
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
mcp-laya
Advanced tools
Safe-by-default MCP server for Laya — fast, local, non-autoregressive typed decisions (classify / score / yes-no) for AI agents, in 100+ languages.
A safe-by-default Model Context Protocol server for Laya — a fast, non-autoregressive System-1 decision engine. It gives an agent a thinking primitive: typed decisions — classify, score, yes/no — over any state (text, an email, a ticket, a JSON object), in a single local forward pass (~33 ms), across 100+ languages, with no text generation — nothing to parse and nothing to hallucinate, and a calibrated confidence on every answer.
Instead of burning a slow, costly LLM round-trip on "which team should handle this? is it urgent? is this a refund request?", the agent calls a typed tool that answers locally, in milliseconds, offline. It's the safest server in the suite — laya only reads a state and returns a decision; it changes nothing.
Part of the dockndevai MCP server suite — one governance model across all of them. (This is the first Python server in the suite; the rest are Node/TS.)
| Tool | For |
|---|---|
decide | answer several typed questions (choice/score/noul) in one pass — the full engine |
classify | assign the single best category (one choice) |
score | rate on an ordinal scale, e.g. urgency (one score) |
check | a yes/no/unknown gate for control flow (one noul) |
triage | a ready-made decision set via a laya preset (triage / email / moderation / guard) |
detect_language | script + language of a text (sub-ms, no model) |
explain_routing | which checkpoint would answer, without running inference |
list_models | the checkpoints available, default, device, offline status |
Three checkpoints, auto-routed per request: english (ModernBERT-large), multilingual (mmBERT, 100+ languages), typed-decisions.
pipx install mcp-laya # or: pip install mcp-laya
Python 3.10+. laya pulls in torch; the model checkpoints download once from Hugging Face (see below), after which it runs fully offline.
Downloads are off by default (nothing leaves your machine at runtime). Pre-fetch the checkpoints one time with network access:
LAYA_ALLOW_DOWNLOAD=true python -c "import laya; laya.Router(preload=True)"
Then run the server offline.
{
"mcpServers": {
"laya": {
"command": "mcp-laya",
"env": { "LAYA_DEFAULT_MODEL": "auto" }
}
}
}
See docs/CLIENTS.md for Claude Code / Cursor / Codex / VS Code / Windsurf, and .env.example for every variable.
Ask your agent to "use laya to classify this ticket's department and whether it's a churn risk":
// classify(state, criteria={billing, technical, sales, other})
{ "choice": "billing", "confidence": 0.95, "probabilities": { "billing": 0.95, ... } }
// check(state, "Does the user threaten to cancel?")
{ "answer": "yes", "probability_yes": 0.91, "confidence": 0.91 }
laya is read-only inference, so the guardrails (in src/mcp_laya/security.py) are about privacy and resource control, not write-gating:
LAYA_ALLOW_DOWNLOAD=true.LAYA_MODELS pins which checkpoints may load.LAYA_MAX_INPUT_CHARS / LAYA_MAX_QUESTIONS bound each request.LAYA_MIN_CONFIDENCE flags (never silently trusts) low-confidence answers; every answer already carries a calibrated confidence.LAYA_REDACT_STATE keeps the input text out of the JSON audit log by default.There's a bundled skill, laya-decisions, teaching an agent when to offload a decision to laya and how to phrase typed questions. See also SECURITY.md.
python -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
ruff check src tests && mypy src && pytest # the policy tests need no model
python -m mcp_laya # run the server (stdio)
Built on laya by Convai Innovations (Apache-2.0). This server wraps that library; all model work is theirs. See NOTICE.
MIT
FAQs
Safe-by-default MCP server for Laya — fast, local, non-autoregressive typed decisions (classify / score / yes-no) for AI agents, in 100+ languages.
We found that mcp-laya demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.