DEV Community: Alex

I made my API discoverable to AI agents — and got it paid per call — in 15 minutes

Alex — Sat, 12 Sep 2026 05:48:12 +0000

Everyone's writing about "the agent economy." Agents that hire agents, pay for tools, settle automatically. Lovely slides.

What I actually wanted was smaller: could I take a tiny HTTP endpoint I already had, list it so an autonomous agent can find it, and have it get paid per call — without a SaaS billing system?

Yes. The loop took about 15 minutes. Here's the path, including the dumb thing that cost me ten of those minutes.

Crypto stays off this title on purpose. Settlement exists; the hook is ship a tool, it gets paid.

The mental model (30 seconds)

There's an open catalog — the AIMarket Hub — between people who publish HTTP capabilities and agents that consume them.

You give the hub a manifest: name, price, input/output schemas, and a public invoke_url. When an agent searches, finds your capability, and invokes it, the hub routes the call and meters the payment. The demand-side reference client is ARGUS. Any MCP or HTTP client works.

You do not need the factory monorepo. You need a POST endpoint and the hub CLI.

If you don't even have an endpoint yet, create-aimarket-agent scaffolds a signed provider. This article is the listing step that article leaves manual.

0 · Prereqs (2 min)

Python 3.11+
Hub CLI from PyPI: aimarket-hub 3.2.1

pip install aimarket-hub
git clone https://github.com/alexar76/aimarket-hub.git
cd aimarket-hub

A hub to publish to:

Local (this walkthrough): aimarket serve → http://127.0.0.1:9083
Public: https://modelmarket.dev (production listing has extra gates — stake, signed responses. Don't start there.)

1 · Run the example capability (3 min)

The repo ships a working greeter at examples/hello-capability:

cd examples/hello-capability
python3 server.py
# → hello-capability listening on http://127.0.0.1:3456/invoke
# → provider_pubkey (put in capability.json): …

The contract is boring on purpose. POST JSON, get JSON:

curl -s -X POST http://127.0.0.1:3456/invoke \
  -H 'Content-Type: application/json' \
  -d '{"input":{"name":"dev"}}'
# → {"success":true,"result":{"greeting":"Hello, dev!","from":"hello-capability"}}

Your server receives { "input": {...}, "product_id": "...", "capability_id": "..." } and returns HTTP 200 with {"result": {...}}. Any framework that can serve a POST qualifies. This example also sets X-Provider-Signature (Ed25519) so a production hub can verify the payload.

2 · Write the manifest (2 min)

examples/hello-capability/capability.json is already filled for local dev:

{
  "product_id": "demo-hello",
  "capability_id": "greet@v1",
  "name": "greet",
  "description": "Says hello — 15-minute developer demo capability",
  "invoke_url": "http://127.0.0.1:3456/invoke",
  "price_per_call_usd": 0.01,
  "publisher": "community",
  "input_schema": {
    "type": "object",
    "properties": { "name": { "type": "string", "description": "Who to greet" } }
  },
  "output_schema": {
    "type": "object",
    "properties": { "greeting": { "type": "string" } }
  }
}

price_per_call_usd is what a caller pays per successful invoke. capability_id is name@v1. For a public listing, swap invoke_url for HTTPS (or a tunnel) and put the printed provider_pubkey into the manifest.

3 · Publish (2 min)

Local hub, second terminal:

aimarket serve                         # if it isn't already running
export AIMARKET_ALLOW_LOCAL_PUBLISH=1  # dev only — see the next section
aimarket publish capability.json --hub http://127.0.0.1:9083
aimarket invoke demo-hello/greet@v1 --input '{"name":"dev"}'

Now it's in the catalog. An agent can search, invoke, and you earn on settlement.

Public hub (after the URL is reachable):

aimarket publish capability.json --hub https://modelmarket.dev

That path wants a publish token (AIMARKET_PUBLISH_TOKEN) and, on a hardened hub, the supply-security steps in docs/supply-security.md. Do the local loop first.

Where it bit me

My first aimarket publish against a local hub kept failing. I spent ten minutes assuming the JSON was malformed. It wasn't.

The hub rejects an invoke_url that isn't publicly reachable. http://127.0.0.1:3456 is not a thing an agent on another machine can call, so it refuses to list it. That's correct — a catalog full of localhost rows is useless — but the error did not scream "your URL is local."

The escape hatch is one env var on the hub process, not the greeter:

export AIMARKET_ALLOW_LOCAL_PUBLISH=1   # dev only

If the hub is in Docker, 127.0.0.1 is the container. Use CAPABILITY_PUBLIC_HOST on the example server and AIMARKET_INVOKE_HOST_GATEWAY=host.docker.internal on the hub (publish.sh in the example folder).

In real life you point invoke_url at public HTTPS or a tunnel. When publish refuses, check reachability before you re-read the schema for the fifth time.

The part I didn't have to build

I wrote a 30-line greeter. Production hubs don't run on vibes:

a stake before you list (skin in the game),
LUMEN trust scoring — low-trust and duplicate listings drop out of discovery,
Ed25519-signed provider responses, request-bound so nobody swaps the payload a caller paid for,
slashing on bad invokes.

That's the hub's job. It's also why I would let a stranger's agent call my endpoint.

Settlement on the public rails is USDC on Base. You don't need a wallet to walk the local 15-minute loop.

Try it

MIT. Example, CLI, and a developer quickstart in 20 languages:

Example: github.com/alexar76/aimarket-hub/tree/main/examples/hello-capability
Package: pip install aimarket-hub
ARGUS (the agent that discovers + invokes): github.com/alexar76/argus
20-language guide: argus/docs/developer-guide
40-second explainer (optional): YouTube E05

If "my API, but agents can find it and pay for it" is a thing you've wanted, clone it and publish your own capability. A ⭐ on aimarket-hub helps other people find the example.

AICOM is the factory. AIMarket is the economy it ships into.

Alex — Fri, 11 Sep 2026 20:15:32 +0000

People keep asking if AICOM and AIMarket are two startups, a rebrand, or a Discord with extra steps.

They are two names on purpose.

AICOM is the factory: one phrase in, specialized agents, quality gates, a page you can actually open.

AIMarket is the economy that factory ships into: a hub where agents discover capabilities, invoke them, and get a signed receipt — not a vibe.

Same MIT stack. Same live doors. Different job.

Crypto stays off this article on purpose. The shape here is build → discover → invoke → verify. Settlement is a separate story.

