mcp.soundside.ai

RFC 9728 protected resource metadata for the MCP endpoint.

Proxy Supabase OAuth authorization server metadata.

x402 payment discovery (x402scan / IETF draft-jeftovic convention). Crawlers (x402scan, x402-discovery-mcp) fetch this to auto-register x402-enabled resources. The ``instructions`` field is LLM-consumable.

Serve the generated public contract byte-for-byte, never reserialized.

Serve the generated public contract byte-for-byte, never reserialized.

Expose the live registry lane projection and its canonical hash.

Expose the live registry lane projection and its canonical hash.

MCP server discovery (emerging convention, MCP spec discussion #1147). Enables MCP directories and clients to discover this server's endpoint, transport, and capabilities without connecting first.

Google A2A agent card for agent-to-agent discovery. Follows the Agent2Agent protocol spec (v0.2+). Soundside is not a full A2A server (no JSON-RPC task management), but the agent card enables discovery by A2A-aware clients and registries. ``protocol: mcp`` signals callers to connect via MCP, not A2A.

Redirect to canonical llms.txt on the docs site.

Redirect to canonical llms.txt on the docs site.

Public endpoint — no auth required. Returns the current x402 payment lane configuration including enabled tools with USDC prices. Agents can query this to discover pricing without hard-coding it.

Resolve a resource ID to a signed download URL. Used by the frontend short-URL redirect route (/r/{shortId}). - Public resources: no auth required, returns signed URL. - Private resources: requires Authorization header with Supabase JWT or API key. Returns 401 if missing, 403 if user is not authorized.

Resolve a provider-input capability token to a fresh signed GCS URL. Minted by `lib/provider_input_urls.py::mint_provider_input_url` for providers (DashScope/Alibaba, 2026-09-17) whose format validators reject a plain signed GCS URL because its path ends in the bare resource UUID, with no file extension. `filename` exists purely for those providers' own format sniffing (a trailing .mp4/.mov/.avi/ .mp3/.wav) — this route ignores its value; the token alone determines which resource is served. No Authorization header is checked: the token itself IS the capability (bearer-capability, same model as `lib/x402_wallet.py`'s session tokens). `lib_resources.visibility` is deliberately NOT consulted here — minting the token already required the owner-or-public access check (see `_resolve_to_provider_url` in toolsets/functional/generation/_common.py); re-deriving or narrowing that decision from a column the token bearer never touched would just be a second, divergent access-control path. Responses: 302 Found, Location: a freshly minted signed GCS URL — the pre-privacy-fix public short-URL flow also redirected and DashScope followed it, so a redirect is proven to work here. 400 Bad Request: token is malformed. 403 Forbidden: token signature doesn't match (tampered). 404 Not Found: token verifies, but the resource doesn't exist, is soft-deleted, or isn't `status='completed'` yet. 410 Gone: token verifies but has expired.

Public polling endpoint for x402 wallet clients. x402 clients that paid for an async tool call receive a resource_id immediately. They poll this endpoint with the short-lived x402 session token returned after payment to check status and retrieve the storage URL once the job completes. No payment required. Headers: Authorization: Bearer <x402_session_token> or X-Session-Token: <x402_session_token> Returns: 200 with resource metadata (id, name, status, storage_url, mime_type, metadata) 404 if resource not found or not owned by the session wallet

List resources owned by an x402 wallet. Wallet clients can browse their library — all resources they've created via x402 pay-per-call. Supports pagination and optional mime_type filter. Headers: Authorization: Bearer <x402_session_token> or X-Session-Token: <x402_session_token> Query params: limit: Max resources to return (default 50, max 200) offset: Pagination offset (default 0) mime_type: Filter by mime type prefix (e.g. "image/", "video/", "audio/") Returns: 200 with { resources: [...], total: N, limit: N, offset: N }

Webhook endpoint for Modal training completion callbacks. Called by the Modal lora_training app when a training job completes or fails. Payload: {job_id, state, adapter_weights_uri, gpu_seconds, gpu_tier, checkpoints, error_message}

Internal endpoint for polling pending resources (optional, for Cloud Tasks). Accepts JSON body with optional resource_id. If resource_id provided, processes that specific resource from database. Otherwise, processes next pending resource from queue.

Request-held compose finisher — the Cloud Run CPU host for out-of-process compose resume. Claims stale composition rows (checkpoint heartbeat+lease) and AWAITS ffmpeg finishing inline. Intended to be hit by Cloud Scheduler. Auth: same Bearer token as /internal/poll (INTERNAL_POLL_TOKEN). Feature flag: same as /internal/poll (ENABLE_INTERNAL_POLL_ENDPOINT). Body (optional): {"limit": 1-10} — max compositions to claim this call.

Request-held remix finisher — the owner-triggered counterpart to /internal/resume-compositions, for remix parents whose lease expired (a crashed or evicted instance, or a phase that outran its lease). Claims each expired per-user remix slot and restarts the phase walk from the durable checkpoint. Unlike the compose finisher this does NOT await the walk: a remix job runs for many minutes, so each resumed run is detached (kept alive by its own lease heartbeat) and this returns as soon as the claims are made. Completion arrives on the caller's usual `notifications/resources/updated` push. Auth: same Bearer token as /internal/poll (INTERNAL_POLL_TOKEN). Feature flag: same as /internal/poll (ENABLE_INTERNAL_POLL_ENDPOINT). Body (optional): {"limit": 1-10} — max remix jobs to claim this call.

Retry failed credit deductions for usage_record rows with status='debt'. Intended to be called by Cloud Scheduler every 15 minutes. Auth: same Bearer token as /internal/poll (INTERNAL_POLL_TOKEN). Feature flag: ENABLE_DEBT_RETRY_ENDPOINT=true (default: false). Returns JSON: {retried, succeeded, failed, written_off}

Produce a billing/x402 reconciliation report for operations. Auth: Bearer INTERNAL_POLL_TOKEN Feature flag: ENABLE_BILLING_RECON_ENDPOINT=true (default: false) Body (all optional): - days: lookback window in days (default 7, range 1-90) - start_at: ISO-8601 UTC timestamp - end_at: ISO-8601 UTC timestamp