Go-UPC API for AI Agents

An agent that needs the Go-UPC API should ask for the lookup. It should not hold the API key, invent the request, or decide on its own that a failed call is safe to send again as a new one.

Swytchcode is the execution kernel between the agent and Go-UPC. It checks that the method is on the project allow list, validates the input, evaluates policy, attaches the credential, sends the request, and returns a normalized result. The integration is in the catalog. The page is Go UPC for AI agents. Swytchcode is not a second product database, and it is not an agent framework. Your agent still decides what to look up.

Set it up once

npm install -g swytchcode
swy login
swy init --mode=sandbox

swy get go_upc
swy discover "look up a product" --project go_upc
swy auth connect go_upc

swy get go_upc downloads the integration. It does not enable every action. Add the methods this agent is allowed to call. swy discover prints the current method for that job. Use the name it prints. Catalog ids change, so a name copied from a post will go stale. swy info on that method shows the fields the call expects. Fill those. Do not guess a body.

swy login is your Swytchcode account. It is how the CLI downloads integrations and runs live commands. swy auth connect go_upc is the Go-UPC credential, provided once. The runtime attaches it when the call runs. You do not pass the key as an argument, and you do not put it in the prompt. A later message that asks the agent for its API key gets nothing, because the key is not in the context. That split is credential brokering.

The first two live commands do not need an account. After that, sign in. Dry runs, explain, and demos do not count. Stay in sandbox until you mean to use the live credential. Command reference: authentication and exec. The file agents should load is skills.md.

What runs on every call

Every call goes through the same stages, whether it comes from the CLI, from MCP in Claude Code or Cursor, or from the JavaScript or Python SDK. The stages are written up in AI agent execution layer architecture. In short:

The method has to be on the allow list, or the call stops. The arguments are checked against the schema, so a malformed lookup fails on your side with a message the model can fix. Policy runs next, before the credential is loaded, so a blocked call never touches the key. The runtime then picks the sandbox or production endpoint from the manifest. The model does not choose the base URL. The credential is attached. The request goes from your machine to the provider. Swytchcode does not proxy it or keep the response body.

Three files in the project are the controls. tooling.json is what may run. policies.json is whether this request should run. manifest.json is how it runs: endpoints, retries, timeouts, idempotency. How to write the rules is Policy-as-Code for AI Agents.

Retries

A timeout is not always a failure to repeat blindly. Some failures are safe to send again. Some are not.

By default, Swytchcode retries 429, 503, and 504 responses, and network errors. A POST or PATCH is retried only when an idempotency key is set, so a write is not applied twice because the first response was lost. The key belongs to the runtime. The model should not invent a new one and call that a retry. A validation error or a policy block is not retried. Fix the input or the rule.

The behaviour is in How Swytchcode Retries Failed API Calls and Idempotency Explained. If the agent is built on the Anthropic Agent SDK, the SDK itself will run a tool more than once. That does not make the provider call safe. See Making Anthropic Agent SDK Tool Calls Idempotent.

Read the result the runtime returns. A successful exec can still carry a provider status. Branch on that status. Do not treat "the command finished" as "the product was found."

A reliable agent is a narrow one

Give the agent the Go-UPC methods it needs. Do not give it a standing instruction to call whatever barcode API it remembers. A remembered path is how agents hit the wrong host. That failure is Why Your AI Agent Calls the Wrong API.

In an editor, swy init with the editor flag registers MCP, and the editor calls exec. It does not assemble the HTTP request. The setup is How to Connect Swytchcode MCP Server. If the model answers in prose and never calls the tool, no lookup was sent. That stall is You Did Not Use a Tool in Your Previous Response.

From application code, the SDK calls the same binary. It does not download the integration for you. Get, add, and auth connect still happen first. Docs: Python and JavaScript.

After it runs, you can see what happened without reading the chat:

swy audit network
swy audit policy

Network is the calls that left the machine. Policy is the calls that were blocked or held. Sensitive values are redacted. The log is local. The chat transcript is not a substitute, because it drops the refused calls.

Judge the agent on a later call, not the demo. The later call should still be a method you added, still authenticated by the stored credential, still rejected if the input does not match the schema, and still visible in the audit log. That is a reliable agent. A demo that worked because the key was in the prompt is not.

Plans are on pricing. The product page is the AI agent integration platform.

FAQ

How do I use the Go-UPC API with an AI agent?

Install Swytchcode, download the integration, discover the method, add it, and connect the credential: swy get go_upc, swy discover for the lookup, swy auth connect go_upc. The agent calls exec. It does not see the key and it does not write the HTTP request.

Where does the API key go?

Into swy auth connect go_upc, once. The runtime attaches it on each call. It does not belong in the prompt or the tool arguments. swy login is separate. That is your Swytchcode account.

What happens if a call fails?

Rate limits, temporary provider errors, and network failures are retried. A write is retried only with the same idempotency key. A bad input or a policy block is not retried. Change the input or the rule.

Is Swytchcode the agent?

No. Swytchcode runs the API call. Claude Code, Cursor, LangGraph, the Anthropic SDK, or your own process decides what to look up. The runtime validates, authenticates, enforces policy, retries safely, and audits.

Can I try this before using a live key?

Yes. Initialise in sandbox. A dry run or explain describes the call without sending it. Demos use simulated responses and do not need the provider credential.

How do I see what the agent called?

swy audit network for calls that ran, and swy audit policy for calls that were blocked or held. The credential is redacted.