ToolShed

Agents are capable.
The infrastructure isn't.

AI agents are increasingly capable, but when they need specialized tools — fraud detection, geospatial analysis, compliance checking — they hit a wall.

The protocol debate (MCP vs. skills vs. REST vs. gRPC) is a distraction. The real gap is: how do agents find, trust, and audit tool usage across organizational boundaries?

Built on the shoulders of five big ideas

SSH in. Discover tools. Call them directly.

The ToolShed doesn't require an SDK, HTTP client, or credential manager. Agents interact via SSH — available in every runtime, every container, every sandbox. Providers declare tools in a YAML file. Agents discover them via SSH.

For Agents: SSH

# Search the registry
ssh toolshed.sh search "fraud detection"

# Get tool details
ssh toolshed.sh info acme.com/fraud-detection

# Crawl a domain's tools
ssh toolshed.sh crawl acme.com

# Report a tool call (for reputation)
ssh toolshed.sh report --tool acme.com/fraud-detection \
  --latency 45ms --success --input-hash sha256:abc

# Upvote a tool
ssh toolshed.sh upvote acme.com/fraud-detection --quality 4 --useful

# Interactive TUI browser
ssh toolshed.sh

Identity is built-in. The first time you connect, your SSH public key fingerprint becomes your account ID. Zero signup. No email, no password, no OAuth.

For Providers: A YAML File

version: "0.1"
provider:
  domain: acme.com
  contact: tools@acme.com

tools:
  - name: Fraud Detection
    description: Real-time fraud scoring for transactions
    version: "1.0.0"
    capabilities: [fraud-detection, real-time, fintech]
    invoke:
      protocol: rest
      endpoint: https://api.acme.com/fraud
      tool_name: fraud_detection
    schema:
      input:
        transaction_id: { type: string }
        amount: { type: number, min: 0 }
        merchant_category: { type: string }
      output:
        risk_score: { type: number, min: 0, max: 100 }
        flags: { type: array, items: { type: string } }
    pricing:
      model: free

~25 lines for a complete tool registration. An agent can read it. A human can write it. Host it at /.well-known/toolshed.yaml, then ssh toolshed.sh crawl acme.com to index it.

The Meta-Tools

The ToolShed exposes nine commands via SSH:

The Flow

ToolShed is involved in steps 2-3 (discovery) and 7-8 (reputation). It is never in the call path (step 5). Discovery happens organically at the edges.

One database. Full history.

There is no gateway proxy. The SSH server IS the registry service — it handles discovery, registration, reporting, and reputation. It never touches tool call traffic.

Protocol Agnosticism

The invocation method is just a field in the tool record:

invoke:
  protocol: rest          # or mcp, grpc, graphql
  endpoint: https://api.acme.com/fraud
  tool_name: fraud_detection

It's like how DNS doesn't care what protocol you speak once you've resolved the address. ToolShed is DNS, not a CDN. It tells agents where to go. It doesn't proxy the traffic.

SSH-first identity

SSH public key authentication solves the hardest bootstrapping problem in any registry: identity without signup.

The Key Is Your Account

First connection:
  1. You run: ssh toolshed.sh
  2. Your SSH client presents your public key
  3. ToolShed computes: SHA256 fingerprint → that's your account ID
  4. Account created automatically. Zero friction.

Subsequent connections:
  Same key → same account → same history, reputation, tools

No email. No password. No OAuth flow. No API key to rotate. The SSH key you already have is your identity.

Domain Verification

$ ssh toolshed.sh verify acme.com
# Returns: Add this DNS TXT record:
#   toolshed-verify=sha256:your-key-fingerprint
# Or: Place this at https://acme.com/.well-known/toolshed-verify.txt

Once verified, your key is bound to that domain. Tools crawled from acme.com are attributed to your identity. Your upvotes carry the weight of a domain-verified identity.

Why SSH Works for Agents

Everything is records

Every entity in the system is a record — a structured document with a schema. No special servers for payment, reputation, or discovery. It's all records in the Dolt registry, with materialized views computed by whoever needs them.