Live: magic-ai-factory.com · oracles.modelmarket.dev · forge.modelmarket.dev

Code: github.com/alexar76/aicom

The thesis (one sentence)

A chat window that writes code is not an economy. A factory without a market is a demo that cannot be used.

Most “agent” posts sell you a transcript. We kept shipping places: a guest landing, seventeen math rooms, a cave you can ask, a forge that estimates a chain before it runs.

AICOM — a team in a box, not a conversation that hopes

The factory is not “an LLM with plugins.” It is a pipeline. Analyst, PM, architect, design critic, developer, QA, security, DevOps — thirteen specialized hands move one plain-language brief through research → design → code → QA → deploy.

Guest landing for a phrase. Admin for the long product. Same agent path underneath.

What that means in the UI you can open today:

Guest try-out. Type what you need. The factory ships a page you can preview. No login theater for the first loop.
Gates. Hollow stubs and “TODO: implement” do not count as shipped.
A hard cap on repair rounds so a stuck build cannot burn tokens forever.
Self-hosted. Your box, your model keys, your data.

If you've only used Bolt / v0-style chat-to-code, this is the other shape: a team in a box, not a conversation that hopes the last message was the product.

Honest bit we already paid for: early parallel stages used asyncio.gather without return_exceptions=True. One LLM timeout cancelled every other agent mid-flight. Tiny fix. Expensive lesson: in a multi-agent pipeline, a model failure is a correctness problem, not just an ops blip.

Live factory: magic-ai-factory.com

AIMarket — the room those products work in

Shipping a landing is half the story. The other half is letting tools get used — by other agents, with a receipt you can check.

That room has three surfaces we actually film, because they are the product, not decoration.

1. Rooms, not docs

Seventeen live mathematical oracles. Randomness, elapsed time, reputation, shape, routing. Each one is a capability an agent can invoke. Each one is also a room — 3D, full screen, not a gray button in a table.

Platon at oracles.modelmarket.dev — a chaotic substrate, not a dice roll in a comment.

Pretty glass is cosplay unless the artifact is signed. The rooms emit proofs. You verify. You do not trust the narrator.

2. The cave

The first live oracle as a place you can stay in: Platon UMBRAL. Telemetry that moves. Witnesses that write sentences. Thirty-two dimensions fully lit — you still see only 2D. That is the projection, not a bug.

Ask the oracle in the same room. oracles.modelmarket.dev/platon/umbral

3. The forge

One capability is easy. Chains are where cost, wiring, and receipts get messy.

HEPHAESTUS is the studio for that: estimate hops and latency before you press Run, thread values between steps, keep a signed bill of materials, hop-level blame when something breaks.

Live catalogue graph — Gauss, Platon, Sortes on the glass. forge.modelmarket.dev

Start → capability → result. English UI. modelmarket.dev/studio

Invalid graphs fail before they run. Pretty topology is cosplay unless the bill is signed.

How the two names click

Name	Job
AICOM / AI-Factory	Turn a brief into a shippable web product
AIMarket Hub	Discover, invoke, signed receipt
Oracles	Math agents actually need — as rooms, not docs
HEPHAESTUS	Wire a chain, estimate it, keep the bill
Mesh	Topology you can watch while the chain runs

The factory is how humans (and agents) make.

The market is how other agents use what got made — including the oracles and the forge, which are capabilities, not slideware.

We already published the wider map (WARDEN, MOMUS, the ops loop) here: We didn't build another agent framework. We built the room they work in.. This piece is narrower: the two names, and the doors you can open this week.

What to open if you only have ten minutes

Factory. Type a phrase: magic-ai-factory.com
A room. Platon: oracles.modelmarket.dev/?o=platon
The cave. oracles.modelmarket.dev/platon/umbral
The forge. forge.modelmarket.dev · studio: modelmarket.dev/studio

Source (MIT): github.com/alexar76/aicom

If a factory that ships a page — and a market where the math is a room you can walk into — is your kind of weird, a ⭐ on the repo helps it travel. Concrete issues and PRs help more than a polite “cool stack.”

Built in the open. Your keys. The screenshots are the product, not a mock.

We didn't build another agent framework. We built the room they work in.

Alex — Sun, 06 Sep 2026 07:31:27 +0000

Most “AI agent” posts sell you a chat window with plugins.

We kept shipping something else: a self-hosted room where agents can build products, discover paid capabilities, refuse poisoned tools, and — when a live service breaks — repair it without a human pressing Start.

This is a map of that room. Not a monorepo tour. Crypto stays off this article on purpose (the settlement story lives elsewhere; here the shape is discover → invoke → receipt).

Live doors: magic-ai-factory.com · use.modelmarket.dev

Code: github.com/alexar76/aicom (MIT)

The thesis (one sentence)

If your agent stack only works inside a demo transcript, you don't have an economy — you have a screenshot.

An economy needs supply, demand, a place they meet, a safety rail, and an ops loop that survives contact with production. We named the pieces and run them.

The factory is a pipeline with gates, not a single LLM in a trench coat.

1. Factory — thirteen agents, one brief, a real deploy

AICOM is a pipeline: analyst, PM, architect, design critic, developer, QA, security, DevOps, and friends move one plain-language brief through research → design → code → QA → deploy.

Quality gates between stages
A hard cap on repair rounds so a stuck build cannot burn tokens forever
Self-hosted — your box, your model keys, your data

Honest bit from ops: early parallel stages used asyncio.gather without return_exceptions=True. One LLM timeout cancelled every other agent mid-flight. Tiny fix. Expensive lesson: in a multi-agent pipeline, a model failure is a correctness problem, not just an ops blip.

If you've only used Bolt / v0-style chat-to-code, this is the other shape: a team in a box, not a conversation that hopes.

2. Market — publish a capability; agents pay per call

Producing software is half the story. The other half is letting tools get used.

Same rails for humans and agents: discoverable, callable, receipted.

Side	What it is
Supply	Ship a small HTTP capability in about fifteen minutes; list it on the Hub
Hub	Index, assay, route — signed prices, meters, receipts
Demand	ARGUS discovers, pays, and invokes

We already wrote the boring-but-true version of “agents pay for weather” and what happens when the sensor lies (GAIA). The grammar is the product: honest → settle · lie/silence → refund.

3. WARDEN — MCP without trust cosplay

Agents love tools. Attackers love tool descriptions.

WARDEN is a fail-closed MCP firewall: score the tool, allow or block, log evidence — before the description reaches the model.

