Skip to content
SHPBL

Third door

The HTTP API

The method ships three ways, and they are the same method. The Evaluation edition runs it offline from a zip. The MCP server runs it inside the chatbot you already use. This runs it over ordinary HTTP JSON — for a CI job, a backend, a script, anything with no agent in the loop.

Nothing here is a second product. The endpoint calls the identical thirteen tool handlers the MCP server advertises: the same procedure, the same conformance rules, the same hands-off boundaries, the same key and meter. The reasoning is still yours — this server never calls a model. Read the method itself in the user's manual.

The contract

Endpoints
GET https://shpbl.com/api/public/v1 for the descriptor (name, version, instructions, tools), GET https://shpbl.com/api/public/v1/tools for the list, POST https://shpbl.com/api/public/v1/tools/{tool} to run one.
Auth
None for the free lane. A Practitioner key travels as `Authorization: Bearer shpbl_mcp_…`, or as `key` in the body — the same key, the same meter, the same register as the MCP doors.
Response
`{ tool, ok, content, structuredContent? }`. `content` is the tool's own text, verbatim. A refusal returns 422 with the tool's wording and its `Next step:` line; bad arguments return 400 with the failing field.
Pacing
120 calls a minute per address on the transport, plus each tool's own metering underneath. A throttled call is refused before any work starts and charges nothing.
Recorded
Every call lands in the same register the MCP doors write to, so /pulse counts API runs beside agent runs.

Four calls, in order

1 · Read the tool list

curl https://shpbl.com/api/public/v1/tools

2 · Audit, free, no key

curl -X POST https://shpbl.com/api/public/v1/tools/evaluate_repo \
  -H 'content-type: application/json' \
  -d '{ "repo": "owner/name" }'

3 · Search the library, keyed

curl -X POST https://shpbl.com/api/public/v1/tools/library_search \
  -H 'content-type: application/json' \
  -H 'Authorization: Bearer shpbl_mcp_YOUR_KEY' \
  -d '{ "scope": "catalog", "query": "idempotent webhook receiver" }'

4 · Walk a run from code

const call = async (tool, args) => {
  const res = await fetch("https://shpbl.com/api/public/v1/tools/" + tool, {
    method: "POST",
    headers: {
      "content-type": "application/json",
      // Omit for the free lane. Same key as the MCP endpoints.
      Authorization: "Bearer " + process.env.SHPBL_KEY,
    },
    body: JSON.stringify(args),
  });
  return res.json(); // { tool, ok, content, structuredContent? }
};

// The conductor walks one step per call, exactly as it does over MCP.
const card = await call("run_gauntlet", { repo: "owner/name" });
const step1 = await call("run_gauntlet", { repo: "owner/name", step: 1 });

One step per call, in the order the tool returns them — the procedure is enforced on the server, not suggested. `run_gauntlet` still refuses step 2 and beyond without the `ledger_digest` from the step before it, and still pauses for a human acknowledgement on its checkpoints. An API caller is held to the same discipline as an agent.

The thirteen tools

POST /tools/…LaneWhat it returns
welcomefreeThis orientation: the tool menu, the example commands, and where the manual lives.
list_reposfreeReal repository names — yours, an owner's public ones, or everything a token can see — and whether a pull request may be opened there.
method_protocolfreeThe whole discipline in words: how an audit, a repair and a harvest are conducted. Fetched once, cached, so later calls carry source instead of instructions.
evaluate_repofreeThe audit: a deterministic survey, every capability found with its file and line, a benchmark against the audited corpus, and the library rows that already cover what the repo does.
fix_repofreeVerbatim source of the files you name, plus the ordered remediation protocol, so your agent writes real diffs against real lines.
harvest_repofreeThe tree in stable batches with the harvest protocol and a citable run seal. Call it with `estimate: true` first — that pre-flight is free and reads no source.
run_gauntletfreeThe conductor: audit, repair order, harvest and closing report from one tool, one step per turn, checking in with you as it goes.
library_indexfreeWhat SHPBL publishes: editions and prices, the seven strategy volumes, the public downloads, the case studies of real runs.
selfcheck_mcpfreeSHPBL's own audit, run against this live server, one pass or fail per verification axis. We hold ourselves to the method we sell.
subscription_statusfreeThe lanes, the prices, which tools meter, and — if you hold a key — this month's usage.
library_search$39/moThe capability library as cited rows: the engineered catalog and the discovery vault, searched in plain words before you write anything new.
library_document$39/moOne long document read paged: a strategy volume in full, the catalog outline, the report template, the standing order.
write_to_repo$39/moThe result kept: repairs, ledgers and reports landed on a branch as a pull request for a human to merge. Never a push to the default branch.

Free lane runs every stage at full depth and keeps nothing. A Practitioner key at $39 a month opens the library rows in full and writes the result back into your own repository — take a key. Questions, ideas or a story about what it found: dev@cmpsbl.com.