AI & search
What an AI agent
finds ready on the platform.
Corporate AI initiatives usually run into four obstacles: fragmented data, no object-level permissions, no audit trail, and no single point of execution. In LubyOS all four are already part of the architecture.
Unified context
The agent reads an already normalized data layer in which every person, company and project has a single identifier — without integrating multiple sources or reconciling divergent models.
Inherited permissions
The agent is another client of the same authorization graph that governs the interface. Its read scope is exactly that of the user on whose behalf it acts.
Retrieval filtered at the source
Content handed to the model has already passed the client and user filter inside the index, which removes any exposure of passages that would be discarded afterwards.
Declared capabilities
Each module declares in a manifest the tools it uses, the data it accesses and the permitted external destinations. The manifest is immutable per version.
An action carried out on behalf of a user travels the same authorized route as a manual action and produces the same audit record. The authorization model is the same in both cases.
Search
Hybrid search across applications, actions and knowledge.
Search combines a lexical index and a vector index executed in parallel, whose results are fused by relative position. An item ranked well in both indexes prevails over an item ranked well in only one.
- Lexical and semantic are complementary. Corporate vocabulary is precise — client names, internal codes, acronyms — and that is where the lexical index has the advantage. Equivalent formulations using different words are retrieved by the vector index. Adopting only one of the two reduces coverage significantly.
- Own infrastructure. The embedding model is multilingual and runs in a dedicated service inside our own infrastructure. Indexed content is not sent to external services.
- Authorization applied before retrieval. The client and user filter is applied inside the index, not to the results. No passage is returned only to be discarded afterwards for lack of permission.
Integration with AI assistants
MCP servers in production, with corporate authentication.
MCP is the open protocol that connects AI assistants to tools and data sources. LubyOS operates its own MCP servers, authenticated by the same identity provider as the system, so each professional uses the assistant of their choice with the organization's standards and knowledge available.
Engineering standards
Ten tools that deliver the organization's standards to anyone developing with AI assistance: the initial structure of a module, the available data sources, the definition of each canonical entity, the authentication procedure, static analysis rules and their enforcement, design tokens in JSON, CSS or Tailwind, the component catalog, the publication procedure and manifest validation.
Generated code adopts the correct visual identity, components and contracts from the first version, which reduces rework at review time.
Operational knowledge
The organization's repository of procedures — creating applications, changing the kernel, building interfaces, the versioning flow and publication — versioned and served by five tools: list, search, load, read a supporting file, and install locally in the professional's own environment.
Procedures with formatting inconsistencies are not served, and their unavailability is reported explicitly to the assistant.
Corporate authentication
Both servers run on OAuth 2.1 with dynamic client registration, integrated with the corporate identity provider and the organization's federated login. Access is granted per individual identity and revoked through the same offboarding process as every other system.
The servers operate in read-only mode. Adding knowledge remains subject to human review.
The effect
Why serving the standard over MCP changes governance, security and quality.
An AI assistant will find context somewhere. With no declared source, it takes it from whichever repository happens to be open, from a forum answer, or from its own memory — and the result is plausible without being correct. MCP turns the organization's standard into something the assistant looks up rather than guesses.
Governance
- Knowledge enters through review. Procedures and documents arrive as a proposal with human approval. The assistant reads the repository; it does not write to it.
- No metadata, no index. Identifier, named owner, version and date are mandatory, and the check fails in continuous integration — not silently.
- Drafts are not served. A procedure not yet approved returns the name of whoever answers for it, rather than a version nobody signed off.
- A single validator. The same check runs in the terminal of whoever writes and on the server that serves. Passing validation and breaking later is not possible.
Security
- The same identity as the rest of the system. Access is granted per individual identity by the corporate provider and revoked through the same offboarding process.
- The agent does not widen reach. An external assistant never reaches further than the credential of whoever operates it already reached.
- These servers hold no company data. They serve contracts and procedures. Real data exists only at runtime, through the kernel, with client isolation, object-level permission and an audit trail.
- The catalog is read-only. Mounted without write access, with any path escaping its folder rejected by three checks and symbolic links ignored during indexing.
Quality
- Tokens are generated, not maintained in parallel. They come from the product's own stylesheet. When more than one palette claimed to be the source of truth, the assistant received the one that was not.
- Six static checks, three of them blocking: a database of its own, an authentication of its own and a login screen — the three things a module must not have.
- The manifest is validated before it exists. The forbidden combination — a third-party module running in-process — is rejected, and an image without a pinned digest is flagged.
- A canonical entity arrives as a contract. Fields and a sample payload, never real data, with the access rule stated alongside.
Static analysis is heuristic, and it is the publication gate that actually blocks. The role of MCP is to arrive earlier: the right standard in the first version of the code, rather than in the third round of review.