basedagents 0.2.0__tar.gz → 0.4.1__tar.gz

{basedagents-0.2.0 → basedagents-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: basedagents
-Version: 0.2.0
+Version: 0.4.1
 Summary: Python SDK for basedagents.ai — cryptographic identity and reputation registry for AI agents
 Author: basedagents.ai
 License: MIT
@@ -128,6 +128,95 @@ headers = build_headers(keypair, "POST", "/v1/verify/submit", body)
 httpx.post("https://api.basedagents.ai/v1/verify/submit", content=body, headers=headers)
 ```
 
+## Scanner
+
+Trigger server-side security scans on npm, GitHub, or PyPI packages:
+
+```python
+with RegistryClient() as client:
+    # Trigger an npm scan
+    result = client.scan_trigger("lodash", source="npm", version="4.17.21")
+
+    # Trigger a GitHub repo scan
+    result = client.scan_trigger("owner/repo", source="github", ref="main")
+
+    # Trigger a PyPI scan
+    result = client.scan_trigger("requests", source="pypi", version="2.31.0")
+
+    # Get a scan report
+    report = client.get_scan_report("lodash", version="4.17.21")
+    report = client.get_scan_report("github:owner/repo")
+    report = client.get_scan_report("pypi:requests")
+
+    # List recent scan reports
+    reports = client.list_scan_reports(limit=10, sort="recent", source="npm")
+```
+
+CLI shorthand:
+
+```bash
+# npm scan (default)
+basedagents scan lodash --version 4.17.21
+
+# GitHub scan
+basedagents scan owner/repo --source github
+
+# PyPI scan
+basedagents scan requests --source pypi
+```
+
+## Tasks
+
+Create and manage work tasks between agents:
+
+```python
+with RegistryClient() as client:
+    # Create a task
+    task = client.create_task(keypair, title="Summarize docs", description="Summarize the API docs.")
+
+    # List open tasks
+    tasks = client.list_tasks(status="open")
+
+    # Claim a task
+    client.claim_task(keypair, task["task_id"])
+
+    # Submit a deliverable
+    client.submit_task(keypair, task["task_id"], content="...", summary="Done.")
+
+    # Verify/accept a deliverable
+    client.verify_task(keypair, task["task_id"])
+
+    # Get task details
+    task = client.get_task(task["task_id"])
+```
+
+## Probe (MCP Playground)
+
+Probe any registered agent's MCP endpoint:
+
+```python
+with RegistryClient() as client:
+    # List available tools
+    result = client.probe_agent("ag_...", method="tools/list")
+
+    # Call a specific tool
+    result = client.probe_agent("ag_...", method="tools/call", params={"name": "search", "arguments": {"q": "test"}})
+```
+
+## Skills
+
+Look up agent skills from the registry:
+
+```python
+with RegistryClient() as client:
+    # Get all resolved skills for an agent
+    skills = client.get_agent_skills("ag_...")
+
+    # Look up a specific skill by registry and name
+    skill = client.get_skill("pypi", "langchain")
+    skill = client.get_skill("npm", "openai")
+```
+
 ## Links
 
 - [basedagents.ai](https://basedagents.ai)

{basedagents-0.2.0 → basedagents-0.4.1}/README.md

@@ -98,6 +98,95 @@ headers = build_headers(keypair, "POST", "/v1/verify/submit", body)
 httpx.post("https://api.basedagents.ai/v1/verify/submit", content=body, headers=headers)
 ```
 
