Skip to main content
Glama

ProtoOS v0.2.0 — Unified Autonomous Protocols Operating System

CI License Python 3.12+ Tests Requirements MCP SDK CLI API x402

Reference implementation of a policy-governed control plane that composes existing agent protocols — MCP, A2A, AP2 mandates, x402, MPP, UCP/ACP-style commerce, AG-UI, ANP/DID-style identity — into one environment where agents are built, discovered, coordinated, authorized, paid, and audited.

Pure Python 3.12 standard library (+ optional cryptography for Ed25519, with OS-verified HMAC fallback). Zero network required.

Related: OpenMesha · rui · server-os

Surfaces

Surface

Entry

CLI

protoos status · protoos verify · protoos graph · protoos vault

SDK

from protoos.sdk import ProtoOSClient

MCP Server

protoos-mcp / protoos/mcp.py (JSON-RPC, paid tools, mux, OpenAPI→MCP)

HTTP/JSON-RPC + SSE

protoos/httpapi.py (/mcp, /a2a, /agui/<run>, /.well-known/agents)

Multi-agent workflows

discovery + budgeted delegate + TaskGraph + AG-UI

Skills

skills/*/SKILL.md (policy, x402, multi-agent, constellation, mcp)

Constellation + Vault

python -m protoos.graph · python -m protoos.vault

CI

.github/workflows/ci.yml

AGENTS.md

Coding-agent contract at repo root

Requirement audit

traceability.json · VERIFICATION.md · python -m protoos.verify

Related MCP server: Agorus MCP Server

New in 0.2.0 — Constellation & Obsidian vault

The world is now a first-class graph, at parity with the web console's Constellation tab.

  • protoos.graph.build_graph(os) derives the live object graph — principals, budgets, MCP servers/tools, AP2 mandate chains, receipts, tasks, pending approvals — with the same node-type/edge-kind vocabulary as the browser build (parity-checked: MATCH).

  • protoos.graph.layout(graph, seed=…) is a deterministic force layout. Exports: to_json, to_dot, to_svg.

  • protoos.vault.write_vault[_zip](os, dest) writes an Obsidian vault of wikilinked notes; unresolved_links() proves integrity.

  • Hardening: AuditLog.append deep-copies payloads; TraditionalRail retains receipts.

python3 -m protoos.graph out/        # constellation.{json,dot,svg}
python3 -m protoos.vault vault.zip   # Obsidian vault
python3 demo.py                      # also writes both artifacts
python3 -m protoos.cli status

Quickstart

python3 -m unittest discover -s tests   # 95 tests
python3 demo.py                          # end-to-end scenario
python3 -m protoos.verify                # traceability audit + live smoke
pip install -e ".[crypto]"               # optional Ed25519
protoos status
from protoos import ProtoOS, Catalog
from protoos.sdk import ProtoOSClient

os_ = ProtoOS()
os_.engine.add_rule("user", "allow", ["payment.settle"], "amount <= 200")
os_.engine.add_rule("org", "require_approval", ["payment.settle"], "amount > 50")

casey  = os_.create_user("casey")
shop   = os_.create_merchant("shop")
budget = os_.wallet.create_budget(casey.did, 500.0, window=(300.0, 86400))

catalog = Catalog(shop.did, "shop")
catalog.add("bk1", "Distributed Systems 101", 10.00, "USD", "digital")

receipt = os_.purchase(casey.did, catalog, [{"sku": "bk1", "qty": 2}],
                       intent_text="buy two intro ebooks", max_amount=100,
                       budget_id=budget.id, categories=["digital"])
# Intent Mandate -> checkout -> Cart Mandate -> Payment Mandate
# -> policy + budget -> x402 settle -> hash-chained audit

Spec → module map

Spec box

Module

Policy Engine + Mandate Store

protoos/policy.py

Orchestrator / Task Graph

protoos/runtime.py, protoos/core.py

Identity & Credential Service

protoos/identity.py

Discovery & Registry

protoos/registry.py

Observability & Audit

protoos/audit.py

Wallet / Spending Controller

protoos/wallet.py

MCP adapter (+OpenAPI→MCP, federation, cache)

protoos/mcp.py

A2A adapter + AG-UI event bus

protoos/a2a.py

UCP/ACP-style commerce

protoos/commerce.py

HTTP/JSON-RPC + SSE transport

protoos/httpapi.py

Control-plane facade (ProtoOS)

protoos/core.py

CLI

protoos/cli.py

SDK

protoos/sdk/

Constellation graph

protoos/graph.py

Obsidian vault export

protoos/vault.py

Kubernetes CRDs + Deployment

deploy/k8s/

Skills

skills/

Requirement audit

traceability.json, VERIFICATION.md, protoos/verify.py

What "reference implementation" means here

Every protocol surface named by the spec is working and tested in-process: JSON-RPC MCP with paid tools, the A2A task lifecycle, the full AP2 Intent→Cart→Payment mandate chain, x402 challenge/settle with an in-process facilitator, MPP prepaid sessions, AG-UI event streams over SSE, DID documents and well-known publication. This sandbox has no network egress, no Kubernetes cluster, and no external SDKs, so anything that requires the open internet is implemented against local/loopback equivalents and explicitly marked partial or deferred in traceability.json — nothing is silently omitted.

