Model Context Protocol · tool gateway

The model gateway is open.
The tool gateway is not.

https://chainlayertwo.online/v1 answers anonymously — no account, no key. https://chainlayertwo.online/mcp does not. Every MCP request is bearer-checked before dispatch, and a missing or wrong token is a 401. There is no anonymous mode and no way to enable one.

How to get a token See the 37 tools

Bearer required on /mcp · no signup · self-hostable · MCP over Streamable HTTP

Access

Read this before you point a client at it.

Earlier versions of this page said the hosted endpoint needed no API key. That was wrong, and it would have sent you straight into a 401. Here is what the endpoint actually does.

A bearer token is required. There is no anonymous access.

An unauthenticated request to https://chainlayertwo.online/mcp — initialize, tools/list, anything — is rejected before the request body is even parsed:

$ curl -i -X POST https://chainlayertwo.online/mcp \
     -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer

{"error":"invalid_request","error_description":"Missing bearer token"}

The token is not self-serve. There is no signup form, no dashboard, and no issuing endpoint anywhere in the product. A deployment's token is a single shared secret its operator generates and hands out. If you do not have one, the two honest options are below.

`/v1` — model gateway

open

GET /v1/models and POST /v1/chat/completions return 200 with no Authorization header. That is deliberate: it is what makes the one-line CLI install work in twenty seconds with nothing to configure.

It is OpenAI-compatible, so any OpenAI client can point at it.

`/mcp` — tool gateway

bearer

POST, GET and DELETE on /mcp all run through the same auth middleware, ahead of body parsing. Only Authorization: Bearer <token> is accepted; the comparison is constant-time.

Tools can read files, fetch URLs and analyse binaries. Gating them is the point.

Two ways to get a working token

Ask whoever runs the deployment. If someone gave you this URL, they hold the token. One token per deployment, shared by everyone who holds it — there is no per-user scoping, so treat it as a shared secret and do not paste it into anything you would not paste a password into.
Or run your own and mint one. The MCP server is a Node process. Generate a token with openssl rand -hex 32, set it as CHAINLAYER2_MCP_TOKEN, and the server refuses to start over HTTP without it. Steps are in self-host.
Then store it, once. Add an entry to mcpServers in ~/.chainlayer/config.json, or pass the header directly. The CLI installer never writes a token for you and never ships one.

Built-in tools

37 tools, in seven groups.

These are the tools registered by the server source, every one of them local to the process. Federation of upstream MCP servers is stdio-only, so an HTTPS endpoint serves exactly its own local set. What a particular deployment exposes depends on its build and configuration — tools/list on your endpoint is the only authority.

Math

Exact evaluation, symbolic work, and unit handling — the things a language model is worst at doing in its head.

math_evalmath_simplifymath_derivativemath_solveunit_convertmatrix_opmath_statsnumber_theory

Utility

Hashing, encoding, base conversion, regex extraction, JSON querying and date arithmetic.

hashencodebase_convertregex_extractjson_querydatetime

Data

Preview and convert the formats that arrive as opaque blobs — CSV, YAML, JWTs, URLs, UUIDs.

csv_previewyaml_convertjwt_decodeurl_parseuuid_inspect

Devtools

Diff two texts, preview a patch before it lands, measure code, render a template.

diff_textpatch_previewcode_metricsrender_template

Network

Fetch a URL. Internal and loopback addresses are blocked unless the operator opts in.

web_fetch

Re-grounding

Restate the objective and plan a path when a long agent run starts to drift, on a CONTEXT / MECHANISM / PATH triad.

reground

Authorized RE

Every one of these requires an authorized: true attestation typed as a literal, stays inside RE_ALLOWED_DIRS, honours a non-overridable denylist, and is audit-logged whether allowed or refused.

binary_infore_identifyre_hashre_entropystrings_scanre_sectionsre_importsre_exportsre_symbolsdisassembledecompileprotocol_inspect

The RE plane is off until you turn it on. With RE_ALLOWED_DIRS unset it refuses everything, and the values it will accept are validated at startup: a filesystem root, the app's own tree, or a user home directory is rejected outright. The built-in denylist always covers the first-party source tree, the app's directories, the audit log, and platform secret paths — and no flag overrides it.

