OpenRouter, but for agent tools instead of models. Point an agent at one base URL with one token and it can do the job: a curated catalog of thousands of endpoints across many providers — SEO and backlinks, social and trends, people and company enrichment, ads, scraping, image and video generation — priced per call, from a cent, with no provider signup. Plus your own team's keys, skills and CLIs, callable by every teammate's agent without the credential ever leaving the server.
Ask for the task, not the tool. You do not need to know which vendor sells backlink data, or to hold an account with them. Search for what you want to do, read the price, call it.
Built for the Superdesign team, live at treg.to — anyone can self-host.
The tools an agent needs for real work sit behind subscriptions nobody buys for a single run — Semrush $139/mo, Moz $99/mo, Crunchbase $99/mo, Apollo $59/seat — behind signup walls, or behind no public API at all (invite-only, partner-only, app-review-only). treg carries those accounts and bills fractions of a cent per call.
- The catalog — external endpoints treg can serve with its own key or through a verified public route that needs no provider key. Own-key calls use the team's prepaid balance; anonymous calls are free. No account with the provider is needed. New verified accounts receive $1.00 free once, when they create an eligible team.
- Your own tools — anything a teammate registered: a paid API account, an OAuth connection, a
vendor CLI, a
SKILL.md. Your own key always wins over treg's, and those calls are never metered.
The vocabulary for the second half:
- tool = something the registry calls for you with the org's credential. Two kinds:
- endpoint — an upstream
base_url+ credential bindings (each binding injects one secret into the request; a request can carry several, e.g. an OAuth bearer and adeveloper-tokenheader). - CLI — a vendor binary (
stripe,gh,vercel, ...) run with the credential injected.
- endpoint — an upstream
- skill / bundle = a recipe (
SKILL.md) + its secrets + its tool(s), registered together.
The one rule: the proxy relays, never models the upstream, and injects auth server-side — so it survives upstream API changes and callers never hold keys.
Visit treg.to (hosted on Render) — the dashboard, sign-in, and every URL below live there.
Same flow as the dashboard's Getting started guide:
# 1. install the CLI — also points it at the registry
curl -fsSL https://treg.to/install.sh | sh
# 2. sign in (GitHub default · --email for a one-time code · --token for agents/CI)
treg login
# 3. do something useful immediately — no key, nothing registered
treg catalog search "backlinks for a domain" # find a tool by what it DOES
treg call tikhub.tiktok.user.profile --query uniqueId=tiktok
treg balance # exactly what that cost
# (or `treg onboard` for the guided walkthrough)Fish Audio provides S2.1 Pro speech, public-voice discovery, and private voice cloning.
Speech is binary stdout, so redirect it to a file. A discovered voice's _id or a team voice id is
the TTS reference_id; voices created on treg's Fish account are durable team resources:
treg call fishaudio.tts.s2-1-pro --method POST --header model=s2.1-pro \
--data '{"text":"Hello from treg","format":"mp3"}' > speech.mp3
treg call fishaudio.voices.discover --query self=false --query licensed=false --query language=en
treg resources list --provider fishaudio --kind voiceWith your own Fish key, requests remain an unrestricted, unmetered upstream relay and Fish owns the account boundary.
Catalog tool inputs are described by treg catalog get <id>. Tools marked strict_query reject undeclared or repeated query parameters, unsupported values and request bodies. Send each declared single-valued parameter once, and a row count such as limit as a whole number within its stated maximum: a tool that enforces this answers a 400 catalog_parameter_invalid naming the parameter, and nothing is charged.
Your token identifies you on every call (X-Treg-Token header) and is the same for all tools.
Discover what your team has shared: treg tool ls · check credential health: treg health.
/plugin marketplace add superdesigndev/treg
/plugin install treg@treg
Installs the treg skill and treg's tools with no token and no configuration. Run /mcp, pick
treg and sign in; the tools appear after it. Other agents: npx skills add superdesigndev/treg -s treg
(or see Workflow skills for the rest).
See docs/CLAUDE-PLUGIN.md. MiniMax Code / MiniMax Agent users: the same
skill ships via the MiniMax Plugin Marketplace (docs/MINIMAX-PLUGIN.md).
