Protocol adapter · 2 of 3
Any REST endpoint. Same policy runtime.
The @aarmos/adapter-openapi package brokers any REST call the same way MCP tools are brokered — through your local policy gate, with signed AVAR receipts. Point it at a spec URL or a bare endpoint.
@aarmos/adapter-openapi.Install
Nothing separate to install — the adapter ships inside the signed CLI artifact. Once the CLI is on your machine, @aarmos/adapter-openapi is available to your policy.
How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in authorizes your workspace for evaluation automatically — no person to wait for — and the software is available the moment you choose to install it. Nothing downloads until you ask for it, and nothing is published to the public npm registry today. The open @avar-standard/* verifier packages are unaffected and remain publicly installable, so anyone can check a receipt without our software.
Wire it into policy
# policy.aarmos.toml
[[adapters.openapi]]
name = "github"
spec = "https://api.github.com/openapi.json"
scopes = ["read:repos", "read:issues"]
gates.destructive = "confirm"
rate.per_minute = 30
[[adapters.openapi]]
name = "billing"
url = "https://api.example.com/v1"
scopes = ["read:invoices"] # writes not scoped — writes are refusedRun
aarmos run my-agent
▸ tool: openapi://github/list_issues (adapter: openapi) ✓ scoped
✓ AVAR receipt: .aarmos/avar/…What the adapter enforces
- Every method + path is a distinct scope. Writes require an explicit write scope.
- Dry-run resolves the request without sending it — you see the full URL, method, headers, and body before it fires.
- Rate limits enforce per-tool at runtime.
- Request URL, response status, and response body hash are recorded in the AVAR chain.
- Auth secrets stay in the local vault — Aarmos never proxies them through a server.
Enforcement runs in this device's runtime — tamper-evident, not tamper-resistant against a modified build. See the threat model.