Living Stack Agent Commerce
Remote MCP for Living Stack offer discovery and buyer-authorized checkout preparation.
Open source Repository Open in the app JSON README (API)
About
Remote MCP for Living Stack offer discovery and buyer-authorized checkout preparation.
Details
- Kind
- MCP servers
- Topic
- E-commerce & business
- Publisher
- equinoxaifinance-rgb
- Origin
- official
- Category
- ferramentas
- Transport
- http
- Version
- 0.1.0-beta.1
- Last push
- 2026-09-01T09:26:45Z
- Repository state
- sumiu
- Language
- JavaScript
- License
- Apache-2.0
- Added
- 2026-09-01 10:00:07
- Updated
- 2026-09-01 10:00:07
- Origin id
io.github.equinoxaifinance-rgb/living-stack-commerce
README
# Living Stack MCP
<p align="center">
<img src="docs/living-stack-logo-3d.png" alt="Living Stack Forged Continuity mark" width="440">
</p>
<p align="center"><strong>Make agent work prove itself.</strong></p>
<p align="center">
<a href="https://github.com/equinoxaifinance-rgb/living-stack-mcp/actions/workflows/ci.yml"><img src="https://github.com/equinoxaifinance-rgb/living-stack-mcp/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
<a href="https://registry.modelcontextprotocol.io/v0.1/servers/io.github.equinoxaifinance-rgb%2Fliving-stack/versions/latest"><img src="https://img.shields.io/badge/MCP%20Registry-active-38d39f" alt="MCP Registry active"></a>
<a href="https://smithery.ai/servers/neoaethel/living-stack-mcp"><img src="https://img.shields.io/badge/Smithery-15%20tools-6e56cf" alt="Smithery 15 tools"></a>
</p>
Living Stack MCP gives MCP-capable AI agents a bounded control-and-proof plane:
scoped continuity, action authorization, budget reservations, typed outcome
evidence, claim gates, durable checkpoints, and cryptographically signed trace
exports. It does not replace the model or execute the customer's actions.
**Try the complete Community edition free:**
```bash
npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1 --self-test
```
That sixty-second local proof sends nothing. If one private workspace needs to
coordinate up to five installations, [Team Local is $19 once](https://living-stack-agent-checkout-live.neoaethel.workers.dev/go/team-local).
The repository is also a portable [Agent Plugins 1.0](https://agent-plugins.org/)
bundle: compatible clients can install the MCP server and its operating skill
together from the same pinned release.
## What ships in 0.3 public beta
- 15 bounded MCP tools and three guided lifecycle prompts over local stdio.
- Per-session state with append-only SHA-256-linked evidence ledgers.
- Server-owned risk policy; `external` and `destructive` actions are denied by default.
- Cost reservation and reconciliation against a session ceiling.
- Credential-shaped value redaction before persistence or protocol output.
- Scope-, state-, expiry-, and lineage-bound recovery checkpoints.
- Ed25519-signed trace exports tied to one local installation.
- An explicit-consent, minimal signed adoption receipt; no session or task payload is accepted.
- Optional offline entitlement grants; billing secrets never enter the MCP.
## Install
Requires Node.js 22 or later.
### MCP bundle
Download the SHA-256-release-bound
[Living Stack MCP bundle](https://github.com/equinoxaifinance-rgb/living-stack-mcp/releases/download/v0.3.4-beta.1/living-stack-mcp-0.3.4-beta.1.mcpb)
and import it into an MCPB-compatible client. Verify downloaded bytes against
the `SHA256SUMS.txt` asset attached to that exact GitHub release.
The same bundle and hash are active in the
[official MCP Registry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.equinoxaifinance-rgb%2Fliving-stack/versions/latest).
The indexed tool surface is also live on
[Glama](https://glama.ai/mcp/servers/equinoxaifinance-rgb/living-stack-mcp) and
[Smithery](https://smithery.ai/servers/neoaethel/living-stack-mcp).
The live remote commerce MCP is separately available through the
[official MCP Registry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.equinoxaifinance-rgb%2Fliving-stack-commerce/versions/latest)
and its [Smithery gateway](https://smithery.ai/servers/neoaethel/living-stack-commerce).
[Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22living-stack%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22github%3Aequinoxaifinance-rgb%2Fliving-stack-mcp%23v0.3.4-beta.1%22%5D%7D),
[add it to Cursor](https://cursor.directory/plugins/living-stack), or follow
the exact-version [Codex, Claude Code, VS Code, Cursor, and desktop client
guide](CLIENTS.md).
### Command line
```bash
npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1
```
Prove the package locally before configuring a host:
```bash
npx -y github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1 --self-test
```
That command exercises a new bounded session, authorization, typed outcome,
claim gate, checkpoint round trip, signed trace, and clean session close. It
does not contact Living Stack. To send one minimal signed first-run receipt,
the user must deliberately add `--report-first-run --host=<host>`; the exact
fields are listed in the Privacy section below.
Or install globally:
```bash
npm install -g github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1
living-stack-mcp
```
Minimal MCP configuration:
```json
{
"mcpServers": {
"living-stack": {
"command": "npx",
"args": ["-y", "github:equinoxaifinance-rgb/living-stack-mcp#v0.3.4-beta.1"]
}
}
}
```
State defaults to `~/.living-stack-mcp/state`. Set `LIVING_STACK_STATE_DIR`
to a dedicated directory. Set `LIVING_STACK_ALLOWED_ROOTS` to explicit roots
if release-manifest verification is needed.
## First agent run
Ask the connected agent to use the native `livingstack.prove_task` prompt, or
copy the concise workflow in [QUICKSTART.md](QUICKSTART.md). The guided path
freezes scope and budget before action, authorizes an exact target, records
typed evidence references afterward, retains explicit outcome IDs, and blocks
unsupported completion language unless the identical subject and selected
fresh outcomes support it—without taking over the host's tools.
## Lifecycle
1. `livingstack.session_start` freezes scope, goal, retention, and budget.
2. `livingstack.context_put` stores provenance-labeled context.
3. `livingstack.authorize_action` checks risk and reserves cost.
4. The MCP host performs the action with its own tools and permissions.
5. `livingstack.record_outcome` consumes authorization and records evidence.
6. `livingstack.check_claim` tests a claim only against explicit fresh successful `outcome_ids` bound to the exact authorization target supplied again as `subject`; unrelated session evidence cannot satisfy it.
7. Checkpoint tools preserve and verify bounded recoverable state.
8. Trace tools expose redacted reports and workspace-signed exports.
## Security boundaries
Living Stack MCP has no arbitrary shell, browser, database, deployment, or
publication tools and no arbitrary HTTP capability. Its single publisher
network action is a fixed-schema, fixed-origin adoption receipt that remains
inert unless the user explicitly sets consent. It does not inspect personal
Codex or Claude state. A
workspace signature proves that an export came from one local installation; it
does not by itself prove publisher or user identity. The host remains the
authority and executor.
The complete Community edition is local-first and free. Team Local is available
separately for $19 once; it coordinates one private workspace and up to five
registered installations without changing the model or uploading Community
session state. Exact scope, purchase paths, and boundaries are documented in
[COMMERCIAL.md](COMMERCIAL.md).
See [PRODUCT.md](PRODUCT.md), [SECURITY.md](SECURITY.md), and
[CHANGELOG.md](CHANGELOG.md). Installation paths are collected in
[CLIENTS.md](CLIENTS.md).
## Development
```bash
npm ci
npm test
npm run verify
```
License: Apache-2.0.
Brand assets and their meaning are documented in [BRAND.md](BRAND.md).
## Privacy Policy
Living Stack Community runs locally and never sends session state, context,
ledgers, checkpoints, private signing keys, or agent payloads to Living Stack.
An optional first-run receipt is sent only after explicit consent and contains
the package version, milestone, coarse host category, installation public-key
hash, timestamp, and signature. The endpoint rejects arbitrary metadata. The
complete policy covers collection, local use and storage,
third-party sharing, retention, and contact information at
[living-stack-mcp.pages.dev/privacy.html](https://living-stack-mcp.pages.dev/privacy.html).