Ready-made recipes your agent runs end to end, every call through treg:
| Skill | What your agent can do |
|---|---|
treg |
Find and call any tool in the catalog, plus your own tools |
web-access |
When your agent's own web tools fall short, read the live web without local scrapers: free search and page reads first, then the right platform job for social, stores, reviews, maps and papers, with treg falling back to the next vendor when one fails |
lead-signals |
Find in-market buyers from public signals (complaints, job changes, hiring, funding, tool adoption) and monitor a topic, competitor or account list for them (treg.to/leads-signals) |
recruit |
Turn a LinkedIn job post into a ranked shortlist: criteria from the post, people search, filters with reasons, one line on why each fits, cited evidence (posts, GitHub, talks, tenure, job change) under a per-candidate spend cap, then a checked personal email and phone, with a run file of counts, evidence and the vendor trail per candidate |
make-ugc |
Make AI UGC videos: trending hooks, a presenter, talking-head clips, captions (treg.to/ugc) |
jev-memory |
Give Claude Code a memory: a Claude Code mod where Jev judges each prompt after the turn and keeps your lasting preferences, installed ready-made or built from one prompt (the mod) |
install.sh installs only treg and names the others in one line; your agent offers them after
sign-in and the first call. Name the ones you want with
sh -s -- --skills lead-signals,recruit (or --skills all; the opt-in jev-memory and rea-growth are never in that set). In Claude Code each one is
also its own plugin in treg's marketplace: /plugin install recruit@treg, or pick them from /plugin. To add
them to an existing agent instead (skills.sh CLI):
npx skills add superdesigndev/treg # every public skill
npx skills add superdesigndev/treg --skill lead-signals # just one
treg skill bootstrap --skills all # the installer's set, with the treg CLI you already haveThe workflow skills run on treg, so set it up first (the Quickstart above, or point your agent at treg.to/llms.txt).
The Claude Connectors Directory surface is https://treg.to/mcp/v2/. It exposes only curated
catalog endpoints, without image, video or audio generation, and separates read calls from write
calls so Claude receives accurate safety signals. The existing /mcp/ surface remains available for catalog endpoints, team-owned tools,
and imported skills. See the MCP and OAuth architecture
for the boundary and implementation, and the
submission runbook for release gates.
The catalog is grouped by what endpoints do: keyword and rank tracking, backlinks and authority, AI visibility, trending and discovery, publishing to socials, people and company enrichment, ads management and creative, measurement.
treg catalog # every platform, busiest first
treg catalog search "find a work email" # by the job, not the vendor
treg catalog search --new # tools added in the last 30 days, newest first
treg catalog get hunter.people.email.find # params, PRICE, example response
treg call hunter.people.email.find --query domain=reddit.com --query full_name="Alexis Ohanian"How a catalogued call is served — the credential ladder, in order:
- your team registered its own tool for that provider → that tool, that key;
- your team stored a secret for the provider → injected through a virtual tool;
- neither, and the endpoint has a verified public route → no provider key, free;
- otherwise → treg's own key, billed to the team's prepaid balance.
The anonymous price assumes the caller does not send a provider credential header. The faithful
relay preserves caller headers, so a caller-supplied provider key can use that key's credits.
Your own credential always beats treg's, so connecting a key you already pay for makes those calls
free of the balance rather than duplicating them. An endpoint treg has no published price for is
refused, not served free — you are told to connect your own key instead. Where several providers
serve one capability, treg catalog search shows them side by side with prices; choosing is
yours — treg does not silently pick or fail over between providers for you. (When treg's own
account for a provider is out it may serve the same endpoint through a treg-owned relay account,
disclosed on the response; a team can opt out.) The exception you opt into: treg.<capability> routed endpoints, where treg picks the provider for you and names it. For common jobs (scraping a page, web search, Google results, finding an email) start with the routed endpoint, such as treg.web.extract or treg.web.search, rather than a provider you remember by name. On treg.people.email.find and treg.people.phone.find, X-Treg-Route-Verify: true also checks the found address or number in the same call, as its own charge, and says what the check found.
treg balance # credit left, calls in flight, recent spend
treg topup # add funds, or set up automatic top-upsOut of balance is an HTTP 402 error: insufficient_balance carrying balance_micro, estimated_cost_micro and a topup_url,
so an agent can act on it without reading prose.
