Strale

Trust and quality infrastructure for AI agents.

What Strale is

Strale is a capability marketplace for AI agents. Agents call `strale.do()`

at runtime to reach verified capabilities — company registry lookups,

compliance checks, financial validation, Web3 security, and more — plus

bundled solutions for multi-step workflows like a full KYB check or company

due diligence, instead of the agent's own code hardcoding integrations and

managing credentials for every data source it might need.

Every capability is watched: free-tier capabilities are tested against real

upstreams on a schedule, paid capabilities are watched through production

observability and an enforced quality floor, and every call returns a

structured, auditable result with source provenance. The current catalog,

free-tier list, and country coverage are live values, not numbers printed

here — see How to use it below for where to read them.

How to use it

MCP server (recommended: no install)

{
  "mcpServers": {
    "strale": {
      "type": "streamableHttp",
      "url": "https://api.strale.io/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_your_key_here"
      }
    }
  }
}

Works with Claude Desktop, Claude Code, Cursor, and any MCP client

supporting Streamable HTTP. For local stdio instead, or the full tool

surface, see `packages/mcp-server/README.md`.

TypeScript SDK

npm install straleio

import Strale from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY });
const result = await strale.do("eu-vat-validate", { vat_number: "SE556000000001" });

Full reference: `packages/sdk-typescript/README.md`.

Python SDK

pip install straleio

from straleio import Strale

strale = Strale(api_key="your_api_key")
result = strale.do("eu-vat-validate", {"vat_number": "SE556000000001"})

Full reference: `packages/sdk-python/README.md`.

Get started without an API key

A subset of capabilities (email/IBAN/crypto-address validation, DNS lookup,

JSON repair, URL-to-markdown, and more) work with no signup, no API key, and

no wallet — only an IP-based daily rate limit. Read the current list from

`GET /v1/platform/facts` (`free_tier_slugs`), not from a number in this

file. Get a key and trial credits at strale.dev when

you need the rest of the catalog.

Framework integrations

Each package's own README is the reference for that integration; this file

only points at them. Every distribution PR against an external framework

repo, and every publish of one of these packages, follows CLAUDE.md's

Distribution PR Integrity Protocol — a package claiming framework-native

integration is verified against the published artefact, not the source

tree, before the claim ships.

Web3

Web3 capabilities (wallet risk scoring, token honeypot detection, ENS

resolution, DeFi protocol data, gas oracle, EU MiCA VASP verification,

market sentiment) and bundled solutions for on-chain agents are available

via the x402 payment protocol — pay per call with USDC on Base mainnet, no

signup required. Not every capability is x402-eligible; read the live,

dynamic subset from:

GET https://api.strale.io/x402/catalog
GET https://api.strale.io/.well-known/x402.json

Quality

Capabilities are continuously tested against their real upstreams: known-

answer, schema, negative, edge-case, and dependency-health checks, plus

piggyback checks fed by real production traffic where a capability's cost

model rules out proactive testing. An enforced quality floor quarantines a

capability that falls below it on real traffic and promotes it back

automatically on recovery. Strale deliberately publishes no single numeric

composite quality score — an earlier one was retired because it compressed

unrelated failure modes into a number that looked more precise than it

was. What is exposed instead is the raw evidence per capability: status,

last-tested timestamp, recent test history, known limitations, and the

data source behind it.

GET https://api.strale.io/v1/capabilities/vat-validate

Every capability publishes its limitations honestly, including coverage

gaps. Methodology: strale.dev/quality.

IDE rules for safe data handling

Drop these into your project to give your coding agent security guidance

for trust-sensitive data (IBANs, company registries, sanctions, PII):

• Cursor: `docs/ide-rules/strale-compliance.mdc` → `.cursor/rules/`
• Windsurf: `docs/ide-rules/strale-compliance.windsurfrules` → project root, or `.windsurf/rules/` as `.md`
• Claude Code: the snippet at `docs/claude-md-snippet.md` → your project's `CLAUDE.md`

These prevent the most common vibe-coding vulnerabilities: client-side IBAN

validation, hardcoded API keys, missing provenance metadata, and direct

registry scraping.

