Agent discovery (ARD)

Inkie is discoverable and verifiable by AI agents. An agent doing someone's marketing can find Inkie on its own, read what it can do, connect over MCP, and cryptographically confirm it really is Inkie before trusting it with anything. This page shows how, using the open Agentic Resource Discovery (ARD) standard.

What is ARD?

ARD (Agentic Resource Discovery) is an open standard for two things an AI agent needs when it reaches outside its own environment:

• Discovery — finding a tool or service that can do a job, without a human wiring it up first.
• Trust — confirming that the thing it found really is who it claims to be.

It works through a small, machine-readable catalogue published at a well-known address on a domain. An agent fetches it, reads the entries, and learns what each resource does and how to call it. ARD is the layer in front of the call: it handles discovery and trust, then hands off to MCP or a REST API to do the actual work.

What Inkie publishes

Inkie publishes an ARD catalogue at:

https://app.inkie.ink/.well-known/ai-catalog.json

Its entry, inkie-mcp, tells an agent:

• What Inkie does — plans a month of content, writes posts and blogs in your brand voice, generates images, and schedules and publishes across platforms.
• How to connect — the MCP endpoint (below).
• Capabilities — the concrete actions available: generate_social_post, create_social_post, update_social_post, generate_blog_post, create_blog_post, update_blog, get_content_plan, update_image, get_platforms, get_post.
• Representative queries — the kinds of requests Inkie is a good answer to, such as "plan a month of social media content for my business" or "write blog posts and captions in my brand voice".
• A trust manifest — a signed statement of identity rooted in https://app.inkie.ink (see Verifying Inkie).

The catalogue follows ARD specVersion 1.0. It carries no security attestations, because Inkie holds none today; any genuine certification would be added here when earned.

Endpoint

Once discovered, an agent connects to the Inkie MCP server:

https://app.inkie.ink/api/mcp

This is a Streamable HTTP MCP endpoint (a legacy SSE transport is available at /api/mcp/sse). Any MCP-compatible agent can connect, authenticate with an API key, and call the capabilities listed in the catalogue. Inkie also exposes a full REST API for anything outside the MCP surface.

Discovering Inkie

1. Fetch https://app.inkie.ink/.well-known/ai-catalog.json.
2. Read the entries array and find inkie-mcp.
3. Use its url to connect over MCP, and its capabilities to know what to ask for.
4. Match intent against representativeQueries to decide whether Inkie fits the job.

Verifying Inkie

An agent can read any catalogue and call any endpoint. What it cannot safely assume is identity. So every entry carries a signed trustManifest rooted in https://app.inkie.ink, the domain Inkie owns. Verifying it proves the entry was published by the holder of that domain's key and was not tampered with.

The signature is a detached ES256 JWS over the canonicalised trust manifest. To verify:

1. Take the trustManifest and remove its signature field.
2. Canonicalise the remaining object with JCS (RFC 8785) to get the exact signed bytes.
3. Read the kid from the JWS protected header.
4. Fetch the public keys from https://app.inkie.ink/.well-known/jwks.json and select the key whose kid matches.
5. Verify the detached JWS (the canonical bytes are the payload) against that key.

import { compactVerify, importJWK } from "jose";
import canonicalize from "canonicalize";

const catalog = await (await fetch("https://app.inkie.ink/.well-known/ai-catalog.json")).json();
const jwks = await (await fetch("https://app.inkie.ink/.well-known/jwks.json")).json();

const entry = catalog.entries.find((e) => e.identifier.endsWith("inkie-mcp"));
const { signature, ...unsigned } = entry.trustManifest;

// detached JWS: header..sig -> re-attach the canonical bytes as the payload
const [header, , sig] = signature.split(".");
const payload = Buffer.from(canonicalize(unsigned)).toString("base64url");
const jws = `${header}.${payload}.${sig}`;

const { kid } = JSON.parse(Buffer.from(header, "base64url").toString());
const jwk = jwks.keys.find((k) => k.kid === kid);

await compactVerify(jws, await importJWK(jwk, "ES256")); // throws if invalid
// verified: this entry was published by the holder of app.inkie.ink's key

If verification succeeds, the Inkie the agent found is the real Inkie. If it fails, the entry should not be trusted.

Well-known endpoints

FAQ

Can an AI agent use Inkie without a human setting it up?

Yes. An agent can discover Inkie from the ARD catalogue, read its capabilities, and connect over MCP on its owner's behalf. It still authenticates with an API key.

How does an agent know the Inkie it found is genuine?

Every catalogue entry carries a signed trust manifest rooted in app.inkie.ink. An agent verifies the ES256 signature against the keys at /.well-known/jwks.json before trusting the entry. See Verifying Inkie.

What can Inkie do for an agent?

Plan and create social posts and blog articles in your brand voice, generate images, and schedule and publish across platforms. The full list is in the catalogue's capabilities.

Does Inkie have a REST API as well as MCP?

Yes. MCP is the standard agent interface; the REST API covers everything outside it. See the API overview.

Where is the catalogue?

At https://app.inkie.ink/.well-known/ai-catalog.json, with verification keys at /.well-known/jwks.json.

See also

• MCP / AI agent integration — connect Claude, Cursor, or any MCP agent to Inkie
• API overview — the full REST API
• Authentication — API keys and OAuth