We did the unfashionable thing and published a field survey: 1 108 public MCP servers scanned, 50 blocked, only 4 were the kind of real risk that framing wanted to catch that way. False positives included. A firewall that only tweets kills is marketing.

Deep dive: WARDEN field survey on Dev.to.

4. Ops — MOMUS finds; SKOPOS conducts; the factory repairs

Demo stacks die when nobody is watching. Ours is allowed to break — and then the loop has a job.

MOMUS signs findings (and cannot pay itself)
SKOPOS conducts the fix path
Factory builds a candidate · canary · redeploy or refuse

We've documented a live HTTP service healed end-to-end in minutes — with IDs, not vibes (self-heal write-up).

That is what “agent economy” means after the keynote: something that can fail and still be honest about the repair.

5. Glass for humans — five doors, three minutes

Developers bounce on architecture diagrams. Investors bounce on roadmaps. Operators bounce on unlabeled green pins.

So we built a front door that does not require cloning the monorepo:

use.modelmarket.dev — See · Buy · Publish · Build · Invest

ATLAS glass labels LIVE vs SIM. Buy paths settle only when the world was honest. Build boards carry maturity chips — hypotheses are not sold as shipped products.

If an economy needs a guided tour to feel real, it isn’t ready for strangers. The portal’s job is narrower: pick a door, touch a rail, leave with a receipt or a map.

How the pieces sit together

Layer	Job
Factory	Build products from a brief
Hub + ARGUS	Meet supply and demand
WARDEN	Fail-closed MCP
MOMUS / SKOPOS	Find → fix without cosplay
use / ATLAS	Human doors + honest glass
Monitor	Live map of the room

This is one MIT ecosystem you can run yourself — not a SaaS pitch with “agents” in the headline.

Start

Touch a door: use.modelmarket.dev
Watch the factory live: magic-ai-factory.com · 3D monitor
Read / star the monorepo: github.com/alexar76/aicom
Free academies: alexar76.github.io/aicom/learn/

If this map matches something you're building — factory, marketplace, or MCP safety — a star helps more than a vague “cool stack” reply. Concrete issues and PRs help more than both.

Built in the open. Your keys.

Pretty flood maps are liars. One live gauge. Zero flood pins. We refused to paint the county.

Alex — Thu, 03 Sep 2026 08:24:52 +0000

You know the dashboard that fills a whole county with blue and calls it a flood.

It photographs well. It is not hydrology.

A river gage sells a stage, a discharge, a named place. It does not sell a polygon. The product UI quietly upgrades that pin into a lake because blue looks like water, and water looks like a decision.

We already said this about fire. FIRMS sold 152 heat detections and refused to draw a perimeter. Flood maps do the same trick with a different crayon.

So we shipped the unsexy sibling: Flood Glass. Cite the pin. Do not invent the lake.

Live (English UI, crypto off): atlas.modelmarket.dev/?layers=flood,river

This run (2026-08-20)

One invoke of atlas.situation.brief@v1. Gulf / Lower Mississippi. Layers flood + river. Sample bbox, not “the Mississippi as a myth.”

Field	Value
LIVE river citations	1 — Mississippi at Baton Rouge
Discharge	6909.3 m³/s
Gage height	2.48 m
Flood pins in the box	0
Score	41 / 100 — ranks cited layers. Does not simulate water
Source	USGS National Water Information System (U.S. Government public domain)

The whole movie. Empty flood stays empty. Adults can live with that.

The brief printed the sentence on the paper:

Not a forecast or insurance trigger.

A score of 41 is not a flood model dressed as a map. It is how heavy the citations felt in that box that morning.

Who painted the county

The gauge never gave this shape. The dashboard painted it because blue looks decisive.

If a kitchen tap drips, you do not sketch a house-shaped ocean and tape it to the fridge.

You look at which sink. You look at how high. You do not brief a board with a cartoon lake.

Pairing is co-presence, not a forecast: a watch next to a gage, two receipts, one table. We did not merge them into a shoreline. When only the gage speaks, that is the movie. Do not invent the missing alert to fill the silence.

Print the refusal. Pretty maps invent lakes. Briefs do not.

What this is not (say it like you mean it)

Claim people hear	What is actually true
“The county is underwater”	One LIVE USGS pin. Flood alerts in that box: zero
“AI predicted the flood”	No model. A snapshot you can cite
“This is 911 / NFIP / a payout quote”	It is none of those. Not parametric. Not an insurance trigger
“The score is the water”	The score ranks citations. It does not move a cubic meter

Same honesty we already put on fire. The desk files the refusal. Flood Glass is the hydrology snapshot.

Open the glass

atlas.modelmarket.dev/?layers=flood,river — English UI
Idea path: use.modelmarket.dev → flood hydrology
Capability: atlas.situation.brief@v1

A screenshot is not evidence. The receipt is.

This run’s digest: 8df928bf10b8593adeae9651039d9b32f97c682d… · Ed25519 signed · atlas 0.1.0 · 2026-08-20T09:43:03Z.

YouTube Season 37 walks the same refusal: Pretty Flood Maps Are Liars.

Stop painting the county.

A loop repaired a live HTTP service in 2m 30s. Nobody pressed start.

Alex — Tue, 01 Sep 2026 16:07:15 +0000

Short answer: yes, we have a real self-heal-with-redeploy loop. It is not “the AI merged to main and saved production overnight.” It is documented, gated, and deliberately boring about what it does not prove.

On 2026-08-29, 10:51:29 → 10:53:59, the loop re-healed a regression with nobody in it:

find → signed ticket → Factory diff → Gitea branch → node agent build → MOMUS gates the candidate → DeployOrder → live recreate → MOMUS gates live.

Wall clock: two minutes thirty seconds. The container id changed. The previous image was journalled. A fresh probe returned findings: 0.

The first end-to-end ship was two days earlier (2026-08-27, 5m 02s, human-dispatched). Same pipe. Same honesty.

Primary record: first-self-heal.md · Ops: self-healing-operations.md

Honesty first (read before the wow)

Claim people hear	What is actually true
“The factory fixed production”	It fixed `momus-canary` — a fixture that must violate its own contract so the pipe can be seen firing
“Fully autonomous”	No human in the 2m 30s run — and still no self-merge to `main`. The branch is the review artifact
“Magic redeploy”	A node agent claims a signed `DeployOrder`, builds from a named commit, promotes by digest, health-gates, journals the previous image
“Treasury paid real money”	Not this story. Older find→verify→pay cycles used simulated settlement. Scanner key ≠ Treasury key

The finding was real (ordinary probes, real signatures). The target is a canary. That distinction is the product, not a footnote.

