Strale

Trust and quality infrastructure for AI agents.

What Strale is

Strale is a capability marketplace for AI agents. Agents call strale.do() at runtime to reach verified capabilities — company registry lookups, compliance checks, financial validation, Web3 security, and more — plus bundled solutions for multi-step workflows like a full KYB check or company due diligence, instead of the agent's own code hardcoding integrations and managing credentials for every data source it might need.

Every capability is watched: free-tier capabilities are tested against real upstreams on a schedule, paid capabilities are watched through production observability and an enforced quality floor, and every call returns a structured, auditable result with source provenance. The current catalog, free-tier list, and country coverage are live values, not numbers printed here — see How to use it below for where to read them.

How to use it

MCP server (recommended: no install)

{
  "mcpServers": {
    "strale": {
      "type": "streamableHttp",
      "url": "https://api.strale.io/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_your_key_here"
      }
    }
  }
}

Works with Claude Desktop, Claude Code, Cursor, and any MCP client supporting Streamable HTTP. For local stdio instead, or the full tool surface, see packages/mcp-server/README.md.

TypeScript SDK

npm install straleio

import Strale from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY });
const result = await strale.do("eu-vat-validate", { vat_number: "SE556000000001" });

Full reference: packages/sdk-typescript/README.md.

Python SDK

pip install straleio

from straleio import Strale

strale = Strale(api_key="your_api_key")
result = strale.do("eu-vat-validate", {"vat_number": "SE556000000001"})

Full reference: packages/sdk-python/README.md.

Get started without an API key

A subset of capabilities (email/IBAN/crypto-address validation, DNS lookup, JSON repair, URL-to-markdown, and more) work with no signup, no API key, and no wallet — only an IP-based daily rate limit. Read the current list from GET /v1/platform/facts (free_tier_slugs), not from a number in this file. Get a key and trial credits at strale.dev when you need the rest of the catalog.

Framework integrations

Each package's own README is the reference for that integration; this file only points at them. Every distribution PR against an external framework repo, and every publish of one of these packages, follows CLAUDE.md's Distribution PR Integrity Protocol — a package claiming framework-native integration is verified against the published artefact, not the source tree, before the claim ships.

Web3

Web3 capabilities (wallet risk scoring, token honeypot detection, ENS resolution, DeFi protocol data, gas oracle, EU MiCA VASP verification, market sentiment) and bundled solutions for on-chain agents are available via the x402 payment protocol — pay per call with USDC on Base mainnet, no signup required. Not every capability is x402-eligible; read the live, dynamic subset from:

GET https://api.strale.io/x402/catalog
GET https://api.strale.io/.well-known/x402.json

Quality

Capabilities are continuously tested against their real upstreams: known- answer, schema, negative, edge-case, and dependency-health checks, plus piggyback checks fed by real production traffic where a capability's cost model rules out proactive testing. An enforced quality floor quarantines a capability that falls below it on real traffic and promotes it back automatically on recovery. Strale deliberately publishes no single numeric composite quality score — an earlier one was retired because it compressed unrelated failure modes into a number that looked more precise than it was. What is exposed instead is the raw evidence per capability: status, last-tested timestamp, recent test history, known limitations, and the data source behind it.

GET https://api.strale.io/v1/capabilities/vat-validate

Every capability publishes its limitations honestly, including coverage gaps. Methodology: strale.dev/quality.

IDE rules for safe data handling

Drop these into your project to give your coding agent security guidance for trust-sensitive data (IBANs, company registries, sanctions, PII):

• Cursor: docs/ide-rules/strale-compliance.mdc → .cursor/rules/
• Windsurf: docs/ide-rules/strale-compliance.windsurfrules → project root, or .windsurf/rules/ as .md
• Claude Code: the snippet at docs/claude-md-snippet.md → your project's CLAUDE.md

These prevent the most common vibe-coding vulnerabilities: client-side IBAN validation, hardcoded API keys, missing provenance metadata, and direct registry scraping.

Agent Skills & code examples

• Agent Skills — SKILL.md files for Claude Code, Cursor, Copilot, and Codex. Copy skills/strale/ into .claude/skills/, .github/skills/, or .cursor/skills/.
• Verify a company with Strale (Python)
• Validate IBANs — free, no API key (Python)
• Build an agent with Strale (TypeScript)
• Connect Strale to Claude (setup guide)

More

• strale.dev — homepage and sign-up
• strale.dev/docs — API reference
• strale.dev/pricing — pricing
• scan.strale.io — Beacon, a free agent-readiness scanner
• api.strale.io/mcp — MCP endpoint (Streamable HTTP)
• Examples — copy-paste examples for every integration

How the code is organised

strale/
├── apps/api/          Hono API server: routes, capability executors,
│                       Drizzle schema + queries, Stripe/matching/auth
│                       helpers. drizzle/ holds the migration history.
├── packages/           Published SDKs and framework integrations (see the
│                       table above) plus internal workspace packages.
├── manifests/          One YAML file per live capability: pricing, data
│                       source, field-reliability declarations, test
│                       fixtures. The onboarding pipeline
│                       (apps/api/scripts/onboard.ts) is the only
│                       sanctioned way a capability enters the system —
│                       see CLAUDE.md's Capability Onboarding Protocol.
├── design/             Design tokens as data (colors, type, spacing) —
│                       one active file per surface, candidates carry a
│                       status, promotion is a decision plus a file swap.
├── config/              Cross-cutting configuration as data, e.g. the
│                       environment-variable manifest every process.env
│                       read is registered against.
└── scripts/            Repo-root tooling: the checkers behind every
                        `npm run *:check` script, the session-handoff
                        gate, and one-off operator scripts.

apps/api/scripts/ and apps/api/src/capabilities/ carry the same idea at capability-authoring scope — read CLAUDE.md's "Adding New Capabilities" section before writing a new executor.

How the company runs the repository