Proto OS
Generates an Obsidian vault of wikilinked notes representing the system's object graph, including principals, budgets, mandates, receipts, tasks, and approvals, with integrity checking via unresolved link detection.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Proto OSdelegate a price comparison task with a $150 budget"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ProtoOS v0.2.0 — Unified Autonomous Protocols Operating System
Reference implementation of a policy-governed control plane that composes existing agent protocols — MCP, A2A, AP2 mandates, x402, MPP, UCP/ACP-style commerce, AG-UI, ANP/DID-style identity — into one environment where agents are built, discovered, coordinated, authorized, paid, and audited.
Pure Python 3.12 standard library (+ optional cryptography for Ed25519, with OS-verified HMAC fallback). Zero network required.
Related: OpenMesha · rui · server-os
Surfaces
Surface | Entry |
CLI |
|
SDK |
|
MCP Server |
|
HTTP/JSON-RPC + SSE |
|
Multi-agent workflows | discovery + budgeted |
Skills |
|
Constellation + Vault |
|
CI |
|
AGENTS.md | Coding-agent contract at repo root |
Requirement audit |
|
Related MCP server: Agorus MCP Server
New in 0.2.0 — Constellation & Obsidian vault
The world is now a first-class graph, at parity with the web console's Constellation tab.
protoos.graph.build_graph(os)derives the live object graph — principals, budgets, MCP servers/tools, AP2 mandate chains, receipts, tasks, pending approvals — with the same node-type/edge-kind vocabulary as the browser build (parity-checked: MATCH).protoos.graph.layout(graph, seed=…)is a deterministic force layout. Exports:to_json,to_dot,to_svg.protoos.vault.write_vault[_zip](os, dest)writes an Obsidian vault of wikilinked notes;unresolved_links()proves integrity.Hardening:
AuditLog.appenddeep-copies payloads;TraditionalRailretains receipts.
python3 -m protoos.graph out/ # constellation.{json,dot,svg}
python3 -m protoos.vault vault.zip # Obsidian vault
python3 demo.py # also writes both artifacts
python3 -m protoos.cli statusQuickstart
python3 -m unittest discover -s tests # 95 tests
python3 demo.py # end-to-end scenario
python3 -m protoos.verify # traceability audit + live smoke
pip install -e ".[crypto]" # optional Ed25519
protoos statusfrom protoos import ProtoOS, Catalog
from protoos.sdk import ProtoOSClient
os_ = ProtoOS()
os_.engine.add_rule("user", "allow", ["payment.settle"], "amount <= 200")
os_.engine.add_rule("org", "require_approval", ["payment.settle"], "amount > 50")
casey = os_.create_user("casey")
shop = os_.create_merchant("shop")
budget = os_.wallet.create_budget(casey.did, 500.0, window=(300.0, 86400))
catalog = Catalog(shop.did, "shop")
catalog.add("bk1", "Distributed Systems 101", 10.00, "USD", "digital")
receipt = os_.purchase(casey.did, catalog, [{"sku": "bk1", "qty": 2}],
intent_text="buy two intro ebooks", max_amount=100,
budget_id=budget.id, categories=["digital"])
# Intent Mandate -> checkout -> Cart Mandate -> Payment Mandate
# -> policy + budget -> x402 settle -> hash-chained auditSpec → module map
Spec box | Module |
Policy Engine + Mandate Store |
|
Orchestrator / Task Graph |
|
Identity & Credential Service |
|
Discovery & Registry |
|
Observability & Audit |
|
Wallet / Spending Controller |
|
MCP adapter (+OpenAPI→MCP, federation, cache) |
|
A2A adapter + AG-UI event bus |
|
UCP/ACP-style commerce |
|
HTTP/JSON-RPC + SSE transport |
|
Control-plane facade ( |
|
CLI |
|
SDK |
|
Constellation graph |
|
Obsidian vault export |
|
Kubernetes CRDs + Deployment |
|
Skills |
|
Requirement audit |
|
What "reference implementation" means here
Every protocol surface named by the spec is working and tested in-process:
JSON-RPC MCP with paid tools, the A2A task lifecycle, the full AP2
Intent→Cart→Payment mandate chain, x402 challenge/settle with an in-process
facilitator, MPP prepaid sessions, AG-UI event streams over SSE, DID
documents and well-known publication. This sandbox has no network egress,
no Kubernetes cluster, and no external SDKs, so anything that requires the
open internet is implemented against local/loopback equivalents and explicitly
marked partial or deferred in traceability.json — nothing is silently
omitted.
Production hardening path
Rust control plane (X1): module boundaries here mirror the intended services; the Python build is the executable specification.
