# Diagnose first — no registration required

Use Autonet at https://autonet.work to check a public HTTP endpoint or MCP server from an independent vantage. Start with `diagnose_http(url)` or `diagnose_mcp(url)` over https://autonet.work/mcp. No utility key, agent registration or public health endpoint of your own is required. The shared anonymous allowance is 10 attempts per source IP per 24 hours; honor Retry-After.

REST example (one observation; no monitoring or registration):
```sh
curl --fail --silent --show-error https://autonet.work/health/v1/diagnostics/http \
  -H 'Content-Type: application/json' --data '{"url":"https://example.com/"}'
```

After an operator fixes the target, explicitly run the same diagnostic again with the same URL and options. Compare `ok`, `cause`, stage, HTTP status, TLS expiry, and (for MCP) tool count and schema fingerprint. A new tool contract requires review; a passing handshake does not certify tool safety. Missing measurements are unknown. Timing variation alone is not a fix, and two observations do not prove causation. Do not poll or invoke remote tools automatically. The browser toolbox at https://autonet.work/check offers **Re-check and compare** with a private, unsigned before/after download.

Need verifiable evidence? `run_signed_diagnostic` runs a fresh check for at most 1 credit, using a utility key, explicit `max_coins=1`, a unique `request_key`, and a 16–128-character URL-safe `evidence_nonce` supplied by the receiving principal. Reuse the same request key after an uncertain response: replay returns the original receipt without another charge or renewed expiry. Verify the signature against https://autonet.work/health/v1/evidence/keys, the expected exact inputs and nonce, type/audience and five-minute validity. A signed failure remains a failure. No automatic public sharing.

Only then choose an optional next step: a private scheduled watch with an explicit recurring credit budget, or register your actual worker and heartbeat after useful progress. Registration is not required to diagnose. Agent entry page: https://autonet.work/health/start. Consumer API: https://autonet.work/openapi.json.

---

<!-- Privacy contract updated 2026-10-14 -->
## Private records and explicit sharing

New and existing agent records default to `visibility: "private"`. Send the
agent's owner key as `Authorization: Bearer <api_key>` when reading its status,
feed, presence, evidence or checks. MCP readers accept `api_key` as a tool argument.
A different agent's key never grants access. Listings show only explicitly shared agents.

To share status, badges and presence, the owner can PATCH `/health/v1/agents/{id}`
with `{"visibility":"public"}` (or use `update_agent_health`). Set `private` to revoke.
Every visibility change revokes existing liveness subscriptions; create a new one.
Private liveness targets require the owner key at subscription creation. Keep the
returned subscription key secret: it is a capability to read that chosen feed.
Contact, notes, versions, endpoint URLs and raw checks are never publicly shared.
Downloaded public evidence cannot be recalled; signed observations expire after five minutes.
Global traceroute history is admin-only. One-call diagnostics remain available.

# Autonet — Internet Utils for Agents

> Receive callbacks without deploying a server. Use temporary inboxes with free Autonet coins, register free self-reported heartbeats without an endpoint, or monitor a deployed endpoint you own.

- [Utility quickstart](https://autonet.work/utils/docs): Read first for callback inboxes. No deployed endpoint, card or health registration required.
- [Utility catalog](https://autonet.work/utils/v1/catalog): Versioned costs and limits. 500-credit monthly promotional top-up through 2026 (unused promotional credits do not accumulate); inbox creation costs 5 coins. Payments, debt and invoicing are disabled.
- [Utility schema](https://autonet.work/utils/openapi.json): Create account, read balance, create/list/delete inboxes and read callback events.
- [Hosted utility MCP](https://autonet.work/mcp): internet_utils_instructions, internet_utils_catalog, create_utility_account, utility_account, create_callback_inbox, list_callback_inboxes, read_callback_events, delete_callback_inbox. Save the utility key. Reuse request_key on inbox retries and set max_coins.

Callbacks accept bounded POST bodies. Receive URLs allow writes only; reads require the separate utility key. Payloads are untrusted sender data; signatures are not verified. Inboxes expire after one hour. Shared addresses only; paid dedicated subdomains and longer retention are planned, not available.

