OpenMHS 0.9 · Development draft 0.9 · not affiliated with Anthropic
OpenMHS is an independent, open draft contract between AI agents and physical equipment — discovery, typed capabilities, an endpoint-enforced safety envelope and an evidence trail for instruments, robots, and the simulations that stand in for them.
# request
mhs.command {
"capability_id": "cap.fluid.transfer.v1",
"input": {
"source": "plate:A1",
"target": "plate:B3",
"volume": { "value": 50, "unit": "uL" }
},
"command_id": "01J8ZQ3V6X…"
}# receipt
{
"status": "completed",
"state_revision_after": 43,
"state_hash_after": "sha256:9f2c…",
"effects": ["material.transfer"],
"evidence": { "seq": 812, "digest": "sha256:4a1e…" }
}mhs://lab-01:7331not a safety certificateThe same request shape moves a pipette, a robot joint or a simulated world. Mode and fidelity are declared, never inferred.
Device market
Every OpenMHS driver package that passed its gate: 299 hardware drivers served on their fake backends and 447 simulations, from oscilloscopes and liquid handlers to robot arms and UAV simulators. Each comes with an introduction and a copy-paste install command.
contract_checked on the fake backend, not a hardware qualification. Real hardware stays an explicit operator decision.
git clone --depth 1 https://github.com/PKU-YuanGroup/OpenMHS.git && cd OpenMHS
PYTHONPATH=MHS/sdk/src python3 -m mhs serve labs/tiagocoutinho__julabo --port 7400That serves a JULABO circulator on its fake backend at http://127.0.0.1:7400. Inspect it from a second terminal with PYTHONPATH=MHS/sdk/src python3 -m mhs describe --endpoint http://127.0.0.1:7400, or install any device into the OpenAI4S workbench with openai4s lab add <id>.
Why OpenMHS
Every lab and robotics stack has the same integration story: a bespoke translator, safety knowledge in a PDF, and simulators that share nothing with the machines they model. OpenMHS makes the contract explicit.
Every instrument ships its own SDK, transport and vocabulary. Twelve instruments mean twelve translators that do not compose.
OpenMHS: one JSON-RPC contract, declarative adapters, and reusable bridge families. The cost of support is a manifest and a thin shim, not a new driver.
Adapters and bridgesA model can read a docstring and still not know that 500 mW will destroy a laser, that the door interlock is open, or that the arm already holds a plate.
OpenMHS: limits, hazards, interlocks and permits travel in-band, and the endpoint evaluates them before any physical effect — not the model.
The safety envelopeMost agent development happens in simulators, but drivers describe real devices. Two standards would double the work; treating them as identical would get someone hurt.
OpenMHS: one object model, one wire protocol, two declared worlds. Mode and a fidelity contract make the difference machine-readable.
Modes and fidelityThe contract plane
OpenMHS standardises what a device is, what it will do, and what happened. Each surface is machine-checkable; none of them lives in prose or in the agent's prompt.
01 · Discover
An endpoint publishes a device manifest: resources, bound capability classes, units, modes, safety declaration, fidelity contract. Schemas are addressable and versioned separately from the wire protocol.
.well-known/mhs.json or explicit configuration02 · Govern
The endpoint checks the session, grant, schema, limits, interlocks, permits, revision and lease — in that order, fail-closed, before any effect. Violations are receipts, not exceptions.
03 · Account
Every command has a caller-generated id, an input digest and a retained receipt: status, revision, state hash, effects, errors and the native code. Receipts chain into tamper-evident evidence.
command_id; reuse with different input fails closedsha256 evidence chainCapabilities, not drivers
Device categories do not compose. A “plate reader” and a “microscope” share no useful interface until their actions are described in the same typed vocabulary.
OpenMHS describes a device as a set of capability classes bound to resources: cap.sensing.image.v1, cap.motion.joint_position.v1, cap.fluid.transfer.v1. Each binding carries units, limits, effects, hazards, determinism and risk. The driver becomes an implementation detail behind the binding, not the interface an agent has to learn.
cap.measure.voltage.v1cap.fluid.transfer.v1cap.world.step.v1Simulation and hardware
OpenMHS is designed for the people who develop in simulation and deploy on equipment. The contract is identical; the truth claim is not.
Drivers, SDKs, serial and VISA instruments, robots on a floor.
No fidelity contract required. Safety is enforced below and beside MHS.
Gymnasium, MuJoCo, Gazebo, analytic workcells and digital twins.
Fidelity F0–F3, determinism claim and known gaps are required.
Mode is not a trust flag. A session requests the device's declared mode; a mismatch is rejected. Switching from simulation to hardware is a different endpoint and device instance, never a flag flipped on a live session.
Fidelity is a contract. A simulator states its engine, fidelity level, timestep, determinism, replay support, validation record and — when non-empty — its gaps. Hiding a gap is a conformance failure.
hardwarethe machineyessimulatedthe modelin the modelhybriddeclared per resourcewith authorityreplaythe recordingread-onlyConformance
A conformance claim names a profile and a level, and points to a machine-readable report that a third party can recompute. Prose claims are not conformance.
The suite includes negative tests: interlock open, revision conflict, duplicate command id, deadline exceeded, cancellation, mode mismatch. A skipped test is not a passed test.
Adoption
Every indexed package states its ring, evidence state and next action. No repository is silently marked supported, and no claim is made about whether it runs.
Status
This site is the public face of a standard under review. The specification, schemas and registry are real artefacts; the SDK, recipes and conformance suite are being built in the open. We would rather label a gap than paper over it.
Get started
Read the core, validate a manifest, connect the SDK, or explore what already exists in the registry.