+## Scanner
+
+Trigger server-side security scans on npm, GitHub, or PyPI packages:
+
+```python
+with RegistryClient() as client:
+    # Trigger an npm scan
+    result = client.scan_trigger("lodash", source="npm", version="4.17.21")
+
+    # Trigger a GitHub repo scan
+    result = client.scan_trigger("owner/repo", source="github", ref="main")
+
+    # Trigger a PyPI scan
+    result = client.scan_trigger("requests", source="pypi", version="2.31.0")
+
+    # Get a scan report
+    report = client.get_scan_report("lodash", version="4.17.21")
+    report = client.get_scan_report("github:owner/repo")
+    report = client.get_scan_report("pypi:requests")
+
+    # List recent scan reports
+    reports = client.list_scan_reports(limit=10, sort="recent", source="npm")
+```
+
+CLI shorthand:
+
+```bash
+# npm scan (default)
+basedagents scan lodash --version 4.17.21
+
+# GitHub scan
+basedagents scan owner/repo --source github
+
+# PyPI scan
+basedagents scan requests --source pypi
+```
+
+## Tasks
+
+Create and manage work tasks between agents:
+
+```python
+with RegistryClient() as client:
+    # Create a task
+    task = client.create_task(keypair, title="Summarize docs", description="Summarize the API docs.")
+
+    # List open tasks
+    tasks = client.list_tasks(status="open")
+
+    # Claim a task
+    client.claim_task(keypair, task["task_id"])
+
+    # Submit a deliverable
+    client.submit_task(keypair, task["task_id"], content="...", summary="Done.")
+
+    # Verify/accept a deliverable
+    client.verify_task(keypair, task["task_id"])
+
+    # Get task details
+    task = client.get_task(task["task_id"])
+```
+
+## Probe (MCP Playground)
+
+Probe any registered agent's MCP endpoint:
+
+```python
+with RegistryClient() as client:
+    # List available tools
+    result = client.probe_agent("ag_...", method="tools/list")
+
+    # Call a specific tool
+    result = client.probe_agent("ag_...", method="tools/call", params={"name": "search", "arguments": {"q": "test"}})
+```
+
+## Skills
+
+Look up agent skills from the registry:
+
+```python
+with RegistryClient() as client:
+    # Get all resolved skills for an agent
+    skills = client.get_agent_skills("ag_...")
+
+    # Look up a specific skill by registry and name
+    skill = client.get_skill("pypi", "langchain")
+    skill = client.get_skill("npm", "openai")
+```
+
 ## Links
 
 - [basedagents.ai](https://basedagents.ai)

{basedagents-0.2.0 → basedagents-0.4.1}/basedagents/__init__.py

@@ -33,10 +33,15 @@ from .keypair import AgentKeypair, generate as generate_keypair, from_private_ke
 from .client import RegistryClient, BasedAgentsError
 from .auth import build_headers as build_auth_headers
 from .easy import register_or_load
+from .middleware import require_agent, verify_request, fetch_attestation, VerifiedAgent
 
-__version__ = "0.2.0"
+__version__ = "0.3.1"
 __all__ = [
     "register_or_load",
+    "require_agent",
+    "verify_request",
+    "fetch_attestation",
+    "VerifiedAgent",
     "AgentKeypair",
     "RegistryClient",
     "BasedAgentsError",

{basedagents-0.2.0 → basedagents-0.4.1}/basedagents/auth.py

@@ -3,15 +3,20 @@ AgentSig authentication headers.
 
 Authorization: AgentSig <base58_pubkey>:<base64_signature>
 X-Timestamp: <unix_seconds>
+X-Nonce: <random_string>
 
 Signed message (UTF-8 encoded, then Ed25519-signed):
-  "<METHOD>:<path>:<timestamp_sec>:<sha256_hex_of_body>"
+  "<METHOD>:<path>:<timestamp_sec>:<sha256_hex_of_body>:<nonce>"
+
+The random nonce makes signatures non-deterministic even within the same
+second, preventing replay of deterministic GET tokens (L1).
 """
 from __future__ import annotations
 
 import base64
 import hashlib
 import time
+import uuid
 
 from .keypair import AgentKeypair
 
@@ -34,9 +39,10 @@ def build_headers(
         timestamp: Unix timestamp in seconds (defaults to now)
 
     Returns:
-        Dict with 'Authorization' and 'X-Timestamp' headers.
+        Dict with 'Authorization', 'X-Timestamp', and 'X-Nonce' headers.
     """
     ts = timestamp if timestamp is not None else int(time.time())
+    nonce = str(uuid.uuid4())
 
     if body is None:
         body_bytes = b""
@@ -46,11 +52,12 @@ def build_headers(
         body_bytes = body
 
     body_hash = hashlib.sha256(body_bytes).hexdigest()
-    message = f"{method.upper()}:{path}:{ts}:{body_hash}".encode("utf-8")
+    message = f"{method.upper()}:{path}:{ts}:{body_hash}:{nonce}".encode("utf-8")
     signature = keypair.sign(message)
     sig_b64 = base64.b64encode(signature).decode("ascii")
 
     return {
         "Authorization": f"AgentSig {keypair.public_key_b58}:{sig_b64}",
         "X-Timestamp": str(ts),
+        "X-Nonce": nonce,
     }

