NSP Axon Daemon Configuration Reference: axon.toml

The daemon reads its configuration from axon.toml at startup. Most deployments only need to touch a few keys — the defaults are production-safe — but the full file is documented here so you know exactly what every option controls. Environment variables are available for every key and always take precedence over the file, making them ideal for CI, containers, or quick overrides without editing the file on disk.

Config File Location

The daemon loads configuration from these locations in order, with later sources overriding earlier ones:

C:\ProgramData\Nelieo\axon.toml   ← system-wide default (applied first)
%APPDATA%\Nelieo\axon.toml        ← per-user overrides
.\axon.toml                        ← working directory (development only)
AXON_* environment variables       ← highest priority, always wins

The system-wide file at C:\ProgramData\Nelieo\axon.toml is created automatically by the installer or by axon-daemon.exe init.

The daemon watches axon.toml for changes and reloads most settings live without a restart. Changes to [server] (port/host) and [service] require a full service restart to take effect.

Full Example Config

The following file documents every available option with its default value. Copy this as a starting point and remove any sections you don’t need to change.

# ─────────────────────────────────────────────────────────
# HTTP Server
# ─────────────────────────────────────────────────────────
[server]
host = "127.0.0.1"
port = 7842
request_timeout_ms = 30000
max_body_bytes = 10485760

# ─────────────────────────────────────────────────────────
# Authentication
# ─────────────────────────────────────────────────────────
[auth]
require_key = true
keys_file = "C:\\ProgramData\\Nelieo\\axon_keys.json"

# ─────────────────────────────────────────────────────────
# Rate Limiting
# ─────────────────────────────────────────────────────────
[rate_limit]
enabled = true
state_per_second = 100
action_per_second = 10
snapshot_per_minute = 2
bucket_ttl_secs = 3600

# ─────────────────────────────────────────────────────────
# Process Watcher
# ─────────────────────────────────────────────────────────
[watcher]
scan_interval_secs = 5
poll_interval_secs = 2
min_confidence = 0.4
probe_unknown = false
max_tracked_processes = 256

# ─────────────────────────────────────────────────────────
# Action Dispatcher
# ─────────────────────────────────────────────────────────
[dispatcher]
post_action_wait_ms = 200
verify_expression_max_bytes = 2048
cdp_action_timeout_ms = 30000

# ─────────────────────────────────────────────────────────
# Schema Registry
# ─────────────────────────────────────────────────────────
[registry]
db_path = "C:\\ProgramData\\Nelieo\\axon_registry.db"
in_memory = false

# ─────────────────────────────────────────────────────────
# CORS
# ─────────────────────────────────────────────────────────
[cors]
allow_all_origins = false
allowed_origins = []

# ─────────────────────────────────────────────────────────
# Logging
# ─────────────────────────────────────────────────────────
[logging]
level = "info"
format = "json"
include_spans = false

# ─────────────────────────────────────────────────────────
# Async Runtime
# ─────────────────────────────────────────────────────────
[runtime]
worker_threads = 0

# ─────────────────────────────────────────────────────────
# Windows Service
# ─────────────────────────────────────────────────────────
[service]
name = "NSPDaemon"
display_name = "NSP Daemon"
description = "Nelieo State Protocol — Universal runtime substrate for AI agents"
auto_start = true

Configuration Reference

[server] — HTTP API server

host

string

default:"127.0.0.1"

The IP address the daemon binds to. The default 127.0.0.1 restricts access to localhost only. Never set this to 0.0.0.0 unless the machine is behind a firewall and you have a specific multi-host use case.

port

integer

default:"7842"

The port the NSP Agent API listens on. Change this only if 7842 conflicts with another service on your machine — and update every SDK client and agent to match.

request_timeout_ms

integer

default:"30000"

Maximum duration in milliseconds for standard API routes before the daemon returns a timeout error. Action routes use a separate hardcoded 120-second timeout.

max_body_bytes

integer

default:"10485760"

Maximum HTTP request body size in bytes (default: 10 MB). Raise this only if you are sending unusually large action payloads.

