API Reference

Full REST API reference for AnythingMCP. All endpoints require JWT authentication unless noted.

Authentication

Get a JWT token via login, then include it in all requests:

TOKEN=$(curl -s http://localhost:4000/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.com","password":"your-password"}' \
  | jq -r '.accessToken')

# Use in subsequent requests
curl -H "Authorization: Bearer $TOKEN" http://localhost:4000/api/connectors

Interactive Swagger docs are available at http://localhost:4000/api/docs.

Auth Endpoints

Method	Endpoint	Auth	Description
POST	`/api/auth/register`	None	Register (first user becomes Admin)
POST	`/api/auth/login`	None	Login, returns JWT token
POST	`/api/auth/invite`	Admin	Invite a user via email
GET	`/api/auth/invite/verify`	None	Verify an invitation token
POST	`/api/auth/accept-invite`	None	Accept invitation and create account
POST	`/api/auth/forgot-password`	None	Request a password reset email
POST	`/api/auth/reset-password`	None	Reset password with token

Register

curl -s http://localhost:4000/api/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.com","password":"your-password","name":"Admin User"}'

A self-hosted instance answers with an accessToken for the new account. AnythingMCP Cloud answers { "verificationRequired": true, "message": "…" } whether or not the address already has an account and sends the details by email; sign in with the same credentials to continue.

Login

curl -s http://localhost:4000/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"admin@example.com","password":"your-password"}'

Response:

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs..."
}

Invite User (Admin)

curl -s http://localhost:4000/api/auth/invite \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"email":"user@example.com","role":"EDITOR","mcpRoleId":"optional-role-id"}'

Connector Endpoints

Method	Endpoint	Description
GET	`/api/connectors`	List all connectors
POST	`/api/connectors`	Create a connector
GET	`/api/connectors/:id`	Get connector with tools
PUT	`/api/connectors/:id`	Update connector
DELETE	`/api/connectors/:id`	Delete connector (cascades tools)
POST	`/api/connectors/:id/test`	Test API connection
POST	`/api/connectors/:id/import-spec`	Auto-import tools from connector's spec URL
POST	`/api/connectors/:id/import`	Import tools from any source
PUT	`/api/connectors/:id/env-vars`	Set environment variables
POST	`/api/connectors/:id/oauth/authorize`	Start OAuth2 authorization flow (returns redirect URL)
GET	`/api/mcp-oauth/callback`	OAuth2 callback — exchanges code for tokens

Create Connector

curl -s http://localhost:4000/api/connectors \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "My API",
    "type": "REST",
    "baseUrl": "https://api.example.com",
    "authType": "BEARER_TOKEN",
    "authConfig": {"token": "api-token"},
    "specUrl": "https://api.example.com/openapi.json"
  }'

Connector types: REST, SOAP, GRAPHQL, DATABASE, MCP

Auth types: NONE, API_KEY, BEARER_TOKEN, BASIC_AUTH, OAUTH2, WS_SECURITY, CERTIFICATE, CONNECTION_STRING

Import Tools

# From OpenAPI/Swagger spec URL
curl -s http://localhost:4000/api/connectors/$ID/import-spec \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"specUrl": "https://api.example.com/openapi.json"}'

# From Postman collection
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "postman", "url": "https://postman.com/collections/abc123"}'

# From cURL commands
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "curl", "content": "curl -X GET https://api.example.com/users"}'

# From GraphQL introspection
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "graphql", "url": "https://api.example.com/graphql"}'

# From WSDL
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "wsdl", "url": "https://service.example.com/api?wsdl"}'

# From custom JSON
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "json", "content": "[{\"name\":\"tool\",\"description\":\"desc\",...}]"}'

# From a HAR file (browser network capture) — the UI slims the file (strips
# response bodies, cookies and credential headers) before upload; do the same
# before sending one by hand.
curl -s http://localhost:4000/api/connectors/$ID/import \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"source": "har", "content": "{\"log\":{\"version\":\"1.2\",\"entries\":[...]}}"}'

Set Environment Variables

curl -s -X PUT http://localhost:4000/api/connectors/$ID/env-vars \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"envVars": {"API_SECRET": "value", "TENANT_ID": "abc"}}'

Tool Endpoints

Method	Endpoint	Description
GET	`/api/connectors/:id/tools`	List tools for connector
POST	`/api/connectors/:id/tools`	Create a single tool
POST	`/api/connectors/:id/tools/bulk`	Bulk create tools
PUT	`/api/connectors/:id/tools/:toolId`	Update a tool
DELETE	`/api/connectors/:id/tools/:toolId`	Delete a tool

Create Tool

curl -s http://localhost:4000/api/connectors/$ID/tools \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "get_user",
    "description": "Get user by ID",
    "parameters": {
      "type": "object",
      "properties": {
        "id": {"type": "integer", "description": "User ID"}
      },
      "required": ["id"]
    },
    "endpointMapping": {
      "method": "GET",
      "path": "/users/{id}"
    }
  }'

Bulk Create Tools

curl -s http://localhost:4000/api/connectors/$ID/tools/bulk \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"tools": [...]}'

See Tool Definition Format for the full schema.

