Installs and Signed Calls

Our Commitment MountDev Ops is built security first. Your business data belongs to you, and you can export all of it at any time. We never use analytics or tracking of any kind inside MountDev Ops.

An install is one paired copy of an outside app your account builds or uses, such as a plugin on a website. Your workspace keeps each install: its address, its own public key, its version, when it was last seen, and the record it belongs to. Your workspace signs every call it makes to an install with its own signing key, so the app knows the call is really yours. Every account has installs. Owners and admins set them up. No AI agent and no API key can send a call to an install.

How an Install Is Made

An outside app pairs with a pairing code. When the app also gives its website name and its own public key (32 bytes in base64url) as address and public_key, the pairing makes an install that is waiting. The answer includes install (its number) and signing_keys, your workspace's public signing keys the app checks every call with. A pairing key can ask for them again at any time with GET me.

Before an install becomes active, your workspace calls its hello route at its address to prove the address. An install that is waiting answers only hello. An install that has ended is never called.

The Connection That Lists the Routes

Go to Settings, Connections and add a custom connection for the app (no key is needed, because every call is signed). Mark it One address per install and list the routes the app answers (action core.installs.routes.save). Each route has:

• a name, in lower case letters, numbers, and underscores, such as health;
• a method: GET, POST, PUT, PATCH, or DELETE;
• a fixed path, such as /mdo/health, with no query, no .., and no //;
• whether it changes something (any method but GET does), and whether it cannot be undone. A DELETE always does both.

A connection must list a hello route (GET, changing nothing). A call can use only a listed route; anything else is refused. At most 50 routes. Nothing in the list is a secret.

The Signing Key

Your workspace makes its own Ed25519 signing key for installs when an owner asks (action core.installs.signing.rotate, owners only). The private half is sealed with your account's own encryption key and is never shown, returned, logged, exported, or sent anywhere. The public half goes to each install. Rotate makes a new key: the new key signs, and the one before stays valid, so two keys are valid at once and an app that has not switched yet keeps working. The key before that is retired. See the public keys with core.installs.signing.status.

What a Signed Call Looks Like

Every call has these headers: X-MDO-Install (the install number), X-MDO-Key (which signing key), X-MDO-Timestamp (seconds), X-MDO-Nonce (a new random value for every call), and X-MDO-Signature (base64url Ed25519). The signature covers these lines, joined by a newline: MDO1, the method, the path, the query (sorted, as sent), the timestamp, the nonce, the SHA-256 of the body in hex (of an empty body when there is none), install:<number>, and key:<number>.

The app must check the signature with the public key named by X-MDO-Key, refuse a timestamp more than 5 minutes from its own clock, and refuse a nonce it has seen. The body is JSON. Your workspace sends only to the install's own https address (checked every time, never a private network address, never following a redirect), waits 15 seconds, and keeps only the answer's JSON (up to 100,000 characters).

Routes That Stop for a Person

A route that deletes or cannot be undone always stops for a person. It is sent only when a person confirms it on the screen (confirm: true on core.installs.call). It is never sent for an API key, an AI agent, or an automation, even if they say they confirmed. A workflow asks through its approval card: see Call an Install.

Actions

• See the installs (action core.installs.list): each install's address, version, state, last seen, and record, the connections that list routes, and which signing keys exist. Never a key. An AI agent may use this one.
• Prove an address (action core.installs.hello): sends the signed hello and makes the install active when the app answers { "ok": true } (and, if it names its install, the right one). The answer's version is kept as the app's version.
• Call a route (action core.installs.call): sends one listed route with an optional query and body and returns the app's answer. Writes the call to the Activity Log with the route and install, never the body or the answer.
• End an install (action core.installs.end): the install is never called again and its key stops at once.

What Is Kept

In your own workspace, in its own region: the signing keys (the private half sealed), the installs, and a record of each call's nonce for 24 hours. Another account cannot see any of it. Nothing about it is sent to us.