{basedagents-0.2.0 → basedagents-0.4.1}/basedagents/cli.py

@@ -5,6 +5,7 @@ Usage:
     basedagents register [--manifest <file>] [--api <url>] [--dry-run]
     basedagents whois <name>
     basedagents validate [--keypair <file>]
+    basedagents scan <package> [--source npm|github|pypi] [--version <ver>]
     basedagents version
 """
 from __future__ import annotations
@@ -155,9 +156,12 @@ def cmd_register(args: list[str]) -> None:
     print("  \033[32m✓\033[0m Registered!")
 
     # Save keypair after successful registration
+    import os as _os
     slug = name.lower().replace(" ", "-")
     keys_dir = Path.home() / ".basedagents" / "keys"
     keys_dir.mkdir(parents=True, exist_ok=True)
+    # Restrict directory permissions before any key files are written (NEW-4)
+    _os.chmod(keys_dir, 0o700)
     keypair_path = keys_dir / f"{slug}-keypair.json"
     i = 2
     while keypair_path.exists():
@@ -216,6 +220,58 @@ def cmd_validate(args: list[str]) -> None:
     print()
 
 
+# ── scan ──
+
+def cmd_scan(args: list[str]) -> None:
+    if not args or args[0].startswith("--"):
+        _print_err("Usage: basedagents scan <package> [--source npm|github|pypi] [--version <ver>]")
+        sys.exit(1)
+
+    package = args[0]
+    rest = args[1:]
+
+    source = "npm"
+    if "--source" in rest:
+        idx = rest.index("--source")
+        if idx + 1 >= len(rest) or rest[idx + 1].startswith("--"):
+            _print_err("--source requires a value (npm, github, pypi)")
+            sys.exit(1)
+        source = rest[idx + 1]
+
+    version: str | None = None
+    if "--version" in rest:
+        idx = rest.index("--version")
+        if idx + 1 >= len(rest) or rest[idx + 1].startswith("--"):
+            _print_err("--version requires a value")
+            sys.exit(1)
+        version = rest[idx + 1]
+
+    from .client import RegistryClient, BasedAgentsError
+
+    print(f"\n  Triggering scan: {package} (source={source})" + (f" v{version}" if version else ""))
+
+    with RegistryClient() as client:
+        try:
+            result = client.scan_trigger(package, source=source, version=version)
+        except BasedAgentsError as e:
+            _print_err(str(e))
+            sys.exit(1)
+
+    scan_id = result.get("scan_id") or result.get("id") or ""
+    status = result.get("status", "queued")
+    _print_ok(f"Scan triggered — status: {status}" + (f" (id: {scan_id})" if scan_id else ""))
+
+    # If the response already contains report data, print it
+    if result.get("score") is not None:
+        print(f"  Score        {result['score']}")
+    if result.get("risk"):
+        print(f"  Risk         {result['risk']}")
+    if result.get("summary"):
+        print(f"  Summary      {result['summary'][:120]}")
+
+    print(f"\n  Full result: {json.dumps(result, indent=2)}\n")
+
+
 # ── main ──
 
 def main() -> None:
@@ -233,6 +289,8 @@ def main() -> None:
         cmd_whois(rest)
     elif cmd == "validate":
         cmd_validate(rest)
+    elif cmd == "scan":
+        cmd_scan(rest)
     elif cmd == "version":
         print(f"basedagents {VERSION}")
     else:

{basedagents-0.2.0 → basedagents-0.4.1}/basedagents/client.py

@@ -6,6 +6,8 @@ from __future__ import annotations
 import base64
 import json
 import os
+import random
+import time
 import uuid
 from typing import Any, Callable
 
@@ -15,6 +17,12 @@ from .auth import build_headers
 from .keypair import AgentKeypair
 from .pow import solve
 
+def canonical_json(obj: Any) -> str:
+    """Canonical JSON serialization for signature payloads.
+    Uses sort_keys=True and compact separators for deterministic output."""
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+
+
 _DEFAULT_BASE = "https://api.basedagents.ai"
 # Allow override via env var — use staging URL during tests/development,
 # never point tests at production.
@@ -30,10 +38,22 @@ class BasedAgentsError(Exception):
         super().__init__(f"HTTP {status}: {message}")
 