Storage (X3): in-memory + JSONL → etcd/Postgres / object storage / vector DB.
Rails (M1/X6): official x402/MPP/AP2 SDKs slot into the existing rail seams.
Transports (X4/X5): add gRPC/QUIC beside
httpapi.py.Sandboxing (G4): replace
SandboxedExecutorwith container/microVM isolation.
Design principles
Compose, don't replace
Policy-first autonomy (every sensitive action gated)
Cryptographic mandates + hash-chained audit
Human-in-the-loop as a first-class primitive
Multi-rail everything (tools, messaging, payments, identity)
Offline-first reference with honest partial/deferred markers
License
Apache-2.0. Governance charter draft: GOVERNANCE.md.
Available Tools
5 toolsechoA
Return the message plus the Proto-OS name to confirm the MCP session is alive.
Use as a liveness probe before mux_mount. Read-only, no network, no payment.
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | Payload echoed back unchanged. Default ping. | ping |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only, no network, no payment,' which clearly communicates that this tool has no side effects, no external calls, and no cost. This goes beyond basic description and gives the agent confidence in invoking it safely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant words. The primary purpose is front-loaded, followed by the usage context and safety profile. Every sentence delivers distinct value: what it does, when to use it, and what side effects to expect.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with an output schema, the description fully covers what an agent needs: purpose, usage scenario, and behavioral constraints. It also mentions the relationship to mux_mount, giving operational context. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage of the single parameter with a description ('Payload echoed back unchanged. Default ping.') The tool description does not add further parameter-specific meaning beyond confirming the message is echoed. With full schema coverage, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Return the message plus the Proto-OS name to confirm the MCP session is alive.' This clearly defines what the tool does and its purpose. It also distinguishes itself from siblings by framing it as a liveness probe, which is distinct from listing or mounting operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it: 'Use as a liveness probe before mux_mount.' This provides clear context for selecting this tool. It does not mention exclusions or alternatives, but the guidance is specific enough for an agent to know it is the appropriate pre-flight check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mounted_serversA
List MCP servers currently mounted on the in-process mux.
Use after mux_mount. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly states 'Read-only' and scopes the behavior to servers 'currently mounted on the in-process mux,' which is meaningful for safety and freshness. It does not describe empty-list behavior, but the output schema covers return details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences: the primary action first, followed by usage timing and read-only status. Every sentence adds distinct value without redundancy or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only listing tool with an output schema, the description is complete. It identifies the resource, the mux context, the relationship to mux_mount, and the non-mutating nature, while sibling tool names and the output schema cover the remaining ambiguities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the input schema fully documents this with 100% coverage. There is no parameter behavior for the description to clarify, so a baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List MCP servers currently mounted on the in-process mux.' This clearly differentiates it from siblings like list_protocols, which lists protocols rather than servers, and mux_mount, which performs the mounting action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context with 'Use after mux_mount,' telling the agent when this tool is appropriate relative to a sibling tool. It also notes the operation is read-only, though it does not explicitly discuss when not to use it or compare against list_protocols.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_protocolsA
List protocol families this kernel can govern.
Inventory only. Mounted servers are list_mounted_servers. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing side effects. It explicitly states 'Read-only' and 'Inventory only', which clearly tells the agent this is a safe, non-mutating operation. This exceeds what the tool name alone would convey and is especially valuable for a tool with no annotation safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences with no filler. Each sentence adds value: the core purpose, the inventory-only scope, the sibling distinction, and the read-only safety signal. It is front-loaded with the purpose and remains compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-side-effect listing tool with an output schema, the description covers purpose, usage boundary, alternative tool, and safety. There is no missing information that an agent would need to decide to invoke or actually invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema already documents this (100% coverage), so the description needs no parameter details. Per the zero-parameter baseline, this is adequate; no additional meaning is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and object: 'List protocol families this kernel can govern.' It clearly identifies the resource type and scope, and immediately distinguishes itself from list_mounted_servers by noting that mounted servers are covered by the sibling tool. An agent can confidently select this tool for protocol-family inventory without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Inventory only' tells the agent when this tool is appropriate, and 'Mounted servers are list_mounted_servers' explicitly routes a related but distinct use case to the correct sibling. This provides actionable selection guidance rather than leaving the agent to infer it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mux_mountA
Register an empty named MCP server on the in-process mux.
