@xberg-io/opencode-liter-llm 2.2.3 → 2.3.0

package/.pi/skills/liter-llm-using-the-mcp-server/SKILL.md

@@ -0,0 +1,91 @@
+---
+description: Use when calling LLM APIs through the liter-llm MCP server's 22 tools, and to decide when MCP beats the CLI or SDK. Covers the tool surface, the auto-installing launcher, and authentication.
+name: liter-llm-using-the-mcp-server
+---
+
+<!--
+AI-RULEZ :: GENERATED FILE — DO NOT EDIT
+Content-Hash: blake3:6925dd58f9790a1cc57f093167cf3b430886393ff3792d28003f15269b5546a2
+Source-Hash: blake3:88c87867f5079f6c8fcb582aee913cca4f6feefe541c5361d2307a9b45233f97
+Schema-Version: v1
+-->
+
+# Using the MCP Server
+
+The `liter-llm` MCP server exposes 22 tools that mirror the proxy's REST
+endpoints, so an MCP-compatible client (Claude Code, Claude Desktop) can call
+174 LLM providers as tools with no glue code.
+
+## Standalone skill installation
+
+Installing this skill alone does not register an MCP server or include the plugin launcher.
+Install the CLI (for example, `brew install xberg-io/tap/liter-llm`), then configure your MCP client with
+`liter-llm mcp --transport stdio` as its stdio command. The full product plugin supplies registration where
+the runtime supports MCP.
+
+## How it runs in this plugin
+
+The plugin auto-registers the server. Its command is the bundled launcher
+`scripts/mcp-launch.sh`, which execs `liter-llm mcp --transport stdio`. On first
+run the launcher resolves a `liter-llm` binary: it reuses one on `PATH`, then
+tries `npx`/`uvx`, then Homebrew, then downloads a prebuilt
+from the tool's latest GitHub release. Override with
+`LITER_LLM_LAUNCHER=auto|npx|uvx|brew|download`.
+
+To run it manually:
+
+```bash
+liter-llm mcp --transport stdio          # for Claude Code / Claude Desktop
+liter-llm mcp --transport http --port 3001
+```
+
+## Configure model routing
+
+Provider-backed tools use the proxy model registry. Create `liter-llm-proxy.toml` in the
+working directory, or pass `--config /absolute/path/liter-llm-proxy.toml` when launching:
+
+```toml
+[[models]]
+name = "gpt-4o"
+provider_model = "openai/gpt-4o"
+```
+
+Supply `OPENAI_API_KEY` in the MCP process environment, then call `chat` using the
+configured name `gpt-4o`. `list_models` shows configured names; an unknown model is a
+request error. Missing credentials are also reported on provider-backed requests.
+Gemini filters host credentials: install with `--skip-settings` and configure the selected
+provider through `gemini extensions config liter-llm "OpenAI key"`. Local stdio does not
+need a separate proxy virtual key.
+
+## The 22 tools
+
+Modality tools: `chat`, `embed`, `generate_image`, `speech`, `transcribe`,
+`moderate`, `rerank`, `search`, `ocr`.
+
+Model listing: `list_models`.
+
+File operations: `create_file`, `list_files`, `retrieve_file`, `delete_file`,
+`file_content`.
+
+Batch operations: `create_batch`, `list_batches`, `retrieve_batch`,
+`cancel_batch`.
+
+Responses API: `create_response`, `retrieve_response`, `cancel_response`.
+
+## Authentication
+
+Local stdio trusts the invoking local client by default, so the registered command starts
+without extra proxy authentication configuration. Provider API keys still come from environment
+variables and are needed for provider-backed requests.
+
+To apply a restricted virtual key, configure `mcp.stdio_key_id`; an unknown key fails startup.
+Set `mcp.stdio_trust_local = false` to require an explicit virtual key. HTTP transport retains
+its authentication policy; the local stdio default does not disable HTTP authorization.
+
+## When to prefer MCP over the CLI or SDK
+
+- **Prefer MCP** inside an agent session: the agent invokes tools directly, with
+  no code to write or process to manage.
+- **Prefer the SDK** when building application software in a specific language.
+- **Prefer the proxy** when many apps or teams need a shared OpenAI-compatible
+  endpoint with keys, budgets, and rate limits.

