Three layers, clear ownership. Agent doesn't know MCP exists.
🖥️ Clippy
Has exec() + system prompt skill. Shells out to mcp-cli. Knows nothing about MCP.
• UX / conversation
• Tool selection via search
↓ exec("mcp-cli search ..." / "mcp-cli call-tool ...")
⚡ mcp-cli
Session lifecycle, format translation, tool invocation. Keeps servers warm. Talks MCP to servers.
• MCP sessions
• Registry → config translation
• Transparent provisioning
↓ odr mcp list / odr mcp --proxy
🛡️ ODR
Discovery, containment, agent user provisioning, IT policy, audit. Source of truth for what servers exist.
• Server registry
• Sandboxed execution
• Agent user lifecycle
• Enterprise policy
↓ contained (MSIX) / uncontained (MCPB)
📦 Servers
Contained: agent user in separate NT session. Uncontained: user session (dev mode only).
• Tool implementation
• Server-side state