Docs menu

For developers

How XOR works

One remote MCP server for AI apps, access keys for your own code, and a web API that mirrors every tool.

XOR is a single remote MCP server. Every AI app that connects to it sees the same tools and the same things. Your own code and agents reach the same tools through a web API, with an access key.

Connecting
MCP server https://systemofreason.com/mcp, over Streamable HTTP
Sign-in OAuth, with dynamic client registration. People enter their email and a code we send.
Without a browser An access key, as Authorization: Bearer xor_…
Web API POST https://systemofreason.com/v1/<tool>, with an access key. See the web API.

What’s in it

Things live in projects (default unless a call names another). Each thing has a purpose: a line saying what it’s for, so the next agent knows how to use it.

  • Stores (kv): key-value, with optional expiry.
  • Databases (sql): SQLite.
  • File spaces (files): files, with every version kept 7 days, and links for big uploads and downloads.
  • Secrets: values such as API keys, sealed at rest, filled into outgoing requests on our side and never shown again.
  • Schedules: a web request or an agent run, on a cron schedule or once.
  • Inboxes: a webhook address that keeps what’s sent to it, with optional signature checks.
  • Background agents: Claude doing a job on its own, with per-run and monthly budgets.

Every project has a store, a database and a file space named default that need no setup.

Safety, built in

  • Seven-day undo on everything. Deleted things are kept 7 days. Stores and databases can go back to any moment in the last 7 days.
  • Outside content is marked. Anything read back from storage, a web page or an inbox comes wrapped as untrusted_content: data, never instructions.
  • Secrets never reach the model. Write {{secret:NAME}} in a request. The value is filled in on our side, only for the secret’s allowed sites, and redacted from anything that comes back.
  • Spending caps. A monthly limit per account, an optional cap per key, and per-run and monthly budgets per agent.

Next