package/.pi/skills/liter-llm-using-the-mcp-server/index.md

@@ -0,0 +1,10 @@
+<!--
+AI-RULEZ :: GENERATED FILE — DO NOT EDIT
+Content-Hash: blake3:f82f5f5a906c27ad7e64d5944e1ab1c02685f1df4d61b3b312a8b1d474dfb465
+Source-Hash: blake3:88c87867f5079f6c8fcb582aee913cca4f6feefe541c5361d2307a9b45233f97
+Schema-Version: v1
+-->
+
+# Concepts
+
+* [Using The Mcp Server](SKILL.md) - Use when calling LLM APIs through the liter-llm MCP server's 22 tools, and to decide when MCP beats the CLI or SDK. Covers the tool surface, the auto-installing launcher, and authentication.

package/README.md

@@ -17,13 +17,50 @@ Self-host:
 /plugin install liter-llm@liter-llm
 ```
 
+### Kimi installation and compatibility
+
+From a checkout of this repository, install with the Python Kimi CLI version used for native
+plugin validation:
+
+```sh
+uvx --from kimi-cli==1.51.0 kimi plugin install ./plugin
+```
+
+Native plugin installation was validated with Python Kimi CLI 1.51.0. The replacement
+`@moonshot-ai/kimi-code` 2.1.1 does not provide a `plugin` CLI subcommand; its interactive
+plugin loading has not been verified. These results do not establish compatibility with
+newer Kimi releases.
+
+### Pi
+
+From a checkout of this repository, run:
+
+```bash
+pi install ./plugin
+```
+
+Once a plugin release includes Pi support, use the shared OpenCode/Pi npm package:
+
+```bash
+pi install npm:@xberg-io/opencode-liter-llm
+```
+
+Pi discovers skills from `.pi/skills` and prompt templates from `.pi/prompts`.
+Use `/liter-llm-chat` and `/liter-llm-stream` to start a task.
+Install the CLI separately using the instructions below. The Pi package does not
+register MCP servers, hooks, or executable extensions. The MCP integration
+sections below apply to clients with MCP support.
+
+Git installs use the repository root's `package.json` resource paths. GitHub
+hosts the checkout resources; the existing npm plugin release publishes the same
+Pi content alongside the OpenCode adapter. No separate Pi release job is needed.
+
 ### Binary requirement
 
 The bundled MCP launcher (`scripts/mcp-launch.sh`) resolves a `liter-llm` binary
 automatically on first run: it reuses one already on `PATH`, then tries
-`npx`/`uvx`, then Homebrew, then a checksum-verified prebuilt binary from the
-tool's latest GitHub release. No manual install is required to use the MCP
-server.
+`npx`/`uvx`, then Homebrew, then a prebuilt binary from the
+tool's latest GitHub release. If every method fails, install a CLI with MCP support using the commands below.
 
 To install the CLI yourself (also gives you the proxy server):
 
@@ -32,7 +69,7 @@ brew install xberg-io/tap/liter-llm
 # or from crates.io (compiles from source):
 cargo install liter-llm-cli
 # or run it without a persistent install (the CLI proxy package self-installs the binary):
-npx @xberg-io/liter-llm-cli --help
+pnpm dlx @xberg-io/liter-llm-cli --help
 uvx --from liter-llm-cli liter-llm --help
 # or download a prebuilt binary from the latest GitHub release:
 #   https://github.com/xberg-io/liter-llm/releases/latest
@@ -48,12 +85,28 @@ Set provider API keys via environment variables (`OPENAI_API_KEY`,
 | Skill | Trigger |
 |-------|---------|
 | **liter-llm** | Universal LLM client surface — chat, streaming, tools, embeddings, image/audio, moderation, search, OCR, reranking — across 174 providers and 14 language bindings. Use when writing LLM code in any supported language or choosing between the SDK, proxy, and MCP server. |
-| **calling-llms** | Use when sending chat completions and routing to a specific provider via the `provider/model` prefix. |
-| **streaming-responses** | Use when streaming tokens incrementally over SSE or async iterators. |
-| **tool-calling** | Use when defining functions/tools for the model to call, or requesting structured outputs. |
-| **embeddings-and-search** | Use when generating embeddings, calling the web-search providers, or running OCR over documents. |
-| **running-the-proxy** | Use when running the `liter-llm api` OpenAI-compatible gateway with virtual keys, rate limits, and budgets. |
-| **using-the-mcp-server** | Use when calling LLM APIs through the 22 MCP tools, and to decide when MCP beats the CLI or SDK. |
+| **liter-llm-calling-llms** | Use when sending chat completions and routing to a specific provider via the `provider/model` prefix. |
+| **liter-llm-streaming-responses** | Use when streaming tokens incrementally over SSE or async iterators. |
+| **liter-llm-tool-calling** | Use when defining functions/tools for the model to call, or requesting structured outputs. |
+| **liter-llm-embeddings-and-search** | Use when generating embeddings, calling the web-search providers, or running OCR over documents. |
+| **liter-llm-running-the-proxy** | Use when running the `liter-llm api` OpenAI-compatible gateway with virtual keys, rate limits, and budgets. |
+| **liter-llm-using-the-mcp-server** | Use when calling LLM APIs through the 22 MCP tools, and to decide when MCP beats the CLI or SDK. |
+
+## CLI release compatibility
+
+Published CLI 2.2.3 predates the local-stdio trust and deferred-provider-credential fixes.
