Skip to content

Say the four catalog tools answer without a key #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kev1n merged 1 commit into from
Sep 5, 2026
Merged

Say the four catalog tools answer without a key #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions mcp-server.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,12 +24,12 @@ registry-driven tool surface that covers the entire catalog — no tool-per-API

<Note>
The MCP surface is **API-key only** — session tokens are not accepted. Send your key as
`Authorization: Bearer <your-key>`. Connecting is keyless: `initialize` and `tools/list`
answer without a credential, so a client can finish the handshake and read the tool list
before your key is in place. Every tool call needs a key, including the discovery tools
(`list_apis`, `search_apis`, `get_api`); without one they return `unauthorized`. To browse
the catalog with no key at all, use the public REST endpoints `GET /catalog` and
`GET /catalog/search` instead.
`Authorization: Bearer <your-key>`. Browsing is keyless: `initialize`, `tools/list`, and the
catalog tools (`list_apis`, `search_apis`, `get_api`, `quote_api`) all answer without a
credential, so an agent can find an API, read its schema, and price a call before your key is
in place. Running an API and reading anything about your account need the key; without one
they return `unauthorized`. The same catalog is also public over REST at `GET /catalog` and
`GET /catalog/search`.
</Note>

## Connect
Expand Down Expand Up @@ -187,9 +187,10 @@ catalog change reaches you without upgrading anything.
</Tab>
</Tabs>

`ANYAPI_API_KEY` is optional at startup. Without it the server still starts and lists its
tools, because the hosted server answers `initialize` and `tools/list` unauthenticated.
Set the key before your agent calls a tool: every tool call needs one.
`ANYAPI_API_KEY` is optional at startup. Without it the server still starts, lists its tools,
and forwards the catalog tools (`list_apis`, `search_apis`, `get_api`, `quote_api`), because the
hosted server answers all of those unauthenticated. Set the key before your agent runs an API:
`run_api` and the account tools need one.

The server is listed in the official
[MCP Registry](https://registry.modelcontextprotocol.io) as
Expand Down
Loading