refused on both counts — the mandate-and-bridge mechanism exists in no incumbent.

Not tested:

Real hardware of any class — no physical printer, no heat; every bench target is a host-shaped simulator.
Real slicer binaries (PrusaSlicer / Orca) — P0 slicing is a deterministic simulated slicer behind the production interface.
Real Moonraker / OctoPrint endpoints and vendor clouds.
Herald signer — P0 uses the local Ed25519 PinSigner fallback behind the production port; Herald custody is a later phase.
Blackbox custody of packs (packs are Blackbox-form; the Blackbox product is not in the P0 path).
P1/P2 adapters — including Bambu (owner-Developer-Mode-only posture per spec) and the Elegoo Neptune 4 dogfood purchase (owner decision D2).
Unattended real printing — mandates default ATTENDED-required; UNATTENDED_RATED is explicitly signed per site.

Bench scorecard (evidence): https://eclipsebazaar.com/cards/eclipse-strata-mcp-2026-10-25-r3.json

Pricing

Bridge license per site + per-printer seats (spec §18); P0 simulator build free/local

Install / verify

No install command is published for this product in the catalog or its registry record.

Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).