HumanMirror

Developer integration, without the ceremony.

HumanMirror has two deliberately separate surfaces: a human-first SaaS for code security and resource operations, and a machine-native x402 layer for autonomous agents.

1. Local security audit

npx --yes https://humanmirror.fr/downloads/humanmirror-audit-0.1.0.tgz

The scanner runs locally by default. Use --json for structured output, --ci to fail a build when risk reaches 70, and --upload with a Pro key to keep cloud history.

2. Architecture

3. TypeScript — update a stock

const key = process.env.HUMANMIRROR_API_KEY;

const response = await fetch("https://humanmirror.fr/api/v1/saas/resources/", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": key
  },
  body: JSON.stringify({
    action: "stock",
    resource_key: "openai_tokens",
    label: "OpenAI token budget",
    unit: "tokens",
    current_amount: 128000,
    max_amount: 1000000,
    source: "production-worker"
  })
});

console.log(await response.json());

4. Python — define a need

import os, json, urllib.request

payload = json.dumps({
    "action": "need",
    "resource_key": "openai_tokens",
    "threshold": 200000,
    "target_amount": 1000000,
    "webhook_url": "https://ops.example.com/hooks/humanmirror",
    "cooldown_minutes": 60
}).encode()

req = urllib.request.Request(
    "https://humanmirror.fr/api/v1/saas/resources/",
    data=payload,
    method="POST",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": os.environ["HUMANMIRROR_API_KEY"]
    }
)

with urllib.request.urlopen(req) as res:
    print(json.load(res))

5. Pro API surfaces

6. Payments

7. Data and stability boundary

• Local CLI scanning does not upload source by default.
• Cloud audit uploads contain finding metadata and scores, not raw source-code contents.
• Resource alert webhooks accept HTTPS public-network targets and reject local/private destinations.
• API keys are hashed server-side; one-time claim material is encrypted until claimed.
• Backward-compatible machine discovery remains available through OpenAPI, MCP, A2A and x402.