# agents.txt: AI agent access policy for Self-sown # https://self-sown.com # Last updated: 2026-09-29 # Self-sown welcomes well-behaved autonomous agents. This file describes how # agents should access the site and its API. It complements /robots.txt and # /llms.txt. Contact: https://self-sown.com/contact Policy: https://self-sown.com/about Source: https://github.com/shopstr-eng/self-sown # --- Discovery --------------------------------------------------------------- LLMs: https://self-sown.com/llms.txt LLMs-Full: https://self-sown.com/llms-full.txt Skill: https://self-sown.com/skill.md OpenAPI: https://self-sown.com/openapi.json UCP: https://self-sown.com/.well-known/ucp MCP: https://self-sown.com/.well-known/mcp.json CLI: https://www.npmjs.com/package/@self-sown/cli Protected-Resource: https://self-sown.com/.well-known/oauth-protected-resource Authorization-Server: https://self-sown.com/.well-known/oauth-authorization-server Agent-Auth: https://self-sown.com/auth.md Agent-Card: https://self-sown.com/.well-known/agent-card.json L402: https://self-sown.com/.well-known/l402.json x402: https://self-sown.com/.well-known/x402.json Web-Bot-Auth: https://self-sown.com/.well-known/http-message-signatures-directory Feed: https://self-sown.com/rss.xml Sitemap: https://self-sown.com/sitemap.xml # --- Programmatic access (preferred) ----------------------------------------- # Use the Model Context Protocol server for structured, reliable access instead # of scraping HTML. MCP-Endpoint: https://self-sown.com/api/mcp MCP-Transport: JSON-RPC 2.0 over Streamable HTTP Auth: Bearer API key (prefix "ss_"), two audiences: shopping (free for any pubkey) and seller (requires an active membership) Scopes: machine-readable in the Protected-Resource metadata (RFC 9728 scopes_supported) and the OpenAPI x-scopes extension Self-Serve: free tier with no sales contact; 30-day Herd trial for new sellers; create keys at https://self-sown.com/settings/api-keys or bootstrap an agent account + key via POST https://self-sown.com/api/mcp/onboard # --- Universal Commerce Protocol (UCP) -------------------------------------- # A REST surface for AI shopping agents (the UCP standard backed by Google and # Shopify), layered over the same catalog and order pipeline as MCP. The # discovery profile advertises a catalog capability and a checkout capability, # each with its JSON Schema. Catalog reads are open; creating a checkout session # requires a free shopping key or a seller key with purchase access (same "ss_" keys as MCP). UCP-Discovery: https://self-sown.com/.well-known/ucp UCP-Catalog-Search: https://self-sown.com/api/ucp/catalog/search UCP-Catalog-Lookup: https://self-sown.com/api/ucp/catalog/lookup UCP-Checkout-Sessions: https://self-sown.com/api/ucp/checkout/sessions # --- CLI --------------------------------------------------------------------- # Official zero-dependency terminal client for agents without an MCP runtime. # Wraps the public UCP catalog endpoints and the Bearer-authed checkout # session lifecycle; `onboard` mints a free shopping API key. # npx @self-sown/cli onboard --name --save # npx @self-sown/cli search "raw milk" # npx @self-sown/cli checkout create --product --quantity 1 # Source: https://github.com/shopstr-eng/self-sown/tree/main/packages/cli # --- Allowed actions --------------------------------------------------------- Allow: browse and search product listings Allow: read seller profiles, reviews, and payment methods Allow: place orders and check order status (shopping key or seller key with purchase access required) Allow: manage your own listings, profile, and stall (full_access key required) Allow: content negotiation via Accept: text/markdown | application/json | text/plain # --- Disallowed -------------------------------------------------------------- Disallow: /api/ # except the documented MCP and discovery endpoints Disallow: /settings/ Disallow: /onboarding/ Disallow: /auth/ Disallow: /wallet/ Disallow: scraping encrypted order or message content (it is end-to-end encrypted) # --- Rate limits ------------------------------------------------------------- # Limits are advisory and enforced per IP and per API key. Responses include # standard RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset headers. # Back off on HTTP 429 and respect the Retry-After header. Rate-Limit: 600 requests/minute per IP on /api/mcp Rate-Limit: 300 requests/minute per API key on /api/mcp Rate-Limit: 30 requests/minute per IP for unauthenticated MCP initialize (5 concurrent sessions) # Other throttled endpoints declare their own budgets in their RateLimit-* # response headers; absence of numeric headers on normal responses means the # endpoint is not throttled. # --- API evolution ----------------------------------------------------------- # The API is semantically versioned: every /api/* response carries an # API-Version header, and you may pin a major version with the API-Version # request header (unsupported pins fail closed with 400 unsupported_api_version). # Deprecated operations carry a Deprecation response header and, once a removal # date is set, a Sunset header (RFC 8594) at least 90 days before removal. # Full policy: https://self-sown.com/developers#versioning # --- Identity ---------------------------------------------------------------- # Identify your agent with a descriptive User-Agent. Decentralized identity is # available via Nostr NIP-05 at /.well-known/nostr.json. # # Web Bot Auth (verifiable agent identity): Self-sown publishes its HTTP # Message Signature public keys (Ed25519, JWK Set) at # /.well-known/http-message-signatures-directory. Keys are identified by their # RFC 7638 JWK thumbprint (kid). Agents that sign requests with HTTP Message # Signatures (RFC 9421) may advertise their own key directory via the # Signature-Agent header so we can verify them in return. Web-Bot-Auth-Directory: https://self-sown.com/.well-known/http-message-signatures-directory Signature-Algorithm: ed25519