# NDEVR OWL

> OWL is NDEVR's zero-knowledge cloud on ndevr.org: end-to-end-encrypted file
> storage and sharing, chat, office documents, media, and an AI gateway. Machine access is a
> supported feature with three first-class paths — pick by task.

## MCP connector (drive OWL apps and documents)

- Endpoint: POST https://ndevr.org/api/owl/mcp (MCP Streamable HTTP / JSON-RPC 2.0).
  A browser GET returns 404 by design — the endpoint only speaks POST.
- Bootstrap without credentials: initialize + tools/list work unauthenticated; the
  open_owl_link tool takes a complete editable OWL share URL as its owl_link argument
  (treat that URL as a secret — never echo it).
- Scoped tokens: an OWL user mints one with `owl ai token mint` and supplies it as a
  Bearer credential when adding the MCP connector.

## CLI (owl.pyz — the full client, zero-knowledge crypto included)

- Download: https://ndevr.org/cli/owl.pyz (any Python 3.7+, stdlib only — no pip installs;
  Windows runs it as `py owl.pyz`).
- Docs and quick start: https://ndevr.org/cli/
- `python3 owl.pyz help all` prints the complete, generated command reference.
- Sign in WITHOUT handling the user's password: `python3 owl.pyz connect login` prints a
  short code and https://ndevr.org/activate — the user approves in their signed-in browser and
  the CLI receives a scoped access token (OAuth 2.0 device flow, RFC 8628).

## HTTP API (OAuth 2.0 for third-party apps and agents)

- Discovery: https://ndevr.org/.well-known/oauth-authorization-server
- Grants: authorization_code + PKCE (consent at https://ndevr.org/owl/connect-authorize)
  and urn:ietf:params:oauth:grant-type:device_code (start at POST https://ndevr.org/api/connect/device/code).
- Token endpoint: POST https://ndevr.org/api/connect/token. Scoped data endpoints:
  GET https://ndevr.org/api/connect/resources, GET/POST https://ndevr.org/api/connect/resource.
- Most other /api/owl/* endpoints require an OWL session plus client-side key crypto —
  use the CLI for those rather than raw HTTP.

## Source repositories (self-hosted git)

- NDEVR's source repos are hosted HERE, over SSH: `git clone git@ndevr.org:<Repo>.git`
  (e.g. NDEVR_Source). There is no anonymous/HTTP clone: access needs an SSH public key
  registered by NDEVR plus a per-repo role.
- Manage and inspect access with the CLI: `owl repo list | info | roles | grant`; code
  review flows through `owl repo review-*`. Browse code and history at https://ndevr.org/owl/repos.
- An agent on a machine whose SSH key is already registered can clone directly — check
  ~/.ssh/config for a git@ndevr.org / ndevr-git host entry before assuming no access.

## Key pages

- https://ndevr.org/ — product overview
- https://ndevr.org/cli/ — CLI download + agent access guide
- https://ndevr.org/security/ — security hub and vulnerability reporting
- https://ndevr.org/sitemap.xml — the full public page set