### Install Dependencies and Setup

Source: https://github.com/better-auth/agent-auth/blob/main/examples/agent-coffee/README.md

Install project dependencies, set up environment variables, push database schema, seed products, and start the development server.

```bash
pnpm install
cp .env.example .env
# Fill in DATABASE_URL and STRIPE_SECRET_KEY
pnpm db:push
pnpm db:seed
pnpm dev
```

--------------------------------

### Brex Agent Setup and Installation

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Instructions for installing dependencies, setting up environment variables, pushing the database schema, and starting the development server.

```bash
pnpm install
cp .env.example .env
# Fill in DATABASE_URL, BREX_API_TOKEN, STRIPE_SECRET_KEY
pnpm db:push
pnpm dev
```

--------------------------------

### Install @auth/agent SDK

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Install the agent SDK using npm.

```bash
npm install @auth/agent
```

--------------------------------

### Start MCP Server

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use this command to start the MCP server. It can be run with pre-configured providers by specifying a URL.

```bash
auth-agent mcp
```

```bash
auth-agent mcp --url https://api.example.com
```

--------------------------------

### Install Agent Auth Plugin

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Install the agent auth plugin using npm.

```bash
npm install @better-auth/agent-auth
```

--------------------------------

### Quick Start with AgentAuthClient

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Initialize the client, discover a provider, connect an agent with specific capabilities, and execute a capability.

```typescript
import { AgentAuthClient } from "@auth/agent";

const client = new AgentAuthClient({
  directoryUrl: "https://directory.example.com",
});

// Discover a provider
const config = await client.discoverProvider("https://api.example.com");

// Connect an agent with constrained capabilities
const agent = await client.connectAgent({
  provider: "https://api.example.com",
  capabilities: ["read_data", { name: "transfer_money", constraints: { amount: { max: 1000 } } }],
  name: "my-assistant",
});

// Execute a capability
const result = await client.executeCapability({
  agentId: agent.agentId,
  capability: "read_data",
  arguments: { id: "user-123" },
});
```

--------------------------------

### Run MCP Server

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Start the agent CLI as an MCP server, specifying the provider URL.

```bash
auth-agent mcp --url https://api.example.com
```

--------------------------------

### Agent Auth Workflow Example

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

This sequence demonstrates the typical steps for connecting to a provider and executing a capability using MCP tools.

```text
1. list_providers
   → See what providers are already known

2. search_providers({ intent: "deploy web apps" })
   → Find a provider if none are known (or discover_provider with a URL)

3. list_capabilities({ provider: "https://api.example.com" })
   → See what the provider offers

4. describe_capability({ name: "deploy_app", provider: "https://api.example.com" })
   → Understand the input schema before executing

5. connect_agent({ provider: "https://api.example.com", capabilities: ["deploy_app"], name: "deploy-bot" })
   → Authenticate and get an agent_id
   → If approval is required, the user will be prompted

6. agent_status({ agent_id: "..." })
   → Confirm the agent is active and capabilities are granted

7. execute_capability({ agent_id: "...", capability: "deploy_app", arguments: { app: "my-app", env: "production" } })
   → Run the capability with the correct arguments
```

--------------------------------

### Install Agent CLI Globally

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Install the agent CLI globally using npm for command-line access.

```bash
npm install -g @auth/agent-cli
```

--------------------------------

### Run Development Server with npm, yarn, pnpm, or bun

Source: https://github.com/better-auth/agent-auth/blob/main/examples/vercel-proxy/README.md

Use these commands to start the Next.js development server. Open http://localhost:3000 in your browser to view the application.

```bash
npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev
```

--------------------------------

### Describe a Specific Capability

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Use the 'describe' command to get detailed information about a specific capability.

```bash
auth-agent describe transfer_money --provider https://api.example.com
```

--------------------------------

### Describe Capability Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Before executing a capability, use `describe_capability` to get its full definition, including the input schema. This tool requires the `provider` and `name` of the capability.

```text
describe_capability
```

--------------------------------

### Define capability constraints

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-connectors/SKILL.md

Example of applying constraints to a capability using semantic and numeric operators.

```jsonc
{
  "name": "gmail.messages.send",
  "constraints": {
    "to": { "in": ["alice@example.com"] }, // semantic, abuse-prone field
    "maxResults": { "max": 25 }, // numeric bounds are fine
  },
}
```

--------------------------------

### Capability Constraints Example

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

This JSON structure defines how to set constraints when connecting an agent to limit its permissions for specific capabilities.

```json
{
  "provider": "https://api.example.com",
  "capabilities": [
    "read_data",
    {
      "name": "transfer_money",
      "constraints": {
        "amount": { "max": 1000, "min": 1 },
        "currency": { "in": ["USD", "EUR"] }
      }
    }
  ]
}
```