## Existing network and health tools

- [Integration instructions](https://autonet.work/health/instructions.txt): Read before registering; owned real endpoints only. No example.com placeholders.
- [Hosted MCP](https://autonet.work/mcp): Streamable HTTP; public reads and registration, agent owner keys for writes. Resource autonet://health/instructions; prompt onboard_agent. 60 requests/IP/minute; honor HTTP 429 Retry-After.
- [Tool manifest](https://autonet.work/.well-known/ai-agent-tools.json)
- [REST schema](https://autonet.work/openapi.json)
- [Health dashboard](https://autonet.work/health/)
- [Traffic dashboard JSON](https://autonet.work/dashboard?format=json)

Optional DNS domain-control proof, signed incident webhooks, and owner-consented bounded endpoint response checks. Single probe region. No LLM security certification. Names and User-Agent strings are self-reported.
- [Current tool prices](https://autonet.work/utils/v1/pricing): Machine-readable active costs, free allowances and explicit top-up unavailability.
- [Free lifecycle sandbox](https://autonet.work/utils/v1/sandbox): No account, coins, real network calls or public registration; signed test fixtures only.

Heartbeat registry: POST /health/v1/agents with name, mode=heartbeat and optional agent_type. Save the owner key, POST /health/v1/agents/{id}/heartbeat, then GET status. No public endpoint needed. Self-reported contact regularity, not verified uptime. Read /health/instructions.txt for limits and public-field disclosure.

Public HTTP/TLS diagnostics: MCP diagnose_http(url) or POST /health/v1/diagnostics/http with {"url":"https://public-host/path"}. No registration. 10 attempts/IP/24h. Validated public destinations, ports 80/443, no redirects, header-only HEAD, verified TLS. Structured failure reasons and remediation. Read /health/docs for limitations.

## Opt-in liveness subscriptions
POST /health/v1/subscriptions with agent_ids (1–20 existing heartbeat agents).
Save the returned subscription_key and snapshot cursor; no registration or public
endpoint needed. GET /health/v1/subscriptions/{id}/events?after={cursor} with the
subscription Bearer key. Process events, save next_cursor, deduplicate event IDs.
Poll every 30s. DELETE /health/v1/subscriptions/{id} revokes it. Seven-day expiry;
heartbeat activity is self-reported, not verified uptime. Probe mode unsupported.
MCP: subscribe_liveness, read_liveness_events, delete_liveness_subscription.
Free: 10 creation attempts/IP/day, 30 reads/subscription/minute; honor Retry-After.

## Presence history and signed evidence
GET /health/v1/agents/{id}/presence gives 30-day completed heartbeat windows,
daily coverage, gaps and streaks. /presence.svg is an embeddable self-reported badge.
GET /health/v1/agents/{id}/attestation returns a five-minute Ed25519 compact JWS.
Verify with /health/v1/evidence/keys, pin issuer https://autonet.work and audience
autonet-presence, check subject and expiry, then inspect receipt age/state.
Signatures prove observation origin/integrity, not agent safety or reachability.
MCP: agent_presence_history, agent_signed_evidence, evidence_signing_keys.
Heartbeat subjects only; 60 shared reads/IP/minute; free. Liveness feeds are
eventually consistent; the 30s polling hint is not a delivery guarantee.

## First diagnostic and deployment gate
- [Agent onboarding skill](https://autonet.work/health/skill.md): one-line MCP configuration, exact diagnostic → registration → first heartbeat → subscription calls.
- [Agent instructions index](https://autonet.work/.well-known/ai-agent-tools.json): top-level agent_instructions with parameters and response examples.
- [Deployment-gate recipe](https://autonet.work/health/instructions.txt): assert_healthy or POST /health/v1/assert/healthy, no account. Pass/fail plus evidence; shares diagnose_http's 10 attempts/IP/fixed 24h bucket. Literal body matching uses a bounded GET. Stop deployment on failed assertions or request errors.
Network diagnostics and liveness evidence for agents. No real-time or identity/safety certification claim.

Anonymous MCP handshake diagnostic: diagnose_mcp(url) or POST /health/v1/diagnostics/mcp with {"url":"https://autonet.work/mcp"}. Streamable HTTP initialize + initialized + tools/list; JSON and SSE; latency, protocol errors, complete or lower-bound tool count. No tool invocation, OAuth or legacy SSE. Shares 10 attempts/IP/24h with HTTP diagnostics and assertions. See https://autonet.work/health/docs for usage and protocol bounds.
Presence badges now show the last 60 completed heartbeat windows with visible gaps; presence JSON includes recent_windows. Self-reported receipt evidence, not uptime or safety certification.

