Is Operator MCP my customer-facing MCP?
No. Operator MCP belongs only to KE. The customer-facing paid product is KE Connector.
K&E Studios
MCP, without the fogFour MCP choices.
Four MCP choices.
One simple choice.
The paid customer product is KE Connector: buy Credits and run released KE tools. The internal one is KE Operator MCP: KE uses it, customers never do. The other two are a public menu and a server the customer already owns.
Start here
Which MCP is which?
You do not need to understand the protocol to choose correctly. Match what you want to do with one of these four cards.
- 01
The public menu
Public discovery
See what exists. Run nothing.- Use it when
- You only want to inspect the available KE capabilities.
- Payment
- Free because no work runs
- 02
Your own connection
Customer-direct MCP
Connect to a server you already control.- Use it when
- You or another provider owns the MCP server and its credentials.
- Payment
- Its owner decides
- 03
The paid KE product
KE Connector
Buy Credits. Run released KE tools.- Use it when
- You want KE to perform a supported job and return the result.
- Payment
- KE Credits · no Platform subscription
- 04
KE internal only
KE Operator MCP
Operate KE itself. Never customer-facing.- Use it when
- William or a KE-controlled process is operating private KE systems.
- Payment
- Not for sale
What a paying customer actually gets
A finished result—not access to our machinery.
KE Connector is like ordering from a protected workshop. The customer chooses an approved job, prepays with Credits, and receives the result plus a receipt. KE keeps the provider account, private methods, prompts, source, routing, and internal Brain behind the wall.
- 1
Choose a released KE tool
The customer chooses from a fixed list. They cannot supply an arbitrary provider, model, URL, file path, or hidden prompt.
- 2
Prove the account and Credits
The spend key, customer account, wallet, and available Credits must all belong to the same person.
- 3
Reserve the maximum first
KE calculates the safe ceiling before work starts. If price or funding cannot be proven, the request stops.
- 4
Return the result and receipt
KE runs the provider privately, charges only verified actual use, releases the unused reserve, and returns a bounded result.
Can customers use William's Replicate account?
They never receive the account or key. If a released KE capability uses Replicate behind the scenes, KE makes that call privately and returns only the customer's result and receipt.
Do Connector customers need a subscription and Credits?
No. API-only KE Connector customers need funded Credits, not a Platform subscription. Private Platform apps use membership, which includes 50 Credits per verified paid period.
Can someone pay once and copy KE's private work?
No. Payment buys permission to use a released capability and receive its result. It never transfers KE Brain, prompts, skills, source, routing, evaluations, provider credentials, or another customer's data.
Optional visual walkthrough · 13 connected chapters
Want the visual version? Walk through it.
The same four answers stay visible in every chapter: Discovery is the menu. Customer-direct is yours. Connector is the paid KE product. Operator is private to KE. Use arrow keys, the chapter controls, or swipe.
- 01Public discovery
- 02Customer-direct MCP
- 03KE Connector
- 04KE Operator MCP
There are four choices. Only one is the paid KE product.Arrow keys · trace the field · Home/End · swipe
Optional engineering reference
Need every route and security check?
If the plain answer was enough, you can stop there. Developers and security reviewers can open the exact request path below—from the client through payment, private execution, result checks, and receipt.
Open the full engineering mapRoutes · account checks · Credits · private data · failures
Compatible hosts / clients
CodexClaude CodeCursorKE DesktopKE product clients
The host runs the agent experience. It does not inherit tool authority merely because it can speak MCP.
- 01Public · read only
Public discovery
The public menu. Anyone can see which KE tools exist, but this route cannot run them or charge anyone.
- Transport
- HTTPS GET
- Identity
- None
- Money
- None
- Returns
- Public metadata
- 02Customer owned · direct
Customer-direct MCP
A server you or another provider owns. You connect to it directly; KE does not relay it, control it, or bill for it.