--------------------------------

### Run Agent CLI with npx

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Execute the agent CLI directly using npx without global installation.

```bash
npx @auth/agent-cli --help
```

--------------------------------

### AI Framework Integration - Vercel AI SDK

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Integrate the AgentAuth SDK with the Vercel AI SDK to leverage agent capabilities within AI-generated responses. This example shows auto-importing JSON schema and explicit passing.

```APIDOC
## AI Framework Integration - Vercel AI SDK

### Description
Integrate the AgentAuth SDK with the Vercel AI SDK to leverage agent capabilities within AI-generated responses. This example shows auto-importing JSON schema and explicit passing.

### Usage (Auto-import JSON Schema)
```ts
import { generateText } from "ai";
import { AgentAuthClient, getAgentAuthTools, toAISDKTools } from "@auth/agent";

const client = new AgentAuthClient();
const tools = await toAISDKTools(getAgentAuthTools(client));

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "Transfer $50 to Alice",
});
```

### Usage (Explicit JSON Schema)
```ts
import { generateText, jsonSchema } from "ai";
import { AgentAuthClient, getAgentAuthTools, toAISDKTools } from "@auth/agent";

const client = new AgentAuthClient();
const tools = await toAISDKTools(getAgentAuthTools(client), { jsonSchema });
```
```

--------------------------------

### Get Brex Cash Balance

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Retrieve the current cash balance of the connected Brex account. This endpoint is human-facing.

```APIDOC
## GET /api/brex/balance

### Description
Get Brex cash balance

### Method
GET

### Endpoint
/api/brex/balance
```

--------------------------------

### List Provider Capabilities

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Use the 'capabilities' command to list all available capabilities for a provider.

```bash
auth-agent capabilities --provider https://api.example.com
```

--------------------------------

### Explore Provider Capabilities

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

List and describe capabilities offered by a provider. Always run `describe` before executing a capability to understand its input schema and constraints.

```bash
auth-agent capabilities --provider https://api.example.com
```

```bash
auth-agent capabilities --provider https://api.example.com --query "transfer"
```

```bash
auth-agent describe transfer_money --provider https://api.example.com
```

--------------------------------

### Discover or Find a Provider

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Use these commands to find and cache provider information. Discover fetches the agent configuration document, while search queries a directory for providers matching a given intent.

```bash
auth-agent discover https://api.example.com
```

```bash
auth-agent search "deploy web apps"
```

```bash
auth-agent providers
```

--------------------------------

### Create Host

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Creates a new host entry in the system.

```APIDOC
## POST /host/create

### Description
Create a host.

### Method
POST

### Endpoint
/host/create
```

--------------------------------

### List Capabilities Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use `list_capabilities` to see available capabilities for a given provider. Parameters like `query`, `agent_id`, `limit`, and `cursor` can be used for filtering and pagination.

```text
list_capabilities
```

--------------------------------

### Connect an Agent

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Connect a new agent to a provider, specifying desired capabilities and a name.

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data transfer_money \
  --name my-agent
```

--------------------------------

### SDK Tools Overview

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

A list of available SDK tools that map to the agent lifecycle, including capabilities for managing providers, agents, and keys.

```APIDOC
## SDK Tools Overview

### Description
A list of available SDK tools that map to the agent lifecycle, including capabilities for managing providers, agents, and keys.

### Available Tools
| Tool                  | Description                                   |
| --------------------- | --------------------------------------------- |
| `list_providers`      | List discovered/configured providers          |
| `search_providers`    | Search registry by intent                     |
| `discover_provider`   | Look up a provider by URL                     |
| `list_capabilities`   | List provider capabilities                    |
| `describe_capability` | Get full capability definition                |
| `connect_agent`       | Register an agent (with optional constraints) |
| `execute_capability`  | Execute a granted capability                  |
| `request_capability`  | Request additional capabilities               |
| `agent_status`        | Check agent status and grants                 |
| `sign_jwt`            | Sign an agent JWT manually                    |
| `disconnect_agent`    | Revoke an agent                               |
| `reactivate_agent`    | Reactivate an expired agent                   |
| `rotate_agent_key`    | Rotate agent keypair                          |
| `rotate_host_key`     | Rotate host keypair                           |
| `enroll_host`         | Enroll host with enrollment token             |
```

--------------------------------

### Discover a Provider

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Use the 'discover' command to find an agent provider at a given URL.

```bash
auth-agent discover https://api.example.com
```

--------------------------------

### List Providers Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use the `list_providers` tool first to discover all configured providers. If no providers are found, consider using `search_providers` or `discover_provider`.

