Inspect and exercise a local AI gateway without credentials

Provides operating guidance for the official unified-ai-system MCP server: a way to inspect and exercise a local, credential-free AI gateway via Docker, without installing the server or changing Codex config itself (the official Codex plugin bundles the MCP definition; skill-only installs need manual setup). The skill pins to a specific reviewed release - the current public release and the latest reviewed immutable MCP image are both v0.4.9, identified by exact digests, and that pin must not be silently replaced with a mutable tag; changing it requires a new content review.

Setup runs as two separately-approved stages. Stage one downloads the reviewed 0.4.9 multi-platform image (linux/amd64 or linux/arm64) into Docker's cache, inspects its metadata and layer history, creates-but-never-starts a temporary container to export its root filesystem, and writes an inspection inventory - checking for native binaries, executable and SUID/SGID files, credential-like files, npm lifecycle hooks, and runtime-sensitive code patterns. The inventory must match a versioned upstream image-content review and an exact set of OCI index/manifest/config digests before proceeding; the review itself discloses that the image runs as root, bundles Debian shell/package utilities and 11 base-image SUID/SGID files, contains 522 internal pnpm links, 3 native Node binaries, and 8 lifecycle-hook declarations, and starts a child gateway over loopback HTTP (with an optional AI_GATEWAY_MCP_URL that only connects out when explicitly passed). Stage two, gated by a separate approval, registers the exact reviewed digest with pulling, container networking, Linux capabilities, and privilege escalation all disabled:

IMAGE='ghcr.io/happy520ai/unified-ai-system/mcp-server@sha256:751a0d32acd2d6b1da6ad9ac67987fbd1ff36ce26b7160014d8605f18b7907b3'
PLATFORM='linux/amd64' # Match the reviewed platform inspected above.
codex mcp add unified-ai-system -- docker run --rm -i --pull never --platform "$PLATFORM" --network none --cap-drop ALL --security-opt no-new-privileges "$IMAGE"
codex mcp get unified-ai-system --json

Once registered (and Codex is restarted or a new task started), nine MCP tools become available: gateway_health and gateway_readiness (status and chat-path readiness), gateway_prompt_enhance (local prompt structuring, no provider call), gateway_chat (deterministic credential-free chat proof), plus knowledge_readiness, workflow_health, workflow_actions, workforce_health, and workforce_agents for the gateway's other subsystems.

Use it when a user asks whether Unified AI System is healthy or ready, wants a credential-free gateway chat proof, asks about the gateway's knowledge/workflow/workforce surfaces, or wants evidence from the bundled MCP tools rather than a claim inferred from documentation or process exit codes. Do not use it for generic model comparisons, unrelated MCP servers, or deploying a production gateway - it explicitly does not deploy, benchmark, or certify the gateway for production, and a healthy handshake or a zero exit code is transport evidence only, never proof that readiness gates passed or grounds for a production-readiness, autonomy, or AGI claim.

Workflow: confirm the unified-ai-system tools are available (if not, run the approved setup and wait for a restart); call gateway_health then gateway_readiness before attempting chat; pick the narrowest tool that answers the request; report the returned provider, execution mode, readiness, and blockers exactly, keeping transport success separate from any product or capability claim. If readiness is blocked, report the blocker rather than retrying chat blindly; if the runtime might be using a real provider, stop before chat and keep the session read-only.

Requires Codex CLI and Docker running locally; the MCP server itself is a separately-installed official integration this skill only operates, not one it bundles. Every host-state change - image pulls, container creation, MCP registration, networking, teardown, even deleting the cached image - is treated as requiring informed user approval, and download/inspection approval is kept separate from registration/activation approval. --pull never stays in the registered command (fail closed if the reviewed image isn't already cached); provider credentials are never requested, read, or transmitted through this skill, and a real provider is never enabled without explicit, scoped authorization.

Codex users and security-conscious engineers who want a supply-chain-reviewed, approval-gated way to verify a local AI gateway's health and prove a credential-free chat path works, without silently pulling a mutable image or granting a container more privilege than the reviewed procedure allows.