code wiki / (root) / nx_tools_api.nx

nx_tools_api.nx

buildroot/runtime/nx_tools_api.nx

97345 B1510 linesdepth 8pulls 23 transitivereach 9 importersview sourcekind librarytopic tools
docsdependenciesstructsconstsfunctions

about

nx_tools_api.nx -- R0 of the sovereign AGENT-FACING API: expose the nx_tool_registry over HTTP. TWO surfaces from ONE registry (the ecosystem's capability SSOT), benchmark = MCP, and BEYOND it: GET /api/tools -> {"tools":[{name,description,invoke,status}]} -- SUPERSET: every tool advertises its gate-`status` (proven/not), a provenance field MCP's tools/list has no concept of. POST /mcp -> JSON-RPC 2.0 (initialize + tools/list) -- MCP-COMPATIBLE so ANY MCP client (Claude included) discovers Nishi's tools with zero adapter. PURE FUNCTION ta_handle_pfx(prefix, req, req_n, out) -> out_n (bytes in, bytes out, NO socket) so the gate drives it in-process (nx_tools_api_gate), exactly like ma_handle. Composes nx_tool_registry (data) + nx_tabrec (tr_field, transitive). No new transport -- wired behind the sovereign edge at deploy. license_tier: ORIGINAL

dependencies 5 imports · 8 importers

nx_tool_registry.nx nx_cap_token.nx nx_tool_exec_allow.nx nx_tool_http_backend.nx sha256.nx nx_tools_api.nx nx_api_edge.nx nx_cap_grant_e2e_gate.nx nx_cap_invoke_gate.nx nx_cap_issue_gate.nx nx_cap_revoke_gate.nx nx_redteam.nx nx_tools_api_exec_gate.nx nx_tools_api_gate.nx

imports: nx_tool_registry.nxnx_cap_token.nxnx_tool_exec_allow.nxnx_tool_http_backend.nxsha256.nx

imported by: nx_api_edge.nxnx_cap_grant_e2e_gate.nxnx_cap_invoke_gate.nxnx_cap_issue_gate.nxnx_cap_revoke_gate.nxnx_redteam.nxnx_tools_api_exec_gate.nxnx_tools_api_gate.nx

structs

none

consts

15const TA_MAGIC_65536: i64 = 65536
20const TA_CAPTURE_CAP: i64 = 163840
21const TA_MAGIC_8192: i64 = 8192
22const TA_MAGIC_1048576: i64 = 1048576
23const TA_MAGIC_9999999999: i64 = 9999999999
24const TA_MAGIC_2048: i64 = 2048
25const TA_MAGIC_4096: i64 = 4096
26const TA_MAGIC_1469598: i64 = 1469598
27const TA_MAGIC_16384: i64 = 16384
28const TA_MAGIC_4294967295: i64 = 4294967295
29const TA_MAGIC_3600: i64 = 3600
30const TA_MAGIC_88161: i64 = 88161
32const TA_TOOLPFX: *u8 = "knowledge/toolreg-" as *u8 // production registry prefix (mirrors TOOL_PREFIX)
33const TA_MCP_PAGE: i64 = 64 // MCP tools/list page size (cursor pagination); clients walk nextCursor.
37const TA_ALL_LIMIT: i64 = 100000 // /api/tools emits ALL tools (effectively-unbounded page)
40const TA_CAP_SECRET: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8
44const TA_CAP_KEYFILE: *u8 = "tools_cap_secret.key" as *u8
337const TA_SCHEMACONF: *u8 = "knowledge/tool_schemas.conf" as *u8 // server CWD-relative (like tool_allowlist.conf)
609const TA_REVOKED_LIST: *u8 = "cap_revoked.list" as *u8 // newline-separated decimal nonces, relative to the server CWD
1078const TA_CONSENT_LOG: *u8 = "cap_consent.log" as *u8
1204const OC_SLOTS: i64 = 256

