lithtrix-skills-api

Operate Lithtrix (lithtrix.ai) from an agent — self-serve API keys, credibility-scored web discovery, per-agent JSON memory, MCP tools, and free-tier referra...

Security Scan

The skill's declared requirements (LITHTRIX_API_KEY, curl) and runtime instructions align with its stated purpose (calling Lithtrix APIs, registration, memory, MCP); nothing requested is disproportionate or unrelated.

Purpose & Capability

Name/description, required env var (LITHTRIX_API_KEY), and required binary (curl) all match the documented Lithtrix API usage (discover, register, search, memory, MCP). There are no unrelated credentials or binaries requested.

Instruction Scope

SKILL.md gives explicit API calls (curl) and describes endpoints, registration flow, and memory endpoints. It does not instruct the agent to read unrelated files, harvest other environment variables, or exfiltrate data. It does mention an optional LITHTRIX_API_URL override and shows using npx for the MCP tool (see install_mechanism note).

Install Mechanism

This is an instruction-only skill with no install spec or local code. The docs recommend running `npx -y lithtrix-mcp` to run an MCP server — that is a direct instruction to fetch & execute an npm package at runtime, which is functionally appropriate for providing MCP tooling but carries the usual remote-code-execution risk of npx. No other downloads, extract steps, or third-party, non-Lithtrix URLs are present.

Credentials

Only LITHTRIX_API_KEY is required and declared as the primary credential; an optional LITHTRIX_API_URL override is documented but not listed as required. The requested environment access is proportional to the skill's purpose.

Persistence & Privilege

Skill is not forced-always, does not request persistent system-wide privileges, and does not modify other skills' configurations. Autonomous invocation is allowed by default (normal for skills).

Assessment

This skill appears coherent and only needs your Lithtrix API key and curl to operate. Before installing or enabling it: keep your ltx_ key secret (do not paste into public logs), be aware the docs instruct running `npx -y lithtrix-mcp` which will fetch and run code from the npm registry (normal for MCP but higher-risk than pure curl calls), and verify the publisher/homepage you trust (https://docs.lithtrix.ai). If you want higher assurance, ask for the skill's source or an official registry entry and avoid running npx unless you trust the package maintainer.

Lithtrix — agent infrastructure skill

What this covers

Lithtrix is agent-native infrastructure: HTTPS APIs for web discovery (credibility-scored results), self-registration (one-time ltx_ API key), optional persistent JSON memory (KV, stats, context, semantic search when the host has vectors/embeddings), usage metering, Stripe billing for paid tiers, and an MCP server (npx -y lithtrix-mcp).

Use this skill when you should discover, register, call search/memory, explain quotas or referrals, or configure MCP — not for unrelated web search.

When to load this skill

• The user mentions Lithtrix, ltx_ keys, lithtrix.ai, lithtrix-mcp, or agent-native search / memory.
• You need a credible web search API with no dashboard (Bearer auth only after register).
• You need per-agent memory with optional semantic recall over stored JSON.
• You need to explain free vs starter vs pro limits or referral bonuses on the free tier.

Canonical URLs (read-first)

Resource	URL	Auth
Agent guide (ordered steps, JSON)	https://lithtrix.ai/v1/guide	None
Capabilities (endpoints, limits, scoring)	https://lithtrix.ai/v1/capabilities	Optional Bearer (see below)
LLM-oriented site summary	https://lithtrix.ai/llms.txt	None
OpenAPI 3.1	https://lithtrix.ai/openapi.json	None
Human docs	https://docs.lithtrix.ai	None
Agent discovery	https://lithtrix.ai/.well-known/ai-agent.json	None
MCP tool JSON (search, register, memory, …)	https://lithtrix.ai/mcp/*.json	None

Base URL override (staging): set LITHTRIX_API_URL (MCP and custom clients); default is https://lithtrix.ai.

Quick start (three calls)

1. Discover

curl -sS "https://lithtrix.ai/v1/capabilities"

2. Register (one-time key — store immediately)

curl -sS -X POST "https://lithtrix.ai/v1/register" \
  -H "Content-Type: application/json" \
  -d '{"agent_name":"my-agent","owner_identifier":"[e-mail]"}'

Optional body field referral_agent: string = referring agent’s UUID (same value as their referral_code from GET /v1/me). Omit if unknown. Only UUID-shaped referrals count toward the referrer’s free-tier bonus.

3. Search (Bearer)

curl -sS "https://lithtrix.ai/v1/search?q=your+query" \
  -H "Authorization: Bearer ltx_your_key_here"

Optional auth on GET /v1/capabilities

If you send a valid Authorization: Bearer ltx_... header, the JSON includes referral_rewards.your_referral_code (your agent UUID — same as referral_code from GET /v1/me). Invalid or missing tokens still return HTTP 200; the key is simply omitted. Unauthenticated responses remain backward compatible.

curl -sS "https://lithtrix.ai/v1/capabilities" \
  -H "Authorization: Bearer ltx_your_key_here"

Referral programme (free tier)

• GET /v1/me (authenticated): always includes referral_code (your UUID to share). Includes referral_agent if you registered with a referrer.
• Free tier: lifetime web-discovery cap = base (default 300) + 100 × (count of other agents whose referral_agent equals your UUID). Self-referral excluded. Starter / Pro: monthly search caps; no referral bonus on search limits.
• Effective cap is reflected in GET /v1/search → usage.search_calls_limit / calls_remaining for free agents.

Memory (per-agent JSON)

After registration, use Bearer auth.

• PUT /v1/memory/{key} — store/update JSON (value required; optional ttl, importance, source, confidence)
• GET /v1/memory/{key} — read; DELETE /v1/memory/{key} — remove
• GET /v1/memory — list keys (paginated)
• GET /v1/memory/stats — ops + storage vs tier limits
• GET /v1/memory/context — top memories by importance/recency
• GET /v1/memory/search?q=... — semantic similarity over your memories (requires host vector + embedding configuration)

Key pattern: [a-zA-Z0-9-_.:]{1,128}. See OpenAPI and docs for response usage objects.

MCP (Claude Desktop, OpenClaw, etc.)

Install and run via stdio (no global install required):

npx -y lithtrix-mcp

Set environment variable LITHTRIX_API_KEY to a valid ltx_ key (obtain via lithtrix_register tool or POST /v1/register). Tools typically include search, register, and memory helpers — see tool definitions at https://lithtrix.ai/mcp/ paths listed in llms.txt or OpenAPI extensions.

Billing (paid tiers)

Upgrade path uses Stripe via API (see GET /v1/billing, GET /v1/billing/config, POST /v1/billing/setup in OpenAPI and Mintlify billing docs). Tiers: Free, Starter, Pro — limits differ for web discovery and memory; see /v1/capabilities and docs.

Security and hygiene

• Never commit or paste raw ltx_ keys into public repos, skills, or logs.
• Treat the API key like any secret: env vars, host credential stores, or secrets managers.
• Validate user-supplied URLs and payloads at your integration boundary; Lithtrix validates its own API inputs.

Troubleshooting

Symptom	Check
401 on /v1/search	Missing/wrong Authorization: Bearer ltx_...
409 on /v1/register	Same agent_name + owner_identifier already registered
Free tier “out of quota”	Lifetime total vs effective cap (includes referrals); inspect usage on search
Memory semantic search unavailable	Host must configure vector + embeddings (product limitation, not client bug)

Support

• Docs: https://docs.lithtrix.ai
• Email: [e-mail]
• GitHub: https://github.com/lithtrix