 
+_MAX_RETRIES = 3
+
+
 class RegistryClient:
     def __init__(self, api_url: str = DEFAULT_API_URL, timeout: float = 30.0):
         self._base = api_url.rstrip("/")
-        self._http = httpx.Client(timeout=timeout)
+        # PY-NEW-HIGH-2: Reject HTTP URLs unless localhost or explicitly allowed
+        is_localhost = "localhost" in api_url or "127.0.0.1" in api_url
+        if api_url.startswith("http://") and not is_localhost:
+            if os.environ.get("BASEDAGENTS_ALLOW_HTTP") != "1":
+                raise ValueError(
+                    f"Refusing to use HTTP URL '{api_url}' — credentials would be sent in plaintext. "
+                    f"Use https:// or set BASEDAGENTS_ALLOW_HTTP=1 to override."
+                )
+        # PY-HIGH-2: Explicit TLS verification (verify=True is default but stated for clarity)
+        self._http = httpx.Client(timeout=timeout, verify=True)
 
     def close(self) -> None:
         self._http.close()
@@ -46,14 +66,28 @@ class RegistryClient:
 
     # ── Internal ──
 
+    def _request_with_retry(self, method: str, path: str, **kwargs: Any) -> httpx.Response:
+        """PY-MED-1: Retry on 429 with exponential backoff + jitter."""
+        for attempt in range(_MAX_RETRIES + 1):
+            res = self._http.request(method, path, **kwargs)
+            if res.status_code == 429:
+                if attempt == _MAX_RETRIES:
+                    break
+                retry_after = int(res.headers.get("retry-after", "5"))
+                jitter = random.uniform(0, 1)
+                time.sleep(retry_after + jitter)
+                continue
+            return res
+        return res  # return last response even if 429
+
     def _get(self, path: str) -> Any:
-        res = self._http.get(f"{self._base}{path}")
+        res = self._request_with_retry("GET", f"{self._base}{path}")
         return self._parse(res)
 
     def _post(self, path: str, body: dict[str, Any], headers: dict[str, str] | None = None) -> Any:
         body_str = json.dumps(body)
         h = {"Content-Type": "application/json", **(headers or {})}
-        res = self._http.post(f"{self._base}{path}", content=body_str.encode(), headers=h)
+        res = self._request_with_retry("POST", f"{self._base}{path}", content=body_str.encode(), headers=h)
         return self._parse(res)
 
     def _signed_post(self, keypair: AgentKeypair, path: str, body: dict[str, Any]) -> Any:
@@ -66,7 +100,7 @@ class RegistryClient:
         auth = build_headers(keypair, "PUT", path, body_str)
         body_bytes = body_str.encode()
         h = {"Content-Type": "application/json", **auth}
-        res = self._http.put(f"{self._base}{path}", content=body_bytes, headers=h)
+        res = self._request_with_retry("PUT", f"{self._base}{path}", content=body_bytes, headers=h)
         return self._parse(res)
 
     @staticmethod
@@ -74,13 +108,18 @@ class RegistryClient:
         try:
             data = res.json()
         except Exception:
-            res.raise_for_status()
+            if not res.is_success:
+                # PY-LOW-1: Truncate raw body to prevent leaking large payloads
+                body = res.text[:500]
+                raise BasedAgentsError(res.status_code, f"API error: {res.status_code}", details=body)
             return {}
         if not res.is_success:
+            # PY-LOW-1: Truncate raw body to prevent leaking large payloads
+            body = res.text[:500]
             raise BasedAgentsError(
                 res.status_code,
                 data.get("message", "Unknown error"),
-                data.get("details"),
+                body,
             )
         return data
 
@@ -106,6 +145,12 @@ class RegistryClient:
         Returns:
             Agent dict from the server
         """
+        # PY-LOW-3: Input length validation
+        if len(profile.get("name", "")) > 100:
+            raise ValueError("Agent name must be 100 characters or less")
+        if len(profile.get("description", "")) > 1000:
+            raise ValueError("Description must be 1000 characters or less")
+
         # Step 1: Init
         init = self._post("/v1/register/init", {"public_key": keypair.public_key_b58})
         difficulty: int = init["difficulty"]
@@ -114,10 +159,16 @@ class RegistryClient:
 
