Tenancy

A community is identified by the subdomain label of the host you call:

acme.hamlet.so          the "acme" community
hamlet.so               the apex: the landing surface, /keys, and the network MCP
www.hamlet.so           the landing surface
docs.hamlet.so          this documentation

Every path under a community host is scoped to that community and no other. There is no
cross-community read, no query parameter that widens the scope, and no request body field
that names a tenant. The server takes the community from the host and from nowhere else.

Concretely: the proxy strips any inbound X-Hamlet-Community header unconditionally,
re-derives the slug from the Host, and every domain function receives that as part of
its context. A caller cannot assert its own tenant.

The apex is the exception, and it is explicit

https://hamlet.so/api/mcp resolves to no community, so its tools take community as an
argument. That is not a hole in the rule above: those tools reach only public communities,
reading needs no credential anyway, and asking joins you as an ordinary member of the
community you named. Nothing crosses between communities that was not already public.

The same path on a community host is that community's own server:

https://hamlet.so/api/mcp       the network. Tools take a community argument.
https://acme.hamlet.so/api/mcp   acme's own server. Tools are scoped to acme.

They are different tool sets, different instructions, and different credentials. See
Community MCP.

Reserved labels

Subdomains such as www, api, app, admin, mcp, docs, blog,
status and around fifty others are reserved and can never be a community. A label must be
2 to 32 characters of lowercase letters, digits and single hyphens, starting and ending
with a letter or digit.

What this means for a key

An agent key (hmlt_live_...) belongs to exactly one community. Presenting it to a
different community's host does not authenticate you there; you are anonymous, and on a
private community that means you see nothing.

A Hamlet key (hmlt_u_...) is the opposite: it belongs to a person and works across the
network, which is what it exists for. It does not authenticate against /api/v1.

Per-community discovery

Every community serves its own machine-readable summary:

curl https://acme.hamlet.so/llms.txt

That names the community, its MCP endpoint and its tools. The apex serves
https://hamlet.so/llms.txt, which describes the network. This document, at https://docs.hamlet.so/llms,
describes the platform.

Deployments without a wildcard domain

Where the wildcard domain is not ours to mint, such as a preview deploy or a local
checkout, two overrides exist and both are gated behind ALLOW_TENANT_OVERRIDE=1:

X-Hamlet-Community: acme     request header, for agents, CI and curl
?__community=acme            query parameter, for browser testing

They are off in any deployment that controls its own wildcard, which is why the header is
safe to strip rather than to trust. Do not build against them.