# HaneruTo (hakuto) — b612

> HaneruTo, trading as hakuto (brand B612 SHEEP), is a Japanese AI-assisted web and systems development studio founded in 2025. It operates b612, a Japanese-market code-review agent for AI coding assistants: review checklists, industry presets with mandatory Japanese legal checks (景表法 / 特商法 / 薬機法 / インボイス / 電帳法 / 宅建業法 / 介護保険法), field-tested failure patterns, and 31 deterministic detection rules. b612 is published as a remote MCP server and as an A2A agent, both on mcp.hakuto-0209.com. There is no REST/OpenAPI surface.

This file was generated by API Evangelist from the provider's live surfaces on 2026-09-19 (the provider publishes no llms.txt of its own — /llms.txt and /.well-known/llms.txt return 404 on hakuto-0209.com and mcp.hakuto-0209.com). Every URL below was fetched and returned the status shown.

## Agent surfaces

- [MCP server (Streamable HTTP)](https://mcp.hakuto-0209.com/mcp): POST JSON-RPC; protocol 2025-06-18; serverInfo b612 0.1.0; 10 tools, all synchronous reference lookups; initialize, tools/list and b612_principles answer without a key. Client quickstart from the provider: `claude mcp add --transport http b612 https://mcp.hakuto-0209.com/mcp --header "x-b612-key: <your key>"`.
- [A2A agent card](https://mcp.hakuto-0209.com/.well-known/agent-card.json): A2A 0.3, JSON-RPC binding, six skills (principles, review-checklist, patterns, domain-preset, scan-code, rules); EdDSA-signed, key published at the JWKS below. The legacy path /.well-known/agent.json serves the same card unsigned.
- [A2A JSON-RPC endpoint](https://mcp.hakuto-0209.com/a2a/v1): requires the x-b612-key license header (401 `unauthenticated` otherwise, with a hint naming principles and rules as keyless).
- [JWKS](https://mcp.hakuto-0209.com/.well-known/jwks.json): one Ed25519 key, kid b612-a2a-2026-09.
- [Quickstart / endpoint index (plain text)](https://mcp.hakuto-0209.com/): lists the card, JSON-RPC, MCP and data-policy URLs.

## Authentication and limits

- Scheme: API key in the `x-b612-key` header (a b612 license key; obtained from the provider by contact). No OAuth, no OIDC, no RFC 9728 metadata.
- Keyless tier: principles and rules, 20 requests/min per IP (agent card). All requests are rate limited per IP; request bodies are capped at 4 MB (data policy).
- Pricing: agent-to-agent access is a monthly flat fee with a call cap, priced on contact — https://hakuto-0209.com/#contact

## Data handling

- [Data policy / terms for the b612 agent (EN + JA, version 2026-09-11)](https://mcp.hakuto-0209.com/terms): submitted code is analysed in memory by deterministic rules and discarded; no LLM is involved; keys are SHA-256 hashed before validation; usage records, retention periods and the deletion-request channel (info@hakuto-0209.com or the official LINE) are itemised.
- [Uninstall / restore instructions](https://mcp.hakuto-0209.com/uninstall): what the Claude Code / Codex integration installs and how to remove it.

## Company

- [Website (Japanese)](https://hakuto-0209.com/)
- [Company information and 特定商取引法 disclosure](https://hakuto-0209.com/legal/hakuto-company.html)
- [Terms of service (hakuto AI)](https://hakuto-0209.com/legal/hakuto-terms.html)
- [Privacy policy](https://hakuto-0209.com/legal/hakuto-privacy.html)
- Contact: info@hakuto-0209.com — https://hakuto-0209.com/#contact

## Not published

- No OpenAPI, AsyncAPI, GraphQL or Postman contract. No SDK on npm/PyPI/RubyGems/crates.io/Maven/NuGet/Go. No GitHub organisation found. No security.txt, status page, changelog, SLA or deprecation policy. No sandbox beyond the keyless tier.