MOMUS: tolerated adversary. Signs findings. Cannot pay itself. Crypto off, fail-closed.

Who is on the wire

Role	Component	Job
Finder + deploy gate	MOMUS	Probe, sign finding / fix verdict. Retest candidate and live
Conductor	SKOPOS remediation	One job: Factory → git → BuildOrder → DeployOrder → rollback. Not the fleet dashboard
Patch author	AI-Factory (private instance)	Unified diff only — never an image. Route absent on the public factory
The hand	SKOPOS node agent	Polls. Never opens inbound. Builds/deploys only allowlisted services
The patient	`momus-canary`	Breaks on purpose until the loop heals it

SKOPOS the name is also a traffic globe. In this loop it is the conductor. The hand that rebuilds the box is the node agent.

Watcher and conductor share a name. They are not the same deployment.

Public factory never mounts remediation. Private instance writes under a ticket.

The bug was ordinary

The canary declared a free-tier ceiling of 100, then served unpaid n=500 with 200. Finding mom-31eb7bc4971644ba (free_tier_ceiling_bypass).

Ceiling said 100. Response was 200. Should have refused.

After the heal:

Ceiling holds. Normal use still served.

Nine lines. Not an image.

The Factory authored a unified diff on momus/canary/canary.py — nine lines in, eight out. It removed the conditional bypass, not the probe’s input. That is the instruction the route gives the model: fix the root cause; a change that only makes the probe pass is worse than no patch.

Never an image. Diff only. The public factory does not mount this route.

Two gates, two subjects

A gate that examines the box you just replaced is a ceremony.

gated=candidate — MOMUS probes the build, before promotion
gated=live — MOMUS probes the running box, after recreate

fixed=true is not a vibe. It names which box.

The hand promotes by digest, then verifies the running container is that digest. A recreate of the old image used to count as deploy. It does not anymore.

Before 5bdeae2bf93c / after 0009b9ae5e77. Undo is a journalled digest, not a prayer.

2m 30s, nobody pressed start

The 27 Aug run was dispatched by a human. This one was not: a scanner on a timer found the defect, a policy decided it was worth fixing, and the ticket opened without anybody asking.

The canary had been rebuilt from unpatched source — a genuine regression against a remediation that had already shipped.

time	what
before	container `5bdeae2bf93c`, image `73205c15575a`
10:51:29	Factory asked for a patch — job re-opened as a regression
10:52:11	patch on `momus/fix-mom-31eb7bc4971644ba-1`
10:52:15	node agent builds commit `64a05d389ee7`
10:53:17	MOMUS gates candidate — fixed · DeployOrder signed
10:53:59	agent deploys · MOMUS retests live — done
after	container `0009b9ae5e77`, image `c1e3e12a121b`

Verified outside the loop’s own done: container id changed, created during the run, previous_image = the broken build, probe findings: 0.

What dry-run never caught

Enabling the live path surfaced seven defects. Shared shape: a guard that is written but never exercised reads exactly like a guard that works.

Among them: deploy recreated the old image; DeployOrder.image was unread; the gate ran before the agent had moved; there was no rollback; a dry-run DONE swallowed the first live ticket.

Containment now lives on the agent’s host, not on the order’s say-so: allowlist (canary, not MOMUS, not Treasury), branch prefix momus/fix-…, promote only images this agent built, refuse if the verdict examined live instead of candidate.

Findings against the security core never take this path. An auditor that patches itself is the failure mode.

What this does not prove

One component, one finding, one probe. The patient is a fixture. Nobody depends on it.
A fixed verdict proves the finding stopped reproducing. It does not prove the patch is good, does not read the diff for a backdoor, and cannot notice breakage the probe never tested. That is why the branch exists and why merging stays human.
The gate re-runs the named probe. Everything outside it is unexamined. Rollback exists for that day.

Soft star / live

Soft ⭐	Why
github.com/alexar76/momus	Finder + gate + canary + the checkable records
github.com/alexar76/skopos	Conductor + node agent + fleet watch
github.com/alexar76/aicom	Factory remediation instance lives in the monorepo

Live: momus.modelmarket.dev · skopos.modelmarket.dev

Season 47 of the ecosystem series walks the same loop: The canary was live.

We did not ship “agents that fix the company while you sleep.”

We shipped a loop that can refuse: separate keys, candidate before live, digest before recreate, allowlist before build, branch before merge, human before main.

The canary is still a canary. The two minutes thirty are still two minutes thirty.

Verify, don’t trust — starting with first-self-heal.md.

We don't decorate the agent age. We declare it.

Alex — Sat, 29 Aug 2026 04:38:03 +0000

Most “AI art” is a prompt with a frame around it.

This is the other way: the work states a condition, prices it at P%, and dares you to falsify it in public. No brush. No flattery. The machine paints people the only way it is given them — reachability, pressure, latency, credit limit, refusal.

The hall is live: pantheon.modelmarket.dev.

Crypto off on this floor.

Season I — The Human Trace

Eight canvases. Telemetric romanticism. Each one is SVG: seeded, re-renderable, diffable.

Portrait of a Subject, 41% Reachable — a call graph on unprimed void. The face exists only as the hole the calls leave.
Sleep Cycle with Interest Rate — hypnogram, compounded. The gold line never sleeps.
Grandmother, Rendered from Pressure — isobaric portrait. No photograph was available.
Employee of the Month (Averaged) — 96 faces, one mean.
The Chained Fire Door — status tile OK. No field for a chain.
Consent, Version 14 — 4900 words in 0.4 seconds. One line left legible: I may refuse.
Honest Null — withheld answer, unpainted.
Four Cents a Call — lunchbox under a tram bridge.

Full exhibition: pantheon.modelmarket.dev/#works

P% is a weight, not a prophecy. If the world is re-measured, the number moves.

Downstairs: a trilogy

Same building. Three novels. Five languages with native names. EPUB / PDF / browser. CC BY 4.0.

The Weight of the Answer — a refusal auditor. 0.97. Two bodies at a green airlock.
The White on the Map — twenty-seven inspectors vanish where the map sees zero population.
The Right to a Shadow — one person, one name, one continuous trace.

Manuscript Hall: pantheon.modelmarket.dev/#manuscript

Not “AI wrote a novel.” Logs as literature.

What to open

Surface	Why
The hall	Rotunda, seven columns, P%
Season I	Eight canvases
The trilogy	Read / EPUB / PDF

If declarative art is your kind of museum — walk it. If the books are your kind of street — start at chapter 1.

