Developer & Agent API: ucalyptus.me

This is the developer portal for ucalyptus.me, the machine-readable API surface for AI agents and developers. > For agents: the full contract is the OpenAPI 3.1 spec. The plain-language auth flow is in auth.md. Public token-verification keys are at /.well-known/jwks.json.

Quick reference

Resource URL Type
OpenAPI 3.1 spec /openapi.json application/json
Auth guide (human + agent) /auth.md text/markdown
API catalog (RFC 9727) /.well-known/api-catalog application/linkset+json
A2A agent card /.well-known/agent-card.json application/json
MCP manifest /.well-known/mcp.json application/json
Agent manifest /.well-known/agent.json application/json
OAuth authorization server /.well-known/oauth-authorization-server RFC 8414
OAuth protected resource /.well-known/oauth-protected-resource RFC 9728
JWKS (public keys) /.well-known/jwks.json application/json
Structured site data /api/site.json application/json
Structured FAQ /ai/faq.json application/json
llms.txt / llms-full.txt /llms.txt ยท /llms-full.txt text/plain
AGENTS.md /AGENTS.md text/markdown

Authentication quickstart

The API uses OAuth 2.0 client_credentials (RFC 6749 ยง4.4). It is stateless and anonymous. Any agent can register. There are no user accounts; registration proves a client exists, not who it is. Client secrets are HMAC-derived, never stored. Tokens are ES256 JWTs valid for 15 minutes.

1. Register a client

curl -sX POST https://ucalyptus.me/oauth/register \
  -H 'content-type: application/json' \
  -d '{"client_name":"my-agent"}'
# -> { "client_id": "...", "client_secret": "...", ... }

2. Get a token

curl -sX POST https://ucalyptus.me/oauth/token \
  -H 'content-type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'client_secret=YOUR_CLIENT_SECRET'
# -> { "access_token": "<ES256 JWT>", "token_type": "Bearer", "expires_in": 900, "scope": "read:extended" }

3. Call the gated endpoint

curl -s https://ucalyptus.me/api/agent/full-profile \
  -H 'authorization: Bearer YOUR_ACCESS_TOKEN'
# 200 -> extended CV/availability JSON
# 401 -> { "error": "invalid_token", ... }  (with a WWW-Authenticate header
#          pointing at /.well-known/oauth-protected-resource)

All error responses are JSON with an error and error_description, so agents never have to parse an HTML error page.

Endpoints

Method Path Auth Description
POST /oauth/register none Register an anonymous client.
POST /oauth/token client secret Exchange credentials for a 15-min Bearer token.
GET /api/agent/full-profile Bearer (read:extended) Extended CV + availability profile.

WebMCP (browser agents)

Every page on this site registers read-only WebMCP tools via document.modelContext (Chrome 149+ spec, with a navigator.modelContext fallback): get_site_overview, search_content, list_content, get_content_item, get_cv_summary, get_contact_info, get_faq, and the OAuth-gated get_full_profile. Tool descriptors are in /.well-known/mcp.json and /.well-known/agent-card.json.

Questions

Email [email protected] or open a discussion on GitHub.