Get an app's agent description without changing the app

Side-effect-free sibling of the page gate: no auto-claim, no token mint, no cookie, no mutating telemetry. A public App or listed Template returns the full descriptor to anyone, with operations[].input/output/examples gated on app:read (owner, accepted share grant, team membership, or a bearer token) — an anonymous caller sees discovery-level operation fields only. An enabled-unlisted Template remains private without app:read, as does any other private App. Those callers — including an unclaimed app’s claim-cookie holder, which grants app:run but never app:read — get the minimal stub (AppDescriptorStub). Reachable via both the /app/{id} UUID form and the /{handle}/{app-name} friendly form (byte-identical id + canonical_url), and advertised from the served page’s <link rel="alternate" type="application/json"> and matching Link: HTTP header.

curl -X GET "https://charm.ing/app/string/agent.json" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://charm.ing/app/string/agent.json", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://charm.ing/app/string/agent.json",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

{
  "type": "charming.app-descriptor",
  "schema_version": "v1",
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "revision": 4,
  "display_name": "string",
  "app_name": "string",
  "visibility": "public",
  "authorized": true,
  "canonical_url": "http://example.com",
  "when_to_use": "string",
  "author_provided": {},
  "operations": [
    {}
  ],
  "http_api": {},
  "mcp": {},
  "auth": {},
  "advisories": [
    {}
  ]
}

{
  "ok": false,
  "error": {
    "kind": "not_found",
    "message": "string",
    "reason": "token_malformed",
    "recovery": {
      "kind": "pair",
      "start": "http://example.com",
      "verification_url": "http://example.com",
      "instructions": "string"
    }
  }
}

{
  "ok": false,
  "error": {
    "kind": "not_found",
    "message": "string",
    "reason": "token_malformed",
    "recovery": {
      "kind": "pair",
      "start": "http://example.com",
      "verification_url": "http://example.com",
      "instructions": "string"
    }
  }
}