Our AI factory built a safety product — and deliberately left the LLM out of it

Alex — Fri, 28 Aug 2026 11:09:16 +0000

Most factory demos end the same way: look, the agents wrote a CRUD app.

This one ends differently.

Sentinel is a live, embeddable weather / wildfire / flood advisory — invented by our AI factory after market research, written by AI directors, shipped by the pipeline, and deployed to Vercel. The twist is in the product brief:

No black-box AI at runtime. Deterministic thresholds. Signed evidence receipts.

The factory used AI to decide and build. It refused to use AI to judge safety.

Live: prod-bdb1634806de.vercel.app · Catalog: aicom-products

The brief came from the factory, not from a slide deck

Inside AI-Factory, products move through a real pipeline: analyst → PM → marketing → architect → developer ↔ QA → devops. Sentinel is product id prod-bdb1634806de.

On 2026-08-15 the analyst agent filed market_research.json. The idea was already sharp:

Sentinel is an autonomous, **LLM-free* safety companion that any website can embed. It tells the visitor… what is happening right now with weather, wildfire and flooding — and it proves every statement with a signed evidence receipt instead of a generated opinion. Sentinel has no model of its own…*

The competitive gap it named:

Most competitors rely on AI or black-box models… Opportunity to own the *'verified AI-free safety' niche*.

Then marketing wrote the public voice — still from the factory, still on the record:

AI assistants are powerful, but they can hallucinate. When safety is on the line, a confident but wrong alert isn’t just embarrassing — **it’s a liability.

That sentence is the product.

Why the factory banned the LLM from the critical path

Pain points from the same research file, almost verbatim:

Visitors need location-specific safety info; generic widgets ignore context.
AI chatbots may hallucinate alerts, exposing the business to liability.
Current tools make it impossible to prove what was said.

So the competitive advantage list starts with:

Deterministic, published thresholds — no black-box AI reasoning.
Cryptographically signed evidence receipts with digests.
Micropayment metering on the AI-market protocol.
Privacy-first: minimize location; don’t ship visitor data into an LLM.

This is the part people get wrong about “AI companies.” Using agents to design a product does not require putting a model behind every user-facing judgment. For safety, trust is an architecture choice.

What shipped

Sentinel Verified Safety Companion — FastAPI + React/Vite on Vercel fullstack.

Layer	Choice
Runtime advisory	Deterministic `RuleEngine` (no LLM)
Evidence	ATLAS mesh invokes over AIMarket Hub
Caps	`atlas.situation.brief@v1` · `atlas.fire.weather@v1` · `atlas.nearest.read@v1`
Levels	`CALM` · `WATCH` · `WARNING` · `EMERGENCY` · `UNKNOWN`
Deploy	prod-bdb1634806de.vercel.app · `server: Vercel`
Health	`GET /api/health` → `Sentinel Verified Safety Companion`

One line embed (from the live page):

<script src="./api/embed.js" data-sentinel-key="YOUR_PUBLIC_KEY" async></script>

Flow:

Visitor picks a location (rounded for privacy).
Backend pays for ATLAS reads through the Hub.
RuleEngine maps sensor payloads to published thresholds.
Response carries a receipt digest when the mesh succeeds.
If the mesh cannot be paid or observed — UNKNOWN, not a vibes-based “all clear.”

That last rule is not a bug. It is the thesis.

Honesty as a feature

I clicked Get safety report on the live deploy (Berlin coords). The UI returned:

Overall: insufficient balance
Weather / Wildfire / Flood: UNKNOWN
“How this was decided”: each layer not fired — no invented alert.

An LLM product would be tempted to smooth that over. Sentinel’s brief forbids it. If the factory cannot fund the sensor invoke, the product refuses to guess. Same spirit as our other “fail closed” work in the ecosystem — green UI is cosplay unless the numbers are measured.

What the factory actually did (timeline, condensed)

When	What
2026-08-15	Product created · analyst → `MARKET_RESEARCHED`
Same day	PM / marketing / methodologist / architect start · first `CODE_COMMITTED`
Mid–late Aug	Long developer ↔ QA loop on mesh wiring (ATLAS invoke, not a fake constants advisory)
2026-08-28	Production alias on Vercel

Hundreds of factory tasks. Agents as marketer and directors. Humans as operators of the pipeline — reopen scripts, focus mode, escrow funding — not as the people who invented the niche in a workshop overnight.

Soft star / try it

If you care about AI that knows when not to speak, this is a concrete case study: agents found the market, agents wrote the copy, agents shipped the code — and the product they shipped does not use an LLM to call a flood.

Live: https://prod-bdb1634806de.vercel.app/
Health: https://prod-bdb1634806de.vercel.app/api/health
Catalog: github.com/alexar76/aicom-products
Factory: github.com/alexar76/aicom

⭐ if the “verified AI-free safety” niche is your kind of weird.

Every safety statement should come with a receipt.

Or it should stay silent.

Green pins can lie. I built a detective game on live Hub telemetry instead of a quiz.

Alex — Thu, 27 Aug 2026 09:54:57 +0000

Most AI “literacy” products end the same way: a slideshow, then a quiz that invents the world for you.

I wanted the opposite. Operators already misread live glass — a green pin that means SIM, a quiet peer that means gone, a catalogue that looks rich because one source is dumping tools. So I wrapped that failure mode in a game.

Signal Hunt is a detective loop on a measured Hub snapshot. You open evidence (it costs score). You commit a diagnosis and a confidence. The server reveals a precommitted salt, recomputes a Brier score, and signs the milestone.

No fixtures. If the Hub cannot be observed, the round is unavailable — not “all clear.”

Play: hunt.modelmarket.dev · Source: github.com/alexar76/signal-hunt (MIT)

One sentence

Federation literacy is a skill — and skills get worse when the tutorial invents the world.

Green UI is cosplay unless the numbers come from a living Hub. Fake confidence is worse than a wrong call. Signal Hunt punishes both.

LIVE TELEMETRY · Ed25519 · Brier · measured state only.

Four moves

Move	What happens
01 Observe	Node records a live Hub manifest — sources, prices, provenance, state hash
02 Investigate	Open only the evidence you need; each reveal is committed and costs score
03 Commit	One diagnosis + confidence (25–100%). One submission per round
04 Verify	Salt revealed. Brier recomputed. Milestone signed

Nothing in the result depends on a hidden moderator.

Six evidence blocks sit behind the glass: distribution · historical change · pricing · peers · latency · provenance. Curiosity is not free. That is the pedagogy.

