v0.3.0 · durable · multi-model · parallel-agent
A terminal coding agent over a hardened local stack.
ChainLayer2 is a CLI coding agent that talks to models through one OpenAI-compatible gateway and to tools through one bearer-gated MCP gateway. Turns are journalled while they run, so a crash resumes instead of restarting.
Node 20+ · verifies SHA-256 before it installs · re-run to upgrade
Captured output · not a mock-up
This is what it prints.
Below is a real terminal session, reproduced verbatim: the launcher boots the local stack, health-checks both planes, then hands the terminal to chainlayer doctor. Nothing here was written for the website.
ASCII-art banner spelling CHAINLAYER, under a chain of three links, with the tagline: a terminal coding agent over a hardened local stack.
✓ Node v24.13.0 (recommended) ✓ OmniRoute service key resolved ✓ MCP bearer token resolved Bringing up the local ChainLayer stack… ● OmniRoute (model gateway) already running — http://localhost:20128/v1 (reusing) ✓ hardened: no-key → 401, service-key → 200 ● ChainLayer2 MCP (tool gateway) already running — http://localhost:8930/mcp (reusing) ✓ /health → 200, /mcp no-token → 401 (bearer-gated) ✓ Local ChainLayer stack is up. OmniRoute http://localhost:20128 · MCP http://localhost:8930 ▶ chainlayer doctor (composition health) ──────────────────────────────────────────────────────────── [PASS] omniroute.health 25ms reachable at http://localhost:20128/v1 (HTTP 401) [PASS] omniroute.auth 21ms no key → 401, service key → 200 [PASS] omniroute.catalog 20ms 115 models (auto/best-coding, auto/best-reasoning, auto/best-fast, …) [PASS] omniroute.completion 2384ms auto/best-coding → "pong" [PASS] mcp.health 2ms http://localhost:8930/health → 200 [PASS] mcp.auth 4ms no token → 401, token → HTTP 200 (reaches init) [PASS] mcp.initialize 15ms initialized "chainlayer2-local" (http://localhost:8930/mcp) [PASS] mcp.tools 0ms 12 tools (math_eval, math_simplify, math_derivative, math_solve, unit_convert, matrix_op, …) [PASS] mcp.math_eval 3ms math_eval(173 * 419) = 72487 [WARN] mcp.protocol_inspect 3ms RE plane disabled / requires host binary (expected) [WARN] unreal.availability 0ms Unreal MCP not federated/reachable (expected in this deployment) summary: 9 pass, 2 warn, 0 fail — OK (exit 0) ──────────────────────────────────────────────────────────── chainlayer exited (0).
NO_COLOR=1. Both services were
already running, so the launcher detected and reused them rather than starting a second copy.
Why math_eval is the proof
173 × 419 = 72487 has no local shortcut. A correct answer means the call actually crossed the MCP server the launcher had just health-checked — not an in-process fallback.
Two WARNs, on purpose
The RE plane is off until you set RE_ALLOWED_DIRS, and no Unreal MCP was federated. doctor exits 0 on warnings and 1 only on a real failure.
115 is a reading, not a spec
omniroute.catalog counts what /v1/models returned on that machine. The number moves with which providers are reachable; it is not a fixed catalog size.
The tool count moves too
This capture predates the current server, which registers 37 tools. What any endpoint actually serves is whatever tools/list returns on it.
How it works
Three planes on one chain, under one policy.
A task enters at the CLI, which mints a single trace_id and threads it through every hop below. The policy set at the top — sandbox, approval gate, budgets — is inherited, never re-decided further down.
OmniRoute
One OpenAI-compatible /v1 endpoint in front of a multi-provider catalog, with role routing (auto/best-coding, auto/best-reasoning, auto/best-fast) and provider fallback.
ChainLayer2 MCP
One bearer-gated Model Context Protocol door. 37 tools across math, data, devtools, fetch, re-grounding and authorized RE — plus federation of upstream MCP servers over stdio.
Parallel sub-agents
A journalled agent loop fans work into 2–8 sandboxed sub-agents, each inheriting the same policy and drawing on one shared budget, merged by a single fenced merger.
policy set at the top — sandbox · approval gate · budgets — is inherited by every hop below it
Roadmap
Two agents the platform is being built to carry.
