Developers
REST API
Versioned JSON over HTTPS at /api/v1. The machine-readable OpenAPI 3.1 document is at /api/v1/openapi.json.
Authentication
Create an API key in your dashboard and send it as a bearer token. Keys look like sqmcp_xxxxxxxxxxxx_…, are shown once, and can be limited to the scopes you need. Revoke a key at any time.
curl -H "Authorization: Bearer $SQUATCH_API_KEY" \ https://squatchmcp.com/api/v1/servers/com.example/weather
Scopes
servers:read: read servers, tools, changes, findings, privacy and MC-BOMs.scans:read/scans:create: read and request scans.watchlists:manage: manage your watchlist.organization:read/organization:admin: read or administer your organization.
Endpoints
| Method | Path | Access |
|---|---|---|
| GET | /api/v1/serversSearch public MCP servers | None (or key with servers:read) |
| GET | /api/v1/servers/{id}Server profile with trust statuses | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/versionsObserved versions and transports | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/toolsCurrent tools with classification (or tools of ?version=) | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/changesChange events, newest first | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/findingsPublic findings with status | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/privacyLatest publisher-declared privacy disclosure | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/trustTrust dimensions with evidence | None (or key with servers:read) |
| GET | /api/v1/servers/{id}/mcbomMCP Bill of Materials (schema_version 1.0) | None (or key with servers:read) |
| GET | /api/v1/changesRecent changes across public servers | None (or key with servers:read) |
| GET | /api/v1/publishers/{id}Publisher profile and public servers | None (or key with servers:read) |
| POST | /api/v1/scansRequest a scan of a remote MCP endpoint, repository or package | scans:create |
| GET | /api/v1/scans/{id}Scan status and results | None (or key with scans:read) |
| GET | /api/v1/watchlistsServers the key's user watches | watchlists:manage |
| POST | /api/v1/watchlistsWatch a server (200 if already watched) | watchlists:manage |
| DELETE | /api/v1/watchlists/{id}Stop watching (watchlist id, server UUID or canonical name) | watchlists:manage |
| GET | /api/v1/organizationThe key's organization and plan | organization:read |
| GET | /api/v1/healthLiveness | None |
| GET | /api/v1/openapi.jsonThis document | None |
Errors and limits
Errors use application/problem+json with a stable type, a human title and a request_id to quote when contacting support. Rate-limited requests receive 429 with a Retry-After header. Daily quotas depend on your plan.
Untrusted fields
Strings that came from third-party MCP servers (names, descriptions, schemas) are returned in objects marked "untrusted": true. Escape them before display and never pass them to a model as instructions.