XtrapeA shared governance plane for the tools you run

Turn ideas into deployable Widgets and governable, observable running Services — under one authorization, audit, and lifecycle model.

Why Xtrape

Concepts

Source & Mirrors

One management plane, many tools

Services register with a shared platform instead of each shipping its own admin panel, auth model, and audit trail.

Controlled exposure

A Service declares what it can do; the Platform decides whether anyone may see or do it. Default is deny, and visibility is never the security boundary.

Invocation-level authorization

Every invocation is authorized against the actual originator, the complete access path, the versioned operation, and the concrete target resource.

Evidence, not trust

Approvals, authentication challenges, and grants are durable, scoped objects. All managed execution is attributable and auditable.

Status

This site is the Xtrape Public Concept Baseline — a working draft published ahead of the first public code releases. Content is marked as stable, experimental, or working draft per page; see the status legend.

Canonical source repository and mirror map: Source
How to cite this baseline: Citation
Verifiable release artifacts: Provenance

What exists today

A headless Platform runtime (Community Edition), a web operator panel, service contracts and a Node.js connector package, a reference Widget, an integrated quickstart stack, and a Telegram adapter exist as working software. The current implementation focus is the Xtrape Exposure spine — AI-facing capability disclosure with an MCP protocol projection. The Artifact Repository, Studio/Workbench authoring surfaces, and Launcher are design-stage. See the Roadmap for the release-train view.

Code repositories are being opened in phases; this site's repository is the first. The Source page is the authoritative map of what is public where.