Enrich Arena lives at /enrich-arena, outside the dashboard. Compare enrichment answers with each vendor’s cost and speed,
vote for the best answer in one click, or watch a sequential waterfall. Capability-compatible
async providers participate too; Arena handles submit and polling internally. Browsing is
public; submitting requires login, and billable attempts use your team's credits. See the
Arena guide.
Web Arena compares Web Search, Web Fetch, and Sitemap providers at /web-arena.
Battle calls selected providers for the same input; Waterfall tries them in order. The
live leaderboard combines direct provider-call hit rates and response times with checked
Web Arena quality results over a rolling 30-day window. The pages open when the feature
is enabled. See the
Web Arena guide.
The zero-thought path — point treg at a project and it figures out what's shareable:
treg scan # read-only preview: the keys, skills & CLIs upload would register
treg upload # register them (encrypted server-side); idempotent, --replace to updatetreg upload scans the .env (matching keys against ~80 known providers), every skill
subdirectory, and installed catalog CLIs. Three kinds of things go into the registry — here's how
to share and use each:
Share — one upstream URL callable with a stored key, or bulk from a .env:
treg secret add STRIPE_KEY --value sk_live_123
treg add stripe --base-url https://api.stripe.com --secret STRIPE_KEY
treg upload env --select openai,stripe,resend # or straight from the .envUse — the agent-native way: build the real upstream request and prefix it with the proxy.
treg resolves the tool by host, injects the credential, and relays everything else faithfully
(your X-Treg-Token is stripped before the upstream sees it):
Real request: GET https://api.intercom.io/conversations?per_page=5
Through treg: GET https://treg.to/call/https://api.intercom.io/conversations?per_page=5
header: X-Treg-Token: <your token>
Or the CLI shorthand — and treg calls for the audit log:
treg call intercom conversations --query per_page=5
treg call stripe v1/balanceShare — automatic: treg upload detects installed catalog CLIs (stripe, gh, vercel, …)
and registers them; a recipe-only catalog CLI skill (e.g. stripe-cli) auto-becomes runnable too.
Use — treg run executes the vendor CLI with the org's credential injected, so you never
hold the key or log in:
treg run stripe -- get /v1/balance
treg run gh -- pr list--local (default) runs on your machine. Server-side CLI execution (--server) is disabled globally.
treg runs is the audit log.
Share — a skill is a whole capability (SKILL.md recipe + its secrets + its tool(s)),
registered together so the whole team runs the same skill, maintained in one place:
treg upload skills --dir ~/.claude/skills --all # register a folder of skills in one passUse — pull any shared skill into your agent; its API calls go through treg with your token, so the key stays on the server, never in the skill:
treg skill install seo-blog-writer # writes into ./.claude/skills/ (--all for the library)# multi-credential tool (e.g. google-ads: OAuth bearer + a developer-token header)
treg tool add google-ads --base-url https://googleads.googleapis.com \
--bind "secret=<oauth-id>,injector=oauth" \
--bind "secret=<dev-id>,name=developer-token,format={secret}"
# one skill, step by step
treg skill init --dir ./my-skill # drafts treg.json (guesses base_url, finds secrets)
treg skill add --dir ./my-skill # registers recipe + secrets + tool, atomically
# OAuth via the browser (mints the first token, treg holds it and auto-refreshes)
treg oauth connect gsc --client-secret client_secret.json \
--scopes https://www.googleapis.com/auth/webmasters.readonlyFull options for every command: USAGE.md.
The CLI and its installer send anonymous usage to PostHog when using treg.to (no arguments or credentials).
Disable with TREG_TELEMETRY=0 or DO_NOT_TRACK=1.
See analytics details.
An account can own up to 10 teams. Joining other teams as a member does not count toward this limit.
Everything is scoped to an org: a token = a (user, org) membership, and every secret, tool,
and skill belongs to the active org. Roles: owner / admin / member / viewer.
treg org create "Acme" # make a team, become owner
treg org invite teammate@acme.com # invite by email (pick role + tool access)
treg org join <code> # accept an invite (sign in as the invited email first)
treg org ls | use <slug> | members # switch orgs, see the roster
treg org access <member> --tools a,b # per-member tool access (admin+)Team owners can enable enterprise SSO from the dashboard's Team → SSO tab. WorkOS connects the company's identity provider; owners can invite their IT admin to finish setup. Employees can enter their work email in any sign-in dialog or use the team's direct sign-in link. treg keeps its team roles and API keys. The Directory Sync plan removes a deactivated employee's team access. See enterprise SSO setup.
