Living Stack MCP

Make agent work prove itself.

Living Stack MCP gives MCP-capable AI agents a bounded control-and-proof plane: scoped continuity, action authorization, budget reservations, typed outcome evidence, claim gates, durable checkpoints, and cryptographically signed trace exports. It does not replace the model or execute the customer's actions.

Try the complete Community edition free:

npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1 --self-test

That sixty-second local proof sends nothing. If one private workspace needs to coordinate up to five installations, Team Local is $19 once.

The repository is also a portable Agent Plugins 1.0 bundle: compatible clients can install the MCP server and its operating skill together from the same pinned release.

What ships in 0.3 public beta

15 bounded MCP tools and three guided lifecycle prompts over local stdio.
Per-session state with append-only SHA-256-linked evidence ledgers.
Server-owned risk policy; external and destructive actions are denied by default.
Cost reservation and reconciliation against a session ceiling.
Credential-shaped value redaction before persistence or protocol output.
Scope-, state-, expiry-, and lineage-bound recovery checkpoints.
Ed25519-signed trace exports tied to one local installation.
An explicit-consent, minimal signed adoption receipt; no session or task payload is accepted.
Optional offline entitlement grants; billing secrets never enter the MCP.

Install

Requires Node.js 22 or later.

MCP bundle

Download the SHA-256-release-bound Living Stack MCP bundle and import it into an MCPB-compatible client. Verify downloaded bytes against the SHA256SUMS.txt asset attached to that exact GitHub release.

The same bundle and hash are active in the official MCP Registry. The indexed tool surface is also live on Glama and Smithery.

The live remote commerce MCP is separately available through the official MCP Registry and its Smithery gateway.

Install in VS Code, add it to Cursor, or follow the exact-version Codex, Claude Code, VS Code, Cursor, and desktop client guide.

Command line

npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1

Prove the package locally before configuring a host:

npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1 --self-test

That command exercises a new bounded session, authorization, typed outcome, claim gate, checkpoint round trip, signed trace, and clean session close. It does not contact Living Stack. To send one minimal signed first-run receipt, the user must deliberately add --report-first-run --host=<host>; the exact fields are listed in the Privacy section below.

Or install globally:

npm install -g github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1
living-stack-mcp

Minimal MCP configuration:

{
  "mcpServers": {
    "living-stack": {
      "command": "npx",
      "args": ["-y", "github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1"]
    }
  }
}

State defaults to ~/.living-stack-mcp/state. Set LIVING_STACK_STATE_DIR to a dedicated directory. Set LIVING_STACK_ALLOWED_ROOTS to explicit roots if release-manifest verification is needed.

First agent run

Ask the connected agent to use the native livingstack.prove_task prompt, or copy the concise workflow in QUICKSTART.md. The guided path freezes scope and budget before action, authorizes an exact target, records typed evidence references afterward, retains explicit outcome IDs, and blocks unsupported completion language unless the identical subject and selected fresh outcomes support it—without taking over the host's tools.

Lifecycle

livingstack.session_start freezes scope, goal, retention, and budget.
livingstack.context_put stores provenance-labeled context.
livingstack.authorize_action checks risk and reserves cost.
The MCP host performs the action with its own tools and permissions.
livingstack.record_outcome consumes authorization and records evidence.
livingstack.check_claim tests a claim only against explicit fresh successful outcome_ids bound to the exact authorization target supplied again as subject; unrelated session evidence cannot satisfy it.
Checkpoint tools preserve and verify bounded recoverable state.
Trace tools expose redacted reports and workspace-signed exports.

Security boundaries

Living Stack MCP has no arbitrary shell, browser, database, deployment, or publication tools and no arbitrary HTTP capability. Its single publisher network action is a fixed-schema, fixed-origin adoption receipt that remains inert unless the user explicitly sets consent. It does not inspect personal Codex or Claude state. A workspace signature proves that an export came from one local installation; it does not by itself prove publisher or user identity. The host remains the authority and executor.

The complete Community edition is local-first and free. Team Local is available separately for $19 once; it coordinates one private workspace and up to five registered installations without changing the model or uploading Community session state. Exact scope, purchase paths, and boundaries are documented in COMMERCIAL.md.

See PRODUCT.md, SECURITY.md, and CHANGELOG.md. Installation paths are collected in CLIENTS.md.

Development

npm ci
npm test
npm run verify

License: Apache-2.0.

Brand assets and their meaning are documented in BRAND.md.

Privacy Policy

Living Stack Community runs locally and never sends session state, context, ledgers, checkpoints, private signing keys, or agent payloads to Living Stack. An optional first-run receipt is sent only after explicit consent and contains the package version, milestone, coarse host category, installation public-key hash, timestamp, and signature. The endpoint rejects arbitrary metadata. The complete policy covers collection, local use and storage, third-party sharing, retention, and contact information at living-stack-mcp.pages.dev/privacy.html.