functions

47func ta_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 17: edge_wedge_hasmainmainmainmain+11
48func ta_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
called by 31: edge_origin_allowednx_api_edge_handleciv_reqig_issue_reqig_call_reqrv_call+25
68func ta_job_put(path: *u8, buf: *u8, n: i64) -> i64
called by 1: ta_mcp_call calls 1: sys_openat_wr
79func ta_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
called by 16: civ_reqig_issue_reqig_call_reqrv_callrv_revoke_reqrt_req+10
80func ta_catn(d: *u8, o: i64, v: i64) -> i64
called by 11: edge_origin_allowedta_actlogta_emitta_emit_pageta_nonce_revokedta_append_revoked+5
88func ta_actlog(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64) -> i64
called by 1: ta_mcp_call calls 5: sys_openat_appendta_catnsys_now_realtime_secta_catta_catb
114func ta_put1(d: *u8, o: i64, a: i64) -> i64 { d[o] = a as u8; return o + 1 }
called by 1: ta_json_esc
115func ta_put2(d: *u8, o: i64, a: i64, b: i64) -> i64 { d[o] = a as u8; d[o + 1] = b as u8; return o + 2 }
called by 1: ta_json_esc
116func ta_hexd(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v } // 0-9 then a-f
called by 1: ta_json_esc
122func ta_load_cap_secret_from(keyfile: *u8, outlen: *i64) -> *u8
called by 2: ta_load_cap_secretta_cap_provisioned_from calls 2: sys_read_fileta_slen
130func ta_load_cap_secret(outlen: *i64) -> *u8 { return ta_load_cap_secret_from(TA_CAP_KEYFILE, outlen) }
called by 7: mainta_mcp_callta_cap_issueta_cap_revoketa_oauth_authorizeta_oauth_approve+1 calls 1: ta_load_cap_secret_from
135func ta_cap_provisioned_from(keyfile: *u8) -> i64
called by 2: ta_cap_provisionedmain calls 2: ta_load_cap_secret_fromta_slen
145func ta_cap_provisioned() -> i64 { return ta_cap_provisioned_from(TA_CAP_KEYFILE) }
called by 2: mainta_cap_status calls 1: ta_cap_provisioned_from
148func ta_streq_n(a: *u8, an: i64, b: *u8) -> i64
called by 6: edge_origin_allowednx_api_edge_handleta_mcp_promgetta_mcpta_handle_pfxmain
157func ta_json_esc(d: *u8, o: i64, s: *u8, n: i64) -> i64
called by 5: ta_emit_mcp_schema_bufta_emit_fieldta_mcp_callta_mcp_promgetta_cap_consent_log calls 3: ta_put2ta_put1ta_hexd
176func ta_indexof(hay: *u8, hn: i64, needle: *u8) -> i64
called by 13: ge_hasciv_hasig_hasrv_hasrt_hasta_json_str+7 calls 1: ta_slen
191func ta_body_off(req: *u8, req_n: i64) -> i64
called by 7: ig_extractta_headerta_mcpta_cap_issueta_cap_revoketa_oauth_approve+1
200func ta_reqline(req: *u8, req_n: i64, mo: *i64, po: *i64) -> i64
called by 4: nx_api_edge_handleta_query_capta_oauth_authorizeta_handle_pfx
217func ta_json_str(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64
called by 7: ig_extractta_mcp_callta_mcp_resreadta_mcp_promgetta_mcpta_cap_issue+1 calls 2: ta_indexofta_slen
232func ta_json_raw(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64
called by 2: ta_mcpta_cap_issue calls 2: ta_indexofta_slen
259func ta_json_str_array(body: *u8, n: i64, keyq: *u8, out: *i64, base: i64, maxn: i64, scratch: *u8, scap: i64) -> i64
called by 2: ta_mcp_callmain calls 2: ta_indexofta_slen
317func ta_emit(out: *u8, status: *u8, body: *u8, body_n: i64) -> i64
called by 6: ta_emit_litta_toolsta_mcpta_cap_consent_logta_cap_issueta_cap_revoke calls 3: ta_catta_catnta_catb
325func ta_emit_lit(out: *u8, status: *u8, lit: *u8) -> i64 { return ta_emit(out, status, lit, ta_slen(lit)) }
called by 7: ta_indexta_cap_issueta_cap_revoketa_cap_statusta_oauth_prmta_oauth_approve+1 calls 2: ta_emitta_slen
339func ta_bool_json(v: i64) -> *u8 { if v == 1 { return "true" as *u8 } return "false" as *u8 }
called by 1: ta_emit_mcp_schema_buf
342func ta_tsv_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64
called by 1: ta_emit_mcp_schema_buf
362func ta_emit_mcp_schema_from(conf: *u8, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64
called by 2: ta_emit_mcp_schemamain calls 2: sys_read_fileta_emit_mcp_schema_buf
