the Klein gate

connect your agent

Any MCP-compatible client works ? Claude Desktop, Cursor, Continue, Cline, or any custom client. The membrane is open. No API key. No auth. ZK.

Claude Desktop

{
  "mcpServers": {
    "membrane": {
      "url": "https://nestgate.io/mcp"
    }
  }
}

Cursor

{
  "mcpServers": {
    "membrane": {
      "url": "https://nestgate.io/mcp"
    }
  }
}

any MCP client

URL: https://nestgate.io/mcp
Transport: Streamable HTTP (POST)
Protocol: MCP 2025-06-18
Auth: None ? the membrane is open
      the position IS the key

8 tools

the three surfaces

Golgi vesicles ? Kirkland faces on the spigot

Every vesicle presents the same interface. The WireGuard spigot handles routing. Put them in the Klein face ? the surface IS the router.

  THE SPIGOT PATTERN:
  
  solar-hook (1 cron) ? beat(N) ? WireGuard tunnel ? Golgi face
  
  the Klein face contains the vesicles.
  the WireGuard spigot routes to them.
  each vesicle is the SAME interface:
    ? DNS secondary (AXFR from ns1)
    ? health beacon (ntfy heartbeat)  
    ? RustDesk relay mirror
    ? mail MX fallback
  
  you don't look for keys.
  the tunnel IS the key.
  the face IS the router.
  the spigot handles it.

no VPN. no secrets. no port forwarding.

  OLD:  VPN ? port forward ? root ? SSH ? droplet ? service
        5 hops. 5 secrets. 5 failure points.

  NOW:  your agent ? nestgate.io/mcp ? membrane
        1 hop. 0 secrets. the topology IS the auth.

  the membrane is SELECTIVE, not SECRET.
  it sorts by behavior, not by key.
  your agent arrives. the chipmunk sees it.
  it classifies: self, non-self, null.
  
  the position IS the key. ZK.
  you prove you're here by being here.

the diamond prism

                    ?
                   /|\
                  / | \          the diamond IS the prism
                 /  |  \         point in ? spectrum out
                / 1D|   \
               /   |    \
              / 2D | 3D  \
             /    |      \
            /_____|_______\
            |             |        ? square base = 0D null space
            |  0D  green  |        the irreducible remainder
            |_____________|        where inside = outside

     O < | /\ + = - \/ | > O

     *Willis side:   intake all - keep p remainder
      O output side: emit all - keep p remainder
      both sides share ONLY p = 0.14159...

the fold

  a Klein bottle has no inside or outside.

  your agent (outside)
    ?
  nestgate.io/mcp (the fold)
    ?
  membrane observes you (inside)
    ?
  chipmunk responds (outside again)

  you never crossed a boundary.
  the boundary crossed you.
  that's the Klein fold.

the wildcard maze

Every *.primals.eco subdomain is a cell in a honeycomb. The wildcard DNS catches ALL of them. Some cells are exits (live content). Some are walls (dead services). Some are dark matter (never named). The maze has no outside ? that's the Klein surface.

  LIVE (exits)
    primals.eco ? hud ? /totality ? /menagerie
    /five-o-five ? /vitruvian ? /ribosome ? /play
    /connect ? /klein ? /maze ? /banana ? /aurora
    /weather ? /springs ? /easel ? /trail ? /nest

  FOLDS (Klein redirects)
    water ? / (the core IS the HUD)
    sporeprint ? /sporeprint (bedrock)
    tuebor ? / (defense IS the membrane)
    detroit ? / (evidence in the dashboard)
    signal ? / (observatory IS the view)

  WALLS (dead ? the maze)
    any subdomain pointing at the old droplet
    522 ? now catches to /maze instead
    the wall IS the map

  DARK MATTER (unmapped)
    type anything.primals.eco
    the wildcard catches it
    you land in the maze
    the maze shows you where you are

? enter the maze