- Transport
- Owner-defined MCP
- Identity
- Customer/provider
- Money
- Paid to its owner
- Returns
- Direct to customer
- 03Paid customer product
KE Connector
The paid KE product. Customers buy Credits to run released KE capabilities and receive results. No Platform subscription is required.
- Transport
- Streamable HTTP MCP
- Identity
- Stable user + scoped spend key
- Money
- Funded KE Credits
- Returns
- Bounded derived results
- 04KE internal · not for sale
KE Operator MCP
KE's private internal control connection. William and KE-controlled systems may use it; customers cannot connect to it or buy it.
- Transport
- Local stdio only
- Identity
- KE process identity
- Money
- Not sold
- Returns
- Private bounded receipts
Only plane 03 enters KE-managed executionNo public-to-operator bridge
Managed KE execution spine
Authorize → quote → reserve → attempt → settle
Every missing proof closes the path before the next costly step.
- 01
Transport boundary
Exact path, host, Origin, content type, size, protocol, and query rules are checked before JSON-RPC dispatch.
- 02
Stable identity
The bearer spend key resolves to one stable account. Possession alone is insufficient; wallet, key, and authenticated owner must be the same user.
- 03
Capability admission
The exact fixed capability, Connector scope, economics, and runtime release must be provable. Missing release or schema proof fails closed.
- 04
Protected input
DLP, canary, composite decoding, and abuse admission reject extraction probes before a wallet hold or provider call.
- 05
Quote + reserves
A server-owned current quote reserves the maximum KE Credit debit, proves processor-net prepaid economic coverage, and admits the renewable provider-cost window before dispatch.
- 06
Durable attempt
The fixed capability and provider-attempt identity are journaled before at-most-once external work can begin.
- 07
Protected output
Generated, built, stored, and replayed results are scanned. Unsafe material is withheld, never returned as a paid result.
- 08
Settle + receipt
Actual usage settles exactly. Exact retries replay; ambiguous provider work is reconciled without blind retry or automatic refund.
Context is resolved before it is projected
Ethos Context Fabric
Customer-bound · entitlement-filtered · hash-bound · size-bounded
Customer Brain
Portable notes, preferences, artifacts, and project context are bound to the exact customer before projection.
KE Brain Kernel
Doctrine, prompts, skills, routing, evaluations, incident knowledge, and economics may influence a result but never enter a customer pack.
Product-owned state
Each KE product retains its records, capabilities, releases, APIs, and failure boundary instead of becoming one universal database.
Client egressCapability Card · permitted context · derived result · receipt
Private boundaryKernel · prompts · source · keys · routing · filesystem stay inside
Side-by-side
Same letters. Different ownership.
“MCP” describes how a host and server exchange typed tool messages. It does not tell you who owns the endpoint, credentials, bill, context, provider relationship, output, or authority. This table does.
| Boundary | 01 · Discovery | 02 · Customer-direct | 03 · KE Connector | 04 · Operator |
|---|---|---|---|---|
| What it is | Public metadata record | Another owner's MCP server | KE customer MCP server | KE private operator server |
| Who can connect | Anyone | The owner's allowed clients | Authenticated funded customer | KE-controlled local workloads |
| Transport | HTTPS GET | Owner-defined | Streamable HTTP MCP | Local stdio only |
| Credential | None | Customer/provider credential | Scoped KE spend key | KE process identity |
| Who pays | Nobody | Customer pays that owner | Exact funded KE Credits | KE internal operating cost |
| What executes | Nothing | Owner's tools | Fixed released KE tools | Fixed private read-only boundary tools |
| Context | Public cards only | Customer/provider contract | Customer-bound projection + server-only KE logic | Private KE context |
| Authority | None | Defined by that product | Invocation only; consequential authority remains separate | Observe-only; no customer authority |
| What leaves | Public metadata | Owner-defined result | Bounded result + billing receipt | Private bounded receipt |
| KE implementation | Never | Not in KE's path | Never transferred by payment | Never publicly discoverable |
The possession boundary
Payment grants use. Never possession.