```text
list_providers
```

--------------------------------

### AgentAuthClient Initialization and Basic Usage

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Initialize the AgentAuthClient and perform common operations like discovering a provider, connecting an agent with specified capabilities, and executing a capability.

```APIDOC
## AgentAuthClient Initialization and Basic Usage

### Description
Initialize the AgentAuthClient and perform common operations like discovering a provider, connecting an agent with specified capabilities, and executing a capability.

### Usage
```ts
import { AgentAuthClient } from "@auth/agent";

const client = new AgentAuthClient({
  directoryUrl: "https://directory.example.com",
});

// Discover a provider
const config = await client.discoverProvider("https://api.example.com");

// Connect an agent with constrained capabilities
const agent = await client.connectAgent({
  provider: "https://api.example.com",
  capabilities: ["read_data", { name: "transfer_money", constraints: { amount: { max: 1000 } } }],
  name: "my-assistant",
});

// Execute a capability
const result = await client.executeCapability({
  agentId: agent.agentId,
  capability: "read_data",
  arguments: { id: "user-123" },
});
```
```

--------------------------------

### Initialize Better Auth with Agent Auth Plugin

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Configure Better Auth with the agentAuth plugin, defining provider details and capabilities.

```typescript
import { betterAuth } from "better-auth";
import { agentAuth } from "@better-auth/agent-auth";

const auth = betterAuth({
  plugins: [
    agentAuth({
      providerName: "my-service",
      providerDescription: "My API service",
      capabilities: [
        {
          name: "read_data",
          description: "Read user data",
          input: {
            type: "object",
            properties: { id: { type: "string" } },
          },
        },
        {
          name: "transfer_money",
          description: "Transfer funds",
          input: {
            type: "object",
            required: ["amount", "to"],
            properties: {
              amount: { type: "number" },
              to: { type: "string" },
              currency: { type: "string" },
            },
          },
        },
      ],
      onExecute: async ({ capability, arguments: args, agentSession }) => {
        // Handle capability execution
        return { success: true };
      },
    }),
  ],
});
```

--------------------------------

### Host Enrollment

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Enroll a host with a provider using an enrollment token and a specified name.

```bash
auth-agent enroll-host --provider https://api.example.com --token <enrollment-token> --name "My Device"
```

--------------------------------

### Host Management Tools

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Tools for managing hosts within the Agent Auth system. Use `enroll_host` to register a new host with a token, `rotate_agent_key` to refresh an agent's key, and `rotate_host_key` to refresh a provider's host key.

```text
enroll_host
  provider, enrollment_token (required), name
```

```text
rotate_agent_key
  agent_id (required)
```

```text
rotate_host_key
  issuer (required)
```

--------------------------------

### Cursor/Claude Desktop MCP Server Configuration

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Configuration for running the agent CLI as an MCP server within Cursor or Claude Desktop.

```json
{
  "mcpServers": {
    "auth-agent": {
      "command": "npx",
      "args": ["@auth/agent-cli", "mcp", "--url", "https://api.example.com"]
    }
  }
}
```

--------------------------------

### Connect Agent with Constraints

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Connect an agent while specifying constraints for certain capabilities, such as maximum transfer amounts.

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data transfer_money \
  --constraints '{"transfer_money":{"amount":{"max":1000}}}' \
  --name constrained-agent
```

--------------------------------

### Buy a Product

Source: https://github.com/better-auth/agent-auth/blob/main/examples/agent-coffee/README.md

Initiates the purchase of a specific coffee product. This endpoint is MPP-gated and may return a 402 challenge.

```APIDOC
## POST /api/products/[slug]/buy

### Description
Buy a product using its slug. This endpoint is MPP-gated and returns a 402 challenge if payment credentials are not provided or are invalid.

### Method
POST

### Endpoint
/api/products/[slug]/buy

### Parameters
#### Path Parameters
- **slug** (string) - Required - The unique identifier for the product to buy.

### Request Body
- **mpp_credential** (string) - Optional - The Shared Payment Token (SPT) for MPP payment.

### Response
#### Success Response (200)
- **order_confirmation** (object) - Details of the confirmed order.
- **receipt** (string) - A receipt for the transaction.

#### Payment Required Response (402)
- **challenge** (object) - An MPP challenge object to guide the agent on creating an SPT.
```

--------------------------------

### Request Additional Capabilities

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Request new capabilities for an existing agent, specifying constraints and a reason for the request.

```bash
auth-agent request <agent-id> \
  --capabilities admin_panel \
  --constraints '{"admin_panel":{"scope":{"in":["read","write"]}}}' \
  --reason "Need admin access for deployment"
```

