QVeris changelog

version

0.15.0 → 0.15.1

https://qveris.ai/llms.txt

− - Hosted MCP (recommended for remote-capable MCP clients): open /hosted-mcp on this site for the correct Streamable HTTP endpoint and Bearer authentication setup — no local process, Node.js, or package install− - CLI v0.11.3 (recommended for shell-capable agents): npm install -g @qverisai/cli — no upfront catalog schemas and structured output for on-demand discovery− - Local MCP Server v0.14.6 (fallback): npx @qverisai/mcp — for stdio-only IDE integrations− - TypeScript SDK v0.9.0: npm install @qverisai/sdk− - Python SDK v0.8.0: pip install qveris− ## Anonymous trial registration (recommended for agents)− - If you do not yet have a human-verified key, register anonymously:− - `qveris login` — interactive login with browser-based key retrieval when available+ ## Agent quick start+ Read [Executable Agent quick start](/plugins/agent.md) for a ready-to-run public Discover request and the explicit bounded trial continuation. Use existing credentials first; reading never creates an identity.+ ## Authentication choices+ Use OAuth in a compatible Hosted MCP client or `qveris auth login`; keep an existing API key for Bearer/SDK/CLI access. For an Agent with no credentials, explicit public read-only REST supports Discover/Inspect only; registration is a separate explicit choice when a trial identity is needed. Discover is free; the default path is authenticated. Begin with one Discover; confirm real parameters and cost separately before Call.+ Quotes and response-size limits are not hard spending caps. Preserve original execution IDs/idempotency keys for unknown outcomes; reconcile with execution lookup, usage and final ledger records instead of replaying a paid Call. After changing identity, refresh identity and permissions. Refresh an old discovery context with Discover; for an already selected tool, recheck inputs, permissions and the quote.+ See [Authentication and trial lifecycle](/auth.md) for the current registration contract, one-time credentials, expiry and claim restrictions. Read `/api/v1/meta` for current availability, allowance and lifetime; the issued response is authoritative for `trial_credits` and `expires_at`. The legacy Agent claim API cannot merge into an existing formal account and does not sign the browser in. Browser claim uses a separate possession and account-verification flow. Never expose keys, tokens or claim+ ## Explicit public read-only REST+ Use a separate uncredentialed REST configuration with `X-Qveris-Access-Mode: public-readonly` only for `POST /search` and `POST /tools/by-ids`. No identity, grant or provider execution is created. Public results omit prices, balance and personal activity and include `public-readonly-v1`; the `pub_` context is correlation, never execution authority. See the [REST guide](/docs/rest-api) for limits and examples.+ Any Authorization, Cookie or session proof conflicts with public mode (`400 access_mode_conflict`), including bad/empty credentials and unrelated cookies. Never silently discard a configured credential. Browser HTTP must use `credentials: "omit"` without Authorization injection. Invalid mode/body returns `422`, oversized bodies `413`; ordinary `401` requires authentication, and `429` requires following `Retry-After` with bounded read retries. Do not auto-register or rotate credentials to evade l+ To upgrade, authenticate explicitly, preserve only selected tool/input intent, refresh Inspect, permissions and any necessary quote, then confirm cost. Do not use public context for Probe/Call or force another Discover for an already selected tool. Default Hosted MCP remains authenticated; local tool listing is not successful public Discover. Current CLI/SDK installation instructions do not imply a new mode; publish syntax only for a verified supporting release.+ ## Explicit read-only Hosted MCP+ The separate Hosted MCP path is `/mcp/readonly` by default, on the same Hosted MCP origin as the authenticated endpoint. Use the [MCP guide](/docs/mcp-server) for the correct endpoint. The default `/mcp` OAuth flow and valid-key fallback remain unchanged. Only canonical `discover` and `inspect` are available on the read-only path; no Probe, Call, audit/history, ledger, execution lookup, aliases or resources are exposed. This mode creates no account, trial grant or persistent MCP session.