submcp

SubMCP

Delegates bounded subtasks to NIM-hosted sub-agents that read the repo themselves and return a written report. Use it to keep large or mechanical exploration out of your context, not to replace normal edits.

Before first use

Call mcp__submcp__list_agents once per session. It's free (no API call) and tells you:

• sandbox root (sub-agents can't read outside it)
• whether write and shell are open (usually both closed → read-only sub-agents)
• default model, step/timeout budgets

Tools

• delegate — one sub-agent, one task. Required: task (self-contained instructions
  • desired output format). Optional: profile, files (paths to hand over up front), write (no-op unless server has SUBMCP_ALLOW_WRITE=1), model, max_steps.
• delegate_parallel — N independent sub-agents at once (capped at SUBMCP_MAX_PARALLEL, default 4). Takes tasks: [str, ...], same profile/files/model applied to all. Always read-only — no write param. Use for "check these 3 files for the same thing" style work, not for chained/sequential steps (task 2 can't see task 1's result).

Profiles: general (default), researcher (read-only, cites what it read), coder (smallest change, matches existing style), reviewer (finds problems, doesn't rewrite).

Writing the task string

Sub-agents start cold — no view of this conversation. Every task must be self-contained: what to look at, what to produce, what "done" means.

• Good: "Find every call site of load_config under submcp/ and list each as path:line with one line on how the result is used; answer as a markdown list."
• Bad: "look into that config thing we discussed"

Pass files for anything you already know is relevant — saves the sub-agent a step.

Guardrails (already enforced, don't re-implement)

• Path confinement to sandbox root (symlinks/.. resolved and checked).
• Secret files refused for read and write: .env (except .env.example-style whitelisted templates), .pem, .key, .pfx, id_rsa, credentials, .netrc, .npmrc, .pypirc, etc.
• write=True and shell access are both no-ops unless the operator explicitly opened those gates server-side.