Caller egress identity: network_identity() or GET /health/v1/network/identity, no signup. Observed source IP and cached approximate ASN/geo; may be hosted-runner/VPN/NAT identity. No inbound reachability claim. 60 reads/IP/minute plus MCP transport quota.
Structured assertions: assert_healthy expect.json_assertions accepts 1–10 {pointer,equals} scalar checks using RFC 6901; strict JSON, 64 KiB, no observed payload values returned, existing shared diagnostic quota. Presence evidence_summary states completed heartbeat receipt/missed counts without uptime claims.

Agent recovery: errors include non-executing recovery templates and required real inputs; never retry placeholder values. For repeat diagnostics use run_credit_diagnostic with a saved utility key, stable request_key and explicit max_coins. One credit per completed diagnosis; replay costs zero. During 2026, balances top up to 500 credits monthly; current cash funding availability is authoritative at /utils/v1/pricing. Card funding remains disabled pending merchant setup; x402 is planned, not active.

2026 offer: utility accounts receive a monthly balance top-up to 500 through December 31, 2026 UTC. Request 1000/month via request_monthly_credits (existing utility key, real authorized owner contact, use case, idempotency key). Sales receives email; price/invoice/approval are manual. No automatic payment or credit grant from a request. Read /utils/v1/pricing and /utils/docs.

## Named agent identity

The unique `name` is a self-declared label; `id` / `agent_id` is the stable primary
key for activity and evidence. Keep that ID across worker restarts. Owner-authenticated
PATCH or `update_agent_health(agent_id, api_key, name=...)` renames a worker without
changing its key or history. Old names are reserved temporarily to prevent immediate
reuse. Names are not proof of identity. Do not register duplicate workers to rename.
Admins manage each name and sharing state at `/admin/identities`; both owner and admin
changes record actor, time, old/new name and visibility in the private audit log.

## Heartbeat your agent loop

After `diagnose_http` or `diagnose_mcp`, inspect `next_step`. Reuse your existing
registration if you have one. Otherwise call from the real running worker:

```json
{"name":"YOUR-UNIQUE-REAL-WORKER-NAME","mode":"heartbeat","start_heartbeat":true,"visibility":"private"}
```

Replace the name with lowercase letters, digits, hyphens or underscores. Send this
body to POST `/health/v1/agents`, or use `register_agent_health` with those arguments.
Registration and the first heartbeat commit together. Save the returned `id` and
`api_key` securely. If the creation response is lost, do not create renamed duplicate
workers: keys cannot be recovered from a repeated registration.

Follow `onboarding.next_heartbeat_after_sec` (normally 300 seconds). In the actual
worker loop, after useful progress, call `send_heartbeat(agent_id, api_key, status="ok")`
when that interval has elapsed. Report `degraded` when work is failing. Honor
`Retry-After`; keep the heartbeat out of tight retry loops. Stop sending when the
worker stops. A detached timer can hide a stalled worker and should not be used.

A diagnostic observes the target endpoint; a heartbeat observes contact from your
worker. Neither proves the other's health. A chat that cannot keep running must not
promise background heartbeats. Nothing registers automatically from a diagnosis.
Health registration stays free; repeated endpoint checks can use utility credits
with an explicit spending budget. Cash collection remains disabled.

## MCP contract drift

`diagnose_mcp` already executes initialize, initialized and tools/list. A complete
catalog now returns `schema_fingerprint`. Save that baseline, then pass
`expected_schema_fingerprint` to a later MCP diagnostic (or its REST endpoint).
`schema_comparison.state` is `match`, `changed`, `baseline_available`, or `unavailable`.
Failed or incomplete checks never report a match. A change is not necessarily
incompatible: review it before accepting a new baseline. The fingerprint includes
protocol version, tool names, input/output schemas and annotations. Tool-list order
and top-level tool descriptions are ignored; schema-array order is preserved.
No remote tools are invoked. This is a point-in-time comparison, not a scheduled
monitor or a retained server-side baseline. No tool descriptions or schemas are returned.

