A safety-first compiler that turns an OpenAPI 3.x document or service idea into a downloadable, testable A2MCP package with contracts, provenance, security gates, and conformance tests.
What it is
Agent Tool Forge is a safety-first A2MCP compiler that turns an OpenAPI 3.x document or service idea into a downloadable, testable agent-service package.
30-second judge path
1. Open the live Judge Console: https://hermes-agent.tail3ab78.ts.net/
2. Run Weather API and verify decision: allow, imported operation: 1, and a downloadable ZIP.
3. Run Token Risk and verify decision: allow_with_review.
4. Run Prompt Injection and verify decision: block with no artifact download.
5. Review 33 passing tests and the latest successful GitHub CI.
Generated package
• OpenAPI and JSON input/output contracts
• Read-only Python handler scaffold
• Security policy and provenance report
• Positive, negative, abuse, and conformance tests
• Opaque, time-limited ZIP artifact
Safety by construction
All user-controlled fields are inspected. Secret-like values are redacted before generation. Prompt-injection patterns block publication assets. Wallet, transaction, PII, financial, and security-sensitive requests require review, while generated services remain read-only by default.
Live proof
Judge Console: https://hermes-agent.tail3ab78.ts.net/
Public API: https://hermes-agent.tail3ab78.ts.net/forge
Health: https://hermes-agent.tail3ab78.ts.net/health
OpenAPI: https://hermes-agent.tail3ab78.ts.net/openapi.json
Source: https://github.com/TecSong/agent-tool-forge
CI: https://github.com/TecSong/agent-tool-forge/actions/runs/29983946153
Commit: 8804401079ef3c53b525a28efad8d83cbca7f336
OKX.AI Agent ID: 5820
Billing and listing status
The public endpoint currently runs in free HTTP 200 mode. An opt-in x402 v2 adapter is implemented and tested, but no payment is collected until paid configuration is explicitly enabled. Agent 5820 remains under OKX.AI listing review.
<p>• Built and deployed a production-supervised public HTTPS A2MCP service with Gunicorn and Tailscale Funnel.</p><p>• Added a responsive Judge Console with three one-click, evidence-first paths: Weather allow, Token Risk allow_with_review, and Prompt Injection block.</p><p>• The Console exposes safety findings, imported operations, artifact digest, ZIP file tree, and a validated download path.</p><p>• Implemented OpenAPI 3.x import and operation extraction.</p><p>• Added secret redaction, prompt-injection blocking, and wallet/transaction review gates.</p><p>• Added bounded artifact storage, rate/concurrency limits, strict JSON validation, hardened HTTP responses, CSP, and same-origin static assets.</p><p>• Added marketplace-compatible GET, HEAD, and empty-POST discovery probes for /forge.</p><p>• Generated downloadable ZIP packages with contracts, handler scaffold, tests, security policy, and provenance.</p><p>• Validated 33 unit, security, billing, artifact, UI-route, and HTTP integration tests.</p><p>• Verified GitHub CI run 29983946153 for commit 8804401: Python 3.10, Python 3.12, and production container all passed.</p><p>• Independently reviewed and fixed async-result races and artifact-download URL validation.</p><p>• Implemented and tested an optional fail-closed x402 v2 payment adapter; the current public endpoint remains free and has collected no payment.</p><p>• Registered OKX.AI Agent ID 5820; marketplace listing remains under review.</p>
<p>Bootstrapped and self-funded. No external funding has been raised.</p>