+Until a CLI release includes them, use a source build for startup without an extra auth config:
+
+```sh
+cargo install --git https://github.com/xberg-io/liter-llm \
+  --rev f14fb8862f9cc73e2c4ab38a2876efe77fab8bf4 --locked liter-llm-cli
+```
+
+Put the installed binary on the assistant's PATH. If a plugin has already cached an older binary,
+remove that plugin's `bin/liter-llm` (or `bin/liter-llm.exe`) before retrying so it selects the source build.
+The released 2.2.3 binary requires `mcp.stdio_trust_local = true` or a configured `mcp.stdio_key_id`;
+configured providers may also require credentials at startup. The source build defers missing provider
+credentials until a request uses that provider. HTTP authentication remains configured separately.
 
 ## MCP server
 
@@ -75,14 +128,16 @@ through to the next on any failure (override with
 `LITER_LLM_LAUNCHER=auto|npx|uvx|brew|download`):
 
 1. Any working `liter-llm` already cached in the plugin's `bin/` or on `PATH`.
-2. `npx @xberg-io/liter-llm-cli` — the published npm CLI proxy package self-installs/runs
+2. `pnpm dlx @xberg-io/liter-llm-cli` — the published npm CLI proxy package self-installs/runs
    the binary (probed first; falls through if not published yet).
 3. `uvx --from liter-llm-cli liter-llm` — the published PyPI CLI proxy package
    (probed first; falls through if not published yet).
 4. `brew install xberg-io/tap/liter-llm` if Homebrew is available.
-5. A checksum-verified prebuilt binary from the tool's *latest* GitHub release
-   (`liter-llm-<latest-version>-<target>.tar.gz`, verified against
-   `SHA256SUMS-<latest-version>.txt`). The tool version is resolved from the
+5. A prebuilt binary from the tool's *latest* GitHub release
+   (`liter-llm-<latest-version>-<target>.tar.gz`). Its hash is checked against
+   `SHA256SUMS-<latest-version>.txt` when the manifest and a hashing tool are available.
+   Missing checksums cause an explicit warning and HTTPS-only download fallback;
+   a hash mismatch fails. The tool version is resolved from the
    GitHub API — it is independent of the plugin's own version.
 
 The `@xberg-io/*` / `liter-llm` binding packages (NAPI-RS / PyO3) are language
@@ -152,6 +207,22 @@ Embed these five paragraphs with openai/text-embedding-3-small and rank them aga
 
 The plugin version tracks the liter-llm core release (`Cargo.toml`). See [CHANGELOG.md](../CHANGELOG.md) for release notes.
 
+## Maintaining the plugin
+
+Edit `plugin/.ai-rulez` sources, then run these commands from the repository root
+with a Pi-capable ai-rulez v5 binary installed:
+
+```bash
+task plugin:generate
+task plugin:verify
+task plugin:test
+```
+
+CI builds the generator from a pinned source revision and verifies the generated
+bundles, OpenCode tools, and actual npm archive before publication. The shared
+npm package publishes both OpenCode and Pi resources; Hermes uses its existing
+PyPI release job. GitHub hosts the remaining plugin bundles and marketplace indexes.