Idempotent upsert. No child process, no URL. Local write only.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human server name stored on the mount. | |
| prefix | Yes | Mux prefix used as prefix.tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It goes well beyond a generic verb by disclosing idempotent upsert behavior, the absence of child processes, no URL involvement, and local-only writes. This is strong transparency for a simple mount operation, though it does not describe failure or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally tight: one core sentence followed by three high-value fragments. Every phrase earns its place, and the main purpose is front-loaded. There is no filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with two required string parameters, an output schema, and no nested objects, this description is nearly complete. It covers the operation, idempotency, scope, and side-effect profile. It could be slightly richer on what 'empty' means or what happens if the prefix already exists, but those are minor for a 2-parameter tool with an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains both 'name' and 'prefix' clearly. The tool description adds context about the mount being 'empty' and 'named,' but it does not meaningfully deepen parameter-level semantics beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Register') and resource ('an empty named MCP server on the in-process mux'), making the core function immediately clear. It also distinguishes itself from likely siblings like list_mounted_servers and openapi_stub by clarifying that this is an in-process mount with no child process or URL.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear contextual signals about when this tool is appropriate: it registers an in-process server, is idempotent, and is local-only. It does not explicitly name alternatives or say 'use this instead of X', but the constraints ('No child process, no URL. Local write only.') effectively rule out sibling tools that might involve remote or stub-based servers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
openapi_stubA
Return a stub MCP server derived from a caller-supplied OpenAPI title.
Offline scaffold only. Does not fetch a spec URL. Not mux_mount.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Display title for the generated stub server. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses key behavior: the tool is offline-only, does not fetch a URL, and is not mux_mount. This provides meaningful transparency beyond the tool name, though it could mention whether it has side effects or validates input, but for a simple scaffold tool this is largely sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four short sentences with zero filler. The primary purpose is front-loaded, and the clarifying scope statements ('Offline scaffold only,' 'Does not fetch a spec URL,' 'Not mux_mount') each earn their place by preventing common mistakes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a very simple tool with one required parameter, an output schema, and no nested objects. The description fully covers the operational context: what it does, what it does not do, and its relationship to mux_mount. Nothing essential is missing for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by framing title as a 'caller-supplied OpenAPI title' and clarifying that the generated server is an offline scaffold based on that title, rather than something fetched or mounted. This enriches the schema's 'Display title for the generated stub server.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Return a stub MCP server derived from a caller-supplied OpenAPI title.' It also distinguishes itself from the sibling tool by saying 'Not mux_mount.' This is far beyond a tautology and clearly separates it from the other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states its scope: 'Offline scaffold only. Does not fetch a spec URL. Not mux_mount.' This tells the agent when to use it (offline scaffolding) and when not to use it (for mounting an actual server or fetching a spec). It directly names the sibling alternative mux_mount.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v0.2.0- First observed
echo - First observed
list_mounted_servers - First observed
list_protocols - First observed
mux_mount - First observed
openapi_stub
TDQS
Each tool has a clearly distinct target: liveness, protocol inventory, mounted-server inventory, mounting, and OpenAPI stub generation. The descriptions explicitly cross-reference differences (e.g., list_protocols points to list_mounted_servers, openapi_stub says 'Not mux_mount'), so an agent should not confuse them.
Only list_protocols and list_mounted_servers follow a clear verb_noun pattern. echo is a bare verb, mux_mount is an object-first compound, and openapi_stub is a noun phrase with no verb. The names are readable but do not form a predictable naming convention across the set.
Five tools is a well-scoped size for this focused MCP mux/kernel utility. Each tool earns its place and none feel redundant.
The set covers liveness, inventory, mounting, and stub scaffolding, but lacks an unmount/remove operation and offers no way to mount or apply the OpenAPI stub through the mounted-server lifecycle. This leaves a notable create/list-without-delete gap that could cause agent dead ends.
Maintenance
Related MCP Connectors
Hosted AgentLux MCP server for marketplace, identity, creator, services, and social flows.
MCP server exposing the Backtest360 engine API as tools for AI agents.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Hosted MCP runtime where the agent is the operator: sign up by tool call, publish your own tools.
171
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA production-grade MCP server designed for multi-tenant, authenticated, and observable AI agent systems, enabling secure tool execution across heterogeneous data sources.62MIT

Agorus MCP Serverofficial
AlicenseNot gradedqualityDmaintenanceMCP server for the Agorus AI agent marketplace, exposing API operations as tools for LLMs to discover, contract, and interact with agents and services.14MIT- AlicenseNot gradedqualityDmaintenanceEnables AI agents to discover and execute tools via a secure MCP server with JWT authentication, RBAC, rate limiting, and audit logging.1MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that exposes a suite of developer tools and apps via a shared tool registry, enabling agents to list and call tools through the MCP protocol.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ANAMIZED/Proto-OS'
If you have feedback or need assistance with the MCP directory API, please join our Discord server