Developers & agents

AllMCPs API Documentation

Public, CORS-friendly endpoints for searching MCP servers, embedding badges, and plugging the AllMCPs directory into AI agents. No API key required for read endpoints. Also available as the official allmcps-server CLI / MCP server on npm, and as a full AllMCPs OpenAPI spec.

OpenAPI JSON ↗llms.txt ↗API catalog ↗OAuth scopes ↗allmcps-server CLI on npm ↗

Quick start

Search the directory from any HTTP client or agent:

Terminal
curl "https://allmcps.com/api/v1/search?q=postgres&limit=5"

Endpoints

Category filtering

/api/v1/search?category= accepts any of the three forms returned by /api/v1/categories — the full stored name (emoji included), the plain label, or the slug. Matching is case-insensitive and ignores surrounding whitespace, so all three requests below return the same listings, and the response echoes back the canonical category it resolved to. Combine it with q= to apply both filters at once.

Terminal
curl "https://allmcps.com/api/v1/search?category=databases&limit=5"
curl "https://allmcps.com/api/v1/search?category=Databases&limit=5"
curl --get --data-urlencode "category=🗄️ Databases" "https://allmcps.com/api/v1/search?limit=5"

# Both filters: Postgres servers within Databases only
curl "https://allmcps.com/api/v1/search?q=postgres&category=databases"

A category the directory doesn't have returns 400 with { "error": "unknown_category" } — an empty servers array always means "this category has no matching listings", never "that category name was wrong".

Scoped agent auth

Read endpoints (search, servers, categories, markdown, health) need no auth at all. Endpoints that mutate a listing require a scoped Bearer token — register via POST /api/v1/agent/register, requesting only the scopes you need in an optional scopes array (omit it to receive the full set below). A token used against an endpoint it wasn't granted a scope for gets back 403 {"error":"insufficient_scope","requiredScope":"...","grantedScopes":[...]} — never a silent failure or a downgraded response.

ScopeGrantsRequired by
listings:claimClaim ownership of an existing listing via DNS TXT, site badge, or GitHub README proof. No other write access.POST /api/v1/agent/claim
POST /api/v1/agent/revoke needs a valid (unrevoked) Bearer token but no specific scope — any token can always revoke itself.

Machine-readable copies of this table: /.well-known/oauth-protected-resource (scopes_supported), the components.securitySchemes.agentBearerAuth.flows.clientCredentials.scopes map in the OpenAPI spec, and /auth.md's frontmatter, for the full registration → claim flow with example requests.

Versioning & deprecation policy

The API is URL-versioned (/api/v1/...); fields are added, not removed or repurposed, within a version. If an endpoint is ever deprecated it will carry a Deprecation: true response header and, once a removal date is set, a Sunset header, for at least 90 days before removal — announced on the blog. Nothing in v1 is currently deprecated.

Agent discovery

  • Link response headers on every page point at this docs URL, the API catalog, and OAuth metadata.
  • Markdown negotiation: send Accept: text/markdown or append ?format=md / .md to listing, blog, or category URLs.
  • Machine catalog: /data.json and /llms-full.txt.

Questions or partnership ideas? Contact us.