mim always serves through the front end. It names the programs to serve explicitly; nothing is served because it happens to be installed. The front end finds each program’s manifest in the installed-programs directory of the state (Overview), checks every one at startup, and starts each program’s daemon on its first request. A daemon that has exited is started again on the next request for it.

The front end answers:

A successful call returns {"status":"ok","result":…​}. A command whose result carries a media type returns the raw bytes with that type instead. A failure returns {"status":"error","error":"…​"}.

Each exported command of each program on the MCP view becomes one tool, named <module>__<command>. A name that collides is refused at startup. The tool’s description is the command’s documentation, and its input schema is an object with one property per argument, keyed by the argument’s published name (its declared long name, or _1, _2, …​ for positional arguments). Morloc types map to JSON Schema:

A record argument may instead be spread into one property per field. A command that renders its result several ways gets an extra _render property naming the rendering. When a command returns a record, the tool also declares an output schema and returns structured content; otherwise the result is one text block of JSON.

A command is not offered as a tool if an argument or its result is a file handle or a stream, or if it reads standard input. These mean nothing to a remote caller, and a stream would write to the standard output that the MCP transport owns.

Protocol. The server speaks MCP protocol version 2025-06-18. A client sends initialize, then the notifications/initialized notification; tools/list and tools/call before that are rejected. Over HTTP, initialize returns an Mcp-Session-Id header that every later request must carry; an unknown session is told to initialize again, and an idle session expires. A call that fails while running returns a normal result marked isError, with the message as text. A malformed request, an unknown tool or a bad argument is a JSON-RPC error.

A daemon outlives any one call, so it must survive a pool that crashes. When it finds a pool dead, it closes admission (new requests are answered as unavailable, HTTP 503), stops every pool, and waits for the requests already running to finish. Only then does it discard the program’s shared memory, create it afresh, restart and ping every pool, and reopen admission. No request spans a recovery, so no shared-memory reference from before the crash is ever read after it. If running requests do not finish within a minute, or recovery keeps failing, the daemon exits instead of serving from an inconsistent state.

When enabled, eval lets a caller send a whole Morloc expression that composes installed functions. It is offered as POST /eval with {"expr": "…​"} and as an MCP tool named eval whose description lists the importable modules.

Each request is typechecked, compiled and run in a fresh process group, under these restrictions:

Nothing about one request is kept for the next.

A server binds the loopback address unless told otherwise, so only the local machine can reach it. A server bound to any other address must have a token, a shared secret every request presents as Authorization: Bearer <token>; without it a request is refused with 401. The token is compared in constant time, and only /health is exempt. Starting an exposed server without a token requires an explicit waiver, meant for a gateway that already checks callers.

Eval is code execution, so it is held to a stricter rule: with no token it is locked — not listed, reported as locked by /discover, and refused — unless waived separately from the server-wide waiver. mim grants that waiver to a loopback server, where every caller is already local.

Remote clients are untrusted in other ways too: a request must arrive within a deadline, its headers and body are bounded, and the number of simultaneous connections is capped, so one client cannot exhaust the server.

The plain-HTTP server does not encrypt. A token stops strangers who find the port, not anyone who can watch the network; mim therefore requires the operator to acknowledge plaintext before exposing a server, and an untrusted network needs a tunnel or a TLS proxy in front.

mim keeps, per environment, a view for each adapter — the modules answering over MCP and over the JSON API — and an optional eval allow-list. Installing a module never serves it. mim start reads the views, starts one front end for the environment, and records its process or container. A second start is refused while the recorded server is alive (judged by the recorded process being the one mim started, not merely a live process id), unless told to replace it. stop ends the server and removes the record.

The token is chosen by the operator and passed to the server in its environment. mim never generates one, writes one to disk, or puts one on a command line. A container server runs with a read-only root file system, and the environment is marked immutable while it serves (Environment solving), so a caller cannot change the installed software.