Capability registry

What peerpush.com declares an agent can do

Measured 2026-10-22 16:33 UTC from the declarations the site publishes (record a9xyomm83r). Each capability is shown as declared, under the policy class that decides whether anything may call it, beside what a call observed.

16declared

0public read-only

0called and verified

0declared ≠ observed

agent_skill, mcp, openapiprotocols

Authenticated read-only 13 · Unknown 1 · Metadata 2

Declared versus observed

Capability	Policy class	Declared	Observed
findProducts openapi · GET · https://peerpush.com/api/v1/products	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
createProduct openapi · POST · https://peerpush.com/api/v1/products	Unknown never called automatically	POST with no declared reversibility auth: apiKey · required inputs: 1	not attempted requires apiKey: never called without the operator's own credentials
getProductDetails openapi · GET · https://peerpush.com/api/v1/products/{slug}	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 1	not attempted requires apiKey: never called without the operator's own credentials
getProductStatus openapi · GET · https://peerpush.com/api/v1/products/{id}/status	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 1	not attempted requires apiKey: never called without the operator's own credentials
findAlternatives openapi · GET · https://peerpush.com/api/v1/products/{slug}/alternatives	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 1	not attempted requires apiKey: never called without the operator's own credentials
compareProducts openapi · GET · https://peerpush.com/api/v1/compare	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 1	not attempted requires apiKey: never called without the operator's own credentials
getTrending openapi · GET · https://peerpush.com/api/v1/trending	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
discoverProducts openapi · GET · https://peerpush.com/api/v1/discover	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getDeals openapi · GET · https://peerpush.com/api/v1/deals	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getNewLaunches openapi · GET · https://peerpush.com/api/v1/launches	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getAwards openapi · GET · https://peerpush.com/api/v1/awards	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getCategories openapi · GET · https://peerpush.com/api/v1/categories	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getUseCases openapi · GET · https://peerpush.com/api/v1/use-cases	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
getAudiences openapi · GET · https://peerpush.com/api/v1/audiences	Authenticated read-only never called automatically	HTTP GET behind apiKey auth: apiKey · required inputs: 0	not attempted requires apiKey: never called without the operator's own credentials
server mcp	Metadata never called automatically	a server declaration; its tools are listed only by the server itself (tools/list), which is not called auth: unknown	not attempted metadata: describes a surface, is not itself an action
peerpush-product-discovery agent_skill · https://peerpush.com/.well-known/agent-skills/peerpush-product-discovery/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted metadata: describes a surface, is not itself an action

Where the declaration and the call disagree

None: every capability that was called answered as declared.

Signed certificate

This page’s rows, signed by the observer’s Ed25519 key: every capability’s id, endpoint, safety class, policy class and observed state, the declaration hashes and the record’s sealed manifest. The certificate is derived from the record alone, so the same record always yields the same id.

certificate_id ccap1:933cbd6b251b3225e29f96ef1640592e193504424589a1c10e843c394ff2cec0
alg Ed25519 · kid 1hHmE3fo1rg5Ig70wuFtJ5wBc7G-sUTgUJkxyPWFRps
sig q2EvhtYY3PbPDQgRajHUZXffePsqCPZyOHu1UyA3_QXN4Hpq_k9UwY4wTE8Dt10gxdyl4miG0jI9V11HZo-iCQ

The certificate as JSON · verify it now · the key directory · machine-readability certificate

To verify it yourself: SHA-256 the certificate object as canonical JSON (keys sorted, no whitespace); the hex digest must equal certificate_sha256 and the id; then check the Ed25519 signature over "crawlcheck-capability-certificate-v1\n" followed by that hex digest, with the key in the directory whose RFC 7638 thumbprint is the kid.

Policy classes

Policy class	Called automatically?	Rule
Public read-only public_read_only	yes, to verify	May be called without credentials. CrawlCheck calls it only to check the declaration: GET with no input, on the scanned origin.
Authenticated read-only authenticated_read_only	never	Never called by CrawlCheck. An agent needs the user's own credentials and consent.
Reversible write reversible_write	never	Never invoked automatically. Needs the owner's written authorisation and a test account.
Irreversible write irreversible_write	never	Never invoked automatically. Deletes or changes something that cannot be undone.
Financial financial	never	Never invoked automatically. Moves money or creates a charge.
External communication external_communication	never	Never invoked automatically. Sends a message, email or notification to someone.
Identity and accounts identity	never	Never invoked automatically. Creates, signs in to or changes an account or credential.
Unknown unknown	never	Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case.
Metadata metadata	never	Nothing to invoke: a listing, a server card or a skill file, not an operation.