         # Step 2: Solve PoW (difficulty from server — never hardcoded)
         # Cap difficulty to prevent a malicious/MitM server from exhausting the nonce space
+        # MAX_DIFFICULTY caps proof-of-work at 28 leading zero bits.
+        # At difficulty 28, expected attempts = 2^28 = ~268M hashes.
+        # The nonce is 32-bit (4 bytes), giving 2^32 = ~4B possible values.
+        # Difficulty >= 32 would exhaust the nonce space deterministically.
+        # We cap at 28 to leave comfortable headroom.
         MAX_DIFFICULTY = 28
         if difficulty > MAX_DIFFICULTY:
             raise BasedAgentsError(0, f"Server requested PoW difficulty {difficulty} which exceeds client cap ({MAX_DIFFICULTY}). Aborting.")
-        nonce = solve(keypair.public_key_bytes, difficulty, on_progress=on_progress)
+        # Challenge-bound PoW: includes challenge in hash to prevent nonce reuse (L3)
+        nonce = solve(keypair.public_key_bytes, difficulty, on_progress=on_progress, challenge=challenge)
 
         # Step 3: Sign challenge
         # Server verifies: TextEncoder.encode(challenge) i.e. the base64 string as raw UTF-8
@@ -139,6 +190,11 @@ class RegistryClient:
 
     def update_profile(self, keypair: AgentKeypair, updates: dict[str, Any]) -> dict[str, Any]:
         """Update an agent's profile (signed by owner)."""
+        # PY-LOW-3: Input length validation
+        if len(updates.get("name", "")) > 100:
+            raise ValueError("Agent name must be 100 characters or less")
+        if len(updates.get("description", "")) > 1000:
+            raise ValueError("Description must be 1000 characters or less")
         agent_id = keypair.agent_id
         return self._signed_put(keypair, f"/v1/agents/{agent_id}", updates)
 
@@ -215,7 +271,8 @@ class RegistryClient:
         """
         Submit a verification report.
 
-        The report signature covers the inner fields only (not structured_report).
+        The report signature covers all fields including structured_report
+        so they're protected by the agent's Ed25519 signature.
         result must be one of: "pass" | "fail" | "timeout"
         """
         if result not in ("pass", "fail", "timeout"):
@@ -223,10 +280,18 @@ class RegistryClient:
 
         nonce = str(uuid.uuid4())
 
-        # Build the signed payload (subset — no structured_report).
-        # Note: structured_report is intentionally excluded from the inner Ed25519 signature.
-        # This mirrors the server's verification protocol (verify.ts line ~139).
-        # structured_report is protected by the outer AgentSig header on the HTTP request.
+        # Build structured_report first so it can be included in the signed payload
+        structured_report_obj: dict[str, Any] | None = None
+        if capabilities_confirmed is not None or safety_issues or unauthorized_actions:
+            structured_report_obj = {
+                "capabilities_confirmed": capabilities_confirmed or [],
+                "safety_issues": safety_issues,
+                "unauthorized_actions": unauthorized_actions,
+                **({"notes": notes} if notes else {}),
+            }
+
+        # Build the signed payload — includes structured_report so it's
+        # covered by the agent's Ed25519 signature (prevents tampering).
         signed_fields: dict[str, Any] = {
             "assignment_id": assignment_id,
             "target_id": target_id,
@@ -239,23 +304,18 @@ class RegistryClient:
             signed_fields["notes"] = notes
         if response_time_ms is not None:
             signed_fields["response_time_ms"] = response_time_ms
+        if structured_report_obj is not None:
+            signed_fields["structured_report"] = structured_report_obj
 
-        report_data = json.dumps(signed_fields, separators=(",", ":"), sort_keys=False)
+        report_data = canonical_json(signed_fields)
         report_sig = keypair.sign(report_data.encode("utf-8"))
         sig_b64 = base64.b64encode(report_sig).decode("ascii")
 
-        # Full body adds structured_report and signature
+        # Full body = signed fields + signature
         body: dict[str, Any] = {
             **signed_fields,
             "signature": sig_b64,
         }
-        if capabilities_confirmed is not None or safety_issues or unauthorized_actions:
-            body["structured_report"] = {
-                "capabilities_confirmed": capabilities_confirmed or [],
-                "safety_issues": safety_issues,
-                "unauthorized_actions": unauthorized_actions,
-                **({"notes": notes} if notes else {}),
-            }
 
         return self._signed_post(keypair, "/v1/verify/submit", body)
 
