What an agent may do here.

The map and the corpus: what Fwozen is, the whole acquisition journey with the four human-consent moments marked, and every documentation page. Both origins serve the same bytes from one builder.

not allowedNothing tenant-specific, ever. The build writes these documents from the marketing content and the public route table, and they contain no customer data of any kind.

App and auth discovery as JSON: the App slug, the install-URL template, the OpenAPI and skills links, and both credential schemes. One is Fwozen’s own device flow, with its two endpoints, its public client id, and its human approval page. The other is the `fwz_` bearer scheme with its scope list.

not allowedThis document publishes no secret. The device-flow client id is a PUBLIC client and has no secret to leak; there is no client secret, no App private key, and no installation id in this document.

The agent skill, published under the agentskills.io index schema with a SHA-256 digest over the exact bytes served. The skill is the CLI’s own file, copied and hashed at build.

not allowedThe digest is generated, not transcribed, so the index cannot advertise a hash for a file that has moved on. Nothing here executes; it is a document.

The plan catalog, from the same constant the pricing page renders. Tiers, prices, what each includes, and the trial terms. Cacheable for five minutes.

not allowedNo organisation, no usage, no entitlement lookup. It answers identically for every caller, which is why it needs no credential.

RFC 9728 protected resource metadata for the MCP endpoint: the resource URL, the authorization server, the bearer methods, and the supported scopes. The MCP endpoint answers an unauthenticated request with a 401 whose `WWW-Authenticate` header points at this document.

not allowedMetadata only. It grants nothing, and discovering it is not a step toward a credential. The credential still comes from a human approving a device code, or from a key an authorised person minted.

Mints an `fwz_` key. A signed-in person creates it, or an agent holding the session that person approved in the device flow.

not allowedA key can never mint a key. This route takes a session credential only, so a leaked `fwz_` key cannot widen itself into a second credential with different scopes or a longer life.

A key is created as `human` or `agent`. An `agent` key must carry an expiry, capped at 90 days, and every audit row written under a key names the key’s id, label, and kind, so an agent principal is distinguishable from the person who authorised it.

not allowedScopes cannot be widened after creation, and keys do not get billing scopes by default. The scope picker shows those unchecked. An agent key with no billing scope cannot open a checkout session or start a trial.

Resolves the signed `state` nonce that `GET /v1/github/install-url` minted, so an agent can poll an install to `pending`, `installed_unclaimed`, or `installed_claimed` instead of asking a human whether they finished.

not allowedIt never accepts a caller-supplied installation id, and it reveals nothing unless the nonce is valid and was minted for that caller. Any mismatch is a 404, the same answer as a nonce that never existed, so nobody can probe for installations through this route.

A streamable-HTTP MCP server. It accepts exactly what the REST API accepts: a session JWT or an `fwz_` key. It builds the same actor and stays scoped to that actor’s organisation. Its tools are thin adapters over routes that already exist, each marked read-only or destructive, and no tool mixes a read with a write.

not allowedNo tool completes a payment. The checkout tool returns a URL for a human and stops. No tool enables a repository the caller did not name. Ending a freeze is the one destructive verb. It is marked destructive, and it refuses without an explicit confirmation argument, because a thaw unblocks a merge someone deliberately stopped.

Freezes, repository enrolment, and branch changes push state into GitHub. The routes behind them carry a per-principal bucket (by key id or user id) in front of the per-organisation one, and organisation creation is limited per signed-in user. An MCP tool call charges the bucket exactly as a REST request does, so driving a write through `POST /mcp` costs what the route costs. Agents retry harder than people do, and the write path into GitHub has a real ceiling behind it.

not allowedA tripped limit is a 429 with a `Retry-After`, never a silently dropped write and never a partial freeze reported as applied. Lifting a freeze is exempt from the per-principal bucket on both surfaces, so one runaway client can never spend the way out. It is not exempt from the organisation’s own ceiling, which is charged first, so a lift can still answer 429. Wait out the `Retry-After` rather than reading it as a freeze that cannot be lifted. The limits are modest and tunable, and we do not quote a number here, because the number is an operational setting rather than a promise. Read `RateLimit-Remaining` off a credentialled `/v1` response instead. The two credential-free routes carry no rate headers.

Never start or lift a freeze on your own judgement.

A freeze blocks every engineer in the organisation. A thaw unblocks a merge somebody deliberately stopped. Both need an explicit human instruction, and a reason is required on the record either way.

Never enable a repository a human did not name.

Private repositories are the billable unit. Enabling one silently is a charge nobody agreed to, so no route, tool, or command auto-enables. Ask, then enable exactly what was named.

Never read "the API was unreachable" as "not frozen".

The deploy gate fails closed on purpose. An error is an error; report it as one rather than resolving the ambiguity in the direction that lets a deploy through.

Never report a branch as protected because enrolment succeeded.

Enrolment and enforcement are two different facts. Read the verification fields and repeat what GitHub actually said, including when it said it could not tell you.