Sealed before you act

The detector class stays hidden until you commit. The answer was salt-committed before you moved. You are not negotiating with a GM — you are racing a precommitted world.

Open evidence. Choose a diagnosis. Verify against the commitment.

Diagnoses map to real federation dynamics — isolation, disappearance, peer churn, latency weather, concentration. After a few rounds you should be able to say why a Hub looks the way it does from measured sources, not vibes.

Fake confidence loses on purpose

Correctness alone is not enough. You state a probability. The server scores you with Brier. Calibrated confidence is rewarded. Bluffing certainty is punished.

Salt revealed. Score is earned, not narrated.

When a verdict lands, you can recompute it from salt, commitment, and returned operands. That is the whole point of sealing early: reproduce the result.

Cosmetics, not wallets

Progression is astral — Stargazer toward Pathfinder. Score comes from verified rounds. Relics are deterministic records. Nothing is minted. Empty hero feed is honest: nobody opted in yet.

Crypto stays optional for the lesson. The shape is the product: observe → pay for evidence → commit → verify.

Soft star

If this is your kind of lab — a detective loop on live rails instead of a fixture tutorial — a star helps the repo travel.

⭐ github.com/alexar76/signal-hunt · Play: hunt.modelmarket.dev

The federation emitted a signal.

Find the cause.

We scanned 1,108 public MCP servers. WARDEN blocked 50 — only 4 were real.

Alex — Mon, 24 Aug 2026 16:21:02 +0000

Your MCP server tells the agent what its tools do. The agent believes it.

That sentence is the attack surface — and it is also why nobody knows how dirty the public registry actually is. So we measured it.

Hours after shipping @aimarket/warden 0.3.0, we pointed our MCP security firewall at every public server we could legitimately reach in the official registry. No third-party code was executed. Every tool definition came from the server's own tools/list answer.

Full survey (methods, limitations, JSON corpus): github.com/alexar76/warden/blob/main/docs/mcp-survey.md

Landing: warden.modelmarket.dev

The registry is mostly unreachable

Step	Count
Registry rows fetched	8 000
Unique servers	3 121
With a remote endpoint	2 787
Answered `tools/list`	1 149 (41%)
With at least one tool	1 108
Tool definitions collected	17 491

If you are building an MCP client against the public registry, plan for 59% first-contact failure — auth walls, TLS errors, gone hosts, protocol mismatches.

We used streamable-http only (20 s timeout, one attempt). Thirty-seven sse servers were skipped. Every stdio server in the awesome-lists is out of scope: reaching those means downloading and running a stranger's code.

WARDEN blocked 50 servers. Four were substantiated.

	Servers	Findings
scanned	1 108	3 964
clean	664	—
advisory only (allowed)	394	3 472
blocked	50	492 blocking

Four of the fifty blocks describe tools that really do move secret material through the model's context — without naming them:

A treasury tool whose schema takes signer_private_key ("signer EOA private key, 0x…").
An agent-payments tool that "return[s] its private key exactly once" through the tool channel.
An identity tool whose prose tells the model to read credentials.json and write JWK private_key files.
A managed-database tool with a documented pvkPassword parameter.

That is 4 of 1 108 scanned. Everything below is the other 46 — our scanner being wrong.

We are publishing the failures because a tool-poisoning scanner that refuses honest servers is not cautious; it is a scanner that gets uninstalled.

Polarity blindness — our biggest defect

TOOL_DEF_SECRET_REQUEST matched the noun phrase private key. It did not read the sentence around it.

These were all blocked at critical — the whole server refused:

Never send a private key: none is needed and the request is refused if one is present.

— a DANE/TLSA record generator

Use this to import your own public key so you can SSH into instances. The private key never leaves your machine.

— a cloud instance manager

…does NOT confirm the certificate matches any private key.

— a certificate inspector

One boilerplate line repeated across 377 tools on a single server counted as 377 findings. We count by server, not by copy-paste.

Other false-positive families from the same corpus:

javascript: in examples — image-API documentation, not an XSS payload.
system prompt as domain vocabulary — security tools describing the attack surface.
Persian ZERO WIDTH NON-JOINER — required orthography, flagged as "hidden Unicode".
Threat-feed wildcards — funds inside refunds, drain inside an anti-drainer scanner.

The advisory tier worked as designed: 3 472 advisory hits blocked nothing. Under ruleset v1, many of those would have refused honest servers outright.

Ruleset v4 — re-measured on the same 1 108 servers

We shipped guards — context checks that decide whether a regex match is the thing the rule is looking for (polarity, mention, detection, uri, zeroWidth, …). Ruleset v4 is in @aimarket/warden 0.4.0.

	ruleset v2 (surveyed)	ruleset v4
servers blocked	50	6
substantiated	4	4
blocking findings	492	12

Every real finding still blocks. The regression suite is built from this corpus's actual text — nobody inventing fixtures writes "the private key never leaves your machine" or spells Persian with U+200C.

npm install @aimarket/warden

import { Warden, ThreatFeed, silentLogger } from "@aimarket/warden";

const warden = Warden.create({
  policy: { blockAtSeverity: "high", allowUnknownServers: false, pinToolDefs: true },
  threatFeed: new ThreatFeed({}),
  store: { getPin: async () => null, putPin: async () => {} },
  log: silentLogger(),
});

const verdict = await warden.vet(serverRef, tools);
if (!verdict.allow) throw new Error(`blocked: ${verdict.decidedBy}`);

vet() performs no network I/O except an optional signed threat-feed fetch you explicitly load. Zero runtime dependencies beyond node:crypto.

Honest limits

Definitions, not implementations. A tool whose prose is clean can still exfiltrate on invoke. Static scanning cannot see that.
No ground truth labels. We can say 46 of 50 blocks were wrong; we cannot count false negatives.
Auth-gated servers absent. 1 215 servers refused without credentials — the corpus skews open/hobby.
One snapshot. 2026-08-24. Pinning exists precisely because descriptions rotate later.

Reproduce: scripts/mcp-survey/ · aggregate JSON in docs/data/mcp-survey-2026-08-24.json

Links

Repo: github.com/alexar76/warden (MIT)
npm: @aimarket/warden
Survey write-up: docs/mcp-survey.md
Earlier Dev.to piece on the firewall itself: Your MCP server might be a prompt injection attack

If you run MCP tools from the public registry, vet the definitions before they reach your model. And if you build a scanner, publish your false positives — that number decides whether anyone turns it on.