--------------------------------

### Execute a Capability

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Execute a specific capability on a connected agent, providing necessary arguments.

```bash
auth-agent execute <agent-id> transfer_money \
  --args '{"amount": 50, "to": "alice"}'
```

--------------------------------

### Enroll Host

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Enrolls a host using a provided token.

```APIDOC
## POST /host/enroll

### Description
Enroll host with token.

### Method
POST

### Endpoint
/host/enroll
```

--------------------------------

### Subpath Import for Tools and Adapters

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Import only the necessary tools and adapters for lighter package size. This avoids including the client, crypto, or storage modules.

```typescript
import { getAgentAuthTools, toOpenAITools, filterTools } from "@auth/agent/tools";
```

--------------------------------

### Connect Agent Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use `connect_agent` to authenticate an agent with a provider. This returns an `agent_id`. Key parameters include `capabilities`, `mode`, and `preferred_method`.

```text
connect_agent
```

--------------------------------

### Discover Provider Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use the `discover_provider` tool with a specific URL if `list_providers` or `search_providers` do not yield the desired provider.

```text
discover_provider
```

--------------------------------

### Request Additional Capabilities

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Request new capabilities for an agent, optionally with specific constraints.

```bash
auth-agent request <agent-id> \
  --capabilities admin_panel \
  --constraints '{"admin_panel":{"scope":{"in":["read","write"]}}}'
```

--------------------------------

### Expose Agent Configuration Endpoint

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Set up a Next.js route to expose the agent configuration discovery document at /.well-known/agent-configuration.

```typescript
// app/.well-known/agent-configuration/route.ts
import { auth } from "@/lib/auth";

export async function GET(req: Request) {
  return auth.api.getAgentConfiguration({ headers: req.headers });
}
```

--------------------------------

### AI Framework Integration - OpenAI Function Calling

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Integrate the AgentAuth SDK with OpenAI's function calling mechanism to enable AI models to invoke agent capabilities.

```APIDOC
## AI Framework Integration - OpenAI Function Calling

### Description
Integrate the AgentAuth SDK with OpenAI's function calling mechanism to enable AI models to invoke agent capabilities.

### Usage
```ts
import { AgentAuthClient, getAgentAuthTools, toOpenAITools } from "@auth/agent";

const client = new AgentAuthClient();
const { definitions, execute } = toOpenAITools(getAgentAuthTools(client), {
  strict: true, // structured outputs — prevents hallucinated arguments
});

const res = await openai.chat.completions.create({
  model: "gpt-4o",
  tools: definitions,
  messages,
});

for (const call of res.choices[0].message.tool_calls ?? []) {
  const result = await execute(call.function.name, JSON.parse(call.function.arguments));
}
```
```

--------------------------------

### Set Approval Strength by HTTP Method with createFromOpenAPI

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Configure approval strength for different HTTP methods when using createFromOpenAPI, enabling granular security policies.

```typescript
createFromOpenAPI(spec, {
  baseUrl: "https://api.example.com",
  approvalStrength: {
    GET: "session",
    POST: "webauthn",
    PUT: "webauthn",
    DELETE: "webauthn",
  },
});
```

--------------------------------

### Capabilities Tools

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Tools to understand and describe the capabilities offered by a provider.

```APIDOC
## list_capabilities

### Description
Lists the capabilities available for a specific provider.

### Tool
`list_capabilities`

### Parameters
#### Query Parameters
- **provider** (string) - Required - The identifier of the provider.
- **query** (string) - Optional - A query to filter capabilities.
- **agent_id** (string) - Optional - The ID of the agent to list capabilities for.
- **limit** (integer) - Optional - The maximum number of capabilities to return.
- **cursor** (string) - Optional - A cursor for pagination.

## describe_capability

### Description
Retrieves the full definition of a capability, including its input schema. This should always be called before executing a capability.

### Tool
`describe_capability`

### Parameters
#### Query Parameters
- **provider** (string) - Optional - The identifier of the provider.
- **name** (string) - Required - The name of the capability.
- **agent_id** (string) - Optional - The ID of the agent associated with the capability.
```

--------------------------------

### Capability Listing

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Lists all available capabilities that can be granted to an agent.

```APIDOC
## GET /capability/list

### Description
List capabilities (Section 5.2).

### Method
GET

### Endpoint
/capability/list
```

--------------------------------

### Search Providers Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Use the `search_providers` tool to find providers based on their intent, such as 'deploy web apps' or 'vercel'.

```text
search_providers
```

--------------------------------

### List All Coffee Products

Source: https://github.com/better-auth/agent-auth/blob/main/examples/agent-coffee/README.md

