MONMONMON for agents

MONMONMON for agents

MONMONMON is Peelander Yellow's collection of tattoo monsters and a home for browser card games. The monsters' head, body and foot parts correspond to katakana syllables; the combined syllables form the monster's name. The site calls the wallet-held cards digital collectibles.

Discover and read

Start with llms.txt, the OpenAPI specification, or the public skill. The API base is https://monmonmon.art. Public rules, curated free cards, news and leaderboard data require no API key. Optional scoped bearer tokens are issued from an existing cookie session at /api/agent/tokens; this does not require an OAuth provider.

  • Hidden Feelings rules: five monsters each, one secret feeling, five rounds at most.
  • Original-game rules: a separate game with its own browser flow.
  • API guide: authenticated game sessions and executable examples.
  • Free cards: search the 25 curated playable previews, not the entire collection.
  • News: recent story metadata, with complete Markdown available by story id.
  • Leaderboard: top 25, latest 25 and full-history totals; cached for five minutes.
  • RSS feed: dated news with story images.
  • API status: endpoint availability; dependency health is reported by each service.

For the wider collection, use Explore. URL filters include q, rarity, head, body and foot, with romaji syllables such as na or chi. The letter filters refer to complete parts of the monster's name, not arbitrary text substrings.

Use tools

The remote MCP endpoint is https://monmonmon.art/api/mcp. It supports Streamable HTTP with JSON responses, protocol version 2025-06-18, public read-only tools and documentation resources. Send initialize before tools/list or tools/call. This transport does not require an API key or a persistent MCP session. Its tools read rules, search free cards, list news and retrieve the leaderboard; they do not create matches or submit moves.

On browsers that support WebMCP, document.modelContext registers public reading tools and Hidden Feelings gameplay tools. Game tools use the browser's existing session and the same server validation as the human interface. Ordinary browsers continue to work without WebMCP.

Play on behalf of a user

Hidden Feelings exposes a session-protected JSON API at /api/agent/duel. Preserve the HttpOnly monmon_duel cookie. Free play needs no wallet; using owned cards additionally requires the wallet owner to sign a verification message. Never request a seed phrase or private key. Start a match or make a move only within the user's request to play. Do not treat documentation discovery as permission to create games, sign messages, buy cards or publish results.

A match response is player-specific. Respect hidden information and use only the returned hand, public cards and revealed rounds. Keep the latest revision and handle HTTP 409 by reading the match again. Challenges expire after seven days. Agent creates require an Idempotency-Key header. Establish the cookie session first. Retry the same create using the same cookie, key and game settings; it returns the existing match without charging another slot.

Persistent context and limited delegation

GET /api/agent/session establishes or restores private session context. POST a label to preserve context across requests. Use /api/agent/tokens to issue a revocable token with only the required scopes, for at most one hour. Default tokens can only read games and session context. A sandbox:play token cannot start a live game, and a games:read token cannot submit moves. Tokens never grant extra daily games or wallet-signing authority.

The intent endpoints /api/agent/intents/start-game and /api/agent/intents/join-game prepare the free team when omitted, so agents can reach the desired game state in one request. The play-turn and continue-game intents handle moves and round acknowledgements. They enforce the same signed-session ownership, revision and daily quota checks as the lower-level API.

Use /api/agent/sandbox to test against the real engine with free cards and a deterministic Monster. Simulations return encrypted continuation state valid for 15 minutes; they do not write real games or results, or consume production admissions. They support solo play only. Request-rate limits continue to apply.

The OpenAPI x-consequence labels identify actions that affect live games, credentials or private context. Each API response carries X-Request-ID. Consequential agent actions emit matching structured logs containing pseudonymous actor IDs without credentials or private move bodies. See the API guide for scopes, examples and the sandbox protocol.

Efficient access

Request Accept: text/markdown on the homepage, docs, news, Explore, leaderboard or game entry pages for a concise text representation. Documentation also has stable .md URLs. These representations cover the same public subject matter without page scripts and styles. Private live match pages are excluded from this negotiation and from the sitemap.

All API routes return X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. The shared guard allows 600 requests per minute per client in each running edge instance; it is not a global account quota. Honor HTTP 429 and Retry-After. Game polling every 2.5 seconds is sufficient; use slower polling for background sessions. Agent gameplay is limited to 50 distinct matches across the whole site per UTC day. The Firebase counter is shared across server instances. New agent games return 429 with code AGENT_DAILY_GAME_LIMIT when exhausted; wait until resetsAt (Unix milliseconds) or Retry-After. Existing admitted games may finish. Read-only calls and in-game moves are not counted as new games. Ordinary human sessions keep their existing game rules.

Updated: September 20, 2026.