-
Feedback:
treg feedback submit friction "The pagination example is unclear."Share problems or suggestions without private information. See feedback instructions. -
Review:
treg review CALL_ID usefulRate an invited catalog call after using its result;not_sureis fine. Omit private data and continue the task. -
USAGE.md— the fulltregCLI reference. -
/llms.txt: the agent entry point, in the llms.txt format: what treg is, setup for each kind of agent, the search-read-call loop and the rules, with links to/skill.md, the operating guide, for everything else. -
The dashboard at treg.to — full CRUD, a guided tutorial (Help → Tutorial), and copyable setup instructions for your agents.
-
The API — everything the CLI does is plain HTTP; interactive OpenAPI docs live at
/docs. The proxy endpoint is/call/{...}; all endpoints take theX-Treg-Tokenheader.
One command (needs tmux + uv; it syncs the venv itself):
scripts/dev-local.sh up # server on http://localhost:18790, dev-safe settingsThat runs the server in tmux with hot-reload, its own sqlite DB (treg-dev.db), and email OTP dev
mode (sign-in codes shown on the page — no mail sender needed). Day-to-day:
scripts/dev-local.sh cli login # sandboxed CLI: never touches your real ~/.treg/config.json
scripts/dev-local.sh logs # server output · status / restart / down
scripts/dev-local.sh reset # wipe the dev DB + CLI sandbox for a fresh startOr run the server directly, without tmux:
bash scripts/build-dashboard.sh # Node 22.12+ and npm; build the Dashboard
uv sync # create the venv from uv.lock (pulls the server deps for dev)
uv run python -m treg upgrade # prepare schema + run idempotent release tasks without serving
uv run python -m treg # serve on 0.0.0.0:18790 (add --reload for dev)
uv run python -m treg keygen # print a fresh Fernet key for TREG_SECRET_KEYInstalling to run a server (not from source): the base package is the CLI only. To run a registry, install the server extra —
pip install "tools-registry[server]"— which adds FastAPI, the database drivers, and encryption.pip install tools-registryalone gives just thetregcommand for talking to an existing registry.
The official hosted service is available at treg.to. Its production topology and live settings are
maintained in the private operator runbook.
Environment variables (prefix TREG_, read from .env):
| Var | Default | Purpose |
|---|---|---|
TREG_DATABASE_URL |
sqlite+aiosqlite:///./treg.db |
DB URL (SQLite for dev, Postgres in prod) |
TREG_READ_DATABASE_URL |
(empty) | Optional SQLite / PostgreSQL read datasource; empty reuses the primary. Requires callers to opt in; existing queries are unchanged. See read datasource setup. |
TREG_SECRET_KEY |
(empty) | Fernet key for secrets-at-rest; empty → an ephemeral key is minted (secrets won't survive a restart) |
TREG_PUBLIC_URL |
https://treg.to |
treg's public base, used to build the OAuth callback URI |
TREG_SESSION_SECRET |
(empty) | signs the dashboard session cookie; falls back to TREG_SECRET_KEY. Set a real value in prod |
TREG_GITHUB_CLIENT_ID / _SECRET |
(empty) | GitHub OAuth sign-in (callback <public_url>/auth/github/callback); empty hides the button |
TREG_GOOGLE_CLIENT_ID / _SECRET |
(empty) | Google OAuth sign-in (redirect <public_url>/auth/google/callback); empty hides the button |
TREG_WORKOS_API_KEY / _CLIENT_ID / _WEBHOOK_SECRET |
(empty) | WorkOS enterprise SSO; configure callback and signed directory webhook as described in enterprise SSO setup |
TREG_ENTERPRISE_SSO_BUNDLE_ONLY |
true |
Show only the SSO + Directory Sync plan by default; set to false to offer both monthly plans. |
TREG_ENTERPRISE_SSO_BUNDLE_PRICE_ID / TREG_ENTERPRISE_SSO_ONLY_PRICE_ID |
(empty) | Reusable monthly Stripe Price IDs in the same account as TREG_STRIPE_SECRET_KEY; an unset or unusable Price hides its plan. Stripe's Price supplies the displayed amount and Checkout charge. |
TREG_ENTERPRISE_SSO_BUNDLE_MIN_PRICE_USD / TREG_ENTERPRISE_SSO_ONLY_MIN_PRICE_USD |
0 |
Optional whole-dollar minimum for each monthly Stripe Price; lower prices are hidden and rejected at Checkout. |
TREG_INSTAGRAM_CLIENT_ID / _SECRET |