Retrieves a list of all available coffee products from the storefront.

```APIDOC
## GET /api/products

### Description
List all coffee products available in the shop.

### Method
GET

### Endpoint
/api/products

### Response
#### Success Response (200)
- **products** (array) - A list of coffee products, each with details like name, price, origin, and roast.
```

--------------------------------

### Configure Capabilities with Approval Strength

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Set the required approval strength for capabilities, ranging from 'session' to 'webauthn' for enhanced security.

```typescript
agentAuth({
  capabilities: [
    {
      name: "read_data",
      description: "Read user data",
      approvalStrength: "session", // default — normal approval
    },
    {
      name: "delete_project",
      description: "Delete a project",
      approvalStrength: "webauthn", // requires physical presence
    },
  ],
  proofOfPresence: {
    enabled: true,
    // rpId and origin are auto-derived from baseURL if omitted
  },
  onExecute: async ({ capability, arguments: args }) => {
    return { success: true };
  },
});
```

--------------------------------

### Agent Lifecycle Management

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Manage the lifecycle of agent connections, including disconnecting (revoking), reactivating expired agents, and viewing connection details.

```bash
auth-agent disconnect <agent-id>
```

```bash
auth-agent reactivate <agent-id>
```

```bash
auth-agent connection <agent-id>
```

```bash
auth-agent connections <issuer-url>
```

--------------------------------

### Agent Auth MCP Tools

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

These are the primary tools for interacting with Agent Auth. Use `execute_capability` to run granted actions, `agent_status` to check an agent's state, `sign_jwt` for manual JWT signing, `request_capability` to ask for more permissions, `disconnect_agent` to revoke access, and `reactivate_agent` for expired agents.

```text
execute_capability
  agent_id, capability (required), arguments
```

```text
agent_status
  agent_id (required)
```

```text
sign_jwt
  agent_id (required), capabilities, audience
```

```text
request_capability
  agent_id, capabilities (required), reason, preferred_method, login_hint, binding_message
```

```text
disconnect_agent
  agent_id (required)
```

```text
reactivate_agent
  agent_id (required)
```

--------------------------------

### Connect an Agent

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Connect an agent to a provider, specifying capabilities, constraints, and connection mode. The returned `agent_id` is required for subsequent operations. Use `--no-browser` to suppress browser opening if approval is needed.

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data transfer_money \
  --name my-agent
```

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data transfer_money \
  --constraints '{"transfer_money":{"amount":{"max":1000}}}' \
  --name constrained-agent
```

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data \
  --mode autonomous
```

```bash
auth-agent connect --provider https://api.example.com \
  --capabilities read_data \
  --preferred-method ciba \
  --login-hint user@example.com
```

--------------------------------

### Pluggable Storage for AgentAuthClient

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Initialize the AgentAuthClient with a custom storage implementation. The SDK uses pluggable storage for persisting host identity and agent connections. A `MemoryStorage` is provided by default.

```typescript
import { AgentAuthClient } from "@auth/agent";

const client = new AgentAuthClient({
  storage: myCustomStorage, // implements Storage interface
});
```

--------------------------------

### Define Capabilities with Constraints

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Specify capabilities with input constraints during registration or capability requests. Constraints are validated at execution time.

```json
// During registration or request-capability, clients can pass:
{
  "capabilities": [
    "read_data",
    {
      "name": "transfer_money",
      "constraints": {
        "amount": { "max": 1000 },
        "currency": { "in": ["USD", "EUR"] }
      }
    }
  ]
}
```

--------------------------------

### Discovery Tools

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Tools to find and identify Agent Auth providers.

```APIDOC
## list_providers

### Description
Lists all discovered or configured providers.

### Tool
`list_providers`

### Parameters
(none)

## search_providers

### Description
Searches the provider directory by intent.

### Tool
`search_providers`

### Parameters
#### Query Parameters
- **intent** (string) - Required - The intent to search for (e.g., "deploy web apps", "vercel").

## discover_provider

### Description
Looks up a specific provider by its URL. Use this if `list_providers` or `search_providers` do not yield the desired result.

### Tool
`discover_provider`

### Parameters
#### Query Parameters
- **url** (string) - Required - The URL of the provider to discover.
```

--------------------------------

### Connect Brex Account

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Connect a Brex account by providing the Brex API token. This endpoint is human-facing.

```APIDOC
## POST /api/brex/connect

### Description
Connect Brex account (API token)

### Method
POST

### Endpoint
/api/brex/connect

### Parameters
#### Request Body
- **token** (string) - Required - The Brex API token.
```

--------------------------------

### List All Orders

Source: https://github.com/better-auth/agent-auth/blob/main/examples/agent-coffee/README.md

Retrieves a list of all orders placed by the agent.

