# A toolchain an agent can drive, and MCP with injection safety at compile time

> On main since rc2: A toolchain an agent can drive, and MCP with injection safety at compile time.

Source: https://kern-lang.eu/releases/agent-toolchain-and-mcp-injection-safety

On main since rc2

## Release notes

Kern is now addressable by code-generating models as a first-class consumer. `kern check --json` and `kern build --json` emit exactly one JSON object on stdout with the same diagnostic schema (`severity`, E-code, message, file, line, column, hint), covering the whole build path: import resolution, typecheck, IR streaming, the cross-link refusal and the clang link. `kern fix` closes the loop by applying the mechanical repairs an agent should not have to reason about, starting with the typechecker's own “Did you mean?” renames; it is safe by construction, re-verifying that the bad token is still exactly at the recorded position before writing and applying edits bottom-up so a same-line fix never shifts a pending column.

A generated `llms.txt` bundle gives a model the whole language surface in one file, counts pulled from source. On the protocol side, three new modules implement **Model Context Protocol** server and client over JSON-RPC 2.0, and they close the injection hole that MCP normally leaves open: tool arguments arrive as `Untrusted<str>` and tool results return as `Untrusted<str>`, so a handler that feeds model-provided input into SQL, shell, HTTP or a file without validating it **does not compile** (E0303).

The same rule now applies to the model itself: `ai_complete`, `ai_api_call` and `ai_chat` return `Untrusted<str>`, because LLM output is adversarial input by definition, and every wrapper above them propagates the taint. That is the compile-time axis; the runtime axis is a WAF prompt-injection detector covering 27 patterns in five families (instruction override, role hijack, system-prompt extraction, delimiter injection, jailbreak). The language surface grew to match: `select` over channels with `recv`, `timeout` and `default` arms, which was the largest concurrency gap against Go, plus `else if`, real atomic sub/and/or/compare-swap, string interpolation over any expression rather than bare identifiers, and `main(args)` receiving argv.

And `kern new api <name>` now scaffolds a service that actually works: health and root routes on :8080, compiling to a roughly 115 KB binary that answers `curl` out of the box, on macOS and Linux.