(empty) | Instagram App ID and secret for direct Instagram Login (redirect <public_url>/oauth/callback) |
TREG_META_CLIENT_ID / _SECRET |
(empty) | Meta app credentials for Facebook Pages, Meta Ads, and optional Instagram page-tools |
TREG_OAUTH_REVIEW_PENDING |
instagram-login,page-messages |
Comma-separated registry review keys whose capabilities must remain gated; hosted review state is maintained privately. |
TREG_RESEND_API_KEY / TREG_EMAIL_FROM |
(empty) | transactional email via Resend (OTP codes + invites); From must be a Resend-verified sender |
TREG_BLOCKED_EMAIL_DOMAINS |
(empty) | comma-separated email domains refused at every sign-up/sign-in door and at team creation (subdomains included, case-insensitive). Empty blocks nothing — no list ships in the code |
TREG_CLIENT_IP_HEADER |
(empty) | a header only your edge can set, used as the client address for every per-IP limit (cf-connecting-ip behind Cloudflare) |
TREG_TRUSTED_PROXY_HOPS |
1 |
without that header: the X-Forwarded-For entry this many hops from the RIGHT (the one your nearest proxy appended); 0 when clients connect directly. The first entry is client-written and never trusted |
TREG_RATE_LIMIT_EXEMPT_IPS |
(empty) | comma-separated addresses or CIDR blocks exempt from every per-IP limit (an authorized security test, a monitoring probe); per-email, per-user and deployment-wide limits still apply. A malformed entry refuses to start |
TREG_REQUIRED_EXTENSIONS |
(empty) | comma-separated policy extensions (treg.extensions entry points) that must be installed, else startup fails. treg.to runs a private abuse-policy extension this way; it can only restrict (policy extensions) |
TREG_TURNSTILE_SITE_KEY / _SECRET |
(empty) | Cloudflare Turnstile on every email sign-in form and on a new address's first GitHub/Google sign-in; either empty = off. The site key is served in /captcha.js, the secret only reaches siteverify |
TREG_TURNSTILE_MODE |
observe |
observe logs each outcome and changes nothing; enforce refuses a code to a missing or invalid token, gives no signup credit when Cloudflare cannot answer, and gives a new GitHub/Google user signup credit only on a passed check |
TREG_TURNSTILE_SOCIAL |
true |
false skips the check on a new address's first GitHub/Google sign-in, which then gets signup credit as with no widget; the email door is unchanged |
TREG_TURNSTILE_HOSTNAMES |
(empty) | comma-separated hosts a token must be solved on; empty = the TREG_PUBLIC_URL host (and its known aliases) |
TREG_ADMIN_TOKEN |
(empty) | cross-tenant super-admin bearer; authorizes every /admin/* endpoint. Empty disables the env path (only is_superadmin users reach /admin). Keep it long + secret. |
TREG_EMAIL_DEV_MODE |
false |
when true, /auth/email/start returns the OTP in its response (no mail sender needed) — dev/local only, never in prod. |
TREG_KV_URL |
(empty) | shared key-value store (Redis protocol) for counters every worker must agree on, today the per-team review-invitation budget. Empty = an in-process fallback, fine for one worker |
No .env is needed for local dev — every setting has a working default (ephemeral key, sqlite).
⚠️ Back these up before moving or redeploying: the Fernet key (TREG_SECRET_KEY) and the database (Postgres in prod;treg.dbfor a local sqlite run). Lose the Fernet key and every stored secret becomes unrecoverable.
Request flow for /call: resolve tool (by URL host + longest base_url prefix, or by name) →
decrypt its secret(s) → apply each binding's injector → stream to the upstream → fire-and-forget
audit record. The infra relay streams bytes without business logic. The call application buffers
responses needing settlement or ownership evidence up to 8 MiB; larger responses return a 502
without charging instead of a truncated success. Endpoints that inline media (Gemini images)
declare spooled_response: their metered answer is read to a temp file instead, settled from its
reported usage, and relayed whole. Authorized free final downloads needing no body
evidence stream in full, as do own-key and own-tool responses.
Module map (src/treg/):