How Glxymesh runs your tools

Organizations, projects and tools

• An organization owns everything and is what gets billed. People are members of it.
• A project is one directory on your machine and one MCP server on Glxymesh. It has a language, Go, TypeScript or Python, chosen when you run gxmesh init.
• A tool is one folder in the project’s tools/ directory, holding a tool.yml. Its name is the folder name: 1–64 characters of a-z, 0-9 and -, unique within the project.

A team that works in two languages uses two projects. Each is its own server with its own address.

One server per project

Clients don’t connect to tools one by one. Each project has a single Streamable HTTP endpoint:

https://<org>.mcp.glxymesh.com/<project>

Each organization has its own host; the default project is the host itself. The older form, https://mcp.glxymesh.com/mcp/<org>/<project>, reaches the same project.

The gateway behind it lists every tool in the project in one tools/list and routes each tools/call to the right tool. Clients see the server as <org>-<project>, such as acme-helpdesk, with the title and description from gx.yml, so two projects connected to the same client never collide.

The endpoint accepts POST only. The platform never pushes messages to the client, so there is no GET stream to open.

Kinds of tool

Kind	You write	Runs
http	A request template in tool.yml. No code.	Inside the platform’s egress gateway. No cold start.
function	One run function in the project’s language	In the project’s own function, shared by every function tool in the project

See Tool kinds for an example of each. Either kind can be written for you: describe the tool and Glxymesh writes it, tests it and hands it to you to publish. See Build tools with AI.

What happens on a call

1. The client sends tools/call to the project’s address with its OAuth token.
2. The gateway checks the token, your plan’s limits and the arguments against the tool’s inputs. Nothing runs if any of these fail.
3. The gateway runs the tool: an http tool’s request goes straight to the egress gateway, and a function tool’s code starts with a short-lived grant for this one call.
4. When the tool makes an HTTP request, the request goes through the egress gateway. It checks the host against the tool’s network.allow, refuses private and internal addresses, adds the tool’s keys on their bound hosts, and sends the request from Glxymesh’s public IP address.
5. The tool returns its answer. With output.format: toon, the gateway turns lists of rows into TOON, a compact format that costs the model fewer tokens than JSON, and replies.
6. The call, its duration, its outbound requests and its log lines appear in the console under Invocations.

Authorization without API keys

The endpoint is an OAuth 2.1 resource server. When a client connects:

1. Its first request has no token, so it gets a 401 whose WWW-Authenticate header points to the endpoint’s protected resource metadata.
2. That document names accounts.glxymesh.com as the authorization server.
3. The client registers itself there through dynamic client registration, which is why you never create a client ID.
4. Your browser opens, you sign in and approve, and the client gets a token that belongs to you.

Because each token belongs to a person, there’s no shared secret to rotate. Access is checked on every call: if someone is removed from the organization, their next call fails, and a project they can’t see returns 404, the same as one that doesn’t exist.

No way out except the front door

Tool code can reach the network only through the egress gateway:

• Only hosts listed in the tool’s network.allow are reachable, and a person approves each new host before it goes live.
• Keys are bound to hosts. A key bound to api.github.com is never sent anywhere else, even to another host on the same tool’s list, and your code never holds it.
• Private addresses, cloud metadata addresses and redirects to them are refused.

Because every request leaves from the same public IP address, you can add that one address to the allow-lists of your own APIs. See Keys and network access.

Idle projects sleep

A project whose function tools nobody calls for 7 days goes to sleep. Its tools stay listed, so clients don’t notice. The next call wakes it, which takes a few seconds; if it isn’t ready in time the client gets “This project is waking up after a week without calls. Try again in a few seconds.”, and that call isn’t billed. On Pro and Business you can keep tools awake from the console’s Tools page. http tools never sleep.