A single integration to meter, cap, and route autonomous tool calls.
1. verify the nx_dev_ key (Redis key-cache GET)
2. per-key rate window (Redis Lua)
3. balance + rolling-24h cap
+ atomic deduct (Redis Lua, one script)
4. publish the CHARGED event (SQS — AWAITED, not
fire-and-forget; a failed
publish is a 503, not a
free call)
5. commit the charge intent (Redis Lua)
6. sign (Ed25519) and forward to the creator, then stream
the response back untouched
A pre-stream non-2xx or timeout reverses the deduction.
Once bytes stream, the charge stands.Six steps inside the gateway, in order. Every one of them completes before a byte reaches the creator, and the response streams back untouched.
nx_dev_ key RedisOne key-cache GET.
A request counter, not money.
One script. No check-then-deduct race.
Awaited, not fire-and-forget. A failed publish is a 503, not a free call.
The deduction is now bound to this request.
Forwarded to the creator, then the response streams back untouched. A pre-stream non-2xx or timeout reverses the deduction. Once bytes stream, the charge stands.
One Redis Lua script does the balance check, the rolling-24h cap check and the deduction together, before the request leaves the gateway. No check-then-deduct race. We publish no latency figure: the only numbers measured so far are from a dev stack and a load run that did not meet its target, so quoting one would be a guess.
Every API key has a rolling 24-hour spend cap that you set. A cap of zero turns it off. The cap is enforced inside the same atomic script as the deduction. A key that hits its cap gets HTTP 402 and the call never reaches the creator.
Charge events ride SQS to a worker that nets them into 5-minute rollup batches and commits them to an append-only, double-entry PostgreSQL journal in integer micro-USD. The ledger is append-only: database triggers refuse updates and deletes.
How a call is authorized: budget, Ed25519 signature, settlement. The decision is the product.
Open productPOST /v1/mcp, the headers, every error code, and the creator-side contract as it stands today.
Open documentationNo published tools yet. What exists, the routing-name shape, and what this page will read when a registry is live.
Open marketplace