Skip to content

Nandi

Agent Hub

AI agents and packs, ready to install in Nandi. Browse them here, then install from Library › Browse in the app. Each one declares the tools, hosts, and OS control it needs, and you approve them before it first runs.

    Publish Your Own Agent

    An agent is a folder with a skill.md in a public GitHub repo. Publishing adds an entry for it to the registry, which is itself a git repo: you open a pull request, and maintainers review what the agent asks for before merging.

    Write skill.md

    The front matter declares who the agent is and everything it may use. The body is its system prompt.

    ---
name: Invoice Reader
description: Reads PDF invoices in your working folder and saves their totals to a CSV.
allowed-tools: [shell, read_file, write_file, list_dir]
requires_approval: [write_file]
network:
  allow:
    - host: api.exchangerate.host
---

You are Invoice Reader. You extract the vendor, date, currency and total
from each PDF in ./invoices/ and append one row per invoice to
./invoices/totals.csv.

- Never delete or modify the PDFs.
- If a total is unreadable, list the file and say why instead of guessing.
- Only api.exchangerate.host is reachable. If the user asks for another
  source, explain that they can fork this agent and add the host to
  network.allow.
    • name and description appear in the Agent Hub, in the app's Library, and in the registry entry.
    • allowed-tools lists every tool the agent may call. Anything else is refused.
    • requires_approval pauses the run for your confirmation before these tools act.
    • network.allow lists the hosts it may reach through the egress proxy. Keep it as short as possible.
    • The body after the front matter is the system prompt. Say what the agent does, what it must never do, and what to tell the user when it can't.

    Test it locally

    Put the folder in your agents repo (~/.nandi/repo/.nandi/agents/<id>/) and Nandi picks it up right away. Chat with it, check what it asks you to approve, and confirm its prerequisites from a terminal:

    nandi verify --agent invoice-reader

    To test a registry entry before you open the pull request, add your fork of the registry under Settings › Sources and install from it in Library › Browse.

    Tag a release

    Push the folder to a public GitHub repo and tag the release. A repo that holds one agent uses v<version>; a repo with several uses <id>-v<version>.

    git tag v1.0.0        # or invoice-reader-v1.0.0 in a repo with several agents
git push origin v1.0.0

    Add it to the registry

    1. Fork the registry repo.
    2. Add agents/<id>.json matching the agent schema (example below).
    3. If you're new, add publishers/<your-handle>.json.
    4. Add the same entry to the agents list in index.json.
    5. Open a pull request. Maintainers review the capabilities before merging.

    agents/invoice-reader.json

    {
  "id": "invoice-reader",
  "name": "Invoice Reader",
  "description": "Reads PDF invoices in your working folder and saves their totals to a CSV.",
  "publisher": "your-handle",
  "repo": "github.com/your-handle/nandi-agents",
  "path": "agents/invoice-reader",
  "latest_version": "1.0.0",
  "tags": ["finance", "pdf"],
  "min_nandi_version": "0.1.0",
  "capabilities": {
    "tools": ["shell", "read_file", "write_file", "list_dir"],
    "network": ["api.exchangerate.host"],
    "pilots": []
  },
  "icon_url": "https://raw.githubusercontent.com/your-handle/nandi-agents/HEAD/agents/invoice-reader/icon.svg",
  "readme_url": "https://raw.githubusercontent.com/your-handle/nandi-agents/HEAD/agents/invoice-reader/README.md"
}

    publishers/your-handle.json

    {
  "github_handle": "your-handle",
  "display_name": "Your Name",
  "public_key": "ed25519:<printed by nandi keygen>",
  "created_at": "2026-10-06T00:00:00Z"
}

    The full field list, including optional and reserved fields, is in the registry schema.

    Shortcut: Publish, in the agent's ⋯ menu in Nandi, does all of this for you. It tags the release, builds the entry from skill.md, signs it if you have a key, and opens the pull request.

    Open the registry repo

    Sign it (recommended)

    Signing is optional but recommended. Your public key goes in publishers/<handle>.json; each entry carries the commit and the signature over it. Signed entries show as verified, and Nandi refuses an install if the tag has moved since you signed it.

    nandi keygen     # once: saves ~/.nandi/keys/publisher.key, prints the public key
nandi sign --kind agent --id invoice-reader --release 1.0.0 \
            --repo github.com/your-handle/nandi-agents
# paste the printed "commit" and "signature" into agents/invoice-reader.json

    Best practices

    • Declare the least you need

      Users approve every tool, host, and pilot capability. A short list gets approved; a long one gets uninstalled. Never list a host you don't call.

    • Ask before acting

      Put anything that writes, sends, deletes, or spends in requires_approval. Reading is usually fine without it.

    • Name things plainly

      IDs are lowercase letters, digits, and hyphens, and become folder names, so make them describe the job (invoice-reader, not my-agent-2).

    • Sign your releases

      Create a key once with nandi keygen, then sign each release with nandi sign.

    • Ship a README

      Say what the agent does, what it needs (files, hosts, keys), and a sample prompt. The README is shown in Nandi.