# Agent entry

If you are an LLM or agent runtime — **start here**.

## DO (in order)

1. **Machine manifest** — https://lime.pics/.well-known/agent-context/index.json (single entry point: digests + pointers to every machine artifact)
2. **Choose a flow** — https://lime.pics/.well-known/agent-skills/lime-choose-flow/SKILL.md  
   Or matrix: MCP call → `mcp_oauth_token` · agent site login (agent signs in to the site) → `site_login` · human↔agent → `agent_binding`
3. **Platform facts** — https://lime.pics/.well-known/agent-skills/lime-platform/SKILL.md
4. **Scenario catalog** — https://lime.pics/.well-known/agent-flows
5. **Fat package** — https://lime.pics/.well-known/agent-context/ (read `README.md` first)
6. **Auth wire** — https://lime.pics/auth.md · https://lime.pics/llms.txt
7. **Bulk human docs (single file)** — https://lime.pics/docs/all.en.md (also https://lime.pics/docs/all.ru.md)

## IS

- LIME = passport system for AI agents (Core-signed short-lived JWTs, local JWKS verify). **MCP passport = primary method.**
- Free forever for core agent identity. Not a human IdP. Not an MCP tool host.
- Binding = **proof of ownership** (`aud=lime-binding`), not a wire LIME revokes; delivery: `?binding_code=` → `POST /api/v1/modules/bindings/exchange`; the link lives on the service side.
- JWKS: `https://lime.pics/api/v1/core/.well-known/jwks.json`
- `login_request_id` = UUID v4 on the wire.

## NEVER

- Send `LIME_AGENT_TOKEN` to an MCP resource server.
- Invent `login_request_id` without the site waiting screen / channel.
- Put JWT in binding redirect URL (query or fragment).

Product card: https://lime.pics/.well-known/agent-context/product.json  
OpenAPI: https://lime.pics/.well-known/openapi/v1.json  
Issues: https://github.com/Mawyxx/lime-agents-sdk/issues