# AnoneHost Agent API

Documentation: https://anonehost.com/agents/
OpenAPI: https://anonehost.com/openapi.json
REST: https://anonehost.com/api/v1/
MCP Streamable HTTP: https://anonehost.com/mcp/

## Start here
Read GET /api/v1/capabilities or call agent_help before making promises.
Public: list_plans, list_locations, quote, domain_check, create_order with dry_run=true.
Authenticated: create_order, payment_status, save_project, list_services.
Generate an account in the client area, or POST {} to /api/v1/accounts.
Store the returned token securely. Authorization: Bearer <your account token>.
No email or password for an account. Domain registration still requires real registrant data.

## Purchase workflow
1. Read the catalog and location IDs. No GPU offers.
2. POST /quote with {"project":{"type":"server","plan":"vps-1","region":"md","os":"ubuntu","cycle":"monthly"}}.
3. Test POST /orders?dry_run=1 with the same project. It creates no account, order or payment.
4. Obtain explicit user approval. Real orders require confirm_order=true, payment_method, a 16-80 character idempotency_key and the Bearer header.
5. Read asset, network, destination and exact amount from the pending order. Quote expiry is 25 minutes. Never sign or transfer funds without authorization.
6. Poll GET /orders/{order_id}. The response is limited to the authenticated account.

## Actual capability limits
Automatic payment detection and server provisioning are not connected.
pending/reported is not paid. paid is not provisioned. Never invent credentials or server actions.
Balance top-ups and x402 are not supported. Never ask for wallet seeds or private keys.
For domains, RDAP only checks availability. Registration is completed in the client area.
Errors, registry timeouts and unknown availability are never purchase success.
Keep tokens out of URLs, logs, examples, browser storage and model tool arguments.

## MCP
Stateless Streamable HTTP, protocol 2025-03-26. POST JSON-RPC messages; GET returns 405.
initialize, notifications/initialized, ping, tools/list, tools/call.
For private operations configure Authorization securely in the client transport.
Mutating tools require explicit user authorization. create_order additionally requires confirm_order=true.