diff --git a/servers/legion/apps/neuron-daemon.yaml b/servers/legion/apps/neuron-daemon.yaml
new file mode 100644
index 0000000..3adfc5b
--- /dev/null
+++ b/servers/legion/apps/neuron-daemon.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: neuron-daemon
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: http://10.43.1.53:3000/will/infrastructure.git
+    targetRevision: main
+    path: servers/legion/k8s/neuron-technologies/daemon
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: neuron-prod
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
diff --git a/servers/legion/dns-neurontechnologies.tf b/servers/legion/dns-neurontechnologies.tf
index 5040329..2ab1c58 100644
--- a/servers/legion/dns-neurontechnologies.tf
+++ b/servers/legion/dns-neurontechnologies.tf
@@ -7,6 +7,15 @@
 # proxied = true enables Cloudflare proxy (CDN, DDoS, SSL termination).
 # ttl = 1 means "auto" when proxied.
 
+resource "cloudflare_record" "nt_tunnel_neuron" {
+  zone_id = local.zone_neurontechnologies_ai
+  name    = "neuron"
+  type    = "CNAME"
+  content = "${var.cloudflare_tunnel_id}.cfargotunnel.com"
+  proxied = true
+  ttl     = 1
+}
+
 resource "cloudflare_record" "nt_tunnel_api" {
   zone_id = local.zone_neurontechnologies_ai
   name    = "api"
diff --git a/servers/legion/k8s/neuron-technologies/daemon/externalsecret.yaml b/servers/legion/k8s/neuron-technologies/daemon/externalsecret.yaml
new file mode 100644
index 0000000..28d74df
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/daemon/externalsecret.yaml
@@ -0,0 +1,23 @@
+# Populate Vault before first deploy:
+#
+#   vault kv put secret/neuron-technologies/daemon \
+#     anthropic_api_key="sk-ant-..."
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: neuron-daemon-secrets
+  namespace: neuron-prod
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: neuron-daemon-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: ANTHROPIC_API_KEY
+      remoteRef:
+        key: secret/data/neuron-technologies/daemon
+        property: anthropic_api_key
diff --git a/servers/legion/k8s/neuron-technologies/daemon/kustomization.yaml b/servers/legion/k8s/neuron-technologies/daemon/kustomization.yaml
new file mode 100644
index 0000000..4372a23
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/daemon/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - externalsecret.yaml
+  - statefulset.yaml
+  - service.yaml
diff --git a/servers/legion/k8s/neuron-technologies/daemon/service.yaml b/servers/legion/k8s/neuron-technologies/daemon/service.yaml
new file mode 100644
index 0000000..9cbb4d6
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/daemon/service.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+spec:
+  selector:
+    app: neuron-daemon
+  ports:
+    - name: ws
+      port: 7749
+      targetPort: 7749
+  type: ClusterIP
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 86400
diff --git a/servers/legion/k8s/neuron-technologies/daemon/statefulset.yaml b/servers/legion/k8s/neuron-technologies/daemon/statefulset.yaml
new file mode 100644
index 0000000..849f820
--- /dev/null
+++ b/servers/legion/k8s/neuron-technologies/daemon/statefulset.yaml
@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: neuron-daemon
+  namespace: neuron-prod
+  labels:
+    app: neuron-daemon
+    env: prod
+spec:
+  serviceName: neuron-daemon
+  replicas: 2
+  selector:
+    matchLabels:
+      app: neuron-daemon
+  template:
+    metadata:
+      labels:
+        app: neuron-daemon
+        env: prod
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1001
+        fsGroup: 1001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: neuron-daemon
+          image: registry.neuralplatform.ai/neuron-technologies/neuron-daemon:latest
+          imagePullPolicy: Always
+          ports:
+            - name: ws
+              containerPort: 7749
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsNonRoot: true
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: NEURON_LLM_PROVIDER
+              value: anthropic
+            - name: NEURON_LLM_MODEL
+              value: claude-haiku-4-5
+            - name: NEURON_DATA_DIR
+              value: /data
+          envFrom:
+            - secretRef:
+                name: neuron-daemon-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 7749
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 3
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 5Gi
diff --git a/servers/legion/k8s/neuron-technologies/marketing/deployment.yaml b/servers/legion/k8s/neuron-technologies/marketing/deployment.yaml
index 53a973c..481d527 100644
--- a/servers/legion/k8s/neuron-technologies/marketing/deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/marketing/deployment.yaml
@@ -40,6 +40,8 @@ spec:
               value: production
             - name: NEURON_LICENSE_API_URL
               value: http://neuron-license.neuron-prod.svc.cluster.local:8082
+            - name: NEURON_DAEMON_WS_URL
+              value: ws://neuron-daemon.neuron-prod.svc.cluster.local:7749/ws
           envFrom:
             - secretRef:
                 name: neuron-marketing-secrets
diff --git a/servers/legion/k8s/neuron-technologies/prod/rest-deployment.yaml b/servers/legion/k8s/neuron-technologies/prod/rest-deployment.yaml
index 4cdf765..c4f196b 100644
--- a/servers/legion/k8s/neuron-technologies/prod/rest-deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/rest-deployment.yaml
@@ -20,7 +20,6 @@ spec:
         kubectl.kubernetes.io/restartedAt: "2026-04-24T10:00:00Z"
     spec:
       securityContext:
-        runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
       containers:
@@ -33,7 +32,6 @@ spec:
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: false
-            runAsNonRoot: true
             capabilities:
               drop: ["ALL"]
           envFrom:
diff --git a/servers/legion/main.tf b/servers/legion/main.tf
index df2d9f5..db46d72 100644
--- a/servers/legion/main.tf
+++ b/servers/legion/main.tf
@@ -149,6 +149,15 @@ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "legion" {
       service  = "ssh://localhost:30022"
     }
 
+    # neuron.neurontechnologies.ai — Neuron MCP (private, neuron-prod namespace)
+    ingress_rule {
+      hostname = "neuron.neurontechnologies.ai"
+      service  = "https://traefik.kube-system.svc:443"
+      origin_request {
+        no_tls_verify = true
+      }
+    }
+
     # neurontechnologies.ai — Neuron Technologies prod (neuron-prod namespace)
     ingress_rule {
       hostname = "neurontechnologies.ai"