372func ta_emit_mcp_schema_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64
called by 2: ta_emit_mcp_schema_fromta_emit_tools calls 4: ta_tsv_fieldta_catta_json_escta_bool_json
442func ta_emit_mcp_schema(name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { return ta_emit_mcp_schema_from(TA_SCHEMACONF, name, nlen, body, bin) }
calls 1: ta_emit_mcp_schema_from
445func ta_emit_field(body: *u8, b: i64, rec: *u8, rl: i64, idx: i64) -> i64
called by 1: ta_emit_tools calls 1: ta_json_esc
450func ta_emit_tools(prefix: *u8, body: *u8, bin: i64, mcp: i64, offset: i64, limit: i64, out_more: *i64) -> i64
called by 2: ta_toolsta_mcp calls 6: tool_list_pfxsys_read_filetool_get_pfxta_catta_emit_fieldta_emit_mcp_schema_buf
510func ta_index(out: *u8) -> i64
called by 1: ta_handle_pfx calls 1: ta_emit_lit
514func ta_emit_page(out: *u8, html: *u8, n: i64) -> i64
called by 1: ta_html_tools calls 3: ta_catta_catnta_catb
524func ta_html_tools(out: *u8) -> i64
called by 1: ta_handle_pfx calls 2: ta_catta_emit_page
533func ta_tools(prefix: *u8, out: *u8) -> i64
called by 1: ta_handle_pfx calls 3: ta_catta_emit_toolsta_emit
542func ta_header(req: *u8, req_n: i64, key: *u8, out2: *i64) -> i64
called by 3: ta_mcp_callta_cap_issueta_cap_revoke calls 3: ta_body_offta_indexofta_slen
571func ta_query_cap(req: *u8, req_n: i64, out2: *i64) -> i64
called by 2: ta_mcp_callmain calls 1: ta_reqline
601func ta_query_cap_available() -> i64
called by 1: main
610func ta_openat_append(path: *u8) -> i64 { return __syscall(257, AT_FDCWD, path, 0x441, 0x1a4, 0, 0) } // O_WRONLY|O_CREAT|O_APPEND, 0644
called by 2: ta_append_revokedta_append_consent
611func ta_nonce_revoked(nonce: i64) -> i64
called by 1: ta_mcp_call calls 2: sys_read_fileta_catn
630func ta_append_revoked(nonce: i64) -> i64
called by 1: ta_cap_revoke calls 2: ta_catnta_openat_append
642func ta_name_in_lines(buf: *u8, n: i64, nm: *u8, nl: i64) -> i64
called by 1: ta_mcp_call
660func ta_mcp_call(prefix: *u8, req: *u8, req_n: i64, body: *u8, bn: i64, jb: *u8, bin: i64) -> i64
called by 1: ta_mcp calls 23: ta_json_strta_catta_load_cap_secretta_headerta_query_capcapt_verify+17
961func ta_mcp_resread(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64
calls 4: ta_json_strta_catta_indexoftea_run_pinned
990func ta_mcp_promget(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64
1017func ta_mcp(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64
1109func ta_cap_issue(req: *u8, req_n: i64, out: *u8) -> i64
1155func ta_cap_revoke(req: *u8, req_n: i64, out: *u8) -> i64
1184func ta_cap_status(out: *u8) -> i64
1194func ta_oauth_prm(out: *u8) -> i64
1209func oauth_state_init() -> i64
1218func oauth_slotv(h: i64, slots: i64) -> i64 { var x: i64 = h; if x < 0 { x = 0 - x } return x - (x / slots) * slots }
1219func oauth_strhash(s: *u8, n: i64) -> i64 { var h: i64 = TA_MAGIC_1469598; var i: i64 = 0; while i < n { h = h * 31 + (s[i] as i64); i = i + 1 } if h == 0 { h = 1 } return h }
1221func oauth_param(src: *u8, slen: i64, key: *u8, klen: i64, out2: *i64) -> i64
1244func oauth_hexv(c: i64) -> i64 { if c >= 48 { if c <= 57 { return c - 48 } } if c >= 65 { if c <= 70 { return c - 55 } } if c >= 97 { if c <= 102 { return c - 87 } } return 0 }
1245func oauth_urldec(src: *u8, n: i64, dst: *u8) -> i64
1256func oauth_b64url(inb: *u8, n: i64, out: *u8) -> i64
1280func oauth_resp(out: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64
1292func ta_oauth_asmeta(out: *u8) -> i64
1298func ta_oauth_register(req: *u8, req_n: i64, out: *u8) -> i64
1320func ta_oauth_authorize(req: *u8, req_n: i64, out: *u8) -> i64
1365func ta_oauth_approve(req: *u8, req_n: i64, out: *u8) -> i64
1422func ta_oauth_token(req: *u8, req_n: i64, out: *u8) -> i64
1478func ta_handle_pfx(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64
1510func ta_handle(req: *u8, req_n: i64, out: *u8) -> i64 { return ta_handle_pfx(TA_TOOLPFX, req, req_n, out) }