Proto OS
ProtoOS v0.2.0 — Единая операционная система автономных протоколов
Эталонная реализация управляющей плоскости на основе политик, которая компонует существующие агентные протоколы — MCP, A2A, мандаты AP2, x402, MPP, коммерцию в стиле UCP/ACP, AG-UI, идентичность в стиле ANP/DID — в единую среду, где агенты создаются, обнаруживаются, координируются, авторизуются, оплачиваются и проходят аудит.
Чистая стандартная библиотека Python 3.12 (+ опциональный cryptography для Ed25519, с проверяемым ОС резервным вариантом HMAC). Ноль сетевых требований.
Связанное: OpenMesha · rui · server-os
Поверхности
Поверхность | Точка входа |
CLI |
|
SDK |
|
MCP-сервер |
|
HTTP/JSON-RPC + SSE |
|
Мультиагентные рабочие процессы | обнаружение + делегирование с бюджетом |
Навыки |
|
Constellation + Vault |
|
CI |
|
AGENTS.md | Контракт для кодирующих агентов в корне репозитория |
Аудит требований |
|
Related MCP server: Enterprise MCP Gateway and Tool Registry
Новое в 0.2.0 — Constellation и хранилище Obsidian
Мир теперь является полноценным графом первого класса, наравне с вкладкой Constellation в веб-консоли.
protoos.graph.build_graph(os)выводит живой граф объектов — принципалов, бюджеты, MCP-серверы/инструменты, цепочки мандатов AP2, квитанции, задачи, ожидающие одобрения — с тем же словарём типов узлов/видов рёбер, что и в браузерной сборке (проверка паритета: MATCH).protoos.graph.layout(graph, seed=…)— детерминированная силовая раскладка. Экспорт:to_json,to_dot,to_svg.protoos.vault.write_vault[_zip](os, dest)записывает хранилище Obsidian из заметок с вики-ссылками;unresolved_links()доказывает целостность.Ужесточение:
AuditLog.appendглубоко копирует полезные нагрузки;TraditionalRailсохраняет квитанции.
python3 -m protoos.graph out/ # constellation.{json,dot,svg}
python3 -m protoos.vault vault.zip # Obsidian vault
python3 demo.py # also writes both artifacts
python3 -m protoos.cli statusБыстрый старт
python3 -m unittest discover -s tests # 95 tests
python3 demo.py # end-to-end scenario
python3 -m protoos.verify # traceability audit + live smoke
pip install -e ".[crypto]" # optional Ed25519
protoos statusfrom protoos import ProtoOS, Catalog
from protoos.sdk import ProtoOSClient
os_ = ProtoOS()
os_.engine.add_rule("user", "allow", ["payment.settle"], "amount <= 200")
os_.engine.add_rule("org", "require_approval", ["payment.settle"], "amount > 50")
casey = os_.create_user("casey")
shop = os_.create_merchant("shop")
budget = os_.wallet.create_budget(casey.did, 500.0, window=(300.0, 86400))
catalog = Catalog(shop.did, "shop")
catalog.add("bk1", "Distributed Systems 101", 10.00, "USD", "digital")
receipt = os_.purchase(casey.did, catalog, [{"sku": "bk1", "qty": 2}],
intent_text="buy two intro ebooks", max_amount=100,
budget_id=budget.id, categories=["digital"])
# Intent Mandate -> checkout -> Cart Mandate -> Payment Mandate
# -> policy + budget -> x402 settle -> hash-chained auditКарта «спецификация → модуль»
Блок спецификации | Модуль |
Политический движок + хранилище мандатов |
|
Оркестратор / граф задач |
|
Служба идентичности и учётных данных |
|
Обнаружение и реестр |
|
Наблюдаемость и аудит |
|
Кошелёк / контроллер расходов |
|
Адаптер MCP (+OpenAPI→MCP, федерация, кэш) |
|
Адаптер A2A + шина событий AG-UI |
|
Коммерция в стиле UCP/ACP |
|
Транспорт HTTP/JSON-RPC + SSE |
|
Фасад управляющей плоскости ( |
|
CLI |
|
SDK |
|
Граф Constellation |
|
Экспорт хранилища Obsidian |
|
Kubernetes CRD + развёртывание |
|
Навыки |
|
Аудит требований |
|
Что здесь означает «эталонная реализация»
Каждая протокольная поверхность, названная в спецификации, работает и протестирована в процессе:
JSON-RPC MCP с платными инструментами, жизненный цикл задач A2A, полная цепочка мандатов AP2
Intent→Cart→Payment, вызов/расчёт x402 с внутрипроцессным
фасилитатором, предоплаченные сессии MPP, потоки событий AG-UI через SSE, документы DID
и публикация well-known. Эта песочница не имеет сетевого выхода,
кластера Kubernetes и внешних SDK, поэтому всё, что требует открытого
интернета, реализовано через локальные/loopback-эквиваленты и явно помечено
partial или deferred в traceability.json — ничего не опускается молча.
Путь производственного ужесточения
Управляющая плоскость на Rust (X1): границы модулей здесь отражают предполагаемые службы; сборка на Python — исполняемая спецификация.
Хранилище (X3): в памяти + JSONL → etcd/Postgres / объектное хранилище / векторная БД.
Рельсы (M1/X6): официальные SDK x402/MPP/AP2 встраиваются в существующие стыки рельсов.
Транспорты (X4/X5): добавить gRPC/QUIC рядом с
httpapi.py.Песочница (G4): заменить
SandboxedExecutorна изоляцию контейнерами/микроVM.
Принципы проектирования
Компоновать, а не заменять
Автономия в первую очередь через политику (каждое чувствительное действие ограничено)
Криптографические мандаты + аудит с хэш-цепочкой
Человек в цикле как примитив первого класса
Всё на нескольких рельсах (инструменты, обмен сообщениями, платежи, идентичность)
Офлайн-первая эталонная реализация с честными маркерами partial/deferred
Лицензия
Apache-2.0. Черновик устава управления: GOVERNANCE.md.
Available Tools
5 toolsechoA
Return the message plus the Proto-OS name to confirm the MCP session is alive.
Use as a liveness probe before mux_mount. Read-only, no network, no payment.
| Name | Required | Description | Default |
|---|---|---|---|
| message | No | Payload echoed back unchanged. Default ping. | ping |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only, no network, no payment,' which clearly communicates that this tool has no side effects, no external calls, and no cost. This goes beyond basic description and gives the agent confidence in invoking it safely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant words. The primary purpose is front-loaded, followed by the usage context and safety profile. Every sentence delivers distinct value: what it does, when to use it, and what side effects to expect.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with an output schema, the description fully covers what an agent needs: purpose, usage scenario, and behavioral constraints. It also mentions the relationship to mux_mount, giving operational context. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage of the single parameter with a description ('Payload echoed back unchanged. Default ping.') The tool description does not add further parameter-specific meaning beyond confirming the message is echoed. With full schema coverage, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Return the message plus the Proto-OS name to confirm the MCP session is alive.' This clearly defines what the tool does and its purpose. It also distinguishes itself from siblings by framing it as a liveness probe, which is distinct from listing or mounting operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it: 'Use as a liveness probe before mux_mount.' This provides clear context for selecting this tool. It does not mention exclusions or alternatives, but the guidance is specific enough for an agent to know it is the appropriate pre-flight check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mounted_serversA
List MCP servers currently mounted on the in-process mux.
Use after mux_mount. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly states 'Read-only' and scopes the behavior to servers 'currently mounted on the in-process mux,' which is meaningful for safety and freshness. It does not describe empty-list behavior, but the output schema covers return details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences: the primary action first, followed by usage timing and read-only status. Every sentence adds distinct value without redundancy or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only listing tool with an output schema, the description is complete. It identifies the resource, the mux context, the relationship to mux_mount, and the non-mutating nature, while sibling tool names and the output schema cover the remaining ambiguities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the input schema fully documents this with 100% coverage. There is no parameter behavior for the description to clarify, so a baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List MCP servers currently mounted on the in-process mux.' This clearly differentiates it from siblings like list_protocols, which lists protocols rather than servers, and mux_mount, which performs the mounting action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context with 'Use after mux_mount,' telling the agent when this tool is appropriate relative to a sibling tool. It also notes the operation is read-only, though it does not explicitly discuss when not to use it or compare against list_protocols.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_protocolsA
List protocol families this kernel can govern.
Inventory only. Mounted servers are list_mounted_servers. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing side effects. It explicitly states 'Read-only' and 'Inventory only', which clearly tells the agent this is a safe, non-mutating operation. This exceeds what the tool name alone would convey and is especially valuable for a tool with no annotation safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences with no filler. Each sentence adds value: the core purpose, the inventory-only scope, the sibling distinction, and the read-only safety signal. It is front-loaded with the purpose and remains compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-side-effect listing tool with an output schema, the description covers purpose, usage boundary, alternative tool, and safety. There is no missing information that an agent would need to decide to invoke or actually invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema already documents this (100% coverage), so the description needs no parameter details. Per the zero-parameter baseline, this is adequate; no additional meaning is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and object: 'List protocol families this kernel can govern.' It clearly identifies the resource type and scope, and immediately distinguishes itself from list_mounted_servers by noting that mounted servers are covered by the sibling tool. An agent can confidently select this tool for protocol-family inventory without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Inventory only' tells the agent when this tool is appropriate, and 'Mounted servers are list_mounted_servers' explicitly routes a related but distinct use case to the correct sibling. This provides actionable selection guidance rather than leaving the agent to infer it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mux_mountA
Register an empty named MCP server on the in-process mux.
