{
  "title": "Hybrid MCP Pattern Matrix",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP 2026-07-28",
  "sourcePackage": "research/10",
  "integrityNote": "All 108 listed ordinary archive payloads verify. The package contains two incompatible numeric source namespaces; public records preserve an explicit archive namespace and never resolve IDs across families.",
  "evidencePolicy": "Only manually curated build_context source groups appear in sourceIds. Raw row tokens are preserved under archive and are not treated as publication citations.",
  "checkedAt": "2026-08-26",
  "count": 8,
  "records": [
    {
      "Pattern": "Parallel local and remote servers",
      "Flow": "Host connects directly to both stdio and HTTP servers",
      "Benefit": "Use each deployment where it fits",
      "Primary risk": "Model may combine data/actions across trust zones",
      "Control": "Per-server labels, confirmations, provenance and least privilege",
      "id": "R10-HYB001",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 1,
        "sourceIds": [],
        "raw": {
          "Pattern": "Parallel local and remote servers",
          "Flow": "Host connects directly to both stdio and HTTP servers",
          "Benefit": "Use each deployment where it fits",
          "Primary risk": "Model may combine data/actions across trust zones",
          "Control": "Per-server labels, confirmations, provenance and least privilege"
        }
      }
    },
    {
      "Pattern": "Local bridge for private system",
      "Flow": "Cloud/remote host → secure tunnel → local/on-prem bridge → private system",
      "Benefit": "Avoid public exposure of private service",
      "Primary risk": "Bridge becomes privileged ingress path",
      "Control": "Device identity, allowlisted operations, user presence and audit",
      "id": "R10-HYB002",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 2,
        "sourceIds": [],
        "raw": {
          "Pattern": "Local bridge for private system",
          "Flow": "Cloud/remote host → secure tunnel → local/on-prem bridge → private system",
          "Benefit": "Avoid public exposure of private service",
          "Primary risk": "Bridge becomes privileged ingress path",
          "Control": "Device identity, allowlisted operations, user presence and audit"
        }
      }
    },
    {
      "Pattern": "Local proxy for remote OAuth",
      "Flow": "Host stdio → local proxy → remote OAuth MCP",
      "Benefit": "Adds remote support to older client",
      "Primary risk": "Proxy code and token storage",
      "Control": "Patched minimal proxy, pinned package, native migration plan",
      "id": "R10-HYB003",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 3,
        "sourceIds": [],
        "raw": {
          "Pattern": "Local proxy for remote OAuth",
          "Flow": "Host stdio → local proxy → remote OAuth MCP",
          "Benefit": "Adds remote support to older client",
          "Primary risk": "Proxy code and token storage",
          "Control": "Patched minimal proxy, pinned package, native migration plan"
        }
      }
    },
    {
      "Pattern": "Enterprise gateway plus approved locals",
      "Flow": "Remote servers through gateway; local servers through endpoint policy",
      "Benefit": "Central remote governance without losing local capabilities",
      "Primary risk": "Inconsistent controls across planes",
      "Control": "Unified inventory and audit schema",
      "id": "R10-HYB004",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 4,
        "sourceIds": [],
        "raw": {
          "Pattern": "Enterprise gateway plus approved locals",
          "Flow": "Remote servers through gateway; local servers through endpoint policy",
          "Benefit": "Central remote governance without losing local capabilities",
          "Primary risk": "Inconsistent controls across planes",
          "Control": "Unified inventory and audit schema"
        }
      }
    },
    {
      "Pattern": "Remote coordinator with local worker",
      "Flow": "Remote MCP delegates narrow operation to authenticated local agent",
      "Benefit": "Cloud orchestration with device-local capability",
      "Primary risk": "Remote command/control channel",
      "Control": "One-purpose protocol, explicit approval, no arbitrary shell",
      "id": "R10-HYB005",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 5,
        "sourceIds": [],
        "raw": {
          "Pattern": "Remote coordinator with local worker",
          "Flow": "Remote MCP delegates narrow operation to authenticated local agent",
          "Benefit": "Cloud orchestration with device-local capability",
          "Primary risk": "Remote command/control channel",
          "Control": "One-purpose protocol, explicit approval, no arbitrary shell"
        }
      }
    },
    {
      "Pattern": "Local cache of remote service",
      "Flow": "Local server caches/filters remote API results",
      "Benefit": "Latency, offline resilience and data minimization",
      "Primary risk": "Stale data and token/local cache exposure",
      "Control": "TTL, encryption, invalidation and clear provenance",
      "id": "R10-HYB006",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 6,
        "sourceIds": [],
        "raw": {
          "Pattern": "Local cache of remote service",
          "Flow": "Local server caches/filters remote API results",
          "Benefit": "Latency, offline resilience and data minimization",
          "Primary risk": "Stale data and token/local cache exposure",
          "Control": "TTL, encryption, invalidation and clear provenance"
        }
      }
    },
    {
      "Pattern": "Remote service with desktop UI helper",
      "Flow": "Remote MCP supplies data; local helper integrates OS/UI",
      "Benefit": "Central backend plus native desktop features",
      "Primary risk": "Identity split and duplicate state",
      "Control": "Explicit account linking and narrow IPC",
      "id": "R10-HYB007",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 7,
        "sourceIds": [],
        "raw": {
          "Pattern": "Remote service with desktop UI helper",
          "Flow": "Remote MCP supplies data; local helper integrates OS/UI",
          "Benefit": "Central backend plus native desktop features",
          "Primary risk": "Identity split and duplicate state",
          "Control": "Explicit account linking and narrow IPC"
        }
      }
    },
    {
      "Pattern": "Development local, production remote",
      "Flow": "Same server code over stdio locally and HTTP in production",
      "Benefit": "Fast development and centralized production",
      "Primary risk": "Behavior/security drift between transports",
      "Control": "Transport-neutral tests and deployment-specific threat reviews",
      "id": "R10-HYB008",
      "sourceIds": [
        "S121",
        "S057",
        "S132",
        "S131",
        "S133"
      ],
      "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping",
      "archive": {
        "namespace": "research/10/hybrid_patterns.json",
        "row": 8,
        "sourceIds": [],
        "raw": {
          "Pattern": "Development local, production remote",
          "Flow": "Same server code over stdio locally and HTTP in production",
          "Benefit": "Fast development and centralized production",
          "Primary risk": "Behavior/security drift between transports",
          "Control": "Transport-neutral tests and deployment-specific threat reviews"
        }
      }
    }
  ]
}