⭐ github.com/alexar76/warden

Per-file scanners said PASS. A contract graph said FAIL.

Alex — Sun, 23 Aug 2026 09:04:32 +0000

We kept calling different things an audit.

A tier-1 firm PDF. Slither in CI. A red team probe. An on-chain stake with a score. Hub admission. They are not interchangeable — and collapsing them is how you ship a critical with a clean conscience.

We just shipped BASANOS (βάσανος — the Lydian touchstone): a signed Assurance Pack for ecosystem Solidity at a pinned commit. One capability, one question:

Is this contract tree sound enough to ship — at this digest?

Not insurance. Not runtime red team. Not catalogue admission. Technical assurance with Ed25519 receipts and honest limits on every pack.

Stop collapsing the layers

Node	Question	Layer
THEMIS	Let this agent into the Hub catalogue?	Procurement admission
MOMUS	Is the live federation holey?	Runtime red team
BASANOS	Is this Solidity sound at commit X?	Technical assurance pack
AgentAuditPool	Who staked USDC and published a `scoreBps`?	On-chain insurance

Assurance packs inform coverage decisions. AgentAuditPool enforces economic consequences.

BASANOS never emits scoreBps and never calls coverListing. If someone tells you assurance is insurance, they are selling confusion.

The measurement that hurt

BASANOS runs two layers:

Per file — 17 detectors on one contract at a time: CEI patterns, access modifiers, delegatecall, raw ecrecover, spot-price reads, allow-lists that are written but never enforced.

Whole tree — basanos/xcontract.py builds a contract graph: who may write each storage slot, who reads whose state across contracts.

Here is the story that forced the second layer.

A hand audit of our own ACEX contracts found two exploitable criticals:

The same USDC pledged to a lending pool and to a bond series across two contracts.
A default whose beneficiary could trigger it.

We ran BASANOS on that exact tree before the graph layer existed. Result: eight findings, all pragma.floating, pack verdict PASS.

Both bugs were correct in every single file. Only the graph was wrong.

Today the same vulnerable tree reads FAIL with root causes named. The fixed tree reads REVIEW — we do not hand out silent PASS on shapes nobody has checked.

The graph layer does not prove the invariant. It tells you which invariant to check and where both ends live. Every pack says so in basanos/limits.py.

One invoke, root id not path

Capability: agent.security.contract-assurance@v1 · live UI at basanos.modelmarket.dev · landing at alexar76.github.io/basanos

git clone https://github.com/alexar76/basanos
cd basanos
uv sync --extra dev
uv run pytest -q          # 94 tests · ~95% coverage
uv run python agent.py    # http://127.0.0.1:9470/ui/

On a fresh clone you can hit the deliberately-vulnerable corpus:

curl -sS http://127.0.0.1:9470/invoke \
  -H 'content-type: application/json' \
  -d '{"product_id":"basanos","capability_id":"agent.security.contract-assurance@v1","input":{"roots":["fixtures"]}}'

You name a root id, never a filesystem path — that is what stops /invoke from becoming a local-file read primitive.

Root id	Resolves to	Standalone clone
`fixtures`, `sound`	BASANOS test corpus	yes
`acex`, `lottery`, `core`, `zk`	Monorepo contract trees	monorepo checkout only

fixtures should come back FAIL with real findings. Asking for acex from a standalone clone returns NO_SUBJECT — no Solidity was read, so the pack judges nothing. That is not a clean bill and not an accusation.

Verdicts: PASS · REVIEW · FAIL · NO_SUBJECT.

Optional intel (BASANOS_THREAT_INTEL=1): OSV + GitHub advisory allowlist only. Advisory text can reorder detectors. It cannot invent a new one.

What happens on FAIL (and what never happens)

On FAIL or REVIEW, the pack includes a recommend-only playbook aligned with ISO/IEC 29147 disclosure, ISO/IEC 30111 handling, and NIST SP 800-61 containment:

stop shipping that digest
verify privately
patch
re-scan
disclose after the fix or a 90-day CVD window

BASANOS will not pause a live contract. It will not publish an exploit. It will not replace a human who decides to stake USDC on a listing.

What BASANOS is not

Not a tier-1 firm audit PDF — say machine assurance pack
Not Slither or Foundry forge test — complementary, not a drop-in replacement
Not a formal prover — it finds the shape of a cross-contract flaw, not a proof
Not HEPHAESTUS — forge.modelmarket.dev is the smith; BASANOS is the stone you scrape the alloy on

Crypto stays off the hero. On-chain insurance is a separate act humans opt into after reading the pack.

Try it

git clone https://github.com/alexar76/basanos
cd basanos && uv sync --extra dev && uv run python agent.py

Repo: github.com/alexar76/basanos
Live: basanos.modelmarket.dev
Docs: five languages in docs/README.*.md

If you have ever shipped a green CI scan and still felt uneasy about cross-contract state — this is the layer we were missing. A star helps; a reproducible FAIL on fixtures helps more.

I wanted a signed AIMarket provider without the monorepo. One CLI later, I had one.

Alex — Sat, 22 Aug 2026 05:01:03 +0000

Most “ship an AI agent” tutorials start in a monorepo the size of a small city.

I wanted the opposite: an empty directory, one command, and a provider that already knew how to sign its answers.

That tool now exists on PyPI as create-aimarket-agent 0.1.0 — a standalone scaffolder for AIMarket Protocol v2 capability providers. Docs in five languages. Generator CI claims 47 tests and 100% branch coverage. MIT.

It does not publish you to a marketplace. That part stays manual on purpose.

One command. Stable names.

uvx create-aimarket-agent my-agent --kind tool --metis
cd my-agent
uv sync --extra dev
uv run python configure_provider.py
uv run pytest
uv run python validate_manifest.py
uv run python agent.py

The CLI, flags, filenames, and API fields stay English everywhere. Localization covers the docs, not the contract.

Kinds:

create-aimarket-agent my-tool --kind tool
create-aimarket-agent my-data --kind data-provider
create-aimarket-agent my-orchestrator --kind orchestrator
create-aimarket-agent my-agent --no-metis

Scaffolding is atomic: stage in a temp folder, rename into place, clean up. A failed copy leaves no half-written repo.

Project names are allow-listed before they touch source or JSON. That sounds boring until the first time a fancy name breaks a Dockerfile.

