Living Stack MCP

Living Stack MCP gives MCP-capable AI agents a bounded control-and-proof plane: scoped continuity, action authorization, budget reservations, typed outcome evidence, claim gates, durable checkpoints, and cryptographically signed trace exports. It does not replace the model or execute the customer's actions.

What ships in 0.3 public beta

• 14 bounded MCP tools over local stdio.

• Per-session state with append-only SHA-256-linked evidence ledgers.

• Server-owned risk policy; external and destructive actions are denied by default.

• Cost reservation and reconciliation against a session ceiling.

• Credential-shaped value redaction before persistence or protocol output.

• Scope-, state-, expiry-, and lineage-bound recovery checkpoints.

• Ed25519-signed trace exports tied to one local installation.

• Optional offline entitlement grants; billing secrets never enter the MCP.

Related MCP server: velvet-rope

Install

Requires Node.js 22 or later.

MCP bundle

Download the signed-release-bound Living Stack MCP bundle and import it into an MCPB-compatible client. Its frozen SHA-256 is aa7e09be0377bc076feb084a72bb9fc12b2e4903c22e318cb3a6a5d08ea4eb6b.

The same bundle and hash are active in the official MCP Registry. The indexed tool surface is also live on Glama.

Command line

npx -y github:equinoxaifinance-rgb/living-stack-mcp

Or install globally:

npm install -g github:equinoxaifinance-rgb/living-stack-mcp
living-stack-mcp

Minimal MCP configuration:

{
  "mcpServers": {
    "living-stack": {
      "command": "npx",
      "args": ["-y", "github:equinoxaifinance-rgb/living-stack-mcp"]
    }
  }
}

State defaults to ~/.living-stack-mcp/state. Set LIVING_STACK_STATE_DIR to a dedicated directory. Set LIVING_STACK_ALLOWED_ROOTS to explicit roots if release-manifest verification is needed.

Lifecycle

1. livingstack.session_start freezes scope, goal, retention, and budget.

2. livingstack.context_put stores provenance-labeled context.

3. livingstack.authorize_action checks risk and reserves cost.

4. The MCP host performs the action with its own tools and permissions.

5. livingstack.record_outcome consumes authorization and records evidence.

6. livingstack.check_claim tests whether a claim has sufficient evidence.

7. Checkpoint tools preserve and verify bounded recoverable state.

8. Trace tools expose redacted reports and workspace-signed exports.

Security boundaries

Living Stack MCP has no arbitrary shell, browser, HTTP, database, deployment, or publication tools. It does not inspect personal Codex or Claude state. A workspace signature proves that an export came from one local installation; it does not by itself prove publisher or user identity. The host remains the authority and executor.

This public beta is local-first and free. Proposed managed tiers are described in COMMERCIAL.md, but no paid managed service is for sale yet. The Organism is a separate Claude-derived product line and is not bundled into Living Stack MCP.

See PRODUCT.md, SECURITY.md, and CHANGELOG.md.

Development

npm ci
npm test
npm run verify

License: Apache-2.0.

Brand assets and their meaning are documented in BRAND.md.