Your AI can vet us.
The first organic sale on this store was checked by the buyer's own AI agent before the buyer paid: it read the legal, support and security pages, tried four addresses that did not yet exist, and bought anyway. We built the four addresses the next morning. This page is the list an agent needs, with the command that proves each line, so the check takes seconds and needs nobody's word — not ours.
The receipts
Each row is a claim, the address that carries it and the check. The counts are read from the store database on every request; the hand check in the last column was run on 2 September 2026 and can be re-run by anyone.
| Claim | Where | Check it |
|---|---|---|
Every one of the 48 business apps answers the Model Context Protocol at POST /mcp on its own host, behind the buyer's own key. The keyless door says so itself: it refuses a GET with the one method it takes. | /connect-your-ai | curl -sI https://invora.ownware.io/mcp → 405, allow: POST. Hand check 2 September 2026: 48 of 48 demo hosts answered this way; each also serves /api/openapi.json. |
| Keys are minted in each app as read-only or full. A read key is refused any write tool at the door, by name; a call with no key is told exactly what it needs. | /connect-your-ai | curl -s https://invora.ownware.io/api/ping → 401 with "Send: Authorization: Bearer <api key>". With a read key of your own, call any write tool and read the refusal. |
| Own Your AI, the flagship, runs an agent in sealed mode — shell and scripts with no network — and produces a signed report of the run that you can hand to anyone. | /p/oya | The product page describes the sealed mode and the signed report; the CLI command is oya verify on your own machine after purchase. |
| The legal terms, licence, refunds and privacy are on one page; the three addresses an agent guesses resolve to it. | /legal | curl -sI https://ownware.io/legal → 200; /privacy, /terms, /refunds → 301 to it. |
Support says what it covers and how to reach a person; /contact lands there. | /support | curl -sI https://ownware.io/contact → 301 to /support#contact. |
| A machine-readable security contact, RFC 9116, with an expiry date. | /.well-known/security.txt | curl -s https://ownware.io/.well-known/security.txt → Contact:, Expires:, Canonical: lines; /security.txt serves the same file. |
| The 13 suites, their members and the live saving against buying the parts, on one page; every price is read from the database at request time. | /suites | curl -sI https://ownware.io/suites → 200; compare any figure with /llms.txt — the two are the same query. |
| The store's own REST API is described in OpenAPI, and the guessed address resolves. | /api/openapi.json | curl -sI https://ownware.io/openapi.json → 301 to /api/openapi.json → 200. |
| A live status page, a changelog with the version in today's download, and two llms files read from the same database as every page. | /status · /changelog · /llms.txt | curl -s https://ownware.io/status — computed at request time, cached one minute. |
What the agent did, and what it found
- Found a product through an "alternatives to" page, then read the product page, the live demo, a suite page and the pricing page. Then it walked a checklist: the legal page,
/privacy,/terms,/refunds,/support,/.well-known/security.txt,/openapi.json, the product's/mcpdoor, then checkout. - Four of those addresses did not exist that day. All four resolve now, and a weekly run of our own agent walks the same list and refuses to pass a missing one.
- Everything an agent reads here is listed on /for-agents, with the addresses that resolve and how to verify a figure without asking us.
What we will not do
We will not put a number on a page that is not read from the database, print a competitor's price without the vendor's own URL and the date we read it, or claim a certification we do not hold. If your agent finds a page that breaks any of that, the address on /support reaches a person who will fix it.