From zero to agent-callable

Self-serve onboarding — the hosted flow

The fastest path needs no CLI and no OpenAPI spec: sign up with your website URL and receive your Connect File (one line of JSON you place on your site once, ever). The free tier gives you a readiness report instantly with no file at all; actual publishing follows this sequence — payment comes after verification, never before:

After launch you stay managed: on-demand re-analysis within your plan's allowance when your site changes, free daily content refresh (search never serves stale data), a daily verification heartbeat on your file, and automatic broken-tool detection from real agent traffic — all governed from your dashboard.

You watch every stage live on your status page (the link with your access key arrives at signup), review form-derived candidates there, and collect your deliverables: the MCP endpoint, registration token, discovery files, and a readiness report with a full audit trail.

Quickstart — run the full demo

The repository ships a complete working loop: a demo shop, the auth layer, the MCP gateway, and a scripted agent that exercises all of it. Requires Node ≥ 18, nothing else.

# clone, then from the repo root:
node scripts/e2e.js

# boots demo-site (:4100), auth (:4200), gateway (:4300),
# registers an agent, gets a token, and runs 14 end-to-end checks.
# Expected final line:
🎉 E2E PASSED

Transform your API into agent tools

If you have an OpenAPI 3.x spec, the transformer compiles it into a function manifest — the universal intermediate representation the gateway serves.

node packages/transformer/src/cli.js your-openapi.json \
  --tenant your-business \
  --base-url https://api.your-site.com \
  --secret-ref YOUR_API_KEY_ENV \
  --out packages/gateway/tenants/your-business.manifest.json

Mapping rules: operationId → tool name · GET → read scope, mutations → write scope · parameters and request bodies → a flattened JSON-Schema inputSchema · x-requires-approval: true → human-in-the-loop gating. The transformer also emits llms.txt and mcp.json discovery artifacts to drop onto your site.

Authentication

The gateway trusts no request without a Bearer token, and validates every token against the auth layer via RFC 7662 introspection. Agents bootstrap the whole flow automatically:

Connect an agent

Any MCP-capable client (Claude, ChatGPT, Copilot, Cursor) connects with a URL:

{
  "mcpServers": {
    "your-business": {
      "url": "https://your-gateway/mcp/your-business",
      "transport": "http"
    }
  }
}

The gateway implements the stateless Streamable-HTTP JSON-RPC subset — initialize, tools/list, tools/call, ping. SSE streaming and session resumability are on the roadmap.

Manifest reference

{
  "manifestVersion": "1.0",
  "tenant": "your-business",
  "origin": {
    "baseUrl": "https://api.your-site.com",
    "allowedHosts": ["api.your-site.com"]   // SSRF allowlist
  },
  "auth": {
    "type": "apiKey",
    "header": "X-API-Key",
    "secretRef": "YOUR_API_KEY_ENV"       // injected server-side, never exposed
  },
  "tools": [{
    "name": "create_order",
    "description": "Create an order. Returns order id and total.",
    "scope": "write",
    "requiresApproval": true,
    "inputSchema": { /* JSON Schema */ },
    "request": { "method": "POST", "path": "/api/orders" }
  }]
}

Error taxonomy

Execution failures map to a stable vocabulary so agents (and your dashboards) can react programmatically: