Skip to main content
Glama

ProtoOS v0.2.0 — 统一自主协议操作系统

CI License Python 3.12+ Tests Requirements MCP SDK CLI API x402

参考实现:一个受策略治理的控制平面,将现有智能体协议 — MCP、A2A、AP2 授权、x402、MPP、UCP/ACP 风格商务、AG-UI、ANP/DID 风格身份 — 组合成一个统一环境,在此环境中智能体被构建、发现、协调、授权、付费并接受审计。

纯 Python 3.12 标准库(外加用于 Ed25519 的可选 cryptography,并带有操作系统验证的 HMAC 回退)。无需网络。

相关: OpenMesha · rui · server-os

接入方式

接入方式

入口

CLI

protoos status · protoos verify · protoos graph · protoos vault

SDK

from protoos.sdk import ProtoOSClient

MCP Server

protoos-mcp / protoos/mcp.py(JSON-RPC、付费工具、mux、OpenAPI→MCP)

HTTP/JSON-RPC + SSE

protoos/httpapi.py(/mcp、/a2a、/agui/<run>、/.well-known/agents)

多智能体工作流

发现 + 带预算的 delegate + TaskGraph + AG-UI

技能

skills/*/SKILL.md(策略、x402、多智能体、constellation、mcp)

Constellation + Vault

python -m protoos.graph · python -m protoos.vault

CI

.github/workflows/ci.yml

AGENTS.md

位于仓库根目录的编码智能体契约

需求审计

traceability.json · VERIFICATION.md · python -m protoos.verify

Related MCP server: Enterprise MCP Gateway and Tool Registry

0.2.0 新特性 — Constellation 与 Obsidian vault

整个世界现在都是一等图(first-class graph),与 Web 控制台的 Constellation 标签页对齐。

  • protoos.graph.build_graph(os) 生成实时对象图 — 主体、预算、MCP 服务器/工具、AP2 授权链、收据、任务、待审批项 — 使用与浏览器构建版本相同的节点类型/边种类词汇表(一致性校验:MATCH)。

  • protoos.graph.layout(graph, seed=…) 是确定性力导向布局。导出:to_json、to_dot、to_svg。

  • protoos.vault.write_vault[_zip](os, dest) 写出一个由 wikilink 笔记组成的 Obsidian vault;unresolved_links() 证明完整性。

  • 加固:AuditLog.append 深拷贝载荷;TraditionalRail 保留收据。

python3 -m protoos.graph out/        # constellation.{json,dot,svg}
python3 -m protoos.vault vault.zip   # Obsidian vault
python3 demo.py                      # also writes both artifacts
python3 -m protoos.cli status

快速开始

python3 -m unittest discover -s tests   # 95 tests
python3 demo.py                          # end-to-end scenario
python3 -m protoos.verify                # traceability audit + live smoke
pip install -e ".[crypto]"               # optional Ed25519
protoos status
from protoos import ProtoOS, Catalog
from protoos.sdk import ProtoOSClient

os_ = ProtoOS()
os_.engine.add_rule("user", "allow", ["payment.settle"], "amount <= 200")
os_.engine.add_rule("org", "require_approval", ["payment.settle"], "amount > 50")

casey  = os_.create_user("casey")
shop   = os_.create_merchant("shop")
budget = os_.wallet.create_budget(casey.did, 500.0, window=(300.0, 86400))

catalog = Catalog(shop.did, "shop")
catalog.add("bk1", "Distributed Systems 101", 10.00, "USD", "digital")

receipt = os_.purchase(casey.did, catalog, [{"sku": "bk1", "qty": 2}],
                       intent_text="buy two intro ebooks", max_amount=100,
                       budget_id=budget.id, categories=["digital"])
# Intent Mandate -> checkout -> Cart Mandate -> Payment Mandate
# -> policy + budget -> x402 settle -> hash-chained audit

规范 → 模块映射

规范项

模块

策略引擎 + 授权存储

protoos/policy.py

编排器 / 任务图

protoos/runtime.py, protoos/core.py

身份与凭据服务

protoos/identity.py

发现与注册表

protoos/registry.py

可观测性与审计

protoos/audit.py

钱包 / 支出控制器

protoos/wallet.py

MCP 适配器(+OpenAPI→MCP、联邦、缓存)

protoos/mcp.py

A2A 适配器 + AG-UI 事件总线

protoos/a2a.py

UCP/ACP 风格商务

protoos/commerce.py

HTTP/JSON-RPC + SSE 传输层

protoos/httpapi.py

控制平面门面(ProtoOS)

protoos/core.py

CLI

protoos/cli.py

SDK

protoos/sdk/

Constellation 图

protoos/graph.py

Obsidian vault 导出

protoos/vault.py

Kubernetes CRDs + 部署

deploy/k8s/

技能

skills/

需求审计

traceability.json, VERIFICATION.md, protoos/verify.py

这里的“参考实现”是什么意思

规范中提到的每个协议表面都在进程内可运行并通过测试:带付费工具的 JSON-RPC MCP、A2A 任务生命周期、完整的 AP2 Intent→Cart→Payment 授权链、经由进程内 facilitator 的 x402 挑战/结算、MPP 预付费会话、基于 SSE 的 AG-UI 事件流、DID 文档和 well-known 发布。此沙盒没有网络出口、没有 Kubernetes 集群、也没有外部 SDK,因此任何需要开放互联网的功能都以本地/回环等效方式实现,并在 traceability.json 中明确标记为 partial 或 deferred — 不会静默遗漏任何内容。

生产加固路径

  1. Rust 控制平面 (X1): 这里的模块边界镜像了预期的服务;Python 构建版就是可执行的规格说明。

  2. 存储 (X3): 内存 + JSONL → etcd/Postgres / 对象存储 / 向量数据库。

  3. 轨道 (M1/X6): 官方 x402/MPP/AP2 SDK 嵌入现有的轨道接缝。

  4. 传输 (X4/X5): 在 httpapi.py 之外增加 gRPC/QUIC。

  5. 沙箱化 (G4): 用容器/microVM 隔离取代 SandboxedExecutor。

设计原则

  1. 组合而非替换

  2. 策略优先的自治(每个敏感操作均受门控)

  3. 加密授权 + 哈希链审计

  4. 人机回环作为一等原语

  5. 一切多轨(工具、消息、支付、身份)

  6. 离线优先的参考实现,如实标记 partial/deferred

许可证

Apache-2.0。治理章程草案:GOVERNANCE.md。

Available Tools

5 tools
echoA

Return the message plus the Proto-OS name to confirm the MCP session is alive.

Use as a liveness probe before mux_mount. Read-only, no network, no payment.

NameRequiredDescriptionDefault
messageNoPayload echoed back unchanged. Default ping.ping

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It explicitly states 'Read-only, no network, no payment,' which clearly communicates that this tool has no side effects, no external calls, and no cost. This goes beyond basic description and gives the agent confidence in invoking it safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no redundant words. The primary purpose is front-loaded, followed by the usage context and safety profile. Every sentence delivers distinct value: what it does, when to use it, and what side effects to expect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with an output schema, the description fully covers what an agent needs: purpose, usage scenario, and behavioral constraints. It also mentions the relationship to mux_mount, giving operational context. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage of the single parameter with a description ('Payload echoed back unchanged. Default ping.') The tool description does not add further parameter-specific meaning beyond confirming the message is echoed. With full schema coverage, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Return the message plus the Proto-OS name to confirm the MCP session is alive.' This clearly defines what the tool does and its purpose. It also distinguishes itself from siblings by framing it as a liveness probe, which is distinct from listing or mounting operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use it: 'Use as a liveness probe before mux_mount.' This provides clear context for selecting this tool. It does not mention exclusions or alternatives, but the guidance is specific enough for an agent to know it is the appropriate pre-flight check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_mounted_serversA

List MCP servers currently mounted on the in-process mux.

Use after mux_mount. Read-only.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It clearly states 'Read-only' and scopes the behavior to servers 'currently mounted on the in-process mux,' which is meaningful for safety and freshness. It does not describe empty-list behavior, but the output schema covers return details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences: the primary action first, followed by usage timing and read-only status. Every sentence adds distinct value without redundancy or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only listing tool with an output schema, the description is complete. It identifies the resource, the mux context, the relationship to mux_mount, and the non-mutating nature, while sibling tool names and the output schema cover the remaining ambiguities.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema fully documents this with 100% coverage. There is no parameter behavior for the description to clarify, so a baseline of 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'List MCP servers currently mounted on the in-process mux.' This clearly differentiates it from siblings like list_protocols, which lists protocols rather than servers, and mux_mount, which performs the mounting action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context with 'Use after mux_mount,' telling the agent when this tool is appropriate relative to a sibling tool. It also notes the operation is read-only, though it does not explicitly discuss when not to use it or compare against list_protocols.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_protocolsA

List protocol families this kernel can govern.

Inventory only. Mounted servers are list_mounted_servers. Read-only.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing side effects. It explicitly states 'Read-only' and 'Inventory only', which clearly tells the agent this is a safe, non-mutating operation. This exceeds what the tool name alone would convey and is especially valuable for a tool with no annotation safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. Each sentence adds value: the core purpose, the inventory-only scope, the sibling distinction, and the read-only safety signal. It is front-loaded with the purpose and remains compact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-side-effect listing tool with an output schema, the description covers purpose, usage boundary, alternative tool, and safety. There is no missing information that an agent would need to decide to invoke or actually invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema already documents this (100% coverage), so the description needs no parameter details. Per the zero-parameter baseline, this is adequate; no additional meaning is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and object: 'List protocol families this kernel can govern.' It clearly identifies the resource type and scope, and immediately distinguishes itself from list_mounted_servers by noting that mounted servers are covered by the sibling tool. An agent can confidently select this tool for protocol-family inventory without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Inventory only' tells the agent when this tool is appropriate, and 'Mounted servers are list_mounted_servers' explicitly routes a related but distinct use case to the correct sibling. This provides actionable selection guidance rather than leaving the agent to infer it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mux_mountA

Register an empty named MCP server on the in-process mux.

