{"schema_version":"1.0","name":"agent-middleware-api","description":"Governed MCP trust plane for autonomous agents: scoped permits, metered tool invocation, signed receipts, and wallet audit chains. Additional routers are labeled proof surfaces, not the product wedge.","version":"1.2.0","canonical_api":"https://api-service-production-433c.up.railway.app","provider":{"name":"Agent-Native Middleware","website":"https://github.com/PetrefiedThunder/agent-middleware-api"},"capabilities":["billing","mcp_tools","permits","receipts","audit","policies","signing_keys","api_keys"],"proof_surfaces":[{"id":"awi_automation","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"HTTP AWI routes bypass the permit→receipt loop unless invoked as governed MCP tools. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"passkey_auth","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"WebAuthn may use WEBAUTHN_ALLOW_MOCK in tests; production-like boots refuse mock verification. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"dom_bridge","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"Playwright DOM bridge is a proof surface, not a production isolation boundary. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"rag_memory","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"Embeddings may fall back to mock vectors when no embedding provider is configured. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"telemetry","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"Autonomous PM / auto-PR paths are simulation-gated by default. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"agent_communication","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"Webhook delivery is simulated until SIMULATION_MODE_AGENT_COMMS is flipped with a real client. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"sandbox_testing","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"Sandboxes are dry-run / demo surfaces, not compliance isolation. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false},{"id":"ai_decision_making","status":"proof_surface","simulation":true,"governed_by_permits":false,"note":"AI decide/heal endpoints are proof surfaces adjacent to the trust wedge. Not mounted (ENABLE_PROOF_SURFACES=false).","mounted":false}],"endpoints":{"api_base":"/v1","discovery":"/v1/discover","mcp":"/mcp","billing":"/v1/billing","permits":"/v1/permits","receipts":"/v1/receipts","audit":"/v1/audit","policies":"/v1/policies","evidence":"/v1/evidence","keys":"/v1/keys","api_keys":"/v1/api-keys","me":"/v1/me","health":"/health","agent_manifest":"/.well-known/agent.json","llm_docs":"/llm.txt","llms_docs":"/llms.txt","dependency_truth":"/health/dependencies"},"authentication":{"type":"api_key","header":"X-API-Key","public_self_serve":false,"bootstrap_docs":"/docs/partner-api-key-bootstrap.md","note":"No public self-serve API key mint. An operator bootstrap/admin key (VALID_API_KEYS) provisions wallets and DB-scoped agent keys. Agents must use a wallet-scoped key — see bootstrap_docs."},"try_it":{"mode":"local_self_hosted","repository":"https://github.com/PetrefiedThunder/agent-middleware-api","command":"make prove-trust-plane","live_access":"operator_issued","requires_live_credentials":false,"proves":["scoped_permit","metered_mcp_invoke","signed_receipt","replay_without_second_charge","out_of_scope_denial"],"note":"Runs the real FastAPI trust path against a throwaway local SQLite database. This is a reproducible proof, not a production or settlement claim."},"pricing":{"model":"controlled_design_partner_pilot","public_pricing":false,"public_sla":false,"note":"Credits and credentials are provisioned by an operator."},"integrations":{"python_sdk":{"status":"release_artifact_only","version":"0.4.0","path":"b2a_sdk/","install":"pip install -e ./b2a_sdk","note":"Wheel and sdist are attached to python-sdk-v0.4.0 by the release workflow. Not published to PyPI."},"typescript_sdk":{"status":"not_published","note":"No published TypeScript SDK. Use HTTP (/mcp, /v1/permits, /v1/receipts)."},"mcp":true,"preferred_integration":"http_mcp","langgraph":"in_repo_wrapper","crewai":"in_repo_wrapper","autogen":"in_repo_wrapper","llamaindex":"in_repo_wrapper"},"documentation":{"human_dashboard":"/dashboard","api_reference":"/docs","openapi":"/openapi.json","llm_readable":"/llm.txt","llms_readable":"/llms.txt","wedge":"/WEDGE.md","security_limitations":"/SECURITY_LIMITATIONS.md","partner_guide":"/DESIGN_PARTNER_GUIDE.md","partner_api_key_bootstrap":"/docs/partner-api-key-bootstrap.md"},"agent_first":{"primary_audience":"autonomous_agents","design_principle":"agent_first","product_wedge":"governed_mcp_trust_plane","product_loop":["discover","authenticate","authorize","invoke","meter","receipt","audit","govern"],"bootstrap_sequence":["/.well-known/agent.json","/llms.txt","/mcp/tools.json","/openapi.json"],"simulation_and_dependency_truth":"/health/dependencies","proof_surfaces_enabled":false,"proof_surface_note":"Entries under proof_surfaces are demo/workload scaffolding. They do not define the product unless they consume the same permit, receipt, idempotency, and audit primitives via governed MCP.","human_observability":{"human_dashboard_url":"/dashboard","interactive_docs_url":"/docs","redoc_url":"/redoc","note":"Human operators can visually inspect active permits, receipts, and audit telemetry at /dashboard."}}}