{
  "markdown": "# Tool Authorization Protocol (TAP)\n\nCredential isolation, approval gating, and connector routing for AI agents.\n\nThis repository contains the code that is most useful for:\n\n- auditing request routing and connector behavior\n- debugging failed requests\n- understanding approval flows\n- improving connector-side request shaping\n- contributing fixes to the core TAP experience\n\n> [!WARNING]\n> **Self-hosting means you own the security of your credentials and signing keys.**\n> TAP keeps secrets out of your agents, but running it yourself puts the host\n> hardening, key isolation, and correct policy-engine operation on you. It's a path\n> for teams that are well versed in security. For everyone else the hosted version is\n> strongly recommended: credentials sit in a hardware enclave we can't read into, with\n> no ops to run. Start free at [tap.human.tech](https://tap.human.tech).\n\n## Start Here\n\n- `crates/tap-proxy/src/routing.rs` — how TAP resolves connector target shapes\n- `crates/tap-proxy/src/placeholder.rs` — credential substitution and position validation\n- `crates/tap-proxy/src/policy.rs` — approval policy enforcement\n- `docs/` — full documentation including self-hosting guide\n\n## Included\n\n- core proxy and storage crates\n- Telegram and Matrix approval bots\n- remote MCP server (`tap-mcp`)\n- CLI\n- docs (self-hosting, API reference, credential setup)\n\n## Not Included\n\n- enclave deployment glue (CCE policy generation, release-policy automation, ARM templates, env config)\n- production workflows and secret bootstrapping\n- managed hosting operations glue\n- the hosted dashboard UI source (a placeholder is shipped so the proxy compiles)\n\nThe enclave **key-management source is included** (`key_provider_enclave.rs`,\n`kms_azure.rs`, `skr.rs`) — it's the custody model documented at\n[docs.tap.human.tech/security](https://docs.tap.human.tech/security), and each\nhosted release's enclave measurement is published in [`measurements/`](measurements/).\nHosted deployment and operational infrastructure are maintained separately from this repository.\n\n## Security\n\nSee [`SECURITY.md`](SECURITY.md) to report a vulnerability.\n\n## License\n\n[Apache-2.0](LICENSE): free to use, read, modify, and self-host. This repo is the\nopen-source TAP runtime (`tap-core`, `tap-proxy`, `tap-bot`, `tap-cli`, `tap-mcp`). The\nhosted dashboard and managed-service deployment glue are proprietary and live in\na separate private repo.\n\n## Contributing\n\nSee `CONTRIBUTING.md`.\n\n## Testing\n\n```bash\n# Needs Postgres (default postgres://tap:tap@localhost:5434/tap, override with\n# POSTGRES_DATABASE_URL). Isolated suites parallelize; env-mutating unit tests stay serial.\ncargo test -p tap-core\ncargo test -p tap-proxy --test integration --test e2e\ncargo test -p tap-proxy -p tap-bot -p tap-cli --lib --bins -- --test-threads=1\n```\n",
  "bytes": 2814,
  "sha": "83121b50dd04cd2adf0ca8acf451066e142a5b41a33b1ea30d759e1d977103af",
  "repo_slug": "holonym-foundation/tap-oss",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_tech_human_tap_e27bd20e/readme"
}