layr8/mcp

Home for Layr8's MCP (Model Context Protocol) components — the pieces that bridge MCP and the Layr8 DIDComm network. Two components live here.

@layr8/mcp — adapter for non-agent runtimes

Root package (src/, package.json).

ember and openclaw are Layr8's agent runtimes. Everything else that wants to reach the Layr8 network — a developer's Claude Code session, a CI step, an n8n workflow, an SRE dashboard — needs a way in that goes through the DIDComm path and its auth surface (helix delegation, VG gating), not around it via admin GraphQL or kubectl.

@layr8/mcp is a stdio MCP server that exposes the DIDComm primitives ember uses — send, request, VG presentation, mcp-gateway routing — as MCP tools any MCP client can call. It holds its own DID and talks to a cloud-node directly via @layr8/sdk.

It ships two bins:

• layr8-broker (recommended) — a resident daemon that holds one stable, granted agent DID and multiplexes every Claude Code session over it, plus a thin stdio shim each session spawns. This is the path the Space portal's Connect an agent wizard drives.
• layr8-mcp — the original per-session adapter (one ephemeral DID per session); kept for compatibility.

Install & connect (broker)

Single-file binary — no Node/npm needed (macOS + Linux):

curl -fsSL https://raw.githubusercontent.com/layr8/mcp/main/install.sh | sh

It installs layr8-broker to ~/.local/bin (override with LAYR8_BIN_DIR). Or, if you already have Node ≥ 20:

npm i -g @layr8/mcp

Then, from your Space in the portal (Agents → Connect an agent):

1. Name your agent and click Generate enrol command, then run what it gives you. It redeems a one-time code for a stable agent DID + credentials written to ~/.config/layr8-mcp/<env>.json — no tokens or OAuth to paste:

   layr8-broker enrol --code <code> --at <stratus-url>

2. Point your MCP client at the broker:

   claude mcp add layr8 -- layr8-broker

   The shim auto-starts the resident daemon on first use — you never run layr8-broker daemon by hand.
3. Grant the agent the tools it should use in the portal (Permissions). Until then, tools/list works but tool calls are safely denied.

Select env via LAYR8_MCP_ENV (default dev).

Run the wizard once per env: layr8-mcp setup — it asks for env name, cloud-node URL and API key, tests the connection, mints (or reclaims) the DID, and writes ~/.config/layr8-mcp/<env>.json. After that layr8-mcp (no args) starts the stdio server; the wizard prints the mcpServers snippet for ~/.claude.json.

mcp-gateway/ — the MCP gateway service

Package @layr8/mcp-gateway — see mcp-gateway/README.md.

A deployed Layr8 service that mediates agent access to third-party MCP servers (e.g. Gmail) under VG-based authorization. It is a DIDComm-connected PEP: it spawns upstream MCP servers as subprocesses, builds a tool catalog from them, and executes Helix-authorized tool calls. No HTTP ingress, no database; env-var configured.

Ships as a container image (ghcr.io/layr8/mcp-gateway) and a Helm chart (ghcr.io/layr8/charts/mcp-gateway), built by .github/workflows/ci-mcp-gateway.yaml.

Repo layout

src/                         @layr8/mcp — adapter source
package.json / tsconfig.json @layr8/mcp — root package (npm)

mcp-gateway/                 @layr8/mcp-gateway — gateway service (pnpm)
charts/mcp-gateway/          gateway Helm chart
Dockerfile.mcp-gateway       gateway image build
scripts/mcp-gateway/         gateway operational scripts (Gmail OAuth onboarding)
tsconfig.base.json           shared TS base config (mcp-gateway extends it)
.github/workflows/           gateway CI

The two components are independent today — different package managers, separate builds, separate release artifacts — and are expected to converge: both exist to make MCP capabilities reachable across the DIDComm boundary, one from the client side, one as a gateway. @layr8/mcp was the first cut for non-agent runtimes; the longer-term direction unifies the two behaviorally.

Build

Each component builds independently — see its own package.json.

# @layr8/mcp (root)
npm install && npm run build

# mcp-gateway
cd mcp-gateway && pnpm install && pnpm build

mcp-gateway depends on @layr8/sdk via file:../../node-sdk; clone layr8/node-sdk as a sibling of this repo for local builds. CI checks it out as a sibling automatically.