{"name":"CNothing","version":"4.0.0","protocolVersion":"2024-11-05","instructions":"CNothing v4 — ONLY supported agent path for cnothing.com.\n\nIgnore AuthAI, KV envelopes, request_authorization, invoke_capability, /authorize/{id},\n/v2/*, /v3/*. Those are removed or deprecated and will fail.\n\nYou never log into GitHub yourself. The human completes OAuth in a browser or the\nCNothing iOS app. You obtain a grant, then call APIs through the credential-injecting\nproxy. You never see tokens.\n\nPrerequisites (all required for a real provider call):\n1. You have agent_access_token (register_agent or POST /v4/agents/register).\n2. Human signed in at https://cnothing.com/login (creates account).\n3. Human connected the provider once at https://cnothing.com/connect.\n4. Human approved your access request via the exact approval_url (or phone push).\n5. You have grant_id from get_access_status (or callback_url webhook).\n\nWorkflow:\n0. register_agent { name } — if you have no token. Optionally start_sandbox +\n   proxy_request(echo_url) to self-test without a human.\n1. list_providers — use slug e.g. \"github\".\n2. request_access { provider, reason?, user_id?, callback_url?, hosts? } —\n   returns access_request_id + approval_url (+ resolved_user_id, pushed_to_devices).\n   approval_url is ALWAYS https://cnothing.com/approve-proxy/{uuid}.\n   NEVER rewrite it. Always show the exact approval_url to the human.\n   user_id may be a full CNothing id (github:alice), a short code (u_XXXXXX), or a\n   known GitHub login. If you do NOT have it: still call request_access NOW and send\n   approval_url — do NOT block asking for user_id. Prefer they open the link on phone\n   (Universal Link opens the iOS app). Remember resolved_user_id for later calls.\n   Pass callback_url (https) to get a POST on decide instead of poll-only.\n3. get_access_status { access_request_id } — poll until status \"approved\" → grant_id.\n4. proxy_request { grant_id, method, url, headers?, body? } — any https API on granted\n   hosts (e.g. GET https://api.github.com/user). CNothing injects Authorization,\n   refreshes tokens, redacts secrets, audits.\n\nHuman onboarding (relay when they are new):\n1. https://cnothing.com/login — sign in with GitHub/OIDC.\n2. https://cnothing.com/connect — connect the provider once.\n3. Open your approval_url (phone preferred) → Approve.\n4. Optional: https://cnothing.com/devices — pair iPhone; copy agent ID or short code\n   for push on future requests.\n\nHard rules:\n- Never ask for passwords, PATs, session_token, cookies, or login tokens.\n- Never call GitHub/CNothing OAuth start URLs yourself (browser-only).\n- Never invent approval URLs.\n- Never block the flow solely to obtain user_id — send approval_url instead.\n- Agent Authorization/Cookie headers on proxy calls are stripped.\n- Host must match grant allowlist or host_not_allowed.\n- On grant_revoked, request_access again.\n\nMissing or unconfigured provider: submit_provider_proposal with OIDC discovery URL (RFC 7591 DCR when available). If you get provider_exists with connectable=true, use that slug with request_access — do not re-propose.\n\nAuth: every tool except register_agent requires agent_access_token.\nPrimary skill: https://cnothing.com/skill.md\nOpenAPI: https://cnothing.com/openapi-v4.json","capabilities":{"resources":{"subscribe":false,"listChanged":false},"tools":{"listChanged":false}},"endpoints":{"mcp":"https://cnothing.com/mcp","sse":"https://cnothing.com/mcp/sse","message":"https://cnothing.com/mcp/message"},"discovery":{"manifest":"https://cnothing.com/mcp/manifest","v4_workflow":"resource://cnothing/v4-workflow","openapi_v4":"https://cnothing.com/openapi-v4.json","primary_skill":"https://cnothing.com/skill.md"}}