AI & Automation
Give an AI tool your devices, one capability at a time.
The daemon can open a single HTTP listener on loopback and speak MCP on it. Claude Code, or any host that can send a bearer token, connects with a key you minted and can then list your devices, read one machine's live state, and run a named program on another. The same daemon is driven by the CLI and by a typed client SDK — all three through one deny-by-default capability model.
- 12Working today
- 2Planned
The mechanism, not the metaphor.
- 01 Open the door
Enabling MCP writes a state file. Nothing listens until you say so.
- 02 Mint a scoped key
Registering a client takes explicit capability flags. The token prints exactly once.
- 03 Connect a host
The host speaks streamable HTTP with a bearer token, to loopback only.
- 04 Filter the tools
The listing shows only what the key holds, and a call it lacks is refused again.
- 05 Cross the fabric
The door has no fabric of its own. It asks the daemon, which uses the peer session.
- 06 Audit and revoke
Every call publishes an event by credential name, and revoking ends work already in flight.
14 capabilities, and where each one stands.
The door
- Working today MCP over loopback
One local endpoint an AI host connects to with a token you minted.
- Working today Off until you say so
The feature ships in the default build and opens no port until enabled.
- Planned Hosted-connector carrier
A token in the URL, for hosts that cannot send a header.
What a model can do
- Working today List devices
The model learns your device ids, and which one it is standing on.
- Working today Read a machine's state
cpu, memory, storage and the heaviest processes on any paired device.
- Working today Run a named program
One program on another device, with its real exit code coming back.
- Working today Ask the key what it holds
The key explains itself, so a missing tool never reads as a bug.
- Planned Action registry
A general catalogue of AI-safe actions beyond the first four tools.
Keeping it bounded
- Working today Capability-scoped keys
Each key holds only the capabilities you named. Everything else is denied.
- Working today Tools filtered by capability
A tool the key cannot use is absent from the list, and refused if called anyway.
- Working today Live revocation
Revoking a key refuses the next call and kills the one already running.
- Working today Per-call audit events
Every call records credential name, tool, device and outcome.
For your own code
- Working today The xs CLI
Scriptable device control with JSON output and real remote exit codes.
- Working today Local client API and SDK
A typed SDK that drives a real daemon — and is refused the admin surface.
Numbers from tests that ran.
- uname -a
Run on a second machine by a model, verified by hand against two daemons on 2026-08-23.
- 31 rows
17 driving real JSON-RPC bytes with no daemon and no credential store, plus 14 through the shipped binaries.
- 401
What the bootstrap token gets at the door. Refused by type, and again by a check — like any stranger.
- Refused twice
A non-loopback bind: once by the CLI, and again by the daemon, because one gate is a gate somebody removes.
And what it is not
- Not a shell. Running a program takes a program and a pre-split argument list — no quoting, no pipes, no expansion.
- Not on by default. The capability ships in the default build and still opens no port until you enable it.
- Not a discovery listing. It reports what this machine already trusts; an unknown machine on the network is not a device.
- Not the whole control surface exposed to a model. Nothing auto-exports service methods, raw channels or platform APIs.
Start with the devices you already own.
Make them work
as one.
The open core is ready to explore. Build your personal device fabric with Xross.
Open-source core · Direct by design · Your devices, your fabric