One endpoint.
The right tools.
Agents get exactly the capabilities they need, with proof of who allowed it and what happened.
Your agent pays for every schema before it does anything.
Five connected servers can consume 72% of a 200k window before the first token of the actual task. The fix is not a larger window. It is not shipping schemas the model will never use.
Measured on a 644-operation Stripe-shaped catalog. 412 tokens until a capability is described.
0.2% of the window before the first call. The schema is paid for once, by the call that needs it.
Search. Describe. Invoke. Receipt.
The endpoint exposes three meta-tools and a typed SDK. The catalog can hold hundreds of operations; the agent sees a handful of words until it chooses.
Live sequence · pauses on hover
capabilities.search
request{ "query": "refund an invoice", "kind": "tool" }result
[
{ "ref": "invoices.refund", "requires": ["invoice", "amount"], "size": 34 },
{ "ref": "invoices.get", "requires": ["invoice"], "size": 28 },
{ "ref": "credits.issue", "requires": ["customer", "amount"], "size": 31 }
]The grant is not the policy.
A capability can be granted and still be refused. Rules run at call time on the source, side-effect class, caller, time window and argument shape. Deny wins.
A production version cannot be granted until someone other than its author approves it. The run records which version, which caller, and what came back.
A skill is a package, not a prompt.
SKILL.md and its files publish as one immutable version. The entry stays under 500 lines; references and assets are read by path. Scripts run in a fresh microVM with no network and a read-only tree.
- atomic publish · tree hash in the version
- scan on publish · critical/high block
- sandbox · fresh VM, egress denied
- envelope encryption · broker-only key
invoice-review/
├── SKILL.md 182 lines
├── scripts/
│ └── reconcile.py runs in sandbox
├── references/
│ └── policy.md read by path
└── assets/
└── template.csv
scan semgrep · trivy · gitleaks
verdict passed — 0 blocking, 1 note
no claim that this is "safe"