hex-restapi-auth SKILL.md skillA
hex-restapi-auth from wntic/pyhouse is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add wntic/pyhouse/hex-restapi-auth@git:20261011.4a676acPins git:20261011.4a676ac in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- wntic/pyhouse
- Path
plugins/pyhouse-hex/skills/hex-restapi-auth/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261011.4a676ac, committed Oct 11, 2026
- First version recorded
- Sep 29, 2026
- Size
- 23,729 bytes
- Repository stars
- 3
- License
- MIT
Use when an HTTP entrypoint must authenticate its caller or gate a route on a role. Owns the caller identity, the token-verifier port and adapter, the `get_current_user` / `require_role` route dependencies, the role-rank gate, the RFC-7235 challenge, and the 401/403 codes a route advertises because of them — a route's other error codes are `hex-restapi-endpoint`'s. - Adding auth to a REST service, choosing between an authenticated and a role-gated route, wiring a token verifier, or deciding…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hex REST — Auth Authentication and transport-level authorization for a hexagonal REST service. Everything here is **optional**: a service whose routes need no caller identity — a public API, an internal worker-facing one, or one behind a gateway that authenticates for it and passes nothing inward — declares no auth and never loads this skill; one that reads the caller from a gateway's header takes the gateway binding under *Other bindings*. The REST core (`hex-restapi-app`, `hex-restapi-endpoint`, `hex-restapi-schema`) is complete without it. **Auth is conditional, not presumed.** An app has auth when some endpoint is non-anonymous, or a token-verifier capability is wired — there is no separate flag for it. "Adding auth" means adding the artifacts below; an app whose every endpoint is anonymous has **no auth layer at all**, which is the absence of the feature rather than "skipping auth". The principle this binds: **the entrypoint authenticates the caller, resolves a caller identity, and passes it inward as ordinary data on a command or query DTO.** No layer below the entrypoint knows how …
Read the whole file at its exact version.
How to install
mdr add wntic/pyhouse/hex-restapi-auth@sha256:ed99f8ded9d50611The line at the top of this page pins the label git:20261011.4a676ac, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hqjvepauysiyiam5)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Sep 29, 2026 and Oct 11, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261011.4a676ac latest | 2026-10-11 | 4a676ac | 23,729 B | A | view · diff |
| git:20261011.7343419 | 2026-10-11 | 7343419 | 23,740 B | A | view · diff |
| git:20260929.3233f4d | 2026-09-29 | 3233f4d | 23,707 B | A | view · diff |
| git:20260929.881b996 | 2026-09-29 | 881b996 | 23,701 B | A | view · diff |
| git:20260929.47c8a08 | 2026-09-29 | 47c8a08 | 23,676 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (23729 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
wntic/pyhouse · 3 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_hqjvepauysiyiam5 GET https://markdownregistry.com/api/v1/resolve?ref=wntic/pyhouse/hex-restapi-auth GET https://markdownregistry.com/api/v1/blob/ed99f8ded9d5061194f07c885e438b865063834ecd8302945eddf03772eb8db1
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.