From 6a791747378a6944ac226ac823ebcb82787352ca Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Sat, 5 Sep 2026 14:15:31 -0700 Subject: [PATCH] Say the four catalog tools answer without a key The hosted MCP server now serves a credential-free tools/call for list_apis, search_apis, get_api and quote_api (anyapi#1041, live and verified against production). Both passages here said the opposite: the auth Note told readers to use the REST catalog endpoints instead, and the local stdio section said every tool call needs a key. run_api and the account tools are unchanged and still answer 401 without one. --- mcp-server.mdx | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/mcp-server.mdx b/mcp-server.mdx index 17d23f6..0f7d9cd 100644 --- a/mcp-server.mdx +++ b/mcp-server.mdx @@ -24,12 +24,12 @@ registry-driven tool surface that covers the entire catalog — no tool-per-API The MCP surface is **API-key only** — session tokens are not accepted. Send your key as - `Authorization: Bearer `. Connecting is keyless: `initialize` and `tools/list` - answer without a credential, so a client can finish the handshake and read the tool list - before your key is in place. Every tool call needs a key, including the discovery tools - (`list_apis`, `search_apis`, `get_api`); without one they return `unauthorized`. To browse - the catalog with no key at all, use the public REST endpoints `GET /catalog` and - `GET /catalog/search` instead. + `Authorization: Bearer `. Browsing is keyless: `initialize`, `tools/list`, and the + catalog tools (`list_apis`, `search_apis`, `get_api`, `quote_api`) all answer without a + credential, so an agent can find an API, read its schema, and price a call before your key is + in place. Running an API and reading anything about your account need the key; without one + they return `unauthorized`. The same catalog is also public over REST at `GET /catalog` and + `GET /catalog/search`. ## Connect @@ -187,9 +187,10 @@ catalog change reaches you without upgrading anything. -`ANYAPI_API_KEY` is optional at startup. Without it the server still starts and lists its -tools, because the hosted server answers `initialize` and `tools/list` unauthenticated. -Set the key before your agent calls a tool: every tool call needs one. +`ANYAPI_API_KEY` is optional at startup. Without it the server still starts, lists its tools, +and forwards the catalog tools (`list_apis`, `search_apis`, `get_api`, `quote_api`), because the +hosted server answers all of those unauthenticated. Set the key before your agent runs an API: +`run_api` and the account tools need one. The server is listed in the official [MCP Registry](https://registry.modelcontextprotocol.io) as