For agents: start with the agent guide. Every page is Markdown by default; add Accept: text/html for HTML.

Hosted agent interfaces

What it does

apps/site hosts the public documentation and agent interfaces. A capability is one named action with shared input, output, and failure definitions and a server-side implementation.¶

• MCP means Model Context Protocol²⁷. It lets an agent discover and call tools.¶
• A2A means Agent2Agent protocol. This site uses it to answer documentation questions through search and read.¶
• Discovery cards describe how to connect with each protocol.¶
• OpenAPI describes the HTTP API for the registered capabilities, including inputs, outputs, and errors.¶
• The agent guide explains connection, search, read, and following links between documentation pages.¶
• The hosted registry exposes search, read, backlinks, neighbors, mentions, path, and execute.¶

Run a program instead of several calls

Use POST /api/execute with a JSON code string. The MCP execute tool runs the same job.¶

Code mode²¹ runs several capability calls in one program inside a restricted environment. joinInterest cannot run there.¶

Source: callable definitions in apps/mischief/src/capabilities/index.ts at 445b1a20b51a5492f8e586daeb9306e8011b7673, lines 34–45.¶

const found = await tools.search({ query: "cartridges", limit: 1 });
const page = await tools.read({ id: found.matches[0].id });
return { title: page.title, id: page.id };

The program passes the search result directly to read.¶

MCP supports protocol versions 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, and 2024-11-05. The newest is stateless. Older clients initialize sessions backed by a Durable Object, Cloudflare’s feature for persistent state and compute.¶

A2A answers documentation questions through search and read. RPC means remote procedure call: a client calls a named operation on the server. Browser RPC serves the browser separately.¶

The standard

• Application calls use shared capability value definitions and server-side implementations.¶
• Discovery and static pages handle routing. Domain calls stay in capability handlers.¶
• Public API access needs no account or access token.¶
• Interest signup¹² has its own consent and email-confirmation rules.¶
• execute runs an async function body in a fresh Dynamic Worker, a Cloudflare Worker loaded at runtime.¶
• It sets globalOutbound: null to block outbound network access.¶
• Imports, exports, and fetch are unavailable.¶
• The program can call only declared capabilities.¶
• API and MCP allow 120 requests per IP per 60 seconds.¶
• Execute also allows 6 per IP and 300 total per 60 seconds.¶
• Native Cloudflare counters apply separately per location.¶

These routes exist today. A reusable cartridge³⁶ for agent interfaces remains planned. A cartridge is a package for one job, with its implementation and required infrastructure.¶

Content asset cache

ContentStore shares completed catalogs, search indexes, learning decks, and graph views within one Worker isolate. Concurrent cold requests each perform their own asset reads. The cache stores a value only after its read and validation succeed. Failed or interrupted reads leave the cache empty.¶

Pending reads must not use a shared promise, fiber, latch, or response body. Those values can belong to the first request’s runtime context. Warm requests reuse decoded data without new asset I/O.¶

test/cold-content-runtime.test.ts sends concurrent first requests through a fresh local Worker. Its asset adapter adds a delay to make cold reads overlap. The test uses workerd, production content routes, and the reader wrapper.¶

How to check

1. Read the MCP connection card.¶
2. Read the A2A card.¶
3. Read OpenAPI.¶
4. Compare the descriptions with apps/site/src/capabilities/index.ts.¶
5. Use the tools/list request in llms.txt.¶
6. Search for a public document.¶
7. Read the document.¶
8. Run pnpm --filter @rat-stack/site test for protocol routing, rate limiting, and sandbox behavior.¶
9. Confirm the live cards and capability list before advertising a new agent path.¶
10. Run pnpm --filter @rat-stack/site exec vitest run test/cold-content-runtime.test.ts to check cold-request isolation.¶

Check a new deploy live as well as running local tests.¶

Last changed 2026-10-10 in 978dccc. Source on GitHub. Change log.