Two surfaces, one shared truth
The kit ships two MCP servers — Maroo MCP (read) and m-aws (write). They run in independent processes with different security boundaries. But they share types, ABIs, and chain config via @maroo-chain/kb-core, so an agentId from m-aws works against PCL queries on Maroo MCP without translation.