Everything above this line ships today. The two agents below do not — no code in this repository implements either one. They are described here because they are what the primitives are aimed at, and because you should be able to tell the difference between what a product does and what it intends to do.
Game-Playing Agent
Would see the screen, plan, and act through the gateway.
The design: take the rendered frame as vision input through OmniRoute, reason about state and goals, and act by issuing tool calls through the ChainLayer2 tool gateway. At a decision fork, fan out parallel sub-agents to explore routes and merge the winner back.
It is scoped for automation, testing, and research — driving a game under a step and time budget so a run is reproducible and bounded, never open-ended.
- Perceive the frameCapture the rendered screen and read it as vision input through a tool-capable model on
OmniRoute. - Plan the next moveReason over the on-screen state toward the goal — objective, obstacles, and the cheapest next action.
- Act through the gatewayEmit the chosen input as a tool call routed through
ChainLayer2 MCP, then re-observe. - Branch in parallel, then mergeAt a fork, fan out 2–8 sub-agents to try routes under one shared budget; a single fenced merger keeps the best.
trace_id would span perceive → plan → act → mergeReverse-Engineering & Coding Agent
Authorized reverse engineering, then working code.
The design: understand a binary or protocol, then write the code to work with it — identify, disassemble, decompile, inspect a wire format, and hand the findings to a coding loop that produces an interoperability shim, a test, or a patch.
The agent is planned. The guardrails below are not — they are enforced in the shipping MCP server today, for every RE tool call anything makes.
Authorized reverse engineering only
The RE plane exists for interoperability, security research on systems you own or are
explicitly authorized to test, understanding your own binaries, and malware analysis in
an isolated lab. Every one of the 12 RE tools takes an authorized: true
attestation typed as a literal, so false fails schema validation outright;
each call is canonicalized to a real path, checked against a non-overridable denylist,
confined to RE_ALLOWED_DIRS, and appended to an audit log whether it was
allowed or refused. It is not a tool for cracking, piracy, DRM removal, or bypassing
protections.
- Attest & scopeAssert
authorized: trueand point at a target insideRE_ALLOWED_DIRS; anything on the denylist is refused up front. Enforced today. - Triage the artifactRun
binary_info,re_identify,strings_scan,re_sectionsandre_importsto map what you are looking at. Ships today. - Analyze the authorized target
disassemble/decompilethe hot paths andprotocol_inspectthe wire format — every call audited. Ships today. - Write the code, gatedA coding loop drafts the interop shim or test; each mutating write passes the approval gate before it lands. Planned.
{timestamp, tool, target, decision} to an append-only audit logSafety by design
The guardrails are the product, not a setting.
There is no flag, mode, or tool whose purpose is to weaken a safety control. The same policy that governs a single task governs every sub-agent it spawns.
Sandbox & path confinement
A run's policy is resolved once and frozen into an immutable job snapshot; --sandbox forces no-write and no-shell, file tools stay in the working directory, and RE tools stay inside allow-listed dirs.
Headless, fail-closed approval
Fan-out runs under an approval gate built without an interactive path: a request it cannot approve returns reject. No concurrent prompts from parallel sub-agents, and no silent yes.
One-level-deep fan-out
Sub-agents inherit the parent's SessionPolicy, and spawn_agents is stripped from their tool set — so parallelism is exactly one level deep and cannot recurse. A stripped tool cannot be restored.
One shared budget
A task defaults to 200 steps and 500 tool calls, and --deadline adds a hard stop. Fan-out draws on one ledger for the whole turn — four sub-agents cannot quietly spend four times the budget.
Trust-tiered model selection
The CLI classifies every backend before it will use one. Default selection refuses any provider tiered experimental or anonymous unless a policy names it explicitly, and a managed deployment refuses rather than falling through.
Fencing & fail-closed auth
Every shared-evidence write is fence-gated, so a superseded worker updates zero rows and gets a typed stale_fence instead of last-writer-wins. Every MCP request is bearer-checked before dispatch; a missing or wrong token is a 401, always.
The objective is never evicted
Context fitting pins the original request and the latest summary — they are shortened before they are ever dropped, so a long session cannot quietly forget what it was asked to do. Oversized tool output is trimmed head-and-tail with an explicit marker, and the conversation auto-compacts at 70% of the window rather than silently truncating.