Agent Skills & code examples

• **Agent Skills** — `SKILL.md` files for Claude Code, Cursor, Copilot, and Codex. Copy `skills/strale/` into `.claude/skills/`, `.github/skills/`, or `.cursor/skills/`.
• Verify a company with Strale (Python)
• Validate IBANs — free, no API key (Python)
• Build an agent with Strale (TypeScript)
• Connect Strale to Claude (setup guide)

More

• strale.dev — homepage and sign-up
• strale.dev/docs — API reference
• strale.dev/pricing — pricing
• scan.strale.io — Beacon, a free agent-readiness scanner
• api.strale.io/mcp — MCP endpoint (Streamable HTTP)
• Examples — copy-paste examples for every integration

How the code is organised

strale/
├── apps/api/          Hono API server: routes, capability executors,
│                       Drizzle schema + queries, Stripe/matching/auth
│                       helpers. drizzle/ holds the migration history.
├── packages/           Published SDKs and framework integrations (see the
│                       table above) plus internal workspace packages.
├── manifests/          One YAML file per live capability: pricing, data
│                       source, field-reliability declarations, test
│                       fixtures. The onboarding pipeline
│                       (apps/api/scripts/onboard.ts) is the only
│                       sanctioned way a capability enters the system —
│                       see CLAUDE.md's Capability Onboarding Protocol.
├── design/             Design tokens as data (colors, type, spacing) —
│                       one active file per surface, candidates carry a
│                       status, promotion is a decision plus a file swap.
├── config/              Cross-cutting configuration as data, e.g. the
│                       environment-variable manifest every process.env
│                       read is registered against.
└── scripts/            Repo-root tooling: the checkers behind every
                        `npm run *:check` script, the session-handoff
                        gate, and one-off operator scripts.

`apps/api/scripts/` and `apps/api/src/capabilities/` carry the same idea at

capability-authoring scope — read `CLAUDE.md`'s "Adding New Capabilities"

section before writing a new executor.

How the company runs the repository

Where truth lives. Product, state, and roadmap truth is migrating from

Notion into this repository (`docs/project/`), but the migration is not

complete: `docs/project/START-HERE.md` and the rest of `docs/project/` are

explicitly candidates (`authority_active: false`) until a founder-

confirmed cutover. Until then, Notion (Project Home, the To-do & Build

Plan, the Decisions DB) is authoritative, and `CLAUDE.md` / `AGENTS.md` say

so at the top of every session. `docs/README.md` indexes every `docs/`

subtree with its current authority status; `docs/project/STRUCTURE.md`

records exactly where the repo's layout still deviates from the migration's

target and why.

Where work in flight lives. Multi-batch work is tracked in

`docs/programs/` (start at `docs/programs/README.md`): each program has a

`PROGRAM.md` with a "Resume here" section and a machine-checked

`tracks.yaml`. A session resuming a program reads only those two files and

follows their pointers — chat history is never required.

How sessions work. `CLAUDE.md` is the canonical operating manual for

Claude Code sessions; `AGENTS.md` is its condensed derivative for Codex-CLI

sessions and points back at `CLAUDE.md` for anything that can drift rather

than restating it. Every session ends through a handoff gate

(`scripts/handoff/handoff-check.mjs`, installed as a git hook) that refuses

to let a session leave uncommitted work, an unpushed branch, a stale

worktree, or code changes with no resume surface for the next session.

Batch work happens in an isolated `git worktree`, never the shared primary

checkout — see `WORKTREES.md`.

What CI checks, by category, not by exhaustive list (see

`.github/workflows/ci.yml` for the exact, current set): an ephemeral-

Postgres integration lane for money- and audit-chain-critical behavior;

typecheck and lint across `apps/api` and every published package; capability

manifest structural and fixture-consistency gates; framework-package

integrity (a published `*-strale` package must contain real code from the

framework it claims to integrate with); a family of content-as-data

registers, each with its own checker and generated index — research

(`docs/research/`), design tokens (`design/`), the environment-variable

manifest (`config/`), the model-id registry, the public claims register

(`docs/company/claims.yaml`), program track registers

(`docs/programs/*/tracks.yaml`), and this repository's own `docs/`

structure (`docs:check`, `archive:index -- --check`); and the session-

handoff gate itself. Every one of these checkers plants a failure case in a

throwaway fixture and proves it fails before the fix — see

`docs/company/LESSONS.md` family F5.

Where history lives

`archive/` holds closed, historical, and superseded material — see

`archive/README.md` for what each subtree holds, generated (with hand-

written prose above it) by `npm run archive:index`. `handoff/` holds one

file per session's end-of-session record; `handoff/README.md` is a

generated, reverse-chronological index of all of them by date and stated

intent. Neither directory is required reading to resume work — the program

register and `docs/project/START-HERE.md` are.

License

MIT