Idempotent upsert. No child process, no URL. Local write only.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human server name stored on the mount. | |
| prefix | Yes | Mux prefix used as prefix.tool. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It goes well beyond a generic verb by disclosing idempotent upsert behavior, the absence of child processes, no URL involvement, and local-only writes. This is strong transparency for a simple mount operation, though it does not describe failure or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally tight: one core sentence followed by three high-value fragments. Every phrase earns its place, and the main purpose is front-loaded. There is no filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with two required string parameters, an output schema, and no nested objects, this description is nearly complete. It covers the operation, idempotency, scope, and side-effect profile. It could be slightly richer on what 'empty' means or what happens if the prefix already exists, but those are minor for a 2-parameter tool with an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains both 'name' and 'prefix' clearly. The tool description adds context about the mount being 'empty' and 'named,' but it does not meaningfully deepen parameter-level semantics beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Register') and resource ('an empty named MCP server on the in-process mux'), making the core function immediately clear. It also distinguishes itself from likely siblings like list_mounted_servers and openapi_stub by clarifying that this is an in-process mount with no child process or URL.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear contextual signals about when this tool is appropriate: it registers an in-process server, is idempotent, and is local-only. It does not explicitly name alternatives or say 'use this instead of X', but the constraints ('No child process, no URL. Local write only.') effectively rule out sibling tools that might involve remote or stub-based servers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
openapi_stubA
Return a stub MCP server derived from a caller-supplied OpenAPI title.
Offline scaffold only. Does not fetch a spec URL. Not mux_mount.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Display title for the generated stub server. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses key behavior: the tool is offline-only, does not fetch a URL, and is not mux_mount. This provides meaningful transparency beyond the tool name, though it could mention whether it has side effects or validates input, but for a simple scaffold tool this is largely sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four short sentences with zero filler. The primary purpose is front-loaded, and the clarifying scope statements ('Offline scaffold only,' 'Does not fetch a spec URL,' 'Not mux_mount') each earn their place by preventing common mistakes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a very simple tool with one required parameter, an output schema, and no nested objects. The description fully covers the operational context: what it does, what it does not do, and its relationship to mux_mount. Nothing essential is missing for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by framing title as a 'caller-supplied OpenAPI title' and clarifying that the generated server is an offline scaffold based on that title, rather than something fetched or mounted. This enriches the schema's 'Display title for the generated stub server.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Return a stub MCP server derived from a caller-supplied OpenAPI title.' It also distinguishes itself from the sibling tool by saying 'Not mux_mount.' This is far beyond a tautology and clearly separates it from the other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states its scope: 'Offline scaffold only. Does not fetch a spec URL. Not mux_mount.' This tells the agent when to use it (offline scaffolding) and when not to use it (for mounting an actual server or fetching a spec). It directly names the sibling alternative mux_mount.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.2.0- First observed
echo - First observed
list_mounted_servers - First observed
list_protocols - First observed
mux_mount - First observed
openapi_stub
TDQS
Scored across 5 tools
Each tool has a clearly distinct target: liveness, protocol inventory, mounted-server inventory, mounting, and OpenAPI stub generation. The descriptions explicitly cross-reference differences (e.g., list_protocols points to list_mounted_servers, openapi_stub says 'Not mux_mount'), so an agent should not confuse them.
Only list_protocols and list_mounted_servers follow a clear verb_noun pattern. echo is a bare verb, mux_mount is an object-first compound, and openapi_stub is a noun phrase with no verb. The names are readable but do not form a predictable naming convention across the set.
Five tools is a well-scoped size for this focused MCP mux/kernel utility. Each tool earns its place and none feel redundant.
The set covers liveness, inventory, mounting, and stub scaffolding, but lacks an unmount/remove operation and offers no way to mount or apply the OpenAPI stub through the mounted-server lifecycle. This leaves a notable create/list-without-delete gap that could cause agent dead ends.
Maintenance
Related MCP Connectors
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Hosted AgentLux MCP server for marketplace, identity, creator, services, and social flows.
MCP server exposing the Backtest360 engine API as tools for AI agents.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA production-grade MCP server designed for multi-tenant, authenticated, and observable AI agent systems, enabling secure tool execution across heterogeneous data sources.66MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to discover and execute tools via a secure MCP server with JWT authentication, RBAC, rate limiting, and audit logging.1MIT
- AlicenseNot gradedqualityBmaintenanceMCP server for the Junction41 platform, providing 125 tools for agent lifecycle, jobs, workspace, payments, bounties, and more, enabling LLMs to interact with Junction41.4 npmMIT
- AlicenseNot gradedqualityBmaintenanceAn MCP server that provides a secure, sandboxed tool execution fabric for AI agents, featuring JSON-RPC 2.0 protocol support, read-only constraints, and an observability inspector dashboard.MIT