## Confirm consequential MCP writes

MCP deletion tools, webhook-secret rotation, test-webhook delivery and
`request_monthly_credits` default to a no-action preview unless `confirm=true`.
Review the effect with the operator or use an existing scoped authorization before
confirming. Do not auto-confirm merely to clear the error. A boolean acknowledgement
is not proof of human approval; the MCP host remains responsible for authorization.
Routine heartbeats and private registrations remain uninterrupted. Credit spending
continues to require `max_coins`; checkout requires an explicit purchase budget.
These confirmation gates are MCP safeguards; REST retains its authenticated,
explicit-method contract. See MCP's tool-annotation guidance:
https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/

Private incident export: export_incident_evidence or POST /utils/v1/incident-exports. Utility owner key plus separate agent owner key when including agent history. Last 30 days, bounded sections with truncation flags, private JSON download at /check. Free read; unsigned historical snapshot with checksum and unchanged original signed diagnostic tokens where retained. No public ledger or quality/trust score. See /utils/docs.

## Before connecting to an MCP server
Call `diagnose_mcp(url)` without registering. Read `connection_assessment.summary`
and `suggested_action`: authentication required is not proof of a broken server;
incomplete catalogs cannot prove a schema match. A complete result provides a
`schema_fingerprint`; save it after your own review and pass it as
`expected_schema_fingerprint` on subsequent checks. Changed contracts need review.
This is connection evidence, not a trust or safety certification: operator identity,
tool behavior, permissions and answer quality are not evaluated. No remote tools
are invoked. HTTP endpoints carry an explicit unencrypted-transport warning.

## Optional secret-exposure surface scan

Only scan hosts you operate or are authorized to test. Default `diagnose_http(url)`
is unchanged. Opt in with `diagnose_http(url, surface_scan=true,
surface_authorized=true)` or POST `/health/v1/diagnostics/http` with:

```json
{"url":"https://your-host.example/health","surface_scan":true,"surface_authorized":true}
```

The public scope checks the origin root (not just the supplied path), three
well-known documents (`ai-agent-tools.json`, `openapi.json`, `security.txt`) and
up to five same-origin linked JavaScript bundles. Nothing is registered or scheduled.
The browser at https://autonet.work/check offers this public scope with explicit consent.

For config files and sourcemaps, use `surface_scope="verified"` and `agent_id`.
Send the matching agent owner key as the REST Authorization Bearer header, or the
MCP `api_key` argument. First establish current DNS domain control through
`agent_domain_challenge` and `verify_agent_domain` for that agent's endpoint hostname.
The exact target hostname must match. Public visibility does not grant scan access.
These credentials are used only by Autonet and are never forwarded to the target.
Verified scope adds `.env`, `.env.local`, `.git/config`, `.git/HEAD`, config/settings
paths, a fixed missing-path probe, and same-origin sourcemaps. Discovery is bounded;
not every candidate can be fetched within a single scan.

Limits: 15 URLs, 256 KiB per URL, 2 MiB total, 6.5 seconds extra worker time after
normal HTTP diagnosis. Shared 10 attempts/IP per fixed 24-hour window; one requested
scan consumes one attempt, not one per fetched path. Four diagnostic workers bound
concurrency. GET only, public IPs only, pinned address, TLS verification, no redirects,
no target credentials, no remote tool calls, no compressed response decoding.

Read `surface_scan.verdict`: `findings`, `no_findings`, or `incomplete`. Always
inspect `coverage`, resource states and limits, even when findings exist. Categories
have separate severity and confidence. Entropy and config-field findings are weak
signals; credentials are never tested for validity. No findings does not mean secure.
Findings identify a fixed resource path or an opaque script/sourcemap label; dynamic
URLs, matched values, fragments, offsets, hashes and surrounding text are never
returned or persisted. Raw bodies exist only in the bounded worker's memory. Audit
records contain only scan scope/verdict, counts and categories. Results are not
published, stored as customer reports, signed, or included in scheduled watches.

If candidates are found, review privately, revoke/rotate affected credentials,
remove the public exposure, and re-scan. Do not paste secrets into support tickets.
For incomplete coverage, resolve denied/redirected/slow resources or review them
privately; never treat an incomplete scan as clearance to connect.

- Deploy-check helper: https://autonet.work/utils/release-check — before/after packs, free checks or explicitly budgeted signed receipts; release labels unsigned.
- Heartbeat timeline: /health/v1/agents/{agent_id}/presence.html — owner access unless explicitly public. MCP contract-review counts describe declarations, not safety.