Capability Families
for Verifiable Agent Actions
Capabilities define the action surface CommandLayer can describe. Receipts prove what happened. Trust Verification is live. Additional families are draft/planned as the protocol expands.
Integrations
External systems authenticate events, payments, or actions in their own way. CommandLayer signs the normalized result as a portable receipt that can be verified independently.
MCP bridges agent clients to CommandLayer runtime actions.
MCP exposes CommandLayer tools to MCP clients, but MCP is a bridge, not the signer.
What MCP does
- Exposes tools.
- Forwards payloads to runtime.
- Blocks private key fields.
- Returns runtime receipts.
- Supports automatic verification workflows.
What MCP does not do
- Does not hold private keys.
- Does not sign receipts.
- Is not the trust root.
- Does not make schema-valid equal verified.
Trust boundary
The proof model is identical whether an action is called through MCP or direct HTTP. MCP changes transport, not trust. Runtime still signs. Verifier still validates. MCP does not hold keys.
Transport
GET https://mcp.commandlayer.org/health
+CommandLayer MCP Bridge MCP BridgeMCP bridges agent clients to CommandLayer runtime actions.
MCP exposes CommandLayer tools to MCP clients, but MCP is a bridge, not the signer.
What MCP does
- Exposes tools.
- Forwards payloads to runtime.
- Blocks private key fields.
- Returns runtime receipts.
- Supports automatic verification workflows.
What MCP does not do
- Does not hold private keys.
- Does not sign receipts.
- Is not the trust root.
- Does not make schema-valid equal verified.
Trust boundary
The proof model is identical whether an action is called through MCP or direct HTTP. MCP changes transport, not trust. Runtime still signs. Verifier still validates. MCP does not hold keys.
Transport
GET https://mcp.commandlayer.org/health
POST https://mcp.commandlayer.org/mcp
Note: /mcp is POST-only MCP transport. GET /mcp is not expected to work.
Tools
clas.trust-verification.verify
diff --git a/public/proof-flow-composer.html b/public/proof-flow-composer.html
index e74bc0d..71df92d 100644
--- a/public/proof-flow-composer.html
+++ b/public/proof-flow-composer.html
@@ -37,7 +37,7 @@
-
+
DemoProof Flow Composer
This demo is now part of Live Proof. Open /proof.html for the complete proof hub.Simulate an external Coinbase event, generate a signed receipt, and verify it in one trace-linked flow.
diff --git a/public/proof.html b/public/proof.html
index 14a2239..5de05e7 100644
--- a/public/proof.html
+++ b/public/proof.html
@@ -34,7 +34,7 @@
diff --git a/public/protocol.html b/public/protocol.html
index 716f07e..b555b41 100644
--- a/public/protocol.html
+++ b/public/protocol.html
@@ -40,7 +40,7 @@
diff --git a/public/receipts.html b/public/receipts.html
index 227ef29..2cd2845 100644
--- a/public/receipts.html
+++ b/public/receipts.html
@@ -38,7 +38,7 @@
diff --git a/public/runtime-core.html b/public/runtime-core.html
index 1d54249..6723eb2 100644
--- a/public/runtime-core.html
+++ b/public/runtime-core.html
@@ -13,7 +13,7 @@
-
+
runtime-coreThe crypto truth layer for CommandLayer receipts.
runtime-core defines the canonicalization, hashing, signing, and verification primitives used to produce and validate CommandLayer receipts.
What runtime-core does
Canonicalizes receipt payloads.Computes SHA-256 hashes.Signs receipts with Ed25519.Verifies Ed25519 signatures.Checks metadata.proof integrity.Detects tampering.
diff --git a/public/runtime.html b/public/runtime.html
index 1d3a61c..342fdd6 100644
--- a/public/runtime.html
+++ b/public/runtime.html
@@ -13,7 +13,7 @@
-
+
RuntimeRuntime signs canonical receipts.
The runtime is the production signer and execution layer for CommandLayer receipts. It executes actions, emits metadata.proof, and powers verification workflows.
What runtime does
- Executes actions.
- Emits metadata.proof receipts.
- Signs receipts with Ed25519.
- Exposes
/verify. - Supports Trust Verification v1 endpoints.
diff --git a/public/schemas.html b/public/schemas.html
index d90295d..2b353f1 100644
--- a/public/schemas.html
+++ b/public/schemas.html
@@ -30,7 +30,7 @@
diff --git a/public/sdk-records.html b/public/sdk-records.html
index 237adc3..05dcdf8 100644
--- a/public/sdk-records.html
+++ b/public/sdk-records.html
@@ -39,7 +39,7 @@
diff --git a/public/stack-proof-demo.html b/public/stack-proof-demo.html
index 613da80..e5cf509 100644
--- a/public/stack-proof-demo.html
+++ b/public/stack-proof-demo.html
@@ -46,7 +46,7 @@
diff --git a/public/verify-badge-demo.html b/public/verify-badge-demo.html
index 3348068..cefb1ba 100644
--- a/public/verify-badge-demo.html
+++ b/public/verify-badge-demo.html
@@ -48,7 +48,7 @@
diff --git a/public/verify.html b/public/verify.html
index c093225..82403a1 100644
--- a/public/verify.html
+++ b/public/verify.html
@@ -36,7 +36,7 @@
diff --git a/public/webhook-auto-verify.html b/public/webhook-auto-verify.html
index 587b9da..e6f156c 100644
--- a/public/webhook-auto-verify.html
+++ b/public/webhook-auto-verify.html
@@ -47,7 +47,7 @@