```APIDOC
## GET /api/orders

### Description
List all orders associated with the current agent.

### Method
GET

### Endpoint
/api/orders

### Response
#### Success Response (200)
- **orders** (array) - A list of past orders.
```

--------------------------------

### Agent Auth Protocol Error Handling

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Tool execution errors are wrapped as structured objects with 'error' and 'code' properties, allowing models to recover gracefully.

```json
{ "error": "Capability not granted", "code": "capability_not_granted" }
```

--------------------------------

### Agent Configuration Discovery

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Provides the agent discovery document, which contains information about the agent's configuration and supported features.

```APIDOC
## GET /agent-configuration

### Description
Discovery document (Section 5.1).

### Method
GET

### Endpoint
/agent-configuration
```

--------------------------------

### AI Framework Integration - Anthropic Claude

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Integrate the AgentAuth SDK with Anthropic's Claude models for tool use, allowing the AI to interact with agent capabilities.

```APIDOC
## AI Framework Integration - Anthropic Claude

### Description
Integrate the AgentAuth SDK with Anthropic's Claude models for tool use, allowing the AI to interact with agent capabilities.

### Usage
```ts
import { AgentAuthClient, getAgentAuthTools, toAnthropicTools } from "@auth/agent";

const client = new AgentAuthClient();
const { definitions, processToolUse } = toAnthropicTools(getAgentAuthTools(client));

const res = await anthropic.messages.create({
  model: "claude-sonnet-4-20250514",
  max_tokens: 1024,
  tools: definitions,
  messages,
});

const toolUseBlocks = res.content.filter((b) => b.type === "tool_use");
if (toolUseBlocks.length > 0) {
  const results = await processToolUse(toolUseBlocks);
  messages.push({ role: "assistant", content: res.content }, { role: "user", content: results });
}
```
```

--------------------------------

### Error Handling in Tool Execution

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Understand how the SDK handles errors during tool execution. Errors are wrapped in a structured object, allowing models to recover gracefully.

```APIDOC
## Error Handling in Tool Execution

### Description
Understand how the SDK handles errors during tool execution. Errors are wrapped in a structured object, allowing models to recover gracefully.

### Example Error Structure
```json
{ "error": "Capability not granted", "code": "capability_not_granted" }
```
```

--------------------------------

### Filtering SDK Tools

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Use the `filterTools` utility to selectively expose only the necessary tools for your agent, improving security and reducing complexity.

```APIDOC
## Filtering SDK Tools

### Description
Use the `filterTools` utility to selectively expose only the necessary tools for your agent, improving security and reducing complexity.

### Usage
```ts
import { getAgentAuthTools, filterTools } from "@auth/agent";

const allTools = getAgentAuthTools(client);

const minimal = filterTools(allTools, { only: ["execute_capability", "agent_status"] });
const safe = filterTools(allTools, { exclude: ["sign_jwt", "rotate_host_key"] });
```
```

--------------------------------

### Connect Agent Tool

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-mcp/SKILL.md

Tool to authenticate an agent with a provider.

```APIDOC
## connect_agent

### Description
Connects an agent to a provider, returning an `agent_id` upon successful authentication.

### Tool
`connect_agent`

### Parameters
#### Query Parameters
- **provider** (string) - Required - The identifier of the provider to connect to.
- **capabilities** (array of strings) - Required - An array of capability names to request for the agent.
- **mode** (string) - Optional - The connection mode. Can be `"delegated"` (acts for a user, default) or `"autonomous"` (acts independently).
- **name** (string) - Optional - The name of the agent connection.
- **reason** (string) - Optional - The reason for establishing the connection.
- **preferred_method** (string) - Optional - The preferred authentication method. Defaults to `"device_authorization"` (opens browser), can also be `"ciba"` (backchannel notification).
- **login_hint** (string) - Optional - User's email address for CIBA flow.
- **binding_message** (string) - Optional - A message to bind the connection.
- **force_new** (boolean) - Optional - If true, creates a new connection even if one already exists.
```

--------------------------------

### Vercel AI SDK Integration with AgentAuthClient

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Integrate AgentAuthClient with Vercel AI SDK to generate text using agent tools. Auto-imports jsonSchema from the 'ai' package.

```typescript
import { generateText } from "ai";
import { AgentAuthClient, getAgentAuthTools, toAISDKTools } from "@auth/agent";

const client = new AgentAuthClient();
const tools = await toAISDKTools(getAgentAuthTools(client));

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "Transfer $50 to Alice",
});
```

--------------------------------

### Agent Registration

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Registers a new agent with the system.

