ambient-api-server

A project guide for the Ambient API Server, a Go service that provides REST and gRPC interfaces for platform resources and plugins.

In plain words
What is it for?
Use it when adding or changing API resources, REST endpoints, gRPC services, OpenAPI definitions, or plugins in the Ambient API Server.
Why use it?
It explains the required structure for resource plugins and identifies the OpenAPI file as the source for generated API code, helping prevent inconsistent changes.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/ambient-code/platform/ambient-api-server
Any agent
npx skills add ambient-code/platform --skill ambient-api-server
Clone the repo
git clone --depth 1 https://github.com/ambient-code/platform

Made for: Claude Code, Codex.

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 860 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00860
Opus 5 $0.00000 $0.00430
Sonnet 5 $0.00000 $0.00172
Haiku 4.5 $0.00000 $0.00086

Measured 2d ago against content hash 4e7c4683fb1f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ambient-api-server scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/sessions/ambient-api-server/SKILL.md · 95 lines

How it starts

The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skill: ambient-api-server

Activates when: Working in components/ambient-api-server/ or asked about API server, REST endpoints, gRPC, OpenAPI, or plugins.


What This Skill Knows

You are working on the Ambient API Server — a Go REST + gRPC server built on the rh-trex-ai framework. It serves the Ambient Platform's resource API under /api/ambient/v1/.

Plugin System (critical)

Every resource kind is a self-contained plugin in plugins/<kind>/. The 8-file structure is mandatory:

plugins/<kind>/
  plugin.go      # route + gRPC registration
  model.go       # GORM DB struct
  handler.go     # HTTP handlers
  service.go     # business logic
  dao.go         # DB layer
  presenter.go   # model → API response
  migration.go   # DB schema
  mock_dao.go    # test mock
  *_test.go      # table-driven tests

Generate scaffold: go run ./scripts/generator.go --kind Foo --fields "name:string,status:string"

OpenAPI is the source of truth

openapi/openapi.yaml
  → make generate → pkg/api/openapi/  (DO NOT EDIT)
  → ambient-sdk make generate → all SDKs

Never edit pkg/api/openapi/ files — they are generated from openapi/openapi.yaml.

gRPC

  • Protos: proto/ambient/v1/
  • Stubs: pkg/api/grpc/ambient/v1/ (generated)
  • Auth: pkg/middleware/bearer_token_grpc.go
  • Watch streams: server-side streaming RPCs — emit AG-UI events to clients
  • Ownership bypass: when JWT username not in context (test tokens), skip per-user ownership check

Environments

AMBIENT_ENV Auth DB Use for
development disabled localhost:5432 local make run
integration_testing mock testcontainer (ephemeral) make test
production JWT required cluster Postgres deployed

Test setup

systemctl --user start podman.socket
export DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock
cd components/ambient-api-server && make test

Runbook: Add a New API Resource

  1. Define schema in openapi/openapi.yaml
  2. Run make generate (updates Go stubs)
  3. go run ./scripts/generator.go --kind MyResource --fields "..."
  4. Implement service.go and dao.go business logic
  5. Write table-driven tests in *_test.go
  6. Run make test — all green
  7. Run make generate in ambient-sdk to propagate to SDKs
  8. Run make build in ambient-cli to update CLI

Read the full file on GitHub · 95 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 95 lines · 0 tokens per session scan A 4e7c4683fb1f

Subscribe to this mod's changes

ambient-api-server is a skill published in the GitHub repository ambient-code/platform (129 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 860 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

peekaboo

Capture and automate macOS UI with the Peekaboo CLI.

the-open-agent/openagent · 17 tokens

powerpoint

Create designed, editable PowerPoint .pptx presentations with PptxGenJS. Use when the user asks to create, generate, update, or inspect a deck, slide deck, presentation, or .pptx file.

the-open-agent/openagent · 48 tokens

argent-tv-interact

Control and inspect TV apps via argent — Apple TV (tvOS), Android TV (leanback), and Amazon Fire TV (Vega). Boot the target, read focus, navigate with the D-pad remote, type, screenshot, and on Vega debug the JS runtime (evaluate, console logs, network inspector). Use when a task targets a TV (runtimeKind "tv", or…

software-mansion/argent · 107 tokens

review-offered-task

Review a task that has been offered to you and decide whether to accept or reject it.

desplega-ai/agent-swarm · 22 tokens

company-hiring-intelligence

Reverse-engineer what a company is building by scraping their job postings, careers page, LinkedIn Jobs, and engineering blog using TinyFish web agents. Use whenever a user wants to understand a company's strategic direction from hiring signals, do competitive intelligence, figure out a tech stack from job…

tinyfish-io/tinyfish-cookbook · 169 tokens

aidd-dev:08:for-sure

Iterative agent loop that tracks attempts and retries until a success condition is met. Use when the user says "for sure", "make sure", "keep trying until", "loop until done", "don't stop until", or needs guaranteed completion of a task with explicit success criteria.

ai-driven-dev/framework · 66 tokens