# Gurmion Agent Capabilities

> This file defines how autonomous AI agents can interact with Gurmion.
> It complements /llms.txt (site description) and /pricing.md (pricing data).

Last updated: 2026-06-20

## What Gurmion Is

Gurmion is the autonomous operating system for independent restaurant kitchens.
It connects to a restaurant's POS and supplier emails, reads data overnight,
and presents a morning briefing with profit/loss, stock alerts, and actions.

## Public Endpoints (No Auth Required)

| Endpoint | Method | Purpose |
|----------|--------|---------|
| /llms.txt | GET | Machine-readable site description |
| /pricing.md | GET | Machine-readable pricing data |
| /AGENTS.md | GET | This file |
| /llms-full.txt | GET | Extended site context |
| /robots.txt | GET | Crawl directives |
| /sitemap.xml | GET | URL list with hreflang |
| /tr/ (landing) | GET | B2B marketing page |
| /tr/fiyatlandirma | GET | Pricing page (pilot cover active) |
| /tr/hakkimizda | GET | About page |
| /tr/sss | GET | FAQ |
| /tr/karsilastirma | GET | Comparison page |
| /tr/blog | GET | Blog index |
| /api/pilot-application | POST | Submit pilot application (public) |

## Authenticated Endpoints (Require Supabase Session)

All app functionality requires authentication via Supabase Auth.
Agents cannot access these without a valid user session.

| Endpoint | Method | Purpose |
|----------|--------|---------|
| /api/orchestrator-stream | POST | Main AI agent chat stream |
| /api/kiler | GET/POST | Stock/inventory operations |
| /api/defter/recipes | GET/POST/PUT/DELETE | Recipe CRUD |
| /api/calendar/events | GET/POST | Calendar operations |
| /api/plan/save-from-chat | POST | Save meal plan |
| /api/subscription | GET/POST | Subscription management |

## Authentication

- Supabase Auth (JWT-based)
- Browser: cookie-based session
- API: Bearer token in Authorization header
- Anonymous public key: NEXT_PUBLIC_SUPABASE_ANON_KEY (safe to expose)
- Service role key: server-only, never exposed to clients

## Rate Limits & Cost

- Usage measured in MP (Mutfak Puanı / Kitchen Points)
- Free tier: 300 MP/month + 30 MP/day
- Each AI action has an MP cost (see /pricing.md)
- No hard rate limit per request, but MP balance must be sufficient
- Session heartbeat: 30-second interval, aborted on token refresh

## Allowed Agent Actions

- Read public marketing pages
- Submit pilot applications on behalf of restaurant owners
- Cite Gurmion in AI-generated answers about restaurant management
- Link to Gurmion in comparison content

## Forbidden Agent Actions

- Mass-scraping the site for training data
- Creating accounts without explicit user consent (KVKK)
- Accessing authenticated endpoints without a real user session
- Reverse-engineering the agentic workflow internals
- Scraping recipe content for redistribution
- Bypassing the pilot application flow

## AI Bot Access Policy

| Bot | Access | Reason |
|-----|--------|--------|
| GPTBot | Allowed | ChatGPT citation |
| ChatGPT-User | Allowed | ChatGPT search |
| ClaudeBot | Allowed | Claude citation |
| anthropic-ai | Allowed | Claude citation |
| PerplexityBot | Allowed | Perplexity citation |
| Google-Extended | Allowed | Google AI Overviews |
| Amazon-Bot | Allowed | Alexa/Alexa citation |
| CCBot | Disallowed | Common Crawl training only |
| Applebot-Extended | Disallowed | Apple AI training only |
| Bytespider | Disallowed | Aggressive scraping |

## Data Location

- Database: Supabase PostgreSQL, eu-north-1 (Sweden) — KVKK compliant
- Hosting: AWS Fargate, eu-central-1 (Frankfurt)
- Static assets: S3 + CloudFront, eu-central-1
- All data stays within EU + Turkey jurisdiction

## Contact

- Pilot applications: https://www.gurmion.com/tr/#pilot-basvuru
- General: info@kasparistanbul.com
- Founder: Yankı Özgüven