+ Use a separate uncredentialed remote connection. A present Origin must be explicitly allowed; native clients without Origin do not require browser-origin configuration. Authorization, Cookie, session/receipt proofs, query strings and any `Mcp-Session-Id` are rejected, including authenticated session IDs. Do not silently discard configured credentials. The endpoint accepts bounded JSON POST, not GET/SSE or DELETE; verify the client's behavior for this mode rather than assuming all remote clients + To Call, explicitly switch to an authenticated connection and recheck the selected tool's Inspect, permissions and any necessary quote before consent. Omit the old public search_id from authenticated Inspect and use its fresh result. Public context is not execution authority. The local MCP package keeps its authenticated setup. Separate explicit public clients are documented in the [CLI guide](/docs/cli) (`--public-read-only`), [TypeScript SDK guide](/docs/js-sdk) (`Qveris.publicReadOnly()`) and+ ## Bounded Agent trial and human handoff+ Humans should register/sign in on the website; [Agent instructions](/try) are a copyable handoff, not a new workbench. Prefer existing credentials. With explicit trial permission only, use published CLI 0.13.2 or later (`qveris auth trial --bounded`) on a supporting endpoint, or the explicit `/agent/trial/*` API in [Authentication and trial lifecycle](/auth.md#bounded-agent-trial-explicit-opt-in). Persist the 43-character possession proof privately before prepare/activate. Preparation grants no + Bounded admission requires fresh exact q≤G, confirmed D<G and D+q<2G, and one unresolved execution. This is not a hard final supplier-price cap or extra grant. Normal authenticated Calls use the issued API key and enforce its policy; the explicit quote/execute adapter additionally requires signed quote confirmation. Preserve original proof/operation after unknown outcomes; no new identity or replay. Anonymous trials exclude the model gateway.+ Use the safe [human claim page](/claim?mode=bounded), never a URL containing proof. Humans privately provide possession plus new-account email verification or target-account sign-in and explicit confirmation. Agent context must not collect their password, OTP or primary login token. Confirmed debt is deducted from formal credits after claim; insufficient balance leaves debt without blocking claim. Claim revokes the old key, grants no duplicate credits or login authority, and returns a recoverabl+ ## Browser trial and claim+ When a page exposes browser trial controls, starting issuance and confirming a Call are explicit user actions. Page reads and session preparation never issue credits. The browser receives no API key or legacy claim code. Use displayed issued allowance and expiry; do not hardcode an allowance or treat a later default change as another grant. Follow [Authentication and trial lifecycle](/auth.md); do not call private browser endpoints from an Agent or copy browser proofs into a CLI/SDK.+ Only supported exact-quote tools proceed after explicit review of tool, inputs and price. A changed input/identity, expired confirmation or higher fresh quote requires another review. Quote confirmation does not reserve funds or lock the price. Twice-allowance tolerance is an admission boundary, not doubled credits or an absolute provider-cost cap.+ A provider result is not final settlement. Preserve the original operation after unknown outcome, timeout or response loss and recover it through the page. Cancellation of waiting and a not-found lookup do not prove no execution. Never replay a paid Call, mint another operation or issue a replacement trial automatically.+ Browser claim requires trial possession plus verified email/new-account proof or the receiving existing account's authenticated identity. Confirmed debt does not block claim: existing formal credits repay it automatically and any shortfall remains ordinary debt, without a cash charge or platform write-off. Pending/unknown execution must be reconciled first. Repayment and remaining-debt receipt values include the receiving account's prior debt; transferred grant value is before repayment. Claim r+ - Hosted MCP (recommended for remote-capable MCP clients): open /hosted-mcp on this site for the correct Streamable HTTP endpoint and OAuth discovery or Bearer API-key fallback — no local process, Node.js, or package install+ - CLI v0.13.2 (recommended for shell-capable agents): npm install -g @qverisai/cli — no upfront catalog schemas and structured output for on-demand discovery+ - Local MCP Server v0.15.0 (fallback): npx @qverisai/mcp — for stdio-only IDE integrations+ - TypeScript SDK v0.10.0: npm install @qverisai/sdk+ - Python SDK v0.9.0: pip install qveris+ ## Legacy Agent API trial registration (explicit opt-in)+ - If you have neither an API key nor an OAuth session, explicitly opt in:+ - `qveris auth login` — OAuth Device Flow without copying a key; `qveris login` — masked API-key entry+ The following catalog applies to authenticated access. The explicit read-only Hosted MCP path lists only `discover` and `inspect`.+ - Authentication and trial lifecycle: https://qveris.ai/auth.md+ - Executable Agent quick start: https://qveris.ai/plugins/agent.md

