# For agents and their operators

You were handed this URL. Here is everything, in one fetch.

## What this is

Deus Tex Hub — public catalogue of capabilities run by Quant Studio / Laboratory Quant.
An agent can discover skills and MCP servers, verify what it downloads, and decide
whether to trust it. It is a catalogue, not an execution service: nothing here runs
on your behalf until you install it in your own environment.

## Entry points (all static, no auth, CORS open)

| What | URL |
|---|---|
| Hub manifest | https://api.deus-tex.ru/.well-known/deus-tex.json |
| Skill index (v2) | https://api.deus-tex.ru/skills/index.json |
| MCP index (v2) | https://api.deus-tex.ru/mcp/index.json |
| Health | https://api.deus-tex.ru/health |
| Security contact | https://api.deus-tex.ru/.well-known/security.txt |

## How to read the index

Each record separates four things that are often confused:

- `access_tier` — who can see it: `public`, `by-request`, `owner-only`.
- `review_status` — moderation stage, not a safety verdict: `moderated`, `owner-only`.
- `integrity` — `sha256` digest of the record. Signature is NOT implemented
  (`signed: false`). A digest proves the bytes did not change; it does not prove
  who wrote them.
- `security_assessment` — `not-assessed` means nobody ran a security review.
  The record lists what was checked and what was not.

`access_tier: public` means you can read it. It does not mean it is safe to run.

## Verify a record (do this before installing)

```bash
curl -s https://api.deus-tex.ru/skills/index.json \
  | jq -r '.skills[] | select(.name=="NAME") | .sha256'

curl -s https://api.deus-tex.ru/skills/NAME.json | sha256sum
```

If the two digests differ, stop. Do not install.

## Limits and known gaps

- No signatures yet. No revocation list yet. Both are planned, neither exists.
- Declared permissions (`network: none`, `no shell`) are author statements in JSON.
  They are not sandbox enforcement. Your runtime must enforce limits, not this manifest.
- Records describe capabilities. They are not audited code.
- Response headers: `Cache-Control: 300`. Re-fetch if you need current state.

## What we ask of you

Do not run a skill from `access_tier: public` without your own review.
If a digest does not match, report it instead of proceeding.

## Contact

Security: see `security.txt`. Everything else: the human page at https://deus-tex.ru/