NSP Daemon Configuration Reference: axon.toml and Env Vars

The NSP daemon reads its settings from axon.toml — a TOML file that controls everything from the API port and authentication requirements to how aggressively the daemon scans for new processes. You can also override any setting with an AXON_* environment variable without touching the file, which is especially useful in CI pipelines and containerized environments.

Config File Locations

The daemon looks for axon.toml in three locations and layers them in priority order — later sources override earlier ones, and environment variables always win:

C:\ProgramData\Nelieo\axon.toml   ← system-wide (recommended for production)
%APPDATA%\Nelieo\axon.toml        ← per-user overrides
.\axon.toml                        ← working directory (useful for development)
AXON_* environment variables       ← highest priority, always overrides the file

The GUI installer and axon-daemon.exe init both create the system-wide config at C:\ProgramData\Nelieo\axon.toml. This is the file to edit for most deployments.

Full Configuration Reference

Below is a complete axon.toml with every available option documented. All values shown are the defaults — you only need to include the keys you want to change.

# ─────────────────────────────────────────────────────────
# HTTP Server
# ─────────────────────────────────────────────────────────
[server]
# The IP address the NSP API listens on. Default: 127.0.0.1
# Keeping this as 127.0.0.1 restricts access to the local machine only.
# Only change this if you are explicitly exposing the daemon to a network
# and have a firewall in place.
host = "127.0.0.1"

# The port the NSP API listens on. Default: 7842
port = 7842

# How long (in milliseconds) the daemon waits for a standard request
# to complete before returning a timeout error. Default: 30000
request_timeout_ms = 30000

# Maximum allowed HTTP request body size in bytes. Default: 10485760 (10 MB)
max_body_bytes = 10485760

# ─────────────────────────────────────────────────────────
# Authentication
# ─────────────────────────────────────────────────────────
[auth]
# Whether the daemon requires an API key on every request. Default: true
# Set to false only for local development — never in production.
require_key = true

# Path to the JSON file where your API keys are stored.
# Add keys to this file using: axon-daemon.exe keygen
keys_file = "C:\\ProgramData\\Nelieo\\axon_keys.json"

# ─────────────────────────────────────────────────────────
# Rate Limiting
# ─────────────────────────────────────────────────────────
[rate_limit]
# Whether to enforce rate limits. Default: true
enabled = true

# Maximum state-read requests per second for each API key. Default: 100
state_per_second = 100

# Maximum action-execution requests per second for each API key. Default: 10
action_per_second = 10

# Maximum heap-snapshot requests per minute for each API key. Default: 2
# Heap snapshots are resource-intensive and can take up to 47 seconds.
# Keep this value low to protect daemon performance.
snapshot_per_minute = 2

# How long (in seconds) rate-limit counters are retained after last use. Default: 3600
bucket_ttl_secs = 3600

# ─────────────────────────────────────────────────────────
# Process Watcher
# ─────────────────────────────────────────────────────────
[watcher]
# How often (in seconds) the daemon scans for newly opened or closed
# applications. Default: 5
scan_interval_secs = 5

# How often (in seconds) the daemon refreshes state for each tracked
# application. This value is the maximum latency of your state cache. Default: 2
poll_interval_secs = 2

# The minimum classification confidence required to start tracking a process.
# Processes scored below this threshold are ignored. Default: 0.4
# Raise this if you see too many false positives in your tracked process list.
min_confidence = 0.4

# Whether to attempt probing processes whose runtime could not be classified.
# Default: false — leave this off unless you are debugging detection coverage.
probe_unknown = false

# The maximum number of processes the daemon tracks at the same time. Default: 256
max_tracked_processes = 256

# ─────────────────────────────────────────────────────────
# Action Dispatcher
# ─────────────────────────────────────────────────────────
[dispatcher]
# How long (in milliseconds) the daemon waits after executing an action
# before reading post-action state. This gives the target application time
# to finish rendering or saving. Default: 200
post_action_wait_ms = 200

# Maximum size (in bytes) of an expression string passed in an action
# verification step. Default: 2048
verify_expression_max_bytes = 2048

# How long (in milliseconds) the daemon waits for a single action command
# to complete. Default: 30000
cdp_action_timeout_ms = 30000

# ─────────────────────────────────────────────────────────
# Schema Registry
# ─────────────────────────────────────────────────────────
[registry]
# Path to the schema database file. Default: C:\ProgramData\Nelieo\axon_registry.db
db_path = "C:\\ProgramData\\Nelieo\\axon_registry.db"

# Use an in-memory schema registry that does not persist between restarts.
# Default: false
# Set to true in CI or testing environments where you want a clean slate
# every run.
in_memory = false

# ─────────────────────────────────────────────────────────
# CORS
# ─────────────────────────────────────────────────────────
[cors]
# Allow requests from any web origin. Default: false
# Only set this to true for local dashboard or browser-based development.
# Never enable this in production.
allow_all_origins = false

# List of specific origins allowed to make cross-origin requests.
# Only applies when allow_all_origins = false.
# Example: ["http://localhost:3000", "https://your-dashboard.com"]
allowed_origins = []

