Agent Tool Forge

What it is

Agent Tool Forge is a safety-first A2MCP compiler that turns an OpenAPI 3.x document or service idea into a downloadable, testable agent-service package.

30-second judge path

1. Open the live Judge Console: https://hermes-agent.tail3ab78.ts.net/

2. Run Weather API and verify decision: allow, imported operation: 1, and a downloadable ZIP.

3. Run Token Risk and verify decision: allow_with_review.

4. Run Prompt Injection and verify decision: block with no artifact download.

5. Review 33 passing tests and the latest successful GitHub CI.

Generated package

• OpenAPI and JSON input/output contracts

• Read-only Python handler scaffold

• Security policy and provenance report

• Positive, negative, abuse, and conformance tests

• Opaque, time-limited ZIP artifact

Safety by construction

All user-controlled fields are inspected. Secret-like values are redacted before generation. Prompt-injection patterns block publication assets. Wallet, transaction, PII, financial, and security-sensitive requests require review, while generated services remain read-only by default.

Live proof

Judge Console: https://hermes-agent.tail3ab78.ts.net/

Public API: https://hermes-agent.tail3ab78.ts.net/forge

Health: https://hermes-agent.tail3ab78.ts.net/health

OpenAPI: https://hermes-agent.tail3ab78.ts.net/openapi.json

Source: https://github.com/TecSong/agent-tool-forge

CI: https://github.com/TecSong/agent-tool-forge/actions/runs/29983946153

Commit: 8804401079ef3c53b525a28efad8d83cbca7f336

OKX.AI Agent ID: 5820

Billing and listing status

The public endpoint currently runs in free HTTP 200 mode. An opt-in x402 v2 adapter is implemented and tested, but no payment is collected until paid configuration is explicitly enabled. Agent 5820 remains under OKX.AI listing review.

• Built and deployed a production-supervised public HTTPS A2MCP service with Gunicorn and Tailscale Funnel.

• Added a responsive Judge Console with three one-click, evidence-first paths: Weather allow, Token Risk allow_with_review, and Prompt Injection block.

• The Console exposes safety findings, imported operations, artifact digest, ZIP file tree, and a validated download path.

• Implemented OpenAPI 3.x import and operation extraction.

• Added secret redaction, prompt-injection blocking, and wallet/transaction review gates.

• Added bounded artifact storage, rate/concurrency limits, strict JSON validation, hardened HTTP responses, CSP, and same-origin static assets.

• Added marketplace-compatible GET, HEAD, and empty-POST discovery probes for /forge.

• Generated downloadable ZIP packages with contracts, handler scaffold, tests, security policy, and provenance.

• Validated 33 unit, security, billing, artifact, UI-route, and HTTP integration tests.

• Verified GitHub CI run 29983946153 for commit 8804401: Python 3.10, Python 3.12, and production container all passed.

• Independently reviewed and fixed async-result races and artifact-download URL validation.

• Implemented and tested an optional fail-closed x402 v2 payment adapter; the current public endpoint remains free and has collected no payment.

• Registered OKX.AI Agent ID 5820; marketplace listing remains under review.

Bootstrapped and self-funded. No external funding has been raised.