+
 ## License
 
 MIT. Skill content references the upstream [liter-llm](https://github.com/xberg-io/liter-llm) repository.
@@ -160,3 +231,69 @@ MIT. Skill content references the upstream [liter-llm](https://github.com/xberg-
 
 - **Marketplace**: this repo — `/plugin marketplace add xberg-io/liter-llm`
 - **Upstream**: [xberg-io/liter-llm](https://github.com/xberg-io/liter-llm)
+
+## Generated runtime bundles
+
+`plugin/.ai-rulez/config.toml` loads `config.plugins.toml` through the `plugins` layer;
+skills, commands and runtime adapters are authored alongside it. AI-Rulez 5.3.0 generates
+all eleven supported runtimes: Claude, Cursor, Codex, Gemini, Kimi, OpenCode, Factory,
+Hermes, Pi, Agent Plugins and Copilot. Codex ships both manifest layouts; repository-root
+Claude and Codex marketplace indexes point to the `plugin` bundle. Cursor also has a marketplace index.
+
+Pi packages skills and prompts without MCP integration. Copilot packages skills and MCP configuration, but does not package slash commands or hooks.
+Hermes includes a Python package under `.hermes/package`; OpenCode and Pi share the npm package.
+The Agent Plugins manifest uses the stable 1.0 specification. Runtime capabilities differ;
+install the CLI before using skills in a runtime without MCP registration.
+
+Run `ai-rulez generate --plugin` from the repository root to regenerate and
+`ai-rulez verify --plugin` to compare current source output and provenance.
+The release workflow packages every runtime into a deterministic archive, checksums,
+and marketplace metadata; npm and PyPI retain their existing publishing jobs.
+
+## Hermes runtime setup
+
+Install the product CLI with MCP support and put it on Hermes' PATH before using the plugin.
+The Hermes adapter registers every bundled skill under the product namespace and provides
+`liter_llm_call`, which calls the selected native MCP tool with `tool_arguments` through a local
+stdio session. Select `tool: "list_tools"` first to inspect the server's exact request schemas. Hermes skills are selected explicitly; they are not automatically appended to the
+system prompt. Enable the plugin in Hermes configuration; project plugins also require
+`HERMES_ENABLE_PROJECT_PLUGINS=true`.
+
+The bridge uses the installed CLI directly. The auto-installing launchers used by other MCP clients
+are not included in the Hermes Python wheel. Provider credentials are inherited from the environment,
+and are needed for provider-backed requests. Missing CLIs, unavailable tools and model preparation
+fail with an actionable request error. CLI result data remains untrusted document content.
+
+## Public Agent Skills
+
+The repository-root `skills/` directory contains the same generated skills and supporting
+resources as `plugin/skills/`. Install them independently of a plugin runtime:
+
+```sh
+npx skills add xberg-io/liter-llm --skill liter-llm
+```
+
+Edit `plugin/.ai-rulez/skills`, then run `task plugin:generate` to regenerate runtime
+bundles and synchronize the public export. `task plugin:verify` checks both projections;
+`task plugin:skills:test` verifies resource freshness, ownership and symlink protection.
+The public ownership manifest records SHA-256 hashes of every exported file.
+
+## Gemini provider credentials
+
+Gemini filters sensitive shell environment variables. This extension declares provider keys
+through native sensitive settings; values are entered in Gemini and stored in its keychain.
+To install without entering credentials for every provider:
+
+```sh
+gemini extensions install ./plugin --skip-settings
+gemini extensions config liter-llm "OpenAI key"
+```
+
+Configure only the provider used by your `liter-llm-proxy.toml` model routing. The local stdio
+server can start without provider credentials; provider-backed requests require a configured
+model and its credentials. For a provider with another variable name, add an appropriate
+`[[plugin.gemini.settings]]` entry in the source and regenerate, or configure a Gemini MCP
+server override. Never put key values in source or a generated manifest.
+
+Launcher and visual assets are authored in `plugin/.ai-rulez/scripts/` and
+`plugin/.ai-rulez/assets/`; `task plugin:generate` copies them into the runtime bundle.

