Agent skill · software engineering · caffeinelabs
extension-http-outcalls
HTTP outcalls performed by the backend canister (not in the frontend), including mandatory local verification of external REST API requests.
Why this skill is useful
Adds specific commands for making HTTP GET and POST requests from the backend canister that the AI wouldn't reliably generate on its own.
What it needs
About 6k tokens when loaded. Last updated 2026-08-06.
What this skill does
HTTP Outcalls HTTP outcalls extension for Caffeine AI. Overview This skill covers the requirements for HTTP requests from the backend canister, including GET, HEAD, POST, PUT, DELETE, and PATCH. Use it whenever integrating with an external API or service. Critical requirements Follow these rules: MUST use a provider-enforced bounded API request. The request must limit the response by identifier, pagination, time range, geographic area, result count, or another server-side bound appropriate to the feature. Limit each response to both at most 10000 entries and at most 1 MB, then paginate if needed. MUST pick the bound that matches the feature. The five bounds are not interchangeable. When the feature looks up one entity by something the user supplies — a flight number, an order id, a ticker, a postcode — the identifier bound is the only correct choice. Paginating a collection to find that entity is the anti-pattern, not an alternative: the work still scales with the whole collection no matter how small each page is. Pagination is for a list the user deliberately pages through, not for searching. MUST put every bound in the actual Motoko http request. A bound used only by a local test does not protect the canister. NEVER fetch an unbounded collection and filter it in the canister. Expected response size, typical traffic, or a currently small dataset is not a bound. MUST reject the API or narrow the feature if the provider cannot enforce a response bound and supply the required data. Do not implement a knowingly unsafe fallback. Test locally against curl implementation. Ensure the 1:1 curl call succeeds and returns every field the app consumes. When Motoko code changes, redo the local curl test. Check the bounds with checkcanisterapicompliance. It probes the endpoint and measures the response against those limits, and it runs behind the deploy gate, so an endpoint it refuses cannot ship. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills caffeinelabs/extension-http-outcalls