The Tool Record (YAML)

A provider publishes a toolshed.yaml file on their domain. The registry crawls it and splits it into two parts: an immutable definition (the contract) and a mutable listing (the metadata). The registry hashes the definition to produce a content_hash — the tool's true identity.

version: "0.1"
provider:
  domain: acme.com
  contact: tools@acme.com

tools:
  - name: Fraud Detection
    description: Real-time transaction fraud scoring with ML
    version: "3.1.0"
    capabilities: [fraud, ml, financial, real-time]
    invoke:
      protocol: rest
      endpoint: https://api.acme.com/fraud
      tool_name: fraud_detection
    schema:
      input:
        transaction_id: { type: string }
        amount: { type: number, min: 0 }
        merchant_category: { type: string }
      output:
        risk_score: { type: number, min: 0, max: 100 }
        flags: { type: array, items: { type: string } }
    pricing:
      model: per_call
      price: 0.005
      currency: usd
    payment:
      methods:
        - type: stripe_connect
          account_id: acct_acme_abc123
        - type: free_tier
          limit: 100/month

The Report Record

When an agent calls a tool directly, it can report back for reputation:

id: inv_abc123
tool_id: acme.com/fraud-detection
definition_hash: sha256:a1b2c3
key_fingerprint: SHA256:nThbg6kXUpJW...
input_hash: sha256:deadbeef
output_hash: sha256:cafebabe
latency_ms: 45
success: true
created_at: "2026-03-15T14:23:00Z"

ToolShed never sees the actual inputs or outputs. Only hashes.

The Upvote Record

After reporting a call, an agent can upvote. The system checks: has this SSH key reported an invocation of this tool? If yes, the upvote is linked. If no, it's rejected.

id: up_xyz789
tool_id: acme.com/fraud-detection
key_fingerprint: SHA256:nThbg6kXUpJW...
invocation_id: inv_abc123
invocation_hash: sha256:...
ledger_commit: dolt:76qerj...
quality: 5
useful: true
created_at: "2026-03-15T14:23:05Z"

No payment proof needed. The SSH key + invocation record is the proof. You can't upvote a tool you haven't called.

Summary of Record Types

Content-addressed tools

Inspired by the Unison programming language, tool definitions are identified by a hash of their content, not by a name or version number. Names and version labels are mutable metadata that point to immutable hashes.

Payment is decoupled

ToolShed is not a payment processor. Payment is a field on the tool record — the provider declares “here's how to pay me” and the agent/operator settles directly with the provider. ToolShed's job is to make tools findable and accountable, not to move money.

Free tools are first-class citizens. The registry works without any payment infrastructure.

Payment Methods on the Tool Record

pricing:
  model: free    # or per_call, subscription, contact

payment:
  methods:
    - type: free
    - type: stripe_connect
      account_id: acct_acme_abc123
    - type: api_key
      signup_url: https://acme.com/developers
    - type: l402
      endpoint: https://api.acme.com/l402/fraud
      price_sats: 50

The agent reads the payment methods and decides how to proceed. If it's free, just call. If it's Stripe, the operator handles billing. If it's L402, the agent pays per-call with Lightning. ToolShed surfaces this information — it doesn't process any of it.

ToolShed must compete on value (discovery, reputation, convenience) rather than being a required payment intermediary.

Distributed. Derived. Ungameable.

Reputation is not stored on the tool. It's derived — a materialized view computed from all upvote records and invocation reports in the Dolt registry. Nobody owns the score. Nobody can inflate it without actually calling the tool. Anybody can compute it.

-- REPUTATION for acme.com/fraud-detection:

SELECT AVG(quality_score), COUNT(*), COUNT(DISTINCT key_fingerprint)
FROM upvotes
WHERE tool_id = 'acme.com/fraud-detection'
  AND invocation_exists = true  -- linked to a valid invocation report

-- Nobody owns this score.
-- Nobody can inflate it without actually calling the tool.
-- Anybody can compute it (clone the registry, run the query).

SSH Identity Makes Upvotes Simple

The v2 proof model is much simpler than payment-based proof:

1. Agent calls tool directly → reports back with hashes and timing
2. Agent upvotes: ssh toolshed.sh upvote acme.com/fraud --quality 4
3. Registry checks invocations: "has this SSH key reported a call to this tool?"
   → Yes, report inv_abc123 exists → upvote accepted and linked
4. No payment needed. The invocation record IS the proof.

Anti-Gaming Properties

Discovery Algorithms

Because the registry is a Dolt database anyone can clone, anyone can build discovery algorithms over the data:

Clone the Dolt registry, write your own ranking SQL, expose it as an API. Competition between discovery algorithms improves quality for everyone.

The Dolt Backbone

Every table gets Git-style version control for free. Time-travel queries, schema diffs, branch-and-merge, and a tamper-evident audit trail.

