# Agent Middleware API — machine discovery

This origin is the human design-partner site. It does not mint credentials or
execute protected tools. Platform engineering, AI infrastructure, and security
teams operating internal MCP tools are the buyers; autonomous clients consume
the discovery contract below.

## Governed loop

discover -> authenticate -> authorize -> invoke -> meter -> receipt -> audit -> govern

## Canonical API

https://api.thisisatest.tech

## Bootstrap

Fetch in this order:

1. GET https://api.thisisatest.tech/.well-known/agent.json
2. GET https://api.thisisatest.tech/llms.txt
3. GET https://api.thisisatest.tech/mcp/tools.json
4. GET https://api.thisisatest.tech/openapi.json

Before assuming real side effects, fetch:

GET https://api.thisisatest.tech/health/dependencies

Inspect the JSON body: HTTP 200 alone does not mean every dependency is ready.
Check `status`, the selected tool's dependencies, `simulation_modes`, and
`enable_proof_surfaces`. Health never replaces authentication or permit checks.

## Authority

Protected routes use the X-API-Key header. Live keys are operator-issued; there
is no public self-serve key mint on this site.

## Published receipt proof

The public proof page is:

https://www.thisisatest.tech/proof/

It labels the evidence as self-issued live gateway proof, not customer
traction. The exact portable receipt and matching key snapshot can be checked
offline with the repository SDK verifier.

## Try the complete loop locally

No live credentials are required. Two local paths, both self-contained:

Drive it yourself (a real server, you hold the keys):

1. Clone https://github.com/PetrefiedThunder/agent-middleware-api
2. Run `make quickstart` from the repository root.
3. Follow docs/quickstart.md: mint your own wallet-scoped key, issue
   yourself a permit, invoke one governed tool, replay it, overspend it,
   and verify the signed receipt offline.

Watch it prove itself (no server, one command):

1. Clone the same repository.
2. Run `make prove-trust-plane` from the repository root.

Both use a throwaway local SQLite database and real FastAPI routes. They
demonstrate permit -> invoke -> charge -> signed receipt -> replay without a
second charge -> out-of-scope denial. These are local proofs, not production
settlement or compliance claims.

## Humans and operators

https://www.thisisatest.tech/
https://github.com/PetrefiedThunder/agent-middleware-api