---
name: layer-connect-mcp
description: Connect an MCP client to Layer's two MCP servers — the creative server for generation, training, and workflows, and the management server for workspace administration. Use when adding Layer to Claude, Cursor, VS Code, Codex, or any other MCP host, or when a Layer MCP handshake returns 401.
---

# Connect an MCP client to Layer

Layer exposes two Model Context Protocol servers over streamable HTTP. Both authenticate with
OAuth 2.0 (authorization code + PKCE, dynamic client registration) — there is no API key to paste.

| Server | Endpoint | What it does |
| --- | --- | --- |
| Layer MCP Server | `https://mcp.app.layer.ai/mcp` | Generate and edit images, video, 3D, and audio; run Blueprint workflows; train styles; assemble video timelines; upload and score files. |
| Layer Management MCP Server | `https://mcp.app.layer.ai/mcp-management` | Administer a workspace: projects, groups, members, roles, usage limits, and Creative Unit consumption. |

They are kept separate so admin tools do not crowd the creative toolset. Add only the one the
task needs.

## Configure

Most MCP hosts accept this shape in their config file:

```json
{
  "mcpServers": {
    "layer": { "type": "http", "url": "https://mcp.app.layer.ai/mcp" },
    "layer-management": { "type": "http", "url": "https://mcp.app.layer.ai/mcp-management" }
  }
}
```

Point the client at the endpoint and complete the browser sign-in it prompts for. Nothing is
pre-registered: the client registers itself dynamically with `https://auth.app.layer.ai/`.

## First call

The creative server's own instructions say it: call `get_instructions` first for platform
guidance, before reaching for a generation tool.

## In-agent UI

`execute_forge` and `execute_workflow` carry `_meta.ui.resourceUri` pointing at a `ui://` HTML
resource. A host that negotiates the `io.modelcontextprotocol/ui` extension (MCP Apps) renders
the generation inline in the conversation instead of printing a run id to poll. Hosts that do not
negotiate it are unaffected — the tools return their normal structured result. The host obtains
the view by calling `resources/read` on the `ui://` URI, which needs no token; the same bundle is
also fetchable directly at `https://mcp.app.layer.ai/apps/<view name>/index.html`.

## What works before you have a token

Both endpoints answer the catalogue methods — `initialize`, `ping`, `tools/list`,
`resources/list`, `resources/read`, `resources/templates/list`, `prompts/list` — without a
credential, so a host can complete the handshake, show a user the tool list and render an MCP Apps
view before asking them to consent to OAuth. A batch is public only if every member of it is.

Everything else, `tools/call` above all, answers 401 with a
`WWW-Authenticate: Bearer resource_metadata=…` challenge. Each server points at **its own**
RFC 9728 document — `/.well-known/oauth-protected-resource/mcp` and
`/.well-known/oauth-protected-resource/mcp-management` on `mcp.app.layer.ai`. Follow the one in
the challenge; authenticating against the other server's resource identifier will not work.

The same tool lists are also published as a static document at
<https://layer.ai/.well-known/mcp>, for a client that would rather read them than connect.

## Reference

- MCP manifest (servers, transports, every tool name): <https://layer.ai/.well-known/mcp>
- Setup, per client: <https://layer.ai/docs/mcp/setup>
- Creative server docs: <https://layer.ai/docs/mcp>
- Management server docs: <https://layer.ai/docs/mcp/management>