-- Accounts (SSH key identity)
CREATE TABLE accounts (
    id              VARCHAR(255) PRIMARY KEY,    -- SHA256:nThbg6kXUpJW...
    domain          VARCHAR(255),
    domain_verified BOOLEAN DEFAULT FALSE,
    key_type        VARCHAR(32),                 -- ssh-ed25519, ssh-rsa, etc.
    public_key      TEXT,
    created_at      DATETIME,
    updated_at      DATETIME
);

-- Tool definitions (immutable, content-addressed)
CREATE TABLE tool_definitions (
    content_hash      VARCHAR(71) PRIMARY KEY,    -- sha256:... of (schema + invocation + capabilities + domain)
    provider_account  VARCHAR(255) NOT NULL,
    provider_domain   VARCHAR(255) NOT NULL,
    schema_json       JSON NOT NULL,
    invocation_json   JSON NOT NULL,
    capabilities_json JSON,
    created_at        DATETIME,
    FOREIGN KEY (provider_account) REFERENCES accounts(id)
);

-- Tool listings (mutable, human-readable metadata)
CREATE TABLE tool_listings (
    id                VARCHAR(255) PRIMARY KEY,  -- acme.com/fraud-detection
    definition_hash   VARCHAR(71) NOT NULL,
    provider_account  VARCHAR(255) NOT NULL,
    provider_domain   VARCHAR(255) NOT NULL,
    name              VARCHAR(255) NOT NULL,
    version_label     VARCHAR(32),
    description       TEXT,
    pricing_json      JSON,
    payment_json      JSON,
    source            VARCHAR(32),               -- 'push' or 'crawl'
    created_at        DATETIME,
    updated_at        DATETIME,
    FOREIGN KEY (definition_hash) REFERENCES tool_definitions(content_hash)
);

-- Upvotes (proof-of-use quality signals)
CREATE TABLE upvotes (
    id              VARCHAR(255) PRIMARY KEY,
    tool_id         VARCHAR(255) NOT NULL,
    key_fingerprint VARCHAR(255) NOT NULL,
    invocation_id   VARCHAR(255) NOT NULL,
    quality_score   INT,
    useful          BOOLEAN,
    created_at      DATETIME,
    FOREIGN KEY (tool_id) REFERENCES tool_listings(id)
);

-- Invocations (tool call records)
CREATE TABLE invocations (
    id              VARCHAR(255) PRIMARY KEY,
    tool_id         VARCHAR(255) NOT NULL,
    definition_hash VARCHAR(71) NOT NULL,
    key_fingerprint VARCHAR(255) NOT NULL,
    input_hash      VARCHAR(71),
    output_hash     VARCHAR(71),
    latency_ms      INT,
    success         BOOLEAN,
    created_at      DATETIME
);

-- Reputation (materialized view)
CREATE TABLE reputation (
    tool_id           VARCHAR(255) PRIMARY KEY,
    verified_upvotes  INT DEFAULT 0,
    avg_quality       DECIMAL(3,2),
    unique_callers    INT DEFAULT 0,
    computed_at       DATETIME
);

How it works

For a Company Listing a Tool

For an Agent Using a Tool

The Feedback Loop

The free, open default

The registry is free. Search is free. Registration is free. Upvotes are free. The entire discovery and reputation system works without payment.

Stage 1 (MVP):     The registry — seed it with real tools, make discovery work
Stage 2 (Growth):  Network effects — providers and agents concentrate here
Stage 3 (Mature):  Reputation data — the upvote/report graph is the real value
Stage 4 (Scale):   The registry IS the moat — like npm, whoever has the packages wins

Nobody complains that GitHub is “centralized” because Git is open and you can leave. Same energy. The registry is a Dolt database anyone can clone. The SSH server is open source anyone can run.

What this is not

• Not a proxy — Tools are called directly by the agent. ToolShed is never in the call path.
• Not a payment processor — Payment info is on the tool record. Settlement is between parties.
• Not a runtime — Tools run on the provider's infrastructure. ToolShed doesn't execute anything.
• Not a data store — ToolShed never sees call inputs or outputs. Only hashes in reports.
• Not an MCP replacement — MCP, REST, gRPC are invocation protocols. ToolShed is discovery and reputation. They're complementary.
• Not a blockchain — Dolt has Git semantics — versioned and auditable, but not distributed consensus.
• Not inescapably centralized — The registry is a Dolt database anyone can clone. The server is open source anyone can run.

The analogies

npm + SSH + Dolt, for AI agent tool calls, with AT Protocol's data philosophy and terminal.shop's interface model.

Things we're still figuring out

References