ChainLayerTwo

https://chainlayertwo.online/mcp Model Context Protocol, Streamable HTTP

ChainLayer2 MCP, the tool gateway.

46 tools for math, data, devtools, fetch and search, knowledge, re-grounding and authorized reverse engineering, behind one bearer-gated door. Every request is checked before it is dispatched, and a missing or wrong token is always 401. There is no anonymous mode and no way to turn one on.

How to get a token See the tools

Authorization: Beareraccess

Read this before you point a client at it.

An unauthenticated request to /mcp (initialize, tools/list, anything) is refused before its body is even parsed.

curl, no token401
$ curl -i -X POST https://chainlayertwo.online/mcp \
     -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer

{"jsonrpc":"2.0","error":{"code":-32001,
 "message":"Unauthorized: missing or invalid bearer token"},"id":null}

/v1, the model gateway

Needs an OmniRoute API key as Authorization: Bearer. The installer writes a published key into your config, and you can make your own on the account panel. OpenAI-compatible, but with no working model backends right now; the CLI’s own local model works without it.

/mcp, the tool gateway

POST, GET and DELETE all pass the same auth check before body parsing, with a constant-time comparison. Tools can read files, fetch URLs and analyse binaries; gating them is the point.

Getting a working token

  1. Ask whoever runs the deploymentA deployment has one token, shared by everyone who holds it. There is no per-user scoping, so treat it like a password.
  2. Or run your own and mint oneGenerate it with openssl rand -hex 32 and set CHAINLAYER2_MCP_TOKEN; over HTTP the server will not start without it. See self-host.
  3. Store it onceAdd an entry to mcpServers in ~/.chainlayer/config.json, or pass the header directly. The CLI-only installer never writes one for you.

The token is not self-serve: there is no sign-up form or issuing endpoint for it. A full-stack install mints one for the local server on your machine.

tools/listbuilt-in tools

46 tools, in eight groups.

These are registered by the server source, all local to the process. An operator can also federate upstream MCP servers (MCP_UPSTREAMS, stdio commands or Streamable-HTTP URLs), whose tools then appear under a <namespace>_ prefix. tools/list on your endpoint is the only authority.

Math 8

Exact evaluation, symbolic work and units: what a language model is worst at doing in its head.

math_evalmath_simplifymath_derivativemath_solveunit_convertmatrix_opmath_statsnumber_theory

Utility 6

Hashing, encoding, base conversion, regex extraction, JSON queries and date arithmetic.

hashencodebase_convertregex_extractjson_querydatetime

Data 5

Preview and convert what arrives as opaque blobs: CSV, YAML, JWTs, URLs, UUIDs.

csv_previewyaml_convertjwt_decodeurl_parseuuid_inspect

Devtools 4

Diff two texts, preview a patch before it lands, measure code, render a template.

diff_textpatch_previewcode_metricsrender_template

Network 2

Fetch a URL or search the web. Internal and loopback addresses are blocked unless the operator opts in.

web_fetchweb_search

Knowledge 8

A memory that survives sessions: retain facts, search them, export and re-import. Re-grounding consults it.

knowledge_addknowledge_searchknowledge_briefknowledge_listknowledge_exportknowledge_importknowledge_organizeknowledge_forget

Re-grounding 1

Restates the objective and plans a path when a long run starts to drift, as context, mechanism and path.

reground

Authorized RE 12

Each needs an authorized: true attestation typed as a literal, stays inside RE_ALLOWED_DIRS, honours a denylist no flag overrides, and is audit-logged whether allowed or refused.

binary_infore_identifyre_hashre_entropystrings_scanre_sectionsre_importsre_exportsre_symbolsdisassembledecompileprotocol_inspect
The reverse-engineering tools are off until you turn them on.

With RE_ALLOWED_DIRS unset they refuse everything, and a filesystem root, the app’s own tree or a home directory is rejected at startup. The built-in denylist always covers the first-party source tree, the app’s directories, the audit log and platform secret paths. They are for interoperability, your own binaries, authorized security research and lab malware analysis; not for cracking, piracy or DRM removal.

mcpServersconnect a client

Any MCP client, with the header.

Every snippet sends Authorization: Bearer and reads the token from your environment. Nothing on this page contains a real token.

Claude Code
claude mcp add --transport http \
  chainlayertwo \
  https://chainlayertwo.online/mcp \
  --header "Authorization: Bearer $CHAINLAYER2_MCP_TOKEN"
ChainLayerTwo CLI, ~/.chainlayer/config.json
{
  "mcpServers": [
    {
      "name": "chainlayertwo",
      "url": "https://chainlayertwo.online/mcp",
      "token": "<your token>"
    }
  ]
}

Add this beside what is already in the file. mcpServers[].token is the MCP bearer token, and may be a ${VAR} reference to an environment variable instead of the literal. Or run chainlayertwo mcp add chainlayertwo --url https://chainlayertwo.online/mcp --token <token>.

curl, raw MCP
curl -X POST https://chainlayertwo.online/mcp \
  -H "Authorization: Bearer $CHAINLAYER2_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
       "params":{"protocolVersion":"2024-11-05","capabilities":{},
                 "clientInfo":{"name":"my-agent","version":"1.0.0"}}}'

Streamable HTTP wants both media types in Accept; reuse the Mcp-Session-Id the response carries.

trace_idobservability

One trace id, five logs.

A run’s trace id is minted once, at the edge, and carried down every hop. One search for it across five logs reconstructs the whole run.

CLI transcript

The agent loop’s own record of the turn.

API access log

The control-plane edge, where the id is minted.

Run store

Durable event records for a run and its child tasks.

MCP request log

One structured tool_call line per call: tool, ok, milliseconds.

RE audit log

Append-only {timestamp, tool, target, decision}, refusals included.

The id itself

Matches trace_[A-Za-z0-9_-]{8,128}, per run. Ids that fail the pattern are dropped, not logged.

The server’s HTTP surface is four routes: GET /health, and POST, GET and DELETE on /mcp. GET /mcp is the protocol’s own event stream; it needs a token and a session, and is not a public feed.

node dist/server.jsself-host

Run it yourself and hold your own token.

One Node process, Node 20 or newer. Behind your own firewall you decide who gets the token and which folders the reverse-engineering tools can see. The full-stack install does this for you on 127.0.0.1:8930.

build and run
# from a ChainLayer checkout
cd chainlayer2-mcp
npm install
npm run build
cp .env.example .env   # then edit it, see below

MCP_TRANSPORT=http MCP_PORT=8930 node dist/server.js
# listens on 127.0.0.1; MCP_HOST=0.0.0.0 to serve other machines
.env
# mint your own; never reuse one from a doc
CHAINLAYER2_MCP_TOKEN=$(openssl rand -hex 32)

# RE stays off until this names real directories.
# Roots, the app tree and home dirs are rejected.
RE_ALLOWED_DIRS=/srv/samples:/srv/builds

# optional
RE_DENYLIST=/srv/samples/quarantine
MCP_AUDIT_LOG=/var/log/chainlayer2/re-audit.jsonl
MCP_UPSTREAMS=          # namespace=url or namespace=command, comma-separated
# upstream URLs on private addresses need MCP_FEDERATION_ALLOW_INTERNAL=1

Put a TLS terminator you control in front. Auth is the server’s job; the proxy only terminates TLS.

Install ChainLayerTwo The /v1 API