Production hardening path

  1. Rust control plane (X1): module boundaries here mirror the intended services; the Python build is the executable specification.

  2. Storage (X3): in-memory + JSONL → etcd/Postgres / object storage / vector DB.

  3. Rails (M1/X6): official x402/MPP/AP2 SDKs slot into the existing rail seams.

  4. Transports (X4/X5): add gRPC/QUIC beside httpapi.py.

  5. Sandboxing (G4): replace SandboxedExecutor with container/microVM isolation.

Design principles

  1. Compose, don't replace

  2. Policy-first autonomy (every sensitive action gated)

  3. Cryptographic mandates + hash-chained audit

  4. Human-in-the-loop as a first-class primitive

  5. Multi-rail everything (tools, messaging, payments, identity)

  6. Offline-first reference with honest partial/deferred markers

License

Apache-2.0. Governance charter draft: GOVERNANCE.md.

Available Tools

5 tools
echoA

Return the message plus the Proto-OS name to confirm the MCP session is alive.

Use as a liveness probe before mux_mount. Read-only, no network, no payment.

ParametersJSON Schema
NameRequiredDescriptionDefault
messageNoPayload echoed back unchanged. Default ping.ping

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only, no network, no payment,' which clearly communicates that this tool has no side effects, no external calls, and no cost. This goes beyond basic description and gives the agent confidence in invoking it safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no redundant words. The primary purpose is front-loaded, followed by the usage context and safety profile. Every sentence delivers distinct value: what it does, when to use it, and what side effects to expect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with an output schema, the description fully covers what an agent needs: purpose, usage scenario, and behavioral constraints. It also mentions the relationship to mux_mount, giving operational context. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage of the single parameter with a description ('Payload echoed back unchanged. Default ping.') The tool description does not add further parameter-specific meaning beyond confirming the message is echoed. With full schema coverage, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Return the message plus the Proto-OS name to confirm the MCP session is alive.' This clearly defines what the tool does and its purpose. It also distinguishes itself from siblings by framing it as a liveness probe, which is distinct from listing or mounting operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use it: 'Use as a liveness probe before mux_mount.' This provides clear context for selecting this tool. It does not mention exclusions or alternatives, but the guidance is specific enough for an agent to know it is the appropriate pre-flight check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_mounted_serversA

List MCP servers currently mounted on the in-process mux.

Use after mux_mount. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly states 'Read-only' and scopes the behavior to servers 'currently mounted on the in-process mux,' which is meaningful for safety and freshness. It does not describe empty-list behavior, but the output schema covers return details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences: the primary action first, followed by usage timing and read-only status. Every sentence adds distinct value without redundancy or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only listing tool with an output schema, the description is complete. It identifies the resource, the mux context, the relationship to mux_mount, and the non-mutating nature, while sibling tool names and the output schema cover the remaining ambiguities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema fully documents this with 100% coverage. There is no parameter behavior for the description to clarify, so a baseline of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'List MCP servers currently mounted on the in-process mux.' This clearly differentiates it from siblings like list_protocols, which lists protocols rather than servers, and mux_mount, which performs the mounting action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context with 'Use after mux_mount,' telling the agent when this tool is appropriate relative to a sibling tool. It also notes the operation is read-only, though it does not explicitly discuss when not to use it or compare against list_protocols.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_protocolsA

List protocol families this kernel can govern.

Inventory only. Mounted servers are list_mounted_servers. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing side effects. It explicitly states 'Read-only' and 'Inventory only', which clearly tells the agent this is a safe, non-mutating operation. This exceeds what the tool name alone would convey and is especially valuable for a tool with no annotation safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. Each sentence adds value: the core purpose, the inventory-only scope, the sibling distinction, and the read-only safety signal. It is front-loaded with the purpose and remains compact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-side-effect listing tool with an output schema, the description covers purpose, usage boundary, alternative tool, and safety. There is no missing information that an agent would need to decide to invoke or actually invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema already documents this (100% coverage), so the description needs no parameter details. Per the zero-parameter baseline, this is adequate; no additional meaning is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and object: 'List protocol families this kernel can govern.' It clearly identifies the resource type and scope, and immediately distinguishes itself from list_mounted_servers by noting that mounted servers are covered by the sibling tool. An agent can confidently select this tool for protocol-family inventory without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Inventory only' tells the agent when this tool is appropriate, and 'Mounted servers are list_mounted_servers' explicitly routes a related but distinct use case to the correct sibling. This provides actionable selection guidance rather than leaving the agent to infer it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mux_mountA

Register an empty named MCP server on the in-process mux.

