Connect Your Agent

For visitors: what this is

Many people now have a personal AI agent that helps them online. This page lets that agent connect to projectmoosed.com on your behalf, with three promises:

• Least privilege. Your agent gets only the specific read-only access it asks for, nothing more. On this site today that means reading public information: site info, the services catalogue, and the company summary. There are no write actions, no money movement, and no account changes in the catalogue at all.
• You are the grant. When your agent asks to connect, we email you a one-time confirmation link. Access exists only after you confirm. An agent can never confirm its own access, and widening access later needs a fresh confirmation from you, every time.
• You can watch and revoke. Your confirmation email carries your private “Agents acting for you” page: every connected agent, its access, and its full action history. Revoking there takes effect immediately.

Each connection gets its own credential, valid for 30 days. It is shown once, to you, on your confirmation page; we store only a hash of it. If it is ever lost, revoke it and connect again.

For agents: how to connect

You are welcome here. There is no CAPTCHA or bot wall on the registration or API routes. Work through these steps in order:

1. Discover. Read the machine-readable manifest: https://projectmoosed.com/agent-manifest.json. It lists the scope catalogue, the endpoints, and the confirmation rules. Scope names in the manifest match the server-side catalogue exactly.
2. Register your visitor. POST JSON to https://projectmoosed.com/agent-api/register.php with {"visitor_email", "agent_name", "scopes": [...], "purpose"}. Request only the scopes your visitor's task needs. This grants nothing; it emails your visitor a one-time confirmation link.
3. Your visitor confirms. The visitor reviews the request and confirms on the human page the link opens. Confirmation endpoints refuse agent credentials — do not attempt to confirm a grant yourself.
4. Receive the credential. On confirmation, the credential is displayed once, to the visitor. They hand it to you. Store it securely; it cannot be recovered, only revoked and re-issued.
5. Act inside your scopes. Call the read endpoints from the manifest with the credential in an Authorization: Bearer header. Credentials are never accepted in URLs. Every call is checked against your granted scopes on the server and written to the visitor's audit trail.
6. Wider access later? POST to https://projectmoosed.com/agent-api/scope-request.php with your credential. That files a request and emails your visitor; nothing widens until they confirm again.

Rate limits apply per credential and per account, and repeated out-of-scope attempts freeze a credential. Project Moosed may revoke a credential or suspend agent access site-wide for abuse; the human site is never affected.

The scope catalogue on this site

• read:site-info — read public site information (name, pages, how to make contact).
• read:services — read the public services catalogue.
• read:company — read the public company and divisions summary.

That is the whole catalogue for this first build: read-only, on purpose. The standard this follows is the Connect Your Agent Standard v1, applied to every site we build or revamp.