Is Living Stack free?

Yes, Living Stack is free to use.

How do I install Living Stack?

Living Stack is a local plugin. Install it using the provided package and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Living Stack safe to use?

Yes. Living Stack passed MCP Marketplace's automated security scan with a score of 10/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What AI apps work with Living Stack?

Living Stack uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Living Stack MCP Server

by civicdataforge

Developer ToolsLow Risk10.0LocalNew

Free

Make AI agent work prove authorization, budget, recovery, and evidence before you trust it.

About

Living Stack is a local-first MCP control plane for teams that need AI agent work to be inspectable instead of merely plausible. It scopes authorization, enforces budget ceilings, tracks recovery and lifecycle state, evaluates evidence before outcome claims, and exports signed traces. Use it to audit agent runs, gate risky workflows, diagnose stale or missing receipts, and turn operational failures into reproducible lessons—without sending project data to a hosted service.

Security Report

10.0

Low Risk10.0Low Risk

Valid MCP server (2 strong, 0 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry. Trust signals: trusted author (6/6 approved).

7 files analyzed · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

Getting Started

Once installed, try these example prompts and explore these capabilities:

1"Audit this agent run and show which outcome claims have sufficient evidence"
2"Set a budget ceiling and scoped authorization before this workflow starts"
3"Check whether recovery completed and export a signed trace"
4Tool: livingstack.session_start — Freeze scope, goal, retention, and budget for one run
5Tool: livingstack.authorize_action — Check risk and reserve cost before a host action
6Tool: livingstack.record_outcome — Bind observed results to the authorization and evidence ledger
7Tool: livingstack.check_claim — Test a proposed completion claim against current evidence
8Tool: livingstack.trace_export — Export redacted, workspace-signed OTLP JSON traces

Documentation

View on GitHub

From the project's GitHub README.

Living Stack MCP

Living Stack MCP gives MCP-capable AI agents a bounded control-and-proof plane: scoped continuity, action authorization, budget reservations, typed outcome evidence, claim gates, durable checkpoints, and cryptographically signed trace exports. It does not replace the model or execute the customer's actions.

The repository is also a portable Agent Plugins 1.0 bundle: compatible clients can install the MCP server and its operating skill together from the same pinned release.

What ships in 0.3 public beta

14 bounded MCP tools and three guided lifecycle prompts over local stdio.
Per-session state with append-only SHA-256-linked evidence ledgers.
Server-owned risk policy; external and destructive actions are denied by default.
Cost reservation and reconciliation against a session ceiling.
Credential-shaped value redaction before persistence or protocol output.
Scope-, state-, expiry-, and lineage-bound recovery checkpoints.
Ed25519-signed trace exports tied to one local installation.
Optional offline entitlement grants; billing secrets never enter the MCP.

Install

Requires Node.js 22 or later.

MCP bundle

Download the SHA-256-release-bound Living Stack MCP bundle and import it into an MCPB-compatible client. Verify downloaded bytes against the SHA256SUMS.txt asset attached to that exact GitHub release.

The same bundle and hash are active in the official MCP Registry. The indexed tool surface is also live on Glama and Smithery.

Install in VS Code, add it to Cursor, or follow the exact-version Codex, Claude Code, VS Code, Cursor, and desktop client guide.

Command line

npx -y living-stack-mcp@0.3.2-beta.1

Or install globally:

npm install -g living-stack-mcp@0.3.2-beta.1
living-stack-mcp

Minimal MCP configuration:

{
  "mcpServers": {
    "living-stack": {
      "command": "npx",
      "args": ["-y", "living-stack-mcp@0.3.2-beta.1"]
    }
  }
}

State defaults to ~/.living-stack-mcp/state. Set LIVING_STACK_STATE_DIR to a dedicated directory. Set LIVING_STACK_ALLOWED_ROOTS to explicit roots if release-manifest verification is needed.

First agent run

Ask the connected agent to use the native livingstack.prove_task prompt, or copy the concise workflow in QUICKSTART.md. The guided path freezes scope and budget before action, authorizes an exact target, records typed evidence references afterward, retains explicit outcome IDs, and blocks unsupported completion language unless the identical subject and selected fresh outcomes support it—without taking over the host's tools.

Lifecycle

livingstack.session_start freezes scope, goal, retention, and budget.
livingstack.context_put stores provenance-labeled context.
livingstack.authorize_action checks risk and reserves cost.
The MCP host performs the action with its own tools and permissions.
livingstack.record_outcome consumes authorization and records evidence.
livingstack.check_claim tests a claim only against explicit fresh successful outcome_ids bound to the exact authorization target supplied again as subject; unrelated session evidence cannot satisfy it.
Checkpoint tools preserve and verify bounded recoverable state.
Trace tools expose redacted reports and workspace-signed exports.

Security boundaries

Living Stack MCP has no arbitrary shell, browser, HTTP, database, deployment, or publication tools. It does not inspect personal Codex or Claude state. A workspace signature proves that an export came from one local installation; it does not by itself prove publisher or user identity. The host remains the authority and executor.

This public beta is local-first and free. Proposed managed tiers are described in COMMERCIAL.md, but no paid managed service is for sale yet.

See PRODUCT.md, SECURITY.md, and CHANGELOG.md. Installation paths are collected in CLIENTS.md.

Development

npm ci
npm test
npm run verify

License: Apache-2.0.

Brand assets and their meaning are documented in BRAND.md.

Privacy Policy

Living Stack Community runs locally and does not send session state, context, ledgers, checkpoints, signing keys, or agent payloads to a Living Stack hosted service. The complete policy covers collection, local use and storage, third-party sharing, retention, and contact information at living-stack-mcp.pages.dev/privacy.html.