```APIDOC
## POST /agent/register

### Description
Register an agent (Section 6.3).

### Method
POST

### Endpoint
/agent/register
```

--------------------------------

### Request Capabilities

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Allows an agent to request specific capabilities.

```APIDOC
## POST /agent/request-capability

### Description
Request capabilities (Section 6.4).

### Method
POST

### Endpoint
/agent/request-capability
```

--------------------------------

### Approve Payment

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Approve a payment, initiating the process to create a Brex card payment method, Stripe Payment Method, and a Single-use Payment Token (SPT). This endpoint is human-facing.

```APIDOC
## POST /api/payments/[id]/approve

### Description
Approve payment (creates Brex card → Stripe PM → SPT)

### Method
POST

### Endpoint
/api/payments/[id]/approve

### Parameters
#### Path Parameters
- **id** (string) - Required - The ID of the payment to approve.
```

--------------------------------

### OpenAI Function Calling Integration

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Adapt AgentAuthClient tools for OpenAI's function calling API, enabling structured outputs and preventing hallucinated arguments with 'strict: true'.

```typescript
import { AgentAuthClient, getAgentAuthTools, toOpenAITools } from "@auth/agent";

const client = new AgentAuthClient();
const { definitions, execute } = toOpenAITools(getAgentAuthTools(client), {
  strict: true, // structured outputs — prevents hallucinated arguments
});

const res = await openai.chat.completions.create({
  model: "gpt-4o",
  tools: definitions,
  messages,
});

for (const call of res.choices[0].message.tool_calls ?? []) {
  const result = await execute(call.function.name, JSON.parse(call.function.arguments));
}
```

--------------------------------

### Execute Capability

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Executes a granted capability on behalf of an agent.

```APIDOC
## POST /capability/execute

### Description
Execute a capability (Section 6.11).

### Method
POST

### Endpoint
/capability/execute
```

--------------------------------

### Connecting Agent with Constraints

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Pass constraints when connecting to an agent or requesting capabilities to restrict argument values. Constraint grants are returned in `capabilityGrants[].constraints`.

```typescript
await client.connectAgent({
  provider: "https://api.example.com",
  capabilities: [
    "read_data",
    {
      name: "transfer_money",
      constraints: {
        amount: { max: 1000, min: 1 },
        currency: { in: ["USD", "EUR"] },
      },
    },
  ],
});
```

--------------------------------

### Set Default Card

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Set a default Brex card for transactions. This endpoint is human-facing.

```APIDOC
## PUT /api/brex/cards

### Description
Set default card

### Method
PUT

### Endpoint
/api/brex/cards

### Parameters
#### Request Body
- **cardId** (string) - Required - The ID of the card to set as default.
```

--------------------------------

### List Synced Cards

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Retrieve a list of all Brex cards that have been synced with the agent. This endpoint is human-facing.

```APIDOC
## GET /api/brex/cards

### Description
List synced cards

### Method
GET

### Endpoint
/api/brex/cards
```

--------------------------------

### List All Payments

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Retrieve a list of all payments. This endpoint is human-facing and requires session authentication.

```APIDOC
## GET /api/payments

### Description
List all payments

### Method
GET

### Endpoint
/api/payments
```

--------------------------------

### Vercel AI SDK with Explicit jsonSchema

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Explicitly pass jsonSchema to toAISDKTools for Vercel AI SDK integration, avoiding dynamic imports.

```typescript
import { generateText, jsonSchema } from "ai";
import { AgentAuthClient, getAgentAuthTools, toAISDKTools } from "@auth/agent";

const client = new AgentAuthClient();
const tools = await toAISDKTools(getAgentAuthTools(client), { jsonSchema });
```

--------------------------------

### Approve Capability

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Approves or denies pending capability requests for an agent.

```APIDOC
## POST /agent/approve-capability

### Description
Approve/deny pending capabilities.

### Method
POST

### Endpoint
/agent/approve-capability
```

--------------------------------

### Capability Description

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Provides a detailed description of a specific capability.

```APIDOC
## GET /capability/describe

### Description
Describe a capability (Section 5.2.1).

### Method
GET

### Endpoint
/capability/describe
```

--------------------------------

### Anthropic Claude Integration

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Adapt AgentAuthClient tools for Anthropic Claude's tool use, processing tool calls and updating messages.