MCP Server Endpoints

Method	Endpoint	Description
GET	`/api/mcp-servers`	List MCP server configurations
POST	`/api/mcp-servers`	Create MCP server config
PUT	`/api/mcp-servers/:id`	Update MCP server config
DELETE	`/api/mcp-servers/:id`	Delete MCP server config

Audit Endpoints

Method	Endpoint	Description
GET	`/api/audit/invocations`	List invocations (with filters)
GET	`/api/audit/stats`	Get invocation stats (24h, 7d, total)

Query Invocations

# Filter by tool name
curl -s "http://localhost:4000/api/audit/invocations?toolName=get_user" \
  -H "Authorization: Bearer $TOKEN"

# Filter by date range
curl -s "http://localhost:4000/api/audit/invocations?from=2026-01-01&to=2026-01-31" \
  -H "Authorization: Bearer $TOKEN"

Get Stats

curl -s http://localhost:4000/api/audit/stats \
  -H "Authorization: Bearer $TOKEN"

Response:

{
  "last24h": 142,
  "last7d": 1053,
  "total": 8721
}

Replay a Tool Call

When viewing an audit log entry in the dashboard (/logs), click Copy as cURL in the expanded row to copy a command that replays the recorded MCP tools/call against the server's endpoint:

curl -sS -X POST 'http://localhost:4000/mcp/<serverId>' \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -H "X-API-Key: $AMCP_MCP_API_KEY" \
  --data-binary @- <<'JSON'
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<tool>","arguments":{...}}}
JSON

Export your key as AMCP_MCP_API_KEY (or AMCP_ACCESS_TOKEN when the server operates in OAuth2 mode) to run the command directly from your terminal. Arguments whose names look like credentials (passwords, tokens, keys) are replaced with [REDACTED], and the command then starts with a comment saying so: fill them in before running it.

Roles & Access Control

Method	Endpoint	Description
GET	`/api/roles`	List all roles
POST	`/api/roles`	Create a custom role
PUT	`/api/roles/:id`	Update a role
DELETE	`/api/roles/:id`	Delete a role
GET	`/api/roles/:id/tools`	List tool access for a role
PUT	`/api/roles/:id/tools`	Set tool access whitelist

Create Role with Tool Whitelist

# 1. Create role
ROLE_ID=$(curl -s http://localhost:4000/api/roles \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"name": "Sales Team", "description": "Access to CRM tools only"}' \
  | jq -r '.id')

# 2. Set tool whitelist
curl -s -X PUT http://localhost:4000/api/roles/$ROLE_ID/tools \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"toolIds": ["tool-id-1", "tool-id-2", "tool-id-3"]}'

MCP API Keys

Method	Endpoint	Description
GET	`/api/mcp-keys`	List your MCP API keys
POST	`/api/mcp-keys`	Generate a new MCP API key
POST	`/api/mcp-keys/:id/revoke`	Revoke (deactivate) an MCP API key
DELETE	`/api/mcp-keys/:id`	Delete an MCP API key

Generate API Key

curl -s http://localhost:4000/api/mcp-keys \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"name": "My Claude Desktop Key", "mcpServerId": "optional-server-id"}'

A key created with mcpServerId (as the dashboard does, from a server's page) works only for that server: on /mcp/<that server>, and on the shared /mcp with that server's tools. Other servers answer 403. The server must be one of an organization you belong to, and deleting it deactivates its keys. A key created without mcpServerId reaches every server of your organization.

CLI

The repository includes the amcp CLI for logging in with an MCP API key, listing and describing tools, and calling them on a specific server. Build it with npm run build -w packages/cli, then run:

node packages/cli/dist/index.js login --url http://localhost:4000 --server YOUR_SERVER_ID
node packages/cli/dist/index.js tools ls
node packages/cli/dist/index.js tools describe YOUR_TOOL_NAME
node packages/cli/dist/index.js tools call YOUR_TOOL_NAME --args '{"id":"123"}' --json

The CLI constructs /mcp/<serverId> from the instance URL and server ID. The /api/* endpoints in this reference use a JWT, while the CLI connects to MCP with an MCP API key.

Site Settings (Admin)

Method	Endpoint	Description
GET	`/api/settings/smtp`	Get SMTP configuration
PUT	`/api/settings/smtp`	Update SMTP configuration
POST	`/api/settings/smtp/test`	Test SMTP connection
GET	`/api/settings/footer-links`	Get footer link configuration
PUT	`/api/settings/footer-links`	Update footer links

Health Check

curl http://localhost:4000/health

No authentication required.

Back to README | Tool Definition Format | Deployment Guide

Navigation Menu

Repository navigation

api-reference.md

api-reference.md

API Reference

Authentication

Auth Endpoints

Register

Login

Invite User (Admin)

Connector Endpoints

Create Connector

Import Tools

Set Environment Variables

Tool Endpoints

Create Tool

Bulk Create Tools

MCP Server Endpoints

Audit Endpoints

Query Invocations

Get Stats

Replay a Tool Call

Roles & Access Control

Create Role with Tool Whitelist

MCP API Keys

Generate API Key

CLI

Site Settings (Admin)

Health Check

FilesExpand file tree

api-reference.md

Latest commit

History

api-reference.md

File metadata and controls

API Reference

Authentication

Auth Endpoints

Register

Login

Invite User (Admin)

Connector Endpoints

Create Connector

Import Tools

Set Environment Variables

Tool Endpoints

Create Tool

Bulk Create Tools

MCP Server Endpoints

Audit Endpoints

Query Invocations

Get Stats

Replay a Tool Call

Roles & Access Control

Create Role with Tool Whitelist

MCP API Keys

Generate API Key

CLI

Site Settings (Admin)

Health Check