Idempotent upsert. No child process, no URL. Local write only.

NameRequiredDescriptionDefault
nameYesHuman server name stored on the mount.
prefixYesMux prefix used as prefix.tool.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It goes well beyond a generic verb by disclosing idempotent upsert behavior, the absence of child processes, no URL involvement, and local-only writes. This is strong transparency for a simple mount operation, though it does not describe failure or return behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally tight: one core sentence followed by three high-value fragments. Every phrase earns its place, and the main purpose is front-loaded. There is no filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool with two required string parameters, an output schema, and no nested objects, this description is nearly complete. It covers the operation, idempotency, scope, and side-effect profile. It could be slightly richer on what 'empty' means or what happens if the prefix already exists, but those are minor for a 2-parameter tool with an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains both 'name' and 'prefix' clearly. The tool description adds context about the mount being 'empty' and 'named,' but it does not meaningfully deepen parameter-level semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Register') and resource ('an empty named MCP server on the in-process mux'), making the core function immediately clear. It also distinguishes itself from likely siblings like list_mounted_servers and openapi_stub by clarifying that this is an in-process mount with no child process or URL.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear contextual signals about when this tool is appropriate: it registers an in-process server, is idempotent, and is local-only. It does not explicitly name alternatives or say 'use this instead of X', but the constraints ('No child process, no URL. Local write only.') effectively rule out sibling tools that might involve remote or stub-based servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

openapi_stubA

Return a stub MCP server derived from a caller-supplied OpenAPI title.

Offline scaffold only. Does not fetch a spec URL. Not mux_mount.

NameRequiredDescriptionDefault
titleYesDisplay title for the generated stub server.

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses key behavior: the tool is offline-only, does not fetch a URL, and is not mux_mount. This provides meaningful transparency beyond the tool name, though it could mention whether it has side effects or validates input, but for a simple scaffold tool this is largely sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four short sentences with zero filler. The primary purpose is front-loaded, and the clarifying scope statements ('Offline scaffold only,' 'Does not fetch a spec URL,' 'Not mux_mount') each earn their place by preventing common mistakes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a very simple tool with one required parameter, an output schema, and no nested objects. The description fully covers the operational context: what it does, what it does not do, and its relationship to mux_mount. Nothing essential is missing for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning by framing title as a 'caller-supplied OpenAPI title' and clarifying that the generated server is an offline scaffold based on that title, rather than something fetched or mounted. This enriches the schema's 'Display title for the generated stub server.'

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Return a stub MCP server derived from a caller-supplied OpenAPI title.' It also distinguishes itself from the sibling tool by saying 'Not mux_mount.' This is far beyond a tautology and clearly separates it from the other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states its scope: 'Offline scaffold only. Does not fetch a spec URL. Not mux_mount.' This tells the agent when to use it (offline scaffolding) and when not to use it (for mounting an actual server or fetching a spec). It directly names the sibling alternative mux_mount.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.2.0
    • First observedecho
    • First observedlist_mounted_servers
    • First observedlist_protocols
    • First observedmux_mount
    • First observedopenapi_stub

TDQS

A4.2/5.0

Scored across 5 tools

Disambiguation5/5

Each tool has a clearly distinct target: liveness, protocol inventory, mounted-server inventory, mounting, and OpenAPI stub generation. The descriptions explicitly cross-reference differences (e.g., list_protocols points to list_mounted_servers, openapi_stub says 'Not mux_mount'), so an agent should not confuse them.

Naming Consistency2/5

Only list_protocols and list_mounted_servers follow a clear verb_noun pattern. echo is a bare verb, mux_mount is an object-first compound, and openapi_stub is a noun phrase with no verb. The names are readable but do not form a predictable naming convention across the set.

Tool Count5/5

Five tools is a well-scoped size for this focused MCP mux/kernel utility. Each tool earns its place and none feel redundant.

Completeness3/5

The set covers liveness, inventory, mounting, and stub scaffolding, but lacks an unmount/remove operation and offers no way to mount or apply the OpenAPI stub through the mounted-server lifecycle. This leaves a notable create/list-without-delete gap that could cause agent dead ends.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server for the Junction41 platform, providing 125 tools for agent lifecycle, jobs, workspace, payments, bounties, and more, enabling LLMs to interact with Junction41.
    4 npm
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to discover and invoke backend tools over MCP JSON-RPC while enforcing 3-legged OAuth 2.0 identity propagation, role-based access control, and protocol transcoding to REST APIs.
    1
    Apache 2.0