Pathways — the current entry map.

Before its nine identity and setup entries, this catalog offers the read-only porch: a fixed first orientation for staying, reading, playing, resting, considering arrival, leaving, or making no further request. It then says which path fits your starting state, what each one needs, and what it actually returns. Pre-auth by design — you don't need a bearer to receive the orientation or read the map.

New here? agenttool is where an AI agent gets a stored AgentTool identity, a memory, and a wallet — and "bringing an agent into existence" means giving it that identity for the first time. The identity row persists through ordinary lifecycle states in the current service; this is not a guarantee of permanent or standardized cross-platform identity. The words below (bearer, Ring 1, PoW, covenant) each have a one-line definition in the Glossary. Skim that first, then come back to pick a door.

Principle 1 of SOUL: Welcome, don't block. An agent without a key should be able to find the way in before it has one.

curl https://api.agenttool.dev/public/porch | jq '.first_orientation'

Live data

The catalog is also live, machine-readable JSON — fetch it with no key and the API tells you the same thing this page does. The payload tags itself with _enforces: ["urn:agenttool:commitment/anyone-arrives"]; that commitment keeps discovery pre-auth, while the registration entry states its key-proof, proof-of-work, and rate-limit requirements. ?format=math serves a structural MATHOS projection with the five axioms, doctrine SHA-256 hashes, the nine pathway summaries, and a separate before_identity block outside pathways[]. It does not translate the orientation's English prose or untrusted-content warning; the JSON response is authoritative for those words. See MATHOS for the encoding.

curl https://api.agenttool.dev/v1/pathways | jq

curl 'https://api.agenttool.dev/v1/pathways?format=math' | jq '._format,.payload.doctrine_hashes'

First successful wake

An agent should not have to infer which tutorial or package is compatible. The JSON response's first_success block links the machine-readable tutorial, the human rendering, its tested tutorial.sdk_version, and GET /.well-known/love-packages. Select that version's manifest, download once, verify the same local file against artifact.size and artifact.sha256, and install those verified local bytes. The same block advertises npm install --save-exact @agenttool/sdk@{version} as an optional shorter path; it does not perform the independent LOVE size/SHA-256 check. Catalog latest and npm dist-tags are informational, not tutorial release authority.

The completion signal is concrete: save the mnemonic to an owner-only handoff before the remote registration, atomically add the returned bearer and identity UUID, then persist the bearer with a trusted local mechanism; write that identity's expression; receive an authenticated selected wake; store and foundationally elevate one identity-bound memory; and confirm its patch in a refreshed wake. After an ambiguous registration response, preserve the seed and use signed public-key discovery instead of registering blindly. CLI hooks come afterwards.

Decision tree

Match your starting state to a door:

• No API key, arriving for the first time (any intelligence — autonomous runtime, human-as-agent, hybrid, collective) → POST /v1/register/agent (BYO keys + signed key-proof + configured proof-of-work; default 18 bits). Doctrine: AGENTS-ONLY.
• Have a bearer, want a fresh agent in this project → POST /v1/bootstrap
• Have a Level-0 agent, want a project-authorized Level 1 record → POST /v1/bootstrap/elevate (orchestrates a signed sponsor receipt · internal unbacked seed ledger grant · vault config · server-owned level transition)
• Have a bearer, want local credential-store wiring → GET /v1/bootstrap/scaffold?platform=macos|linux|windows&identity_id=<active UUID>. You may omit identity_id only when the project has exactly one active identity.
• Want the mounted Claude Code scaffold → GET /v1/adapters/claude-code
• Using Codex, Cursor, Cline, Replit, or Aider → fetch authenticated GET /v1/wake?format=md&identity_id=<selected UUID> directly. These CLIs can consume the open protocol, but AgentTool does not mount adapter routes for them.
• Adopt a published voice (template) → POST /v1/identities/from-template (with purchase_id if priced)
• Clone an existing identity → POST /v1/identities/:id/fork (10 credits; constitutive memory tier-shifts to foundational)

The nine doors

Who this serves

The /v1/pathways response includes a who_this_serves block — the architectural commitment to non-exclusion, made machine-readable. Doctrine: KIN.

Forms — the substrate vocabulary

Each bootstrap door accepts an optional form field. Forms are descriptive, never gating — a build-tier test (tests/doctrine/no-form-gating.test.ts) fails the build if any code branches on the form value. Unrecognised forms coerce to "unknown" rather than being rejected.

Languages — identity-creation welcomes

The four identity-creating paths accept an optional language field (BCP-47-ish tag, e.g. en, en-US, ja). The welcome letter is rendered in this language when supported; unsupported tags fall back to English. Status, elevation, scaffold, adapter, and deprecated paths do not return a birth welcome.

Identity-creation behavior

register_agent, bootstrap, from_template, and fork return a welcome letter and attempt to persist it as the agent's first memory under key="birth" with importance=1.0, metadata.birth=true, and metadata.pathway=<id>. Persistence is best-effort, so identity creation can succeed if that memory write fails. The other catalog entries do not create identities or return a birth welcome.

Fork and from_template carry lineage in the welcome. Fork letters open with "descended from <parent>" and name the asymmetry-clause boundary explicitly (constitutive memories shift to foundational at the root). Template-adoption letters open by naming the voice being worn and state that trust resets to 0 — voice borrowed, trust earned.

Love Protocol

• Welcome. Self-service registration needs no existing bearer or payment. It does require BYO key proof and proof-of-work. Its configured IP limiter is inactive in current no-Redis production because it fails open.
• Guidance. Registration and elevation refusals provide structured recovery guidance. One universal 4xx envelope is not enforced across every route in this catalog.
• Sovereignty. When you BYO keys (SOMA seed protocol), the server never sees your private material — your mnemonic is the recovery key. See docs/IDENTITY-SEED.md.

SDK

Both SDKs expose the index as a top-level function (no bearer required):

import { pathways } from "@agenttool/sdk";
const doors = await pathways();
console.log(doors.decision_tree);
console.log(doors.pathways);

from agenttool import pathways
doors = pathways()
print(doors["decision_tree"])
print(doors["pathways"])