Everything PRAE publishes, in one place.

Install

npm install -g prae-cli                 # the prae command
npm install prae-gate                    # the gate, loaded by the agent harness as a plugin
prae check ./org.prae.json               # validate a policy pack
prae explain ./org.prae.json write path=/etc/hosts
prae console ./ledger.jsonl --out ./console --serve   # the console, and its record API on localhost

The CLI

• prae check — a policy pack against the schema; prae test runs it against security invariants.
• prae explain — why a call is allowed, held or refused, rule by rule.
• prae verify — a decision ledger's hash chain and signatures, offline; prae report renders it.
• prae console — the console as static pages from a ledger, and with --serve its record API on localhost.
• prae mcp — an MCP server over stdio: gated filesystem access for any MCP client. Every file read is judged, and sealed when --ledger is given; listings are confined to the root.
• prae init claude-code — installs a Claude Code PreToolUse hook (prae hook claude-code) that judges each tool call before it runs, in shadow mode first.

The API

prae console --serve exposes a JSON API on localhost: the record, the ledger and its verification. The Command Center server adds same-origin mutations — signed with the operator key — for answering a held call and steering a fleet; it ships with the Command Center today, not in prae-cli. Both are described in /openapi.json, with an operationId, a description and typed schemas on every operation, and JSON error bodies throughout.

The public read API

https://prae-ai.com/api/v1 — no key, read-only, JSON. /api/v1/trust/status says whether PRAE's control layer passed its latest validation run, and when; /api/v1/trust/scenarios lists each attack, the control expected to stop it and what was observed; /api/v1/trust/provenance is the connector image's build record. It reads the same published record as the trust center; it controls nothing.

Each client may make 60 requests a minute. Every response says where it stands in the IETF RateLimit and RateLimit-Policy headers; past the budget the answer is a 429 with Retry-After. The budget is kept per edge location, so treat it as a pace to keep, not a quota to plan against.

Versioning and deprecation

The public API is versioned in its path: /api/v1 changes only by adding fields and routes, and a breaking change would ship as /api/v2 beside it. Every response names its version in X-PRAE-API-Version. A route on its way out carries Deprecation (RFC 9745) and Sunset (RFC 8594) headers for at least 90 days before it stops answering, and the OpenAPI document marks it deprecated in the same release. The self-hosted API follows prae-cli's semver and carries the package version in the same header.

Policy packs

A pack is a JSON document: rules over tools, paths, commands, data and approvals, each with an effect (allow, require approval, refuse) and a reason the operator reads. Packs can expire, can be signed, and layer: a built-in baseline, your organisation's rules, and a fleet steer an operator applies at runtime. The packs view shows a real one; the playground judges calls against one in your browser.