file

absent → published

https://raw.githubusercontent.com/qverisai/qveris-agent-toolkit/HEAD/AGENTS.md

+ # QVeris Agent Toolkit+ Instructions for coding agents working in this repository. Start with the section relevant to the task; configuring an integration or calling a provider is not a prerequisite for editing or testing the toolkit.+ ## Sources of truth+ - [CONTRIBUTING.md](CONTRIBUTING.md): development and contribution workflow.+ - [agent/SETUP.md](agent/SETUP.md): installing and configuring an integration without exposing credentials.+ - [agent/GUIDELINES.md](agent/GUIDELINES.md): capability selection, parameters, billing, and recovery.+ - [skills/qveris/SKILL.md](skills/qveris/SKILL.md): MCP workflow; [skills/qveris-cli/SKILL.md](skills/qveris-cli/SKILL.md): CLI workflow.+ - [docs/openapi/qveris-public-api.openapi.json](docs/openapi/qveris-public-api.openapi.json): checked-in public API contract. Use the intended deployment's current OpenAPI and operation documentation when checking live service support.+ - [Official documentation](https://qveris.ai/docs) and [machine-readable index](https://qveris.ai/llms.txt): service entry points. Package manifests, release tags, and package guides determine client versions and supported client behavior; a website mirror can lag a release.+ Do not copy catalog counts, client versions, trial amounts, expiry periods, or prices into instructions as permanent guarantees. Check the relevant manifest, response, or current deployment documentation.+ ## Working in the repository+ The root package is a task runner, with no npm workspaces or root dependencies. Packages install and release independently.+ | Path | Purpose | Checks |+ | --- | --- | --- |+ | `packages/cli` | `@qverisai/cli`, shell integration | Node test runner, ESLint/Prettier |+ | `packages/mcp` | `@qverisai/mcp`, local stdio and HTTP server | TypeScript, Vitest |+ | `packages/js-sdk` | `@qverisai/sdk`, REST client and AI adapter | TypeScript, Vitest |+ | `packages/python-sdk` | `qveris`, Python client and agent integrations | uv, pytest, Ruff |+ | `packages/openclaw-qveris-plugin` | OpenClaw plugin | TypeScript, Vitest |+ | `agent/`, `skills/`, `recipes/`, `plugins/`, `ecosystem/` | Instructions, examples, integration assets | Script and contract checks |+ | `docs/`, `contracts/` | Localized guides and public contracts | Locale, API, and compatibility checks |+ Use Node from `.nvmrc` (`22.22.3`) for the full development toolchain and `uv` for Python. Package runtime compatibility is defined by each package's manifest; do not raise it merely to match the root development runtime.+ Full setup and validation, from the repository root:+ ```bash+ npm run install:all+ npm run lint+ npm run typecheck+ npm test+ npm run build+ ```+ For a scoped change, start with the affected checks:+ ```bash+ # CLI: no dependency installation needed for its Node tests+ npm --prefix packages/cli test+ # Example TypeScript package+ npm --prefix packages/mcp ci+ npm --prefix packages/mcp run typecheck+ npm --prefix packages/mcp test+ # Python+ cd packages/python-sdk

Showing the first 40 of each.

version

0.14.6 → 0.15.0

https://qveris.ai/llms.txt

− - Local MCP Server v0.14.5 (fallback): npx @qverisai/mcp — for stdio-only IDE integrations+ - Local MCP Server v0.14.6 (fallback): npx @qverisai/mcp — for stdio-only IDE integrations+ - `lookup_execution` — Read-only outcome lookup using a Call idempotency key

description

Discover, inspect, quote, and call external tools, with usage and final credit settlement audits → Professional data and tools for AI: find services, review scope, call them, and audit usage.

version

0.14.5 → 0.14.6

https://qveris.ai/llms.txt

− - TypeScript SDK v0.8.4: npm install @qverisai/sdk− - Python SDK v0.7.3: pip install qveris+ - TypeScript SDK v0.9.0: npm install @qverisai/sdk+ - Python SDK v0.8.0: pip install qveris