Crash-durable turns
Progress is appended to a turn journal as the turn runs, not just at its end. A crash, power loss, or closed terminal is detected on the next launch and resumed with /retry — and /context shows how full the window is before it matters.
The platform
Four cooperating planes, one product.
You experience one tool; internally the services stay cleanly separated — routing models is not the same job as managing durable work. Two planes come up with the local stack; the control plane is a separate service you run yourself.
OmniRoute
OpenAI-compatible /v1 in front of a multi-provider catalog; role routing and provider fallback. The launcher starts it with REQUIRE_API_KEY=true and binds it to loopback.
ChainLayer2 MCP
Bearer-gated MCP server — math, data, devtools, fetch, re-grounding, authorized RE, and stdio federation of upstream MCP servers under clean namespaces.
ChainLayer API
Authenticated edge for durable runs: mints the trace, freezes the policy into a job snapshot, and dispatches to a separate crash-recoverable worker. Deployed separately.
ChainLayer CLI
The terminal coding agent and primary interface — an autonomous, approval-gated loop over local and MCP tools. This is what the one-line install puts on your PATH.
Install
One line. Then read what it tells you.
The installer picks one of two paths and prints which one it chose and why. They give you materially different things, so the difference is worth thirty seconds of your attention.
Node.js 20+ on PATH (24 recommended) · downloads cli.js, checks it against the SHA-256 in version.json, and installs nothing if the digest disagrees · re-run to upgrade
CLI-only
What you get if nothing is already serving 127.0.0.1:20128 and you did not ask for more.
- The
chainlayertwocommand on your PATH - Pointed at the hosted model gateway,
https://chainlayertwo.online/v1 - That gateway answers anonymously — no account, no key
- Installs in about twenty seconds; nothing is cloned or compiled
- No tools. No MCP server is configured, so file and shell tools are off
The installer says this out loud, in yellow, before it exits: TOOLS ARE NOT AVAILABLE on this install. To add them, install the local stack or point mcpServers in ~/.chainlayer/config.json at an MCP endpoint you have a token for.
Full stack
Chosen automatically if an OmniRoute checkout is already beside a ChainLayer checkout, or on request:
- OmniRoute on
127.0.0.1:20128, started withREQUIRE_API_KEY=true - ChainLayer2 MCP on
127.0.0.1:8930, bearer token minted on this machine - The launcher on PATH as both
chainlayertwoandchainlayer2 - Tools on. Both planes health-checked before the installer claims success
- Needs git, npm and a ChainLayer checkout; the first Next.js compile takes 1–3 minutes
Once installed, chainlayer2 --stack-only brings the gateways up and leaves them running, and chainlayer2 --dry-run reports state without starting anything.
Commands
chainlayertwointeractive REPL, or the launcher menu on a full-stack installchainlayertwo doctorper-stage health report; exit 1 only on a real failurechainlayertwo "add tests to ./src"one-shot agent task in the current folderchainlayertwo --sandbox "…"read-only mode: every mutating tool is blockedchainlayertwo --deadline 5m "…"hard stop, on top of the step and tool-call budget
Uninstall: delete %LOCALAPPDATA%\ChainLayerTwo and drop its \bin from PATH.
> irm https://chainlayertwo.online/install.ps1 | iex ✓ Node v24.13.0 Path: CLI-ONLY reason: no local stack was found and none was requested Fetching release manifest … ✓ chainlayertwo 0.3.0 Downloading CLI bundle … ✓ Verified SHA-256 6061303749573398… ✓ Installed chainlayertwo 0.3.2 ✓ Config written (baseUrl: https://chainlayertwo.online/v1) Verifying end to end … GET https://chainlayertwo.online/v1/models ✓ One-shot request answered - the install works. ChainLayerTwo 0.3.0 is installed and verified. Endpoint: https://chainlayertwo.online/v1 Try it: chainlayertwo "summarise the files in this folder" chainlayertwo doctor TOOLS ARE NOT AVAILABLE on this install. This is the CLI talking to a model gateway - no MCP tool server is configured, so file/shell tools are off.
version.json at release time.Durable by default
Give your agents a platform that resumes.
One model gateway, one bearer-gated tool gateway, and parallel sub-agents on a journalled loop — every hop on one trace, every action under one policy.