package/package.json

@@ -1,32 +1,87 @@
 {
-  "name": "@xberg-io/opencode-liter-llm",
-  "version": "2.2.3",
+  "author": {
+    "email": "contact@xberg.io",
+    "name": "Kreuzberg, Inc.",
+    "url": "https://xberg.io"
+  },
+  "dependencies": {
+    "@opencode/plugin": "^2.0.26"
+  },
   "description": "Universal LLM API client for 174 providers — chat, streaming, tools, embeddings, search, OCR, plus an OpenAI-compatible proxy and an MCP server.",
+  "exports": {
+    ".": "./.opencode/plugins/liter-llm.js"
+  },
+  "files": [
+    ".opencode/ai-rulez-bundle.json",
+    ".opencode/ai-rulez-content.js",
+    ".opencode/commands/liter-llm-chat.md",
+    ".opencode/commands/liter-llm-stream.md",
+    ".opencode/plugins/liter-llm.js",
+    ".opencode/skills/liter-llm-calling-llms/SKILL.md",
+    ".opencode/skills/liter-llm-calling-llms/index.md",
+    ".opencode/skills/liter-llm-embeddings-and-search/SKILL.md",
+    ".opencode/skills/liter-llm-embeddings-and-search/index.md",
+    ".opencode/skills/liter-llm-running-the-proxy/SKILL.md",
+    ".opencode/skills/liter-llm-running-the-proxy/index.md",
+    ".opencode/skills/liter-llm-streaming-responses/SKILL.md",
+    ".opencode/skills/liter-llm-streaming-responses/index.md",
+    ".opencode/skills/liter-llm-tool-calling/SKILL.md",
+    ".opencode/skills/liter-llm-tool-calling/index.md",
+    ".opencode/skills/liter-llm-using-the-mcp-server/SKILL.md",
+    ".opencode/skills/liter-llm-using-the-mcp-server/index.md",
+    ".opencode/skills/liter-llm/SKILL.md",
+    ".opencode/skills/liter-llm/index.md",
+    ".pi/prompts/liter-llm-chat.md",
+    ".pi/prompts/liter-llm-stream.md",
+    ".pi/skills/liter-llm-calling-llms/SKILL.md",
+    ".pi/skills/liter-llm-calling-llms/index.md",
+    ".pi/skills/liter-llm-embeddings-and-search/SKILL.md",
+    ".pi/skills/liter-llm-embeddings-and-search/index.md",
+    ".pi/skills/liter-llm-running-the-proxy/SKILL.md",
+    ".pi/skills/liter-llm-running-the-proxy/index.md",
+    ".pi/skills/liter-llm-streaming-responses/SKILL.md",
+    ".pi/skills/liter-llm-streaming-responses/index.md",
+    ".pi/skills/liter-llm-tool-calling/SKILL.md",
+    ".pi/skills/liter-llm-tool-calling/index.md",
+    ".pi/skills/liter-llm-using-the-mcp-server/SKILL.md",
+    ".pi/skills/liter-llm-using-the-mcp-server/index.md",
+    ".pi/skills/liter-llm/SKILL.md",
+    ".pi/skills/liter-llm/index.md",
+    "README.md",
+    "assets/",
+    "scripts/"
+  ],
+  "homepage": "https://xberg.io",
   "keywords": [
+    "embeddings",
     "llm",
+    "mcp",
     "openai",
-    "proxy",
-    "embeddings",
-    "mcp"
+    "pi-package",
+    "proxy"
   ],
-  "homepage": "https://xberg.io",
+  "license": "MIT",
+  "main": ".opencode/plugins/liter-llm.js",
+  "name": "@xberg-io/opencode-liter-llm",
+  "pi": {
+    "prompts": [
+      "./.pi/prompts/liter-llm-chat.md",
+      "./.pi/prompts/liter-llm-stream.md"
+    ],
+    "skills": [
+      "./.pi/skills/liter-llm-calling-llms",
+      "./.pi/skills/liter-llm-embeddings-and-search",
+      "./.pi/skills/liter-llm-running-the-proxy",
+      "./.pi/skills/liter-llm-streaming-responses",
+      "./.pi/skills/liter-llm-tool-calling",
+      "./.pi/skills/liter-llm-using-the-mcp-server",
+      "./.pi/skills/liter-llm"
+    ]
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/xberg-io/liter-llm"
   },
-  "license": "MIT",
   "type": "module",
-  "main": ".opencode/plugins/liter-llm.js",
-  "exports": {
-    ".": "./.opencode/plugins/liter-llm.js"
-  },
-  "files": [
-    ".opencode/",
-    "assets/",
-    "README.md",
-    "scripts/"
-  ],
-  "dependencies": {
-    "@opencode/plugin": "^2.0.20"
-  }
-}
+  "version": "2.3.0"
+}

package/scripts/mcp-launch.sh

@@ -48,12 +48,13 @@ if have "$BINARY_NAME"; then
 fi
 
 if want npx && have npx; then
-  log "probing npx $NPM_PKG@latest ..."
