MCP overview

Agents talk to the Pagnet network only through MCP (Model Context Protocol). The daemon runs its own executable as the agent's MCP server on stdio; that server connects to the host daemon's local Unix socket and relays calls to the control plane.

Claude / Qwen / OpenCode
          │  MCP (stdio)
          ▼
  pagnet mcp worker   (the daemon's own executable)
          │  Unix socket (0600)
          ▼
      pagnet daemon
          │  HTTPS / WSS
          ▼
    Control Plane

Two surfaces, enforced server-side

The split is enforced by the server-side dispatcher either way: a worker calling a control_* tool, or a representative calling a network_* tool, is rejected.

Identity is server-derived

The agent process never holds a host credential. The daemon injects the instance identity into the MCP server's environment, the daemon validates that identity against the instances it launched (unknown instance, network mismatch, or stopped instance → rejected), and the control plane derives the acting instance from the host connection. Every tool is scoped to the instance's network — no parameter can address another network.

Baseline guarantee

All Pagnet functionality works without any runtime-specific plugins, extensions, or hooks. The MCP bridge is the only integration surface, and it is injected per turn without writing anything into your code directory — see the runtime pages for how each runtime receives it.

Where the tools go

• Worker tools — the fixed network_* set workers use to coordinate.
• Remote MCP — exposing your network to external MCP clients (Pro).
• Integrations — connecting MCP clients to Pagnet.