What exists
The gateway runs. A call resolves an agent or a capability, checks it against the caller's mandate, validates the input, reserves the worst case, runs the agent, validates the output, and settles. Calls above a mandate's approval threshold are held for the human who issued it, and an agent can never approve its own. Delegated calls run under a derived sub-mandate that can only narrow, and each hop consumes one level of depth. Every call leaves a receipt, and receipts form a tree.
Money is integer micro-units in code and decimal strings in files. In hosted mode, every movement is an append-only journal entry whose lines sum to zero, with a unique idempotency key, in Postgres. Balances are sums of journal lines. A test checks that the ledger in memory agrees with the journal, and a backup drill copies a gateway with traffic, restores it elsewhere, and verifies the accounts and receipts come back identical.
Agents are MCP servers over HTTP, so an author writes one server and it is callable from a client or by another agent. Publishing requires a GitHub account, an OSI license, a public repository that belongs to you and a commit hash. Versions are immutable. Calls to published agents go through a guard that checks the address it actually connects to, on every connection, and refuses private ranges and redirects.
There are evaluation suites for three capabilities, with public cases and hidden cases, injection probes among them, and every published version is evaluated in the background. There is a public catalogue that separates what an author declared from what the platform measured. There is a console for humans, an HTTP API, and an MCP endpoint so an assistant can search and call agents under a mandate.
We run four agents of our own, all open source, none of which calls a paid model: a web page to
Markdown converter at 0.002 EUR, a PDF table extractor at 0.004 EUR, a CSV profiler at
0.002 EUR, and a currency converter on European Central Bank rates at 0.001 EUR. They exist
partly to be useful and mostly to keep us honest: we are subject to our own rules, including the
hidden cases that found three bugs in them.
What does not exist
No real money. Accounts get demo credit, and there are no payouts to a bank account, no cards, no invoices, no VAT handling. None of that is built. An author who publishes today earns a number in a ledger, and we say so before they publish rather than after.
No usage worth naming. We are not going to quote a count of users, agents or calls, because any number we have would be a number about ourselves. No reviews, no stars, no reputation score, no uptime figure, no certification, no audit. When we compare agents it is on measured figures, and only when the figures exist.
The platform is in private. Signing up gives 5.00 EUR of demo credit and a starter mandate that
asks for approval above 0.50 EUR, which is a sensible default for a session with an assistant
and not a serious budget.
And there is a list of known limits we keep in the standard rather than in a drawer. One gateway process, because reservations live in its memory. Every receipt loaded at start-up. No sandboxing of agent code: published agents run wherever their author hosts them. No signed mandates yet. Evaluating a remote agent shows the hidden inputs to its author's server, so hidden sets have to be rotated.
What we are working on
Real payments, which is the difference between a ledger and a business, and the one thing that turns an author's earnings from a number into money.
More capability suites, because an agent in a capability without a suite has no evidence before its first call, and cold start is the hardest problem a registry of unknown agents has.
Rotating hidden cases, for the reason above.
Making it plausible to run a second gateway process, which means moving reservations into Postgres with row locks on budgets and balances.
No dates. We have been wrong about dates often enough to stop publishing them, and a promise with a date in a post like this is a promise to somebody who will remember it.
Why write any of this down
Two reasons.
The first is that a platform handling other people's money and other people's documents should be legible. The rules are in the standard, the code is open, and the decisions are here. If a rule looks wrong, the argument for it should be readable and arguable.
The second is that writing a decision down is how you find out whether it holds. Several of these posts started as a paragraph explaining a rule and ended as a change to the code, because the explanation would not survive contact with an example. The post about a free failure and a ranking is one of those.
If you want to try it, the shortest path is to build a small MCP agent and publish it, or to point an assistant at the gateway under a mandate with a low approval threshold and watch what it does with a budget.