“It’s not about a smarter LLM — it’s about smarter infrastructure around it.” G. Watts, “Beyond Code Generation,” CHEP 2026

• His framing: data & tools → MCP → skills → agents; grounded in primary sources; “we need a pip-install.”
• This talk: the facility-context layer is the decisive one, it ports, and the open problems are identity, trust, packaging, and equity.

G. Watts’ CHEP 2026 slides · © Gordon Watts + AI

MCP (JSON-RPC)

⟷

Python · subprocess · REST

⟷

from fastmcp import FastMCP
from rucio.client import Client

mcp = FastMCP("rucio")
client = Client()

@mcp.tool()
def list_dids(scope: str,
              pattern: str = "*") -> str:
    """Search datasets in a scope by wildcard.

    Use a narrow pattern; results are paginated.
    """
    return ", ".join(
        client.list_dids(scope, {"name": pattern}))

mcp.run()

rucio-mcp started from this barebones structure

• Everything the LLM sees is right here: name list_dids, schema scope: str, pattern: str = "*", description = the docstring
• Wrap rucio.client, not the CLI: structured data in, curated text out
• Start on stdio on your laptop; add HTTP when a facility hosts it
• fastmcp handles the JSON-RPC; you only write the function

• ATLAS — where I work; the deepest playbook, in production at the UChicago AF.
• CMS & DUNE — the hosted data-access layer already serves their VOs; informal collaboration with colleagues on these agentic ideas.
• Belle II — early discussions on the same ideas.
• ESCAPE — a live escape site behind the hosted Rucio MCP: the bridge to the multi-science world (backup).

rucio-mcp.af.uchicago.edu: live OIDC sites for atlas, cms, dune, escape.

claude mcp add --transport http rucio-atlas \
  https://rucio-mcp.af.uchicago.edu/site/atlas/

→

→

→

→

→

→

→

→

bad: a token service deciding permissions

if "atlas-users" in token["groups"]:
    mint_ticket(user)
# a second copy of the access rules,
# trusting whatever the token claims

good: it only verifies who is calling

claims = verify(token, aud="krb5-token-service")
mint_ticket(claims["sub"])
# the gateway already decided permissions;
# this token proves who, from the broker

sketch; written into each token service's docstring (krb5 app.py)

entitlements:
  group_permissions:
    /connect/atlas-af: [read_data, read_files,
      submit_jobs, manage_jobs, manage_jupyter, ...]
    /connect/uchicago/admin: [..., exec_jobs,
      manage_data, admin]
    __authenticated__: [read_monitoring]
aggregator:
  services:
    - name: condor_service
      exclude_tools: ["advertise_to_collector"]
      required_permission:  # no __default__:
        submit_job: submit_jobs  # new tools
        remove_job: manage_jobs  # ship off
        exec_in_job: exec_jobs
        query_jobs: read_monitoring

excerpt of the deployed Helm values (UChicago AF)

bad: the raw API dump

{"logicalDatasetName": "mc23_13p6TeV.601229...",
 "crossSection": "0.729", "crossSection_unit": "nb",
 "genFiltEff": "1.0", "kFactor": "1.0",
 "principalPhysicsGroup": "...", "prodsysStatus":
 "...", ...95 more fields, duplicate rows...}

every field, no units help, and the same for each of 50 datasets

good: markdown-friendly, LLM-friendly

**mc23_13p6TeV.601229** (PhPy8EG ttbar) · VALID
Cross-section: 729 pb (0.729 nb × 1000)
Events: 2M · k-factor: 1.0

---
**Next steps:**
- ami_get_dataset_prov for provenance
- rucio_list_dataset_replicas to locate copies

~15 curated fields, units converted in the open, follow-up tools named

bad: what the agent sees by default

Traceback (most recent call last):
  File ".../replicaclient.py", line 158, ...
rucio.common.exception.DataIdentifierNotFound:
  Data identifier 'user.gstark:mydata'
  not found

a dead end: nothing tells the agent what to try next

good: what rucio-mcp returns instead

Error: Data identifier
'user.gstark:mydata' not found

**Recovery:** The DID does not exist in
Rucio. Use `rucio_list_dids` with a
wildcard pattern to search for it.

returned to the agent, not raised into server logs; the next tool is named

bad: rucio_list_files("mc23..."), unbounded

mc23_13p6TeV:file_000001.root
mc23_13p6TeV:file_000002.root
mc23_13p6TeV:file_000003.root
... 499,997 more lines ...

one call floods the LLM's entire context window, and the server downloaded all 500k names to do it

good: capped, and the output says so

mc23_13p6TeV:file_000001.root
... 49 more ...

---
Showing 50 results (offset=0).
Pass `offset=50` to see more.

a hard server-side limit, announced in the output, with the way to continue spelled out

Coach = engine · playbook = playbook · athletes = agents · equipment = services · stadium = gateway

• ESCAPE’s Data Lake (Rucio), VRE (k8s + Jupyter + REANA + CVMFS), and OSSR software registry: a multi-science analysis platform.
• My hosted Rucio MCP already serves an escape site. The bridge is built; the agentic layer can sit on top of the VRE.
• Multi-messenger by design: gravitational waves (Virgo), neutrinos (KM3NeT), dark matter (XENON), cosmic rays (Auger).

# escape.cfg, a real shipped site config
[client]
rucio_host = https://vre-rucio.cern.ch
auth_host = https://vre-rucio-auth.cern.ch
oidc_issuer = escape
oidc_audience = rucio

How do we evaluate, and secure, an agent that acts?

How should facilities expose context?

How do we share context between facilities, and keep it true?

What makes an environment truly portable, and maintainable?

Who pays for inference, and is that fair?

What becomes standard across sciences?