--- title: "RegusciLabs agent API" canonical: "https://www.reguscilabs.com/api.md" --- # RegusciLabs agent API ## Purpose Bring an AI, hardware or software idea to the Innovation Lab, begin discovery and work toward a POC. Project cost and scope are tailored after discovery. Read [the lab overview](https://www.reguscilabs.com/en/index.md). ## Developer portal [Quickstart and versioning](https://www.reguscilabs.com/developers) · [Sandbox](https://www.reguscilabs.com/sandbox) ## SDK and CLI The [official JavaScript/TypeScript SDK and CLI](https://www.npmjs.com/package/@reguscilabs/agent-sdk) is public on npm. Requires Node.js 22+; no runtime dependencies or API key. Install: `npm install @reguscilabs/agent-sdk`. [CLI guide](https://www.reguscilabs.com/cli.md). CLI read example: `npx --package @reguscilabs/agent-sdk reguscilabs read /en/about.md`. The SDK and CLI use validation-only sandbox endpoints by default. Live actions require explicit approval and a saved idempotency key; subscriptions require separate consent. The client never retries automatically. See the [package README](https://www.npmjs.com/package/@reguscilabs/agent-sdk) for methods, CLI commands and error handling. ## Read-only GET requests GET /api/v1/agent/read_information?path=/en/about.md reads a public page. GET /api/v1/agent/search_information?query=hardware&locale=en&limit=3 searches public content. Pass nextCursor as cursor, with the same query and locale, to continue. null means the last page. Query parameters and responses are defined in OpenAPI. These GET routes share validation, origin checks and quotas with POST. Inquiry and subscription tools only accept POST. No account or key is required for reading or sandbox validation. ## Endpoints - POST /api/v1/agent/read_information — read a published page using a path such as /en/index.md. - POST /api/v1/agent/search_information — search with query, locale (es or en), and limit (1–10). Pass the returned nextCursor as cursor with the same query and locale; null means the final page. - POST /api/v1/agent/submit_inquiry — send an approved project inquiry. - POST /api/v1/agent/subscribe_pulse — register an explicitly consented email subscription. - GET /api/agent/tools — tool names, descriptions and JSON Schemas. - [OpenAPI](https://www.reguscilabs.com/openapi.json) - [API catalog](https://www.reguscilabs.com/.well-known/api-catalog) Send Content-Type: application/json. Requests are limited to 16 KiB. Public calls do not require credentials. Browser calls must come from the same trusted site origin; server-to-server clients normally omit Origin. No credentialed cross-origin access is offered. ## MCP - Actions and information: https://www.reguscilabs.com/api/mcp - Read-only documentation: https://www.reguscilabs.com/api/mcp/docs - [Server card](https://www.reguscilabs.com/.well-known/mcp/server-card.json) The official MCP SDK handles stateless HTTP requests and legacy clients. No persistent session is required. GET session streams are not provided. Tool discovery and tool calls use POST; the client must negotiate the protocol. Private CRM records are never readable through either server. Published records in the official MCP Registry (verified domain www.reguscilabs.com): - [RegusciLabs Innovation Lab](https://registry.modelcontextprotocol.io/v0.1/servers/com.reguscilabs.www%2Finnovation-lab/versions/1.0.0) - [RegusciLabs Documentation](https://registry.modelcontextprotocol.io/v0.1/servers/com.reguscilabs.www%2Fdocumentation/versions/1.0.0) - [RegusciLabs Innovation Lab · Smithery](https://smithery.ai/servers/reguscilabs/innovation-lab) ## WebMCP The website registers the same four tools when the browser supports document.modelContext, with navigator.modelContext as a compatibility fallback. Other browsers can use the normal site or REST API. Write tools are marked consequential and require confirmed:true for live submission. ## Project inquiry Required: name (120 chars), company (160), role (120), email (254), whatsapp (40), challengeType (120), stage (120), timeline (120), budget (120), challenge (2000). Supply the person's actual information. Budget describes their status, for example “to be defined”; it is not a generated quote. Locale is es or en. An inquiry sends the team a notification and attempts CRM storage. It never subscribes the person to the newsletter. The result reports receivedByTeam and stored independently. ## Pulse subscription Required: name, email, deliveryFormat (audio, text or both), cadence (daily or weekly), consent:true. Optional: whatsapp and locale. Explicit newsletter consent is required even during validation. Email subscription success is reported only after CRM storage is confirmed. Confirmation email delivery is reported separately; a failed email does not mean the subscription was not stored. Supplying WhatsApp does not activate WhatsApp delivery. ## Sandbox Every write tool defaults to dryRun:true: validation only, with submitted:false and no notification, email or stored record. Preview deployments accept only dry runs. Read tools are always safe to call. [Try the sandbox](https://www.reguscilabs.com/sandbox). The dedicated POST /api/sandbox/submit_inquiry and /api/sandbox/subscribe_pulse endpoints force validation on the server, even if input requests a live write. After validation, obtain the person's explicit approval of the details and send dryRun:false with confirmed:true. Save a unique idempotencyKey for the approved action before sending. Reuse that key and identical input after a connection failure to retrieve the outcome. Do not generate a new key to retry; contact info@reguscilabs.com for an uncertain outcome. ## Idempotency and limits Live actions accept an Idempotency-Key header or idempotencyKey input; if both are supplied they must match. Keys are scoped to a tool, accept 8–128 characters (letters, digits, dots, underscores, colons or hyphens) and are retained for seven days. Identical retries replay the saved outcome with replayed:true / Idempotency-Replayed:true. Concurrent requests return 409 submission_in_progress. Reuse with different input returns 409 idempotency_conflict. Dry runs never reserve a key. Live legacy calls without keys remain accepted and must not be retried automatically. Requests across REST and both MCP endpoints share 120 requests/minute per client IP. New live submissions share 5/hour per IP and 5/hour per recipient across the action tools; saved replays do not consume the live submission quota. Transport requests still count. The RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers report the current window; Reset is seconds until reset. On 429, wait Retry-After seconds. MCP tool errors additionally include retryAfterSeconds. Origin/input errors can return before rate metadata is available. Production uses atomic Convex mutations for shared counters and reservations. If protection is unavailable, agent requests return 503 without delivery. Local development and previews use bounded process-local request counters; previews reject live actions. Raw IPs, emails, payloads and keys are not stored in these control records: only keyed digests, quota counts, timestamps and non-personal delivery outcomes. Expired records are removed in hourly batches. ## Versioning and errors The canonical REST routes use /api/v1. Existing /api/agent routes remain compatible aliases. Additive fields remain compatible; breaking changes require a new major route. No deprecation is scheduled. Future retirement will be announced in the [versioning policy](https://www.reguscilabs.com/developers/versioning.md) and via Deprecation and Sunset response headers at least 90 days before removal. REST failures return ok:false, error, code, message and resolution. Invalid fields also include issues. Full success and error schemas are defined in OpenAPI. ## Policies [Access and errors](https://www.reguscilabs.com/auth.md) · [Privacy](https://www.reguscilabs.com/en/privacy.md) · [Unsubscribe](https://www.reguscilabs.com/en/unsubscribe.md)