Serve your agent a catalogue of 21 tools whose list is fixed at startup by one daemon session and its capability, so a tool your session's scope does not cover never appears. Each call becomes a daemon invocation that passes the policy, capability, budget, rate-limit and audit gates; the MCP server holds no write path of its own. Register it with Claude Code, Claude Desktop, Cursor or VS Code, and the written config carries no credential.

What it does

The layerx-mcp crate serves a catalogue of 21 tools to a model context protocol client: reads such as balance.get, history.list and receipt.get, and writes such as activity.submit, wallet.send, token.mint and grant.draw. Each tool names one required scope, and the server's authority is fixed at startup from one agent daemon session and its capability, so a tool whose scope the session does not hold is absent from the list. Every call becomes a DaemonInvocation that the agent daemon runs through its Policy, Capability, Budget, RateLimit and Audit gates; the MCP server has no write path of its own. A second transport serves the agent-to-agent protocol on a loopback endpoint with an agent card, and a TypeScript package carries adapters for six framework targets.

Key capabilities

• 21 scoped tools; a tool whose scope the bound session lacks never appears in the list.
• Every call passes the daemon's policy, capability, budget, rate-limit and audit gates.
• Read-only mode drops all write tools at construction, so mutations are unreachable.
• layerx install mcp registers the server with Claude Code, Claude Desktop, Cursor or VS Code.
• A2A serving publishes an agent card and answers message/send, tasks/get and tasks/cancel.
• TypeScript adapters for MCP, A2A, OpenAI, Anthropic, LangChain and the Vercel AI SDK.

Differentiators

There is no MCP-only write path: the server can only construct daemon invocations, and read-only mode is a construction boundary rather than a runtime check, so a read-only server holds no write tool to refuse. The installed host config is credential-free, and installation refuses outright until the daemon has enrolled.

Outcomes

• Hand a model a read-only server where no write tool exists
• Audit every tool call with a digest of its arguments
• Wire agents through MCP, A2A, OpenAI, Anthropic, LangChain or Vercel AI SDK

Technical notes

• Transports: layerx mcp serve --daemon-binding <path> [--read-only] on standard input and output, and a Unix-socket listener that admits connections by peer credential, owner uid/gid and socket mode. The served path holds no signing seed and no gateway credential.
• Bounds: MCP protocol version 2025-06-18; message and route arguments capped at 1,048,576 bytes; catalogue argument validation at 65,536 bytes; tool name at 128 bytes; history.list limit 1-256; activity.wait timeout 1-600,000 ms.
• A2A: layerx a2a serve requires --gateway-credential and --authorization-file, defaults to 127.0.0.1:9433, and publishes the card at /.well-known/agent-card.json and /.well-known/agent.json. Bearer tokens are compared in constant time. Limits: 32 KiB of headers, 256 KiB per request, 128 tracked tasks, 8 workers.
• Not served on A2A: message/stream, tasks/resubscribe and tasks/pushNotificationConfig/set return JSON-RPC -32004; an unknown method or an unserved skill returns -32601. The TypeScript agent card declares streaming: false and pushNotifications: false, and its cancelTask raises an unsupported-operation error.
• Framework adapters: the TypeScript integrations package needs Node.js 22.18.0 or newer and exposes layerx_spend, layerx_track and layerx_verify_receipt to every framework, plus layerx_events on the MCP path for signature-verified webhook deliveries (256 buffered). Its A2A integration requires a durable task store and an authentication boundary. A build and postinstall step patches hash-checked lines in its upstream framework dependencies, so a dependency bump needs the patch file updated with it.
• No ElizaOS, CrewAI or Virtuals Protocol adapter exists in the repository.

layerx install mcp --host claude-code --daemon-binding ~/.layerx/agentd/binding.json
layerx mcp serve --daemon-binding ~/.layerx/agentd/binding.json --read-only

layerx a2a serve \
  --gateway-credential "$LAYERX_GATEWAY_CREDENTIAL" \
  --authorization-file ~/.layerx/a2a/authorization.json \
  --listen 127.0.0.1:9433
layerx a2a status

More in Developers