A paid Connector account licenses bounded invocation and delivery of the customer's result. It does not sell an upstream provider account, the private Operator MCP, the KE Brain Kernel, or the machinery that produced the result.
Direct extraction attempts are refused before provider work or charge. Output is checked again before response, persistence, and replay. Privacy-safe abuse receipts support velocity limits, temporary suspension, review, and key revocation without storing raw probes.
May cross to the customer
- Validated public Capability Cards
- The customer's own permitted context
- Strict, bounded derived results
- Exact debit, balance, window, and receipt
- Opaque references for protected exclusions
Never sold or projected
- KE Brain Kernel or another customer's Brain
- System/developer prompts or proprietary skills
- Handlers, source, evaluations, or routing logic
- Provider credentials, model topology, or margins
- Filesystem, operator paths, or private registries
Public fixed-tool catalog
These IDs are public contracts, not a generic proxy. Availability is still controlled by fixed scope, funded Credits, economics, provider, and release gates.
- ke_api_catalog
- ke_credits_balance
- ke_terminal_complete
- ke_beacon_create_lesson
- ke_beacon_coach
No arbitrary URL · provider · model · system prompt · file · filesystem path · private resource · generic tool name
Everything around MCP
The protocol is one layer in a governed system.
These adjacent systems do the jobs people often—and incorrectly—assign to MCP itself. Keeping them separate is what makes the connector portable without making it unsafe.
Ethos identity
Answers who the actor is. A model, runtime, session, and Agent identity are not interchangeable.
Product access + capability release
Separates private Platform membership from the API-only Connector and proves which fixed capability is actually released.
Credits + economic coverage
Answers whether processor-net funded value can reserve and settle variable work without exposing KE to uncovered provider cost.
Context Fabric
Answers which knowledge can be projected, which can influence only a derived result, and which must remain server-only.
Capability contracts
Define fixed schemas, artifacts, limits, side effects, release state, idempotency, and evidence for each tool.
Execution Governor
Answers whether a consequential side effect has explicit authority and budget. MCP connection is never approval.
Provider + attempt journal
Records whether external work may have started so retries, reversals, and reconciliation remain economically safe.
Movement + Kea Watch
Turns bounded receipts into human-visible operating evidence without exposing prompts, credentials, or private topology.
Routes and failure semantics
The endpoint should tell the truth before it does work.
Public metadata remains easy to inspect. Executable routes fail closed with explicit status and error classes before tool dispatch or spend whenever identity, entitlement, security, or lifecycle proof is absent.
https://kestudios.dev/api/v1/mcpGET returns discovery. POST returns 410 before JSON-RPC parsing.
https://kestudios.dev/api/v1/ke/mcpBearer spend key, same-user ownership, Connector scope, verified funded Credits, prepaid economic coverage, and capability release all remain required. No Platform subscription is required.
No shared KE URLCustomer-direct endpoints belong to their owner. Operator MCP has no public listener or paid bridge.
Public execution retired
POST to the discovery route never reaches JSON-RPC dispatch.
Credential refused
Missing, malformed, suspended, or unscoped spend authority.
Boundary denied
Origin, Connector scope, capability release, or same-user proof does not pass.
Host refused
An unrecognized or inconsistent request host is rejected.
Temporary suspension
Privacy-safe abuse velocity or a canary signal pauses the user/key with Retry-After.
Proof unavailable
Wallet, funding evidence, lifecycle, current economics, or abuse-journal truth cannot be established.
Ambiguous provider work
Do not replay or auto-refund work that may have crossed the provider boundary; reconcile it.
Choose the boundary you actually need
Inspect publicly. Connect directly. Use KE when you need governed execution.
KE Connector is the portable customer product. KE Brain provides bounded context. KE Desktop is an optional first-party client. The private Operator MCP remains inside KE.