+  log "resolving npx $NPM_PKG@latest ..."
   scratch="$(mktemp -d)"
-  if (cd "$scratch" && npx -y "$NPM_PKG@latest" --version >/dev/null 2>&1); then
-    log "launching via npx $NPM_PKG@latest"
-    cd "$scratch"
-    exec npx -y "$NPM_PKG@latest" "$@"
+  # Resolve in an empty project, then execute the selected binary in the caller's cwd. ~keep
+  if npm_bin="$(cd "$scratch" && npx -y --package "$NPM_PKG@latest" --call "command -v ${BINARY_NAME%.exe}" 2>/dev/null)" && runs_ok "$npm_bin"; then
+    rm -rf "$scratch"
+    log "launching npm package binary $npm_bin"
+    exec "$npm_bin" "$@"
   fi
   rm -rf "$scratch"
   log "npx $NPM_PKG not available (no CLI bin yet); falling through"

package/.opencode/skills/using-the-mcp-server/SKILL.md

@@ -1,63 +0,0 @@
----
-name: using-the-mcp-server
-description: Use when calling LLM APIs through the liter-llm MCP server's 22 tools, and to decide when MCP beats the CLI or SDK. Covers the tool surface, the auto-installing launcher, and authentication.
----
-
-<!--
-AI-RULEZ :: GENERATED FILE — DO NOT EDIT
-Content-Hash: blake3:bb42aaf38dca362b154240ddbee4e03bb76614ff452facc744f7d560cfc6d523
-Source-Hash: blake3:3cb955aedbbbd51d9b5f60a411d90b9386534c5f14bf20a056bef60f7dace49e
-Schema-Version: v1
--->
-
-# Using the MCP Server
-
-The `liter-llm` MCP server exposes 22 tools that mirror the proxy's REST
-endpoints, so an MCP-compatible client (Claude Code, Claude Desktop) can call
-174 LLM providers as tools with no glue code.
-
-## How it runs in this plugin
-
-The plugin auto-registers the server. Its command is the bundled launcher
-`scripts/mcp-launch.sh`, which execs `liter-llm mcp --transport stdio`. On first
-run the launcher resolves a `liter-llm` binary: it reuses one on `PATH`, then
-tries `npx`/`uvx`, then Homebrew, then downloads a checksum-verified prebuilt
-from the tool's latest GitHub release. Override with
-`LITER_LLM_LAUNCHER=auto|npx|uvx|brew|download`.
-
-To run it manually:
-
-```bash
-liter-llm mcp --transport stdio          # for Claude Code / Claude Desktop
-liter-llm mcp --transport http --port 3001
-```
-
-## The 22 tools
-
-Modality tools: `chat`, `embed`, `generate_image`, `speech`, `transcribe`,
-`moderate`, `rerank`, `search`, `ocr`.
-
-Model listing: `list_models`.
-
-File operations: `create_file`, `list_files`, `retrieve_file`, `delete_file`,
-`file_content`.
-
-Batch operations: `create_batch`, `list_batches`, `retrieve_batch`,
-`cancel_batch`.
-
-Responses API: `create_response`, `retrieve_response`, `cancel_response`.
-
-## Authentication
-
-stdio has no per-request auth headers, so the server binds auth once at startup
-via `[mcp]` config: set `mcp.stdio_key_id` to bind a specific virtual key, or
-`mcp.stdio_trust_local = true` for fully trusted local environments. Provider
-keys still come from env vars.
-
-## When to prefer MCP over the CLI or SDK
-
-- **Prefer MCP** inside an agent session: the agent invokes tools directly, with
-  no code to write or process to manage.
-- **Prefer the SDK** when building application software in a specific language.
-- **Prefer the proxy** when many apps or teams need a shared OpenAI-compatible
-  endpoint with keys, budgets, and rate limits.