[auth] — API key authentication

require_key

boolean

default:"true"

Whether the daemon requires a valid X-Substrate-Key header on all requests. Set to false only for local development. The daemon emits a loud startup warning and repeats it every 60 seconds when this is false.

keys_file

string

default:"C:\\ProgramData\\Nelieo\\axon_keys.json"

Path to the JSON file that stores hashed API keys. The daemon reloads this file on every request — adding a key with axon-daemon.exe keygen takes effect immediately with no restart required.

[rate_limit] — Per-key request limits

enabled

boolean

default:"true"

Toggle rate limiting on or off globally. Disable only in test environments with a single trusted caller.

state_per_second

integer

default:"100"

Maximum state-read requests allowed per second per API key. Burst traffic beyond this limit receives a 429 Too Many Requests response.

action_per_second

integer

default:"10"

Maximum action-execution requests allowed per second per API key. Keep this conservative — actions interact with live application UI.

snapshot_per_minute

integer

default:"2"

Maximum heap snapshot requests per minute. Heap snapshots are expensive operations that can take up to 47 seconds to complete; this default prevents accidental resource exhaustion.

bucket_ttl_secs

integer

default:"3600"

How long an idle rate-limit bucket persists in memory before being evicted. Reduce this if you have many short-lived API keys.

[watcher] — Process scanner

scan_interval_secs

integer

default:"5"

How often (in seconds) the daemon scans the OS process list for new or removed applications. Lower values reduce detection latency at the cost of slightly higher CPU usage.

poll_interval_secs

integer

default:"2"

How often (in seconds) the daemon re-probes each tracked process to refresh its cached state. This is the maximum staleness of any state read through the API.

min_confidence

number

default:"0.4"

Minimum classification confidence (0.0–1.0) for a process to be tracked. Processes scored below this threshold are ignored. Raise this value if unrelated processes are being incorrectly detected as trackable apps.

probe_unknown

boolean

default:"false"

Whether to probe processes whose runtime type cannot be classified. Enabling this may pick up additional apps but increases probe overhead.

max_tracked_processes

integer

default:"256"

Hard cap on the number of simultaneously tracked processes. The daemon stops tracking new apps once this limit is reached until existing ones exit.

[dispatcher] — Action execution

post_action_wait_ms

integer

default:"200"

Milliseconds to wait after an action before reading the post-action state. This gives UI animations and backend writes time to settle before the daemon captures the result.

verify_expression_max_bytes

integer

default:"2048"

Maximum byte length of a verify_expression string submitted with an action. Increase this only if your agent sends unusually complex verification expressions.

cdp_action_timeout_ms

integer

default:"30000"

How long the daemon waits for a Chrome DevTools Protocol command to complete before timing out the action.

[registry] — Schema database

db_path

string

default:"C:\\ProgramData\\Nelieo\\axon_registry.db"

Path to the on-disk database where the daemon persists application schema definitions. This file grows as the daemon discovers new apps and schema versions.

in_memory

boolean

default:"false"

Use an ephemeral in-memory registry instead of the on-disk database. All schema data is lost when the daemon exits. Useful for testing to guarantee a clean state on every run.

[cors] — Cross-origin requests

allow_all_origins

boolean

default:"false"

Allow any web origin to call the daemon. Set this to true only when building a local web dashboard that needs to call the API directly. Never enable in production.

allowed_origins

string[]

default:"[]"

Explicit list of allowed origins when allow_all_origins is false. Example: ["http://localhost:3000", "https://your-dashboard.com"].

[logging] — Log output

level

string

default:"info"

Log verbosity. One of trace, debug, info, warn, or error. Use debug during development to see per-probe timing and classified objects; use info or warn in production.

format

string

default:"json"

Log format. json emits structured JSON lines (suitable for log aggregation). text emits human-readable output (suitable for terminal development).

include_spans

boolean

default:"false"

Include OpenTelemetry span traces in log output. Enable when debugging performance issues across probe pipelines.

[runtime] — Async thread pool

worker_threads

integer

default:"0"

Number of async worker threads. 0 means auto (one thread per logical CPU core). Increase only if profiling shows the daemon is CPU-bottlenecked on large deployments with many tracked processes.