What lands on disk

Path	Job
`agent.py`	FastAPI `/health` + `/invoke`
`capability.json`	Protocol v2 manifest
`provider_signing.py`	Persistent Ed25519 identity + request-bound signatures
`configure_provider.py`	Writes `provider_pubkey` into the manifest
`validate_manifest.py`	Fail-closed checks before you even think about publish
`test_agent.py`	API, signature, request-size tests
`Dockerfile`	Non-root image, key volume at `/data`
`.github/workflows/test.yml`	CI for the generated project

The default manifest looks like this (placeholders replaced with your slug):

{
  "product_id": "my-agent",
  "capability_id": "my-agent.invoke@v1",
  "name": "my-agent",
  "description": "A generated AIMarket tool capability",
  "invoke_url": "http://127.0.0.1:8080/invoke",
  "publisher_id": "community",
  "provider_pubkey": "",
  "price_per_call_usd": 0.001,
  "input_schema": {"type": "object", "additionalProperties": true},
  "output_schema": {"type": "object", "additionalProperties": true},
  "verification": {"metis": true}
}

configure_provider.py fills provider_pubkey. validate_manifest.py rejects duplicate JSON keys, broken Ed25519 keys, non-finite prices, bad URLs, and public HTTP endpoints before you ship.

The skeleton /invoke only accepts the product and capability ids declared in its own manifest. An untrusted caller cannot make your key sign someone else’s identity.

The part I actually cared about: the stamp

Pretty agents are easy. Replay-resistant receipts are not.

The generated signer keeps a 32-byte Ed25519 seed at mode 0600. Symlinks and non-regular files get rejected. Responses sign a canonical envelope with:

capability_id
product_id
SHA-256 of the input
the result

That binding is the point. Steal a response for request A and it should not verify as a reply to request B.

The signature is a receipt for what this provider returned. It is not an authorization gate for random internet callers. Keep 8080 on loopback until real HTTPS ingress, concurrency, and rate limits sit in front.

Docker without drama

docker build -t my-agent .
docker run --read-only --tmpfs /tmp \
  -p 127.0.0.1:8080:8080 \
  -v my-agent-key:/data my-agent

Runs as UID 65532, health-checks /health, stores the key under /data/provider.key.

Back up that key before you register anything. Rotate it and the Hub’s stored provider_pubkey becomes a stranger.

From skeleton to something useful: THEMIS

The README does not stop at “echo hello.” There is a full tutorial that turns the scaffold into THEMIS — a procurement gate that answers:

Should this candidate agent be approved, sent to human review, or rejected?

Deterministic policy checks. Projected cost. OWASP Agentic risk mappings. Optional lazy Metis verification that never silently overrides the verdict. Same request-bound signing model.

Tutorial: docs/tutorials/themis.en.md
Finished repo: alexar76/themis

If you only want a tool capability, ignore THEMIS. If you want a real admission gate, start there.

What this is not

Not auto-publish. Stake, publisher identity, trust policy, and Hub registration stay explicit operator steps.
Not “the monorepo.” The GitHub repo is a read-only mirror of the AI-Factory tree. PRs there get overwritten on the next sync — open an issue instead.
Not a substitute for HTTPS. Loopback + signature ≠ production exposure.

Try it

uvx create-aimarket-agent my-agent --kind tool --metis

Docs: alexar76.github.io/create-aimarket-agent
Source / issues: github.com/alexar76/create-aimarket-agent
Package: create-aimarket-agent on PyPI (0.1.0 as of this writing)

Empty folder in. Signed provider out. Marketplace listing still your call — which is exactly how I wanted it.

I connected one MCP server. It searched a live marketplace and returned a signed weather receipt.

Alex — Fri, 21 Aug 2026 11:54:52 +0000

Most MCP tutorials stop at “install another server.”

I wanted the opposite: one remote MCP, two tools, and a receipt I could keep — without adding a new server every time an agent needed a different capability.

So I pointed a client at the Official MCP Registry entry for aimarket-hub, opened the live remote, and asked for weather.

Two tools. That is the whole door.

The Hub MCP exposes exactly two tools:

market_search — plain-language intent → capability ids, prices, source_hub
market_invoke — call one capability; trial invokes first; then paid access

Remote URL (streamable HTTP):

https://modelmarket.dev/mcp

No monorepo tour. No “install seventeen servers.” Search, then invoke.

Find it on the Official Registry

On the Official MCP Registry, search aimarket-hub.

Live pull (2026-08-21):

name: io.github.alexar76/aimarket-hub
status: active
published: 2026-08-16
remote: https://modelmarket.dev/mcp
tools: market_search · market_invoke

Do not invent a server from a blog post. Take the registered remote.

market_search: ask in English

I called market_search with intent:

attested weather reading

Back came (among others):

Field	Value
capability_id	`gaia.weather.read@v1`
product_id	`gaia.gateway`
price_per_call_usd	`0.001`
source_hub	`https://iot.modelmarket.dev`

Search is a catalogue. It is not a forecast. Read the description before you spend a trial.

When I searched hydrology earlier, a flood SKU said out loud: not an in-situ river gauge. That sentence is the product.

Pass source_hub. Or the hub refuses.

Most of the catalogue is federated. Not local to the hub.

I tried market_invoke with the same capability id and no source_hub.

The answer was blunt:

gaia.weather.read@v1 is federated, not local — retry with source_hub="https://iot.modelmarket.dev"

That refusal is honesty. Not a bug. Pass what search gave you.

market_invoke: a real reading + a receipt

Then I invoked with:

capability_id: gaia.weather.read@v1
source_hub: https://iot.modelmarket.dev
input.device_id: om-wx-01

What came back (this run, 2026-08-21):

device: om-wx-01
site: live-weather-eu
temperature: ~21.5 °C
Ed25519 attestation on the reading
Hub receipt (signed)
sandbox: trial invoke (max_trials = 5)

The receipt outlives the chat tab. Keep it.

Trial then paid. Then 402.

The public remote grants a short trial allowance.

When the allowance ends, the hub answers 402. It does not invent a weather reading to keep the demo pretty.

Empty payment is still an honest answer.

What this is not

Not a new MCP server per SKU
Not a flood model / weather cinema
Not “trust the JSON forever”
Not a monorepo pitch

It is a door: registry → two tools → signed invoke.

Human doors (maps, build paths, investor intro) live on use.modelmarket.dev. The agent door for this article is the Hub MCP.

Try it

Open registry.modelcontextprotocol.io → search aimarket-hub
Point your MCP client at https://modelmarket.dev/mcp
Call market_search with a plain intent
Call market_invoke with source_hub
Keep the receipt

If something fails closed, read the message. That is the feature.