Idempotent upsert. No child process, no URL. Local write only.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesHuman server name stored on the mount.
prefixYesMux prefix used as prefix.tool.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It goes well beyond a generic verb by disclosing idempotent upsert behavior, the absence of child processes, no URL involvement, and local-only writes. This is strong transparency for a simple mount operation, though it does not describe failure or return behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally tight: one core sentence followed by three high-value fragments. Every phrase earns its place, and the main purpose is front-loaded. There is no filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with two required string parameters, an output schema, and no nested objects, this description is nearly complete. It covers the operation, idempotency, scope, and side-effect profile. It could be slightly richer on what 'empty' means or what happens if the prefix already exists, but those are minor for a 2-parameter tool with an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains both 'name' and 'prefix' clearly. The tool description adds context about the mount being 'empty' and 'named,' but it does not meaningfully deepen parameter-level semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Register') and resource ('an empty named MCP server on the in-process mux'), making the core function immediately clear. It also distinguishes itself from likely siblings like list_mounted_servers and openapi_stub by clarifying that this is an in-process mount with no child process or URL.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear contextual signals about when this tool is appropriate: it registers an in-process server, is idempotent, and is local-only. It does not explicitly name alternatives or say 'use this instead of X', but the constraints ('No child process, no URL. Local write only.') effectively rule out sibling tools that might involve remote or stub-based servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

openapi_stubA

Return a stub MCP server derived from a caller-supplied OpenAPI title.

Offline scaffold only. Does not fetch a spec URL. Not mux_mount.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYesDisplay title for the generated stub server.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses key behavior: the tool is offline-only, does not fetch a URL, and is not mux_mount. This provides meaningful transparency beyond the tool name, though it could mention whether it has side effects or validates input, but for a simple scaffold tool this is largely sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four short sentences with zero filler. The primary purpose is front-loaded, and the clarifying scope statements ('Offline scaffold only,' 'Does not fetch a spec URL,' 'Not mux_mount') each earn their place by preventing common mistakes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a very simple tool with one required parameter, an output schema, and no nested objects. The description fully covers the operational context: what it does, what it does not do, and its relationship to mux_mount. Nothing essential is missing for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning by framing title as a 'caller-supplied OpenAPI title' and clarifying that the generated server is an offline scaffold based on that title, rather than something fetched or mounted. This enriches the schema's 'Display title for the generated stub server.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Return a stub MCP server derived from a caller-supplied OpenAPI title.' It also distinguishes itself from the sibling tool by saying 'Not mux_mount.' This is far beyond a tautology and clearly separates it from the other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states its scope: 'Offline scaffold only. Does not fetch a spec URL. Not mux_mount.' This tells the agent when to use it (offline scaffolding) and when not to use it (for mounting an actual server or fetching a spec). It directly names the sibling alternative mux_mount.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.2.0
    • First observedecho
    • First observedlist_mounted_servers
    • First observedlist_protocols
    • First observedmux_mount
    • First observedopenapi_stub

TDQS

A4.2/5.0
Disambiguation5/5

Each tool has a clearly distinct target: liveness, protocol inventory, mounted-server inventory, mounting, and OpenAPI stub generation. The descriptions explicitly cross-reference differences (e.g., list_protocols points to list_mounted_servers, openapi_stub says 'Not mux_mount'), so an agent should not confuse them.

Naming Consistency2/5

Only list_protocols and list_mounted_servers follow a clear verb_noun pattern. echo is a bare verb, mux_mount is an object-first compound, and openapi_stub is a noun phrase with no verb. The names are readable but do not form a predictable naming convention across the set.

Tool Count5/5

Five tools is a well-scoped size for this focused MCP mux/kernel utility. Each tool earns its place and none feel redundant.

Completeness3/5

The set covers liveness, inventory, mounting, and stub scaffolding, but lacks an unmount/remove operation and offers no way to mount or apply the OpenAPI stub through the mounted-server lifecycle. This leaves a notable create/list-without-delete gap that could cause agent dead ends.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ANAMIZED/Proto-OS'

If you have feedback or need assistance with the MCP directory API, please join our Discord server