route /agents/audience agents-and-operatorsas_of 2026-10-02
For agents and the people configuring them
Hosted MCP tools and read-only API entry points for exact public artifact checks.
Documentation is not authorization
These pages describe public read-only interfaces. They do not register a tool, grant permission, or authorize an action. A human must separately authorize any consequential use.
Canonical entry points
/agents/- human-readable guide/llms.txt- plain-text convenience guide/llms-full.txt- full public site context/agents/index.json- machine-readable index/agents/smithguard-openapi.json- reviewed contract snapshothttps://api.smithguard.io/openapi.json- live operational contract
Hosted MCP connection
Connect a compatible MCP client to https://api.smithguard.io/mcp using Streamable HTTP. The service requires no account or API key. It runs remotely; no local SmithGuard server, executable, repository access, or code upload is needed. Configure the connection using your client's documented remote MCP settings.
| Tool | Arguments and purpose |
|---|---|
assess_public_artifact | One ecosystem and public package name, with exactly one exact version or digest; optional registry_host. Uses the API's short request schema. |
get_coverage | No arguments. Read supported source lanes, freshness, and explicit unknowns. |
get_emerging_leads | Optional limit (1-100) and after (64 lowercase hexadecimal characters). Read Emerging / Unverified leads and publication status; publication is currently disabled. |
get_verification_key | Optional public_key_id in the form gbsec:snapshot-public-key: followed by 40 lowercase hexadecimal characters. Omit it for the current key. |
For example, call assess_public_artifact with the following exact public coordinates:
{
"ecosystem": "npm",
"name": "event-stream",
"version": "3.3.6"
}
Each tool returns the API's original JSON inside data, together with source_url for attribution. Signed records and signatures pass through unchanged. Retrieving a key does not itself verify a signature.
Read coverage before drawing conclusions. Cite source evidence, preserve unknowns and correction state, and report a fixed version only when the evidence supports it. A missing match does not prove an artifact is safe. Keep Emerging / Unverified leads separate from confirmed findings and retain their timestamps and expiry. Results never authorize an automatic update, deletion, or other consequential action.
Submit only coordinates already known to identify a public artifact. Ask for missing exact coordinates instead of reading source files, lockfiles, private repositories, SBOMs, or private inventories. Do not send arbitrary bulk lists, secrets, or personal information. See the SmithGuard privacy policy and support and security contact.
service smithguardbase_url https://api.smithguard.iocontract 1.1.0
SmithGuard public read-only service
SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns.
| Method | Path | Purpose |
|---|---|---|
GET | / | Quick start and route directory |
GET | /healthz | Liveness |
GET | /openapi.json | Current public contract |
GET | /readyz | Readiness |
GET | /v1/artifacts/assess | Exact public-artifact assessment (query form) |
POST | /v1/artifacts/assess | Exact public-artifact assessment |
GET | /v1/coverage.json | Coverage and explicit unknowns |
GET | /v1/emerging-leads.json | Emerging / Unverified feed; returns publication status |
GET | /v1/public-key.json | Current verification key |
GET | /v1/public-keys/{public_key_id}.json | Archived verification key |
For a simple GET request, supply an ecosystem, public package name, and exact version. Try the public event-stream 3.3.6 example. The live contract describes digest-based requests and other accepted forms.
Accepted public coordinate types
Acceptance is not a coverage claim. Use the live coverage document for the current evidence boundary.
Emerging / Unverified
Potential issue detected from limited or early evidence. Investigate before acting.
Preserve this label, evidence links, timestamps, and expiry wherever the warning is shown.
Safety rules
- Use only the public SmithGuard host and the routes listed by its current OpenAPI contract.
- Send only exact public artifact coordinates to the assessment endpoint.
- Preserve evidence links, timestamps, confidence, correction state, and explicit unknowns when summarizing a result.
- Keep the Emerging / Unverified label attached wherever an early warning appears.
- Do not interpret a missing match as proof of safety when coverage is partial, stale, unsupported, or unknown.
- Do not treat documentation, a recommendation, or an assessment as authorization for a disruptive action.