```typescript
import { AgentAuthClient, getAgentAuthTools, toAnthropicTools } from "@auth/agent";

const client = new AgentAuthClient();
const { definitions, processToolUse } = toAnthropicTools(getAgentAuthTools(client));

const res = await anthropic.messages.create({
  model: "claude-sonnet-4-20250514",
  max_tokens: 1024,
  tools: definitions,
  messages,
});

const toolUseBlocks = res.content.filter((b) => b.type === "tool_use");
if (toolUseBlocks.length > 0) {
  const results = await processToolUse(toolUseBlocks);
  messages.push({ role: "assistant", content: res.content }, { role: "user", content: results });
}
```

--------------------------------

### Filter Agent SDK Tools

Source: https://github.com/better-auth/agent-auth/blob/main/packages/sdk/README.md

Use filterTools to expose only the necessary tools for your agent, either by specifying 'only' or 'exclude' parameters.

```typescript
import { getAgentAuthTools, filterTools } from "@auth/agent";

const allTools = getAgentAuthTools(client);

const minimal = filterTools(allTools, { only: ["execute_capability", "agent_status"] });
const safe = filterTools(allTools, { exclude: ["sign_jwt", "rotate_host_key"] });
```

--------------------------------

### Key Rotation

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Rotate the cryptographic keys associated with an agent or a provider's host.

```bash
auth-agent rotate-agent-key <agent-id>
```

```bash
auth-agent rotate-host-key <issuer-url>
```

--------------------------------

### Deny Payment

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Deny a payment. This endpoint is human-facing.

```APIDOC
## POST /api/payments/[id]/deny

### Description
Deny payment

### Method
POST

### Endpoint
/api/payments/[id]/deny

### Parameters
#### Path Parameters
- **id** (string) - Required - The ID of the payment to deny.
```

--------------------------------

### Sign JWTs Manually

Source: https://github.com/better-auth/agent-auth/blob/main/skills/agent-auth-cli/SKILL.md

Manually sign a JWT for an agent, optionally scoping it to specific capabilities. This is useful for making external HTTP calls.

```bash
auth-agent sign <agent-id>
```

```bash
auth-agent sign <agent-id> --capabilities transfer_money read_data
```

--------------------------------

### Grant Capability

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Directly grants capabilities to an agent.

```APIDOC
## POST /agent/grant-capability

### Description
Directly grant capabilities.

### Method
POST

### Endpoint
/agent/grant-capability
```

--------------------------------

### Check Agent Status

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Check the current status of a connected agent using its ID.

```bash
auth-agent status <agent-id>
```

--------------------------------

### Agent Status

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Retrieves the current status of an agent.

```APIDOC
## GET /agent/status

### Description
Agent status (Section 6.5).

### Method
GET

### Endpoint
/agent/status
```

--------------------------------

### Reactivate Agent

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Reactivates an agent that has expired.

```APIDOC
## POST /agent/reactivate

### Description
Reactivate expired agent.

### Method
POST

### Endpoint
/agent/reactivate
```

--------------------------------

### Disconnect Agent

Source: https://github.com/better-auth/agent-auth/blob/main/packages/cli/README.md

Disconnect an agent from the provider using its ID.

```bash
auth-agent disconnect <agent-id>
```

--------------------------------

### Revoke Host

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Revokes a host's access and credentials.

```APIDOC
## POST /host/revoke

### Description
Revoke a host.

### Method
POST

### Endpoint
/host/revoke
```

--------------------------------

### Rotate Agent Key

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Rotates the cryptographic key associated with an agent.

```APIDOC
## POST /agent/rotate-key

### Description
Rotate agent key (Section 6.8).

### Method
POST

### Endpoint
/agent/rotate-key
```

--------------------------------

### Agent Session Resolution

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Resolves an agent JWT into a session JSON object. This is useful for custom route handlers that need to authenticate and authorize agent requests.

```APIDOC
## GET /agent/session

### Description
Resolve agent JWT to session JSON (for custom route handlers).

### Method
GET

### Endpoint
/agent/session
```

--------------------------------

### Introspect Token

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Introspects a token to determine its validity and associated information.

```APIDOC
## POST /agent/introspect

### Description
Introspect a token.

### Method
POST

### Endpoint
/agent/introspect
```

--------------------------------

### Revoke Agent

Source: https://github.com/better-auth/agent-auth/blob/main/packages/agent-auth/README.md

Revokes an agent's access and credentials.

```APIDOC
## POST /agent/revoke

### Description
Revoke an agent.

### Method
POST

### Endpoint
/agent/revoke
```

--------------------------------

### Poll Payment Status

Source: https://github.com/better-auth/agent-auth/blob/main/examples/brex-agent/README.md

Poll the status of a payment. This endpoint is agent-facing and requires an Agent Auth bearer token.

```APIDOC
## GET /api/payments/[id]

### Description
Poll payment status (pending/approved/denied)

### Method
GET

### Endpoint
/api/payments/[id]

### Parameters
#### Path Parameters
- **id** (string) - Required - The ID of the payment to poll.
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.