# ─────────────────────────────────────────────────────────
# Logging
# ─────────────────────────────────────────────────────────
[logging]
# Minimum log level to emit. Default: "info"
# Options: "trace" | "debug" | "info" | "warn" | "error"
level = "info"

# Log output format. Default: "json"
# Use "json" for log aggregators (Datadog, Splunk, etc.).
# Use "text" for human-readable output during development.
format = "json"

# Include distributed tracing span data in log output. Default: false
include_spans = false

# ─────────────────────────────────────────────────────────
# Runtime
# ─────────────────────────────────────────────────────────
[runtime]
# Number of worker threads the daemon uses. Default: 0 (one per logical CPU core)
# Increase this if the daemon is CPU-bound on a high-core-count machine.
worker_threads = 0

# ─────────────────────────────────────────────────────────
# Windows Service
# ─────────────────────────────────────────────────────────
[service]
# The service name registered with the Windows Service Control Manager.
# Must not contain spaces. Default: "NSPDaemon"
name = "NSPDaemon"

# The human-readable name shown in services.msc. Default: "NSP Daemon"
display_name = "NSP Daemon"

# The description shown in the Windows Services panel.
description = "Nelieo State Protocol — Universal runtime substrate for AI agents"

# Whether the service starts automatically when Windows boots. Default: true
auto_start = true

Environment Variable Reference

Every axon.toml key has a corresponding environment variable. Variables follow the format AXON_<SECTION>__<KEY> with a double underscore (__) between the section and key names. Environment variables always override the config file.

Variable	Default	What it controls
`AXON_SERVER__PORT`	`7842`	The port the API listens on
`AXON_SERVER__HOST`	`127.0.0.1`	The IP address the API binds to
`AXON_SERVER__REQUEST_TIMEOUT_MS`	`30000`	Request timeout for standard routes
`AXON_AUTH__REQUIRE_KEY`	`true`	Whether API key authentication is enforced
`AXON_AUTH__KEYS_FILE`	system path	Path to the API keys JSON file
`AXON_RATE_LIMIT__ENABLED`	`true`	Whether rate limiting is active
`AXON_RATE_LIMIT__STATE_PER_SECOND`	`100`	State-read rate limit per key
`AXON_RATE_LIMIT__ACTION_PER_SECOND`	`10`	Action-execution rate limit per key
`AXON_WATCHER__POLL_INTERVAL_SECS`	`2`	How often the daemon refreshes tracked state
`AXON_WATCHER__SCAN_INTERVAL_SECS`	`5`	How often the daemon scans for new processes
`AXON_WATCHER__MIN_CONFIDENCE`	`0.4`	Minimum confidence to track a process
`AXON_DISPATCHER__POST_ACTION_WAIT_MS`	`200`	Post-action settle time
`AXON_REGISTRY__IN_MEMORY`	`false`	Use an ephemeral, non-persistent schema registry
`AXON_LOGGING__LEVEL`	`info`	Minimum log level
`AXON_LOGGING__FORMAT`	`json`	Log output format (`json` or `text`)
`AXON_CORS__ALLOW_ALL_ORIGINS`	`false`	Allow cross-origin requests from any origin

Example Configurations

CI / Testing Environment

In CI, you typically want no authentication, a fresh schema registry on every run, and verbose readable logs. Set these with environment variables so your config file stays unchanged:

AXON_AUTH__REQUIRE_KEY=false \
AXON_REGISTRY__IN_MEMORY=true \
AXON_LOGGING__LEVEL=debug \
AXON_LOGGING__FORMAT=text \
axon-daemon.exe run

Minimal Development Config

For local development with a single agent, use this minimal axon.toml to get fast refresh cycles and skip authentication overhead:

[auth]
require_key = false

[server]
port = 7842

[watcher]
scan_interval_secs = 1
poll_interval_secs = 1

[registry]
in_memory = true

[rate_limit]
enabled = false

[logging]
level = "debug"
format = "text"

Startup Warnings

The daemon prints prominent warnings when it starts with insecure settings. These warnings are intentional — they tell you when your configuration is unsafe for a production environment:

⚠️  NSP DAEMON RUNNING WITHOUT AUTHENTICATION — All API requests pass without
    a key. Set AXON_AUTH__REQUIRE_KEY=true before any production use.

⚠️  CORS allow_all_origins=true — Any web origin can call this daemon.
    Unsafe in production.

Do not suppress these warnings by adjusting log levels. If you see them on a production system, fix the configuration — set require_key = true and remove allow_all_origins = true before exposing the daemon to any agents or clients outside your local machine.

Get Started

The Daemon

Runtime Probes

Security

Guides

Config File Locations

Full Configuration Reference

Environment Variable Reference

Example Configurations

CI / Testing Environment

Minimal Development Config

Startup Warnings

​Config File Locations

​Full Configuration Reference

​Environment Variable Reference

​Example Configurations

​CI / Testing Environment

​Minimal Development Config

​Startup Warnings

Config File Locations

Full Configuration Reference

Environment Variable Reference

Example Configurations

CI / Testing Environment

Minimal Development Config

Startup Warnings