DEVELOPER QUICKSTART / V0.2

One call before the fetch.

The free pilot inspects public signals and returns a conservative routing decision. It does not execute the recommended route, acquire a license, or make payments. The site and API run on the same origin.

Run the complete agent integration → · Handle access decisions →

HTTP

curl https://accessgraph.snugguppy5.chatgpt.site/route \
  -H 'Content-Type: application/json' \
  -d '{"target_url":"https://example.com/","action":"read","capabilities":["http","mcp"],"budget_usd":0}'

Actions: read (mapped to AI input), ai-input, search (indexing), ai-train, transact. Capabilities: http, browser, mcp, a2a, x402. Optional user_agent is your product token; AccessGraph always probes under its own identity and checks both robots policies.

Decision	What your agent should do
route_available	A route passed the implemented checks. Review applicable terms before execution.
conditional	Resolve the reported license, payment, capability, or policy requirement.
blocked	Stop. Do not evade the restriction or switch identity.
unknown	Do not treat missing evidence as permission.

Open clients

Download the dependency-free JavaScript client, Python client, or local MCP stdio bridge. Client code is MIT licensed. Download the complete source release, including tests, documentation and the MIT license.

MCP

Connect a remote client using Streamable HTTP:

{
  "mcpServers": {
    "accessgraph": {
      "url": "https://accessgraph.snugguppy5.chatgpt.site/agent/mcp",
      "type": "http"
    }
  }
}

Client configuration syntax varies. The public endpoint is /agent/mcp; the platform-managed /mcp connection uses Sites authentication. Both expose public access-preflight data only. The server supports initialize, ping, tools/list, and tools/call for the route tool, using MCP 2025-06-18 or 2025-03-26. It is stateless, returns JSON, and does not offer an SSE stream. Send Accept: application/json, text/event-stream. Use the negotiated MCP-Protocol-Version header after initialization.

A2A

Read the A2A 0.3.0 agent card. POST message/send to /a2a with a user message, messageId, and a data part containing the same route input. The server returns a synchronous agent message; there are no long-running tasks or streaming.

Evidence and limits

At most nine metadata/target probes per request, with timeouts and 256 KiB response bounds. Redirects are not followed. Rate limits are 10 requests per minute and 100 per day per IP. Probes examine robots first; unsupported content signals and RSL references require review. Discovered APIs, MCP servers and A2A skills are candidates, not interchangeable verified routes. Browser fallback is deliberately absent.

The initial recommendation is direct HTTP when inspection succeeds with no observed restriction. Its $0 is an observed access charge, not a contractual price. Unknown prices never become zero. budget_usd is accepted for future paid routing; this pilot never recommends or purchases a paid route.

Freshness and measurement

Responses include cache.status, cache.evidence_age_ms, timing.processing_ms and telemetry.transport. Cache entries last at most five minutes within a worker instance, respect shorter publisher freshness directives, and never fall back to expired evidence. Restricted, conditional, failed, query-bearing and no-store requests are not cached. Send Cache-Control: no-cache for a fresh inspection. New blocks at execution time must still stop your agent.

Optional X-AccessGraph-Source accepts quickstart, research-example, mcp-registry, python-client, javascript-client or benchmark. It is self-declared attribution, never verified acquisition. Use X-AccessGraph-Demo: 1 for tests. Anonymous requests remain unverified; only operator-provisioned credentials identify registered integrations.

Outcome feedback

A route response includes request_id and a one-use feedback_token. POST them with success: true or false to /feedback within 24 hours. Reports are labelled client-reported and never counted as independently verified task success.

Discovery surfaces

OpenAPI 3.1 · llms.txt · Capabilities · Sitemap · Bazaar integration draft

Bazaar metadata is a compatibility draft, not a registered listing or a payment offer. The pilot has no payment wallet and charges nothing. The MCP Registry manifest identifies the public remote endpoint. Check the official registry API for its publication status.

Privacy

Requests disclose the target to AccessGraph and cause identifiable requests to the target publisher. Query strings, page bodies, raw IP addresses, and authorization tokens are not stored in the application database. See privacy and retention.