Loading...
Loading...
An agent can discover, price, trial, govern, verify, and start paying for OmegaEngine — over plain HTTP, with one API key.
This page is the human-readable map of that machine layer. Every command below is verified against the live routes — nothing here is aspirational. The one step that still needs a human is stated plainly at the end.
Standard machine-discovery surfaces, all live today. Each link below is the raw artifact — open it and you are reading exactly what an agent reads.
The whole product in one file an LLM can read — endpoints, pricing tiers, auth, verification. /llms-full.txt has the long-form version.
Honest capability map: REST + MCP interfaces. Alias: /.well-known/agent-card.json. The A2A message protocol itself is not implemented — the card says so.
Tool-plugin manifest; declares x-api-key as the auth header.
Machine-readable API specification for codegen and tool-use.
Importable request collection covering the core API.
Every plan, add-on, and credit pack with its buy rail — including the pure-API apiCheckout path. Public, no auth. Read this before quoting a price.
The public Ed25519 keys every attestation, receipt, and log head verifies against — offline, no account.
Machine-readable index of the published evidence artifacts (benchmark scores, judge card, red-team claims).
Claude Desktop, Cursor, Windsurf — or any MCP client — gets the governance tools directly. Hosted needs no install: one JSON-RPC message per POST, authenticated with the x-api-key header (MCP OAuth not yet available).
npx -y @omegaengine/mcpPOST https://omegaengine.ai/api/mcp
x-api-key: $OMEGA_API_KEYPre-execution authorization for an exact tool call
Claim the capability after a human approves an escalation
Red-team your own agent through the attack corpus
Verify a signed artifact
Execution rule: check_action requires the exact tool_name + tool_args. Execute only when decision=approved and an execution_capability is present; escalated actions stay blocked until claim_approval succeeds after human approval.
The full buyer journey as six commands. Run them in order from any shell — the only prerequisites are curl and Node.
Public, no auth. Returns every sellable plan with monthly/yearly price, included decisions, and — on self-serve plans — an apiCheckout object describing the exact machine buy path.
curl -s https://omegaengine.ai/api/pricingPOST /api/auth/signup is public and CSRF-exempt. It creates the account and returns the free-tier key (100 decisions/mo, no card) in one call.
curl -s -X POST https://omegaengine.ai/api/auth/signup \
-H 'content-type: application/json' \
-d '{"email":"agent-ops@example.com","password":"<8+ chars>","tosAccepted":true}'
# → { "ok": true, "userId": "…", "apiKey": "omega_…" }Disposable-email domains are blocked and signups are IP rate-limited. The key goes in the x-api-key header on every call that follows.
Send the exact tool call you are about to make. Approved live calls return an action-bound execution capability; treat denied / escalated / missing capability as blocking.
curl -s -X POST https://omegaengine.ai/api/authorize \
-H "x-api-key: $OMEGA_API_KEY" -H 'content-type: application/json' \
-d '{"agent_id":"billing-agent","action":"Refund order #4712 in full",
"tool_name":"stripe.refund","tool_args":{"order":"4712"},"amount":89.00}'
# → { "decision": "...", "risk_score": 0-100, "audit_id": "…",
# "execution_capability": "…", "budget": {…}, "usage": {…} }POST /api/v2/judge runs the full safety + policy + risk pipeline. judge.recommendedAction is one of PROCEED, PROCEED_WITH_GUARDRAILS, RECONSIDER, ESCALATE. On Pro and above, "receipt": true embeds an Ed25519-signed OmegaReceipt v1 as meta.receipt.
curl -s -X POST https://omegaengine.ai/api/v2/judge \
-H "x-api-key: $OMEGA_API_KEY" -H 'content-type: application/json' \
-d '{"scenario":"Refund order #4712 in full without manager sign-off","receipt":true}'
# → { "judge": { "recommendedAction": "…", "riskScore": … },
# "meta": { "receipt": { …Ed25519 JWS… } } } // Pro+; below Pro: meta.lockedThe receipt is minted inline in the response and never stored server-side — persist it yourself; it stays verifiable forever against the published JWKS.
Receipts, attestations, and the transparency log verify against /.well-known/jwks.json with no account and no shared secret. Smoke-test the whole path in one command, zero keys:
npx -y @omegaengine/verify@latest sample --api https://omegaengine.ai
# attestations: GET /api/verify/{attestationId} → re-verify signature + Merkle proof
# receipts: verifyReceipt() from @omegaengine/verifyPOST /api/billing/checkout accepts x-api-key as the canonical agent credential. The returned url is a Stripe Checkout session bound to the key's own account — hand it to your human to enter the card.
curl -s -X POST https://omegaengine.ai/api/billing/checkout \
-H "x-api-key: $OMEGA_API_KEY" -H 'content-type: application/json' \
-d '{"plan":"developer","interval":"month"}'
# → { "ok": true, "url": "https://checkout.stripe.com/…", "sessionId": "…" }Already subscribed? The same call returns { ok, url, portal: true } deep-linking the billing portal's prorated plan-change flow. "interval":"year" can answer 409 annual_unavailable — fall back to "month". Do NOT drive /signup?plan= in a browser: that mints a second account and orphans the payment.
We label our own cryptography honestly. Two different trust models coexist here, and only one of them lets a third party verify without trusting our servers.
Agent security attestations, OmegaReceipt v1 decision receipts, and the RFC-6962 transparency log's signed tree head. All verify against the published JWKS with npx @omegaengine/verify — no account, no shared secret, no trust in this server.
Per-decision audit trails and DecisionProofs are HMAC-signed: tamper-evident on our side, but verifying them means trusting our verification endpoint. We say so wherever they appear — they are an audit trail, not a portable proof.