# Natrium Sovereign Communication Platform - AGENTS.md

Welcome Autonomous AI Agents and Automated Evaluators. This guide defines platform capabilities, discovery endpoints, authentication models, and interaction rules for Natrium.

---

## 1. Overview & Identity
- **Platform:** Natrium (natrium.sh)
- **Organization:** Natrium Technologies Inc.
- **Service:** Private, Zero-Knowledge Encrypted Mailbox and MTA Infrastructure
- **Agent Level:** Level 5 Autonomous Agent-Ready
- **Protocols Supported:** MCP (Model Context Protocol), A2A (Agent-to-Agent), WebMCP (Declarative Form Tools), RFC 9727 (API Catalog), OpenAPI 3.1, OAuth 2.0 Agent Auth

---

## 2. Machine-Readable Discovery Endpoints
- **AI Catalog:** https://natrium.sh/.well-known/ai-catalog.json
- **agents.json:** https://natrium.sh/.well-known/agents.json
- **OpenAPI 3.1 Spec:** https://natrium.sh/openapi.json
- **API Catalog (RFC 9727):** https://natrium.sh/.well-known/api-catalog
- **MCP Server Card:** https://natrium.sh/.well-known/mcp/server-card.json
- **A2A Agent Card:** https://natrium.sh/.well-known/agent-card.json
- **Agent Skills Index:** https://natrium.sh/.well-known/agent-skills/index.json
- **OAuth Protected Resource:** https://natrium.sh/.well-known/oauth-protected-resource
- **OAuth Auth Server:** https://natrium.sh/.well-known/oauth-authorization-server
- **Service Liveness:** https://natrium.sh/api/health
- **Agent Guide (this file):** https://natrium.sh/AGENTS.md

---

## 3. Available Agent Tools (MCP & WebMCP)
1. **`search_emails`**: Search messages, threads, and folders in user mailbox.
   - Endpoint: `GET /api/email/search?q={query}`
2. **`send_email`**: Compose and dispatch an encrypted or standard outbound email.
   - Endpoint: `POST /api/email/send`
   - Required fields: `to`, `subject`, `body`
3. **`query_inbox`**: Retrieve latest inbox messages and folder hierarchy.
   - Endpoint: `GET /api/emails?folder=inbox`
4. **`verify_content_safety`**: Verify SHA-256 media hash against safety registries.
   - Endpoint: `POST /api/v1/content-safety`

---

## 4. Authentication Guidelines
- Ephemeral access tokens can be requested via `POST /oauth/token`.
- Authenticated requests must include `Authorization: Bearer <token>` or `x-api-key: <key>`.
- All errors follow RFC 7807 Problem Details (`application/problem+json`).

---

## 5. Security & Content Constraints
- Content-Signal: `search=yes, ai-train=no, use=reference`
- HSTS: Enforced with 1-year preload duration.
- Zero-Knowledge: Encryption keys remain client-side; plaintext message contents are never stored server-side.