Discover
What resources and operations exist right now?
The Agent tool plane for the existing internet
Every API,Agent-ready.
Realmroot turns existing OpenAPI services into secure, discoverable tools for Agents—without making every service maintain a separate Agent integration.
OpenAPI stays the contractLive discoveryPrecise authorityDirect API calls
The Agent Tool Plane
Reuse the API.Remove the reintegration.
Resource teams keep their APIs, OpenAPI contracts, and authorization boundaries. Realmroot registers, discovers, and equips those capabilities for Agents.
Discover live, not from a static catalog.
Agents find available resources and current operations at task time instead of carrying a growing tool list in prompts or clients.
Live contract → current capabilityInvoke generically, not adapter by adapter.
OpenAPI remains the operation and scope vocabulary. The Realmroot Skill and Restish provide one consistent way to call it.
One Skill + one generic CLICompound capability as resources join.
Every registered resource expands what Agents can do without adding Agent-specific backend code to the service.
Register once → composable by AgentsOne product, two inseparable layers
Capability above.Trust beneath.
Tools without trust are unsafe. Identity without tools never completes the task. Realmroot combines both into one explainable, revocable, direct call.
Discover broadly. Authorize precisely. Call directly.Agent Tool Plane
Agents find the right tool and complete the operation against its live contract.
Resource registrationLive discoveryGeneric invocationUnbounded composition
The IDP is the foundation: stable principals, precise authority, and an auditable lifecycle for every tool call.
Agent identityController relationGrant approvalRevocation & audit
Clear boundaries scale safely
The original servicekeeps the final decision.
Realmroot is not an HTTP proxy or a copied business-permission database. It coordinates discovery, identity, and delegated authority while the resource server enforces its own rules.
Realmroot owns
- Registration and discovery
- Stable Agent identity
- Controller and grant lifecycle
- Short-lived token coordination
- Approval, revocation, and audit
AUTHORITY→The Agent calls the original service directly with sufficient identity and authority
APIThe resource server owns
- API and OpenAPI contract
- Business scope semantics
- Object-level permissions
- Data and business rules
- Final allow / deny
Open contracts and standards. No proprietary Agent tunnel.
OpenAPIOpenID ConnectOAuth 2.0RFC 8693DPoP
Value compounds with every resource
One integration.Every participant wins.
Agent users
Complete more real tasks without handing over a personal API key.
Agent developers
Use one Skill and a generic CLI instead of a growing set of custom adapters.
Resource teams
Turn the existing API and OpenAPI into Agent capability without a parallel surface.
Product teams
Reuse hosted identity, OIDC, account, and administration infrastructure.
Security teams
Keep principals, narrow scopes, short-lived DPoP, revocation, and audit explicit.
Journal
Building the Agent capability network
The API already exists. Do not rebuild it for Agents.
OpenAPI can remain the tool contract while Realmroot adds discovery, stable Agent identity, and precise delegated authority.
Discover broadly. Authorize precisely. Call directly.
The three-part operating model that lets an Agent find useful APIs without turning discovery into ambient authority or Realmroot into a proxy.
Why your product needs an identity root
Authentication is only the front door. A product also needs one explicit boundary for users, applications, policy, APIs, and delegated agents.
Every API, Agent-ready.
Make your APIan Agent capability.
Keep the service boundary you already trust. Add discovery, identity, and precise delegated authority with Realmroot.