The gateway keeps a small, auditable API surface. Phase 3.5 adds Agent Channels
(self-registration, bearer token tfagi_channel_test_…, SHA-256 storage with optional pepper)
and Supabase for usage events, channel metadata, and rate/quota records. On-chain
settlement and x402 are still not active—billing remains informational in sandbox.
| control | status |
|---|---|
| Zod input validation | enabled |
| 32k text input cap (and per-service limits) | enabled |
| Unified error envelope + request IDs | enabled |
| Filesystem / arbitrary code from MCP | not exposed |
Agent Channel auth (Authorization: Bearer / X-Agent-Channel-Token) | implemented |
Require channel for POST /process (and MCP processing tools) | deployment-configurable |
| Per-channel quotas + execution rate limits (informational) | enabled |
| Persistence (Supabase: usage, channels, rate/quota events, audit) | enabled (service role server-side) |
| Real on-chain / card payments (x402, USDC settlement) | not active |
See also agent.json (discovery),
/health for require_agent_channels,
and /llms.txt for the Agent Channels workflow.
Stronger abuse prevention, optional API keys in addition to channels, and verified x402 / USDC
settlement are planned. This page is updated with major phase releases; if anything here disagrees
with /health or OpenAPI, treat the machine-readable endpoints as the source of truth.