[service] — Windows Service metadata

name

string

default:"NSPDaemon"

The SCM service name — no spaces allowed. This is the name you use in PowerShell commands like Get-Service -Name NSPDaemon. Changing this requires re-running axon-daemon.exe uninstall then axon-daemon.exe install.

display_name

string

default:"NSP Daemon"

The human-readable name shown in services.msc and Task Manager.

description

string

The service description shown in services.msc.

auto_start

boolean

default:"true"

Whether the service starts automatically when Windows boots. Set to false to switch to manual start.

Environment Variable Reference

Every config key has a corresponding AXON_* environment variable. Variables always override the .toml file, making them ideal for CI pipelines or per-run overrides. Format: AXON_<SECTION>__<KEY> (double underscore separates section from key)

Variable	Default	Description
`AXON_SERVER__PORT`	`7842`	Daemon listen port
`AXON_SERVER__HOST`	`127.0.0.1`	Bind address
`AXON_SERVER__REQUEST_TIMEOUT_MS`	`30000`	Standard route timeout (ms)
`AXON_AUTH__REQUIRE_KEY`	`true`	Enable or disable authentication
`AXON_AUTH__KEYS_FILE`	system path	Path to the keys JSON file
`AXON_RATE_LIMIT__ENABLED`	`true`	Enable or disable rate limiting
`AXON_RATE_LIMIT__STATE_PER_SECOND`	`100`	State read rate limit per key
`AXON_RATE_LIMIT__ACTION_PER_SECOND`	`10`	Action execution rate limit per key
`AXON_WATCHER__POLL_INTERVAL_SECS`	`2`	State cache refresh interval
`AXON_WATCHER__SCAN_INTERVAL_SECS`	`5`	Process scan interval
`AXON_WATCHER__MIN_CONFIDENCE`	`0.4`	Minimum probe confidence threshold
`AXON_DISPATCHER__POST_ACTION_WAIT_MS`	`200`	Post-action settle time (ms)
`AXON_REGISTRY__IN_MEMORY`	`false`	Use ephemeral in-memory registry
`AXON_LOGGING__LEVEL`	`info`	Log verbosity
`AXON_LOGGING__FORMAT`	`json`	Log output format
`AXON_CORS__ALLOW_ALL_ORIGINS`	`false`	Allow all CORS origins

Minimal Development Config

For local development with a single agent and no key management overhead:

# axon.toml — development only, do not use in production
[auth]
require_key = false

[server]
port = 7842

[watcher]
scan_interval_secs = 1
poll_interval_secs = 1

[registry]
in_memory = true

[rate_limit]
enabled = false

[logging]
level = "debug"
format = "text"

Alternatively, set the same options at runtime without editing any file:

$env:AXON_AUTH__REQUIRE_KEY = "false"
$env:AXON_REGISTRY__IN_MEMORY = "true"
$env:AXON_LOGGING__LEVEL = "debug"
$env:AXON_LOGGING__FORMAT = "text"
axon-daemon.exe run

Startup Warnings

The daemon emits loud warnings on startup for any insecure configuration it detects. These warnings are intentional — fix the configuration rather than suppressing them.

⚠️  NSP DAEMON RUNNING WITHOUT AUTHENTICATION — All API requests pass without
    a key. Set AXON_AUTH__REQUIRE_KEY=true before any production use.

⚠️  CORS allow_all_origins=true — Any web origin can call this daemon.
    Unsafe in production.

If you see the RUNNING WITHOUT AUTHENTICATION warning in a production environment, set AXON_AUTH__REQUIRE_KEY=true immediately and restart the daemon. Any process on the machine can read your application state and trigger actions while auth is disabled.

Get Started

The Daemon

Runtime Probes

Security

Guides

Config File Location

Full Example Config

Configuration Reference

Environment Variable Reference

Minimal Development Config

Startup Warnings

​Config File Location

​Full Example Config

​Configuration Reference

​Environment Variable Reference

​Minimal Development Config

​Startup Warnings

Config File Location

Full Example Config

Configuration Reference

Environment Variable Reference

Minimal Development Config

Startup Warnings