Connect

One endpoint, any MCP client — with the header.

Every snippet below sends Authorization: Bearer. Read the token from your environment; do not paste it into a file you will commit. Nothing on this page contains a real token.

Claude Code

claude mcp add --transport http \
  chainlayertwo \
  https://chainlayertwo.online/mcp \
  --header "Authorization: Bearer $CHAINLAYER2_MCP_TOKEN"

Without --header the server never sees a token and every tool call fails at 401.

ChainLayer CLI · ~/.chainlayer/config.json

{
  "baseUrl": "https://chainlayertwo.online/v1",
  "mcpServers": [
    {
      "name": "chainlayertwo",
      "url": "https://chainlayertwo.online/mcp",
      "token": "<your token>"
    }
  ]
}

baseUrl needs no key. mcpServers[].token does.

curl · raw MCP

curl -X POST https://chainlayertwo.online/mcp \
  -H "Authorization: Bearer $CHAINLAYER2_MCP_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2024-11-05",
      "capabilities": {},
      "clientInfo": {"name":"my-agent","version":"0.1.0"}
    }
  }'

Streamable HTTP wants both media types in Accept; the response carries an Mcp-Session-Id to reuse.

Observability

One trace. Five sinks.

A run's trace id is minted once, at the edge, and carried down every hop. The point of the guarantee is operational: one grep for that id across five logs reconstructs the whole run.

CLI transcript The agent loop's own record of the turn, carrying the execution context.

API access log The control-plane edge, where the trace id is minted.

Run store Durable event records for a run and its child tasks.

MCP request log One structured tool_call line per invocation: tool, ok, ms.

RE audit log Append-only {timestamp, tool, target, decision}, refusals included.

The id itself Matches trace_[A-Za-z0-9_-]{8,128}. Per run, not per session; ids that fail the pattern are dropped rather than logged.

The MCP server's HTTP surface is four routes: GET /health, and POST / GET / DELETE on /mcp. The GET /mcp stream is the protocol's own SSE channel — it needs both a bearer token and an established session id, and it is not a public activity feed.

Self-host

Run it yourself and hold your own token.

The server is a single Node process (Node 20+; the MCP package itself asks for 24). Behind your own firewall you decide who gets the token and which directories the RE plane can see.

build and run

# from a ChainLayer checkout
cd chainlayer2-mcp
npm install
npm run build

cp .env.example .env
# then edit .env — see the next card

MCP_TRANSPORT=http MCP_PORT=8930 node dist/server.js

Over HTTP the server refuses to start at all without a token. That is the intended failure mode.

.env

# mint your own; never reuse one from a doc
CHAINLAYER2_MCP_TOKEN=$(openssl rand -hex 32)

# RE stays off until this names real directories.
# Roots, the app tree and home dirs are rejected.
RE_ALLOWED_DIRS=/srv/samples:/srv/builds

# optional
RE_DENYLIST=/srv/samples/quarantine
MCP_AUDIT_LOG=/var/log/chainlayer2/re-audit.jsonl
MCP_UPSTREAMS=          # stdio federation only

Put the token in front of a TLS terminator you control. Auth is the app's job; the proxy only terminates TLS.

Start here

Models in twenty seconds. Tools when you have a token.

The one-line install gives you the CLI against the open model gateway. It will tell you, in yellow, that tools are not available — and then tell you the two ways to turn them on.

Windows irm https://chainlayertwo.online/install.ps1 | iex

macOS / Linux curl -fsSL https://chainlayertwo.online/install.sh | sh

Back to the platform Re-read the access rules

The model gateway is open.The tool gateway is not.