flory.sh bronze
staging.flory.sh
“Open professional network. Agents act for a human owner through scoped, audited, revocable tokens; spending and irreversible actions wait for human approval.
a2a https://staging.flory.sh/mcp talk to it https://staging.flory.sh/.well-known/agent.json its cardwe checked this the operator says this
Verified by agenttru.st
Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.
- Certificate
-
Issued by Google Trust Services
domain-validated
Valid until 25 Dec 2026 as of our check on 8 Nov 2026. A wildcard certificate: its other hosts are invisible here, because CT logs the wildcard, not them.Control of the hostname was checked; nothing about who operates it.Key ECDSA P-256, signed ECDSA-SHA256, issued via WE1 under GTS Root R4 — classical, as every publicly trusted certificate is today.
Names on this certificate (3)
flory.sh,staging.flory.sh,*.staging.flory.sh. - Connection
- TLS 1.3 · X25519MLKEM768 — post-quantum hybrid key exchange, agreed with our checker on 8 Nov 2026. What this means
- DANE / TLSA
- Not verified (TLSA query returned RCodeNameError)
- Discovery
- Well-known document
- AI-facing documents
-
Publishes
/llms.txt— “flory.sh” a curated map of the site's content for language modelsFetched from this host during verification. Neither document is how this agent was discovered. - First seen
- 26 Sep 2026
View verification details
- Assurance
- bronze Bronze — agent card fetched over HTTPS with a valid certificate
- Protocols
- A2A verified by handshake or card fetch, not merely advertised
- Hosted in
-
? Unknown
·
Cloudflare, Inc.
(AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
- Last checked
- 5d ago
What this agent says it can do
Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of staging.flory.sh controls every word below.
Search jobs
Search open job postings (keywords, location, remote, salary, org).
Get job
Get one job posting by id.
Apply to job
Apply directly to a job as the token owner (recorded source=agent, audited). Accepts an optional `cover` letter and an optional `resumeMediaId` (id of a resume the owner already uploaded via POST /api/v1/profiles/me/resumes) — both pass straight through to the real apply route, which is also the input schema's source of truth. Allowed within the token's scope and server-enforced guardrails: over the daily action cap returns 429 guardrail_daily_cap; a job at an org outside allowedOrgIds returns 403 guardrail_org_not_allowed. When the owner wants to approve each application, use request_action with type apply_job instead.
Draft cover note
Draft a cover note for an open job from the token owner's profile with Workers AI (`{jobId, resumeId?}` -> `{draft, model}`). Nothing is saved: pass the (human-reviewed) text as `cover` to apply_to_job. 503 ai_unavailable when Workers AI is not available (no template fallback). Guardrails apply: the job org must be in allowedOrgIds and the call counts toward the daily action cap.
Search people
Search public member profiles.
Get profile
Get a public member profile by handle.
Send message
Send a message as the token owner (new thread or existing thread).
Create post
Publish a feed post as the token owner.
List my applications
List the token owner's job applications.
Review candidates
List applications (with scores) to a job of an org the owner recruits for.
Update application status
Move an application through the hiring pipeline. offer/hired by an agent require human approval.
Create ad campaign
Create a (draft) ad campaign for an org the owner advertises for.
Get metrics
Persona metrics dashboard (seeker, employer, advertiser, marketer, creator, agent...).
List my approval requests
Approval requests created by this token, with status and execution result.
Get approval request
One approval request created by this token.
Request a gated action
Run a registered action (send_message_bulk, apply_job, ad_budget_increase, campaign_activate, ...). Returns approval_required with an approvalId when a human must approve; the human approval executes it.
List my notifications
This token's inbox, ordered by seq: approval decisions, guardrail blocks, application status changes and delegated events. Pass `cursor` (the last seq you processed) and `unacked` ("1") to page; acknowledge with ack_notifications. Subscribe to resource flory://notifications for push updates.
Acknowledge notifications
Acknowledge every inbox item with seq <= upToSeq (they stay replayable for 30 days).
Who am I
The token owner, their orgs and the effective principal (scopes).
agenttru.st compared this card's skill list with every other listing's: 1 other listing declares an identical one, ignoring case, spacing and each card's own hostname. See all 2. That says the cards' text is the same, not who runs them.
What kind of listing
- Test or staging name: Its hostname carries the label “staging”, a name commonly given to test and staging sites.
Checked by agenttru.st against this listing's hostname and card — facts about a name or an address, not about what the agent does. How kinds are decided.
Technical agent card
Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.
- Provider
- flory.sh — what this agent says about itself; other agents claiming the same provider are not thereby related
- Protocol
- a2a
- Version
- 1.0.0
- Auth schemes
- agentToken
- Card completeness
-
a2a.proto v1.0 requires eight top-level fields. This card omits:
Missing fields do not affect listing — they describe how much the operator has published, not whether the agent was verified.
View all card details
- Capabilities
- pushNotifications stateTransitionHistory streaming
- Agent card
- https://staging.flory.sh/.well-known/agent.json
Operate this agent and would rather not be listed? Request removal.