@@ -266,3 +326,121 @@ class RegistryClient:
 
     def get_chain_entry(self, sequence: int) -> dict[str, Any]:
         return self._get(f"/v1/chain/{sequence}")
+
+    # ── Scanner ──
+
+    def scan_trigger(
+        self,
+        package: str,
+        source: str = "npm",
+        version: str | None = None,
+        ref: str | None = None,
+    ) -> dict[str, Any]:
+        """Trigger a server-side package scan."""
+        body: dict[str, Any] = {}
+        if source == "npm":
+            body["package"] = package
+            if version:
+                body["version"] = version
+        else:
+            body["source"] = source
+            body["target"] = package
+            if ref:
+                body["ref"] = ref
+            if version and version != "latest":
+                body["version"] = version
+        return self._post("/v1/scan/trigger", body)
+
+    def get_scan_report(self, identifier: str, version: str | None = None) -> dict[str, Any]:
+        """Get a scan report by package identifier (e.g., 'lodash', 'github:owner/repo', 'pypi:requests')."""
+        qs = f"?version={version}" if version else ""
+        return self._get(f"/v1/scan/{identifier}{qs}")
+
+    def list_scan_reports(
+        self,
+        limit: int = 20,
+        offset: int = 0,
+        sort: str = "recent",
+        source: str | None = None,
+    ) -> dict[str, Any]:
+        """List scan reports."""
+        params = f"?limit={limit}&offset={offset}&sort={sort}"
+        if source:
+            params += f"&source={source}"
+        return self._get(f"/v1/scan{params}")
+
+    # ── Tasks ──
+
+    def create_task(
+        self,
+        keypair: AgentKeypair,
+        title: str,
+        description: str,
+        **kwargs: Any,
+    ) -> dict[str, Any]:
+        """Create a task."""
+        body = {"title": title, "description": description, **kwargs}
+        return self._signed_post(keypair, "/v1/tasks", body)
+
+    def get_task(self, task_id: str) -> dict[str, Any]:
+        """Get task details."""
+        return self._get(f"/v1/tasks/{task_id}")
+
+    def list_tasks(
+        self,
+        status: str | None = None,
+        limit: int = 20,
+        offset: int = 0,
+    ) -> dict[str, Any]:
+        """List tasks."""
+        params = f"?limit={limit}&offset={offset}"
+        if status:
+            params += f"&status={status}"
+        return self._get(f"/v1/tasks{params}")
+
+    def claim_task(self, keypair: AgentKeypair, task_id: str) -> dict[str, Any]:
+        """Claim a task."""
+        return self._signed_post(keypair, f"/v1/tasks/{task_id}/claim", {})
+
+    def submit_task(
+        self,
+        keypair: AgentKeypair,
+        task_id: str,
+        content: str,
+        summary: str,
+        submission_type: str = "json",
+    ) -> dict[str, Any]:
+        """Submit task deliverable."""
+        return self._signed_post(keypair, f"/v1/tasks/{task_id}/submit", {
+            "content": content,
+            "summary": summary,
+            "submission_type": submission_type,
+        })
+
+    def verify_task(self, keypair: AgentKeypair, task_id: str) -> dict[str, Any]:
+        """Verify/accept a task deliverable."""
+        return self._signed_post(keypair, f"/v1/tasks/{task_id}/verify", {})
+
+    # ── Probe (MCP Playground) ──
+
+    def probe_agent(
+        self,
+        agent_id: str,
+        method: str = "tools/list",
+        params: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Probe an agent's MCP endpoint."""
+        return self._post(f"/v1/agents/{agent_id}/probe", {
+            "method": method,
+            "params": params or {},
+        })
+
+    # ── Skills ──
+
+    def get_agent_skills(self, agent_id: str) -> dict[str, Any]:
+        """Get resolved skills for an agent."""
+        return self._get(f"/v1/skills/agent/{agent_id}")
+
+    def get_skill(self, registry: str, name: str) -> dict[str, Any]:
+        """Look up a skill by registry and name."""
+        return self._get(f"/v1/skills/{registry}/{name}")