Skip to main content
The Toolshed API server is built with Hono and uses Better Auth for authentication. All endpoints are under the /api base path.

​
Authentication

Routes are protected by one of two mechanisms:
  1. Better Auth session cookie — set automatically by the web app after login
  2. Bearer token — Authorization: Bearer <TOOLSHED_API_SECRET> for CLI and programmatic access
Unauthenticated routes:
  • GET /api/health
  • GET|POST /api/auth/* (handled by Better Auth)
  • ALL /api/mcp/:token (authenticates via the MCP token in the URL — see MCP Server Overview)

​
Route groups

GroupPath prefixDescriptionStatus
Auth/api/authBetter Auth (login, OAuth social + genericOAuth, sessions)Implemented
Connections/api/connectionsTool connections with encrypted secrets, MCP endpointsImplemented
Connectors/api/connectorsConnector availability registry (which providers have creds)Implemented
Tokens/api/tokensOAuth token vending + three-source resolveToken()Implemented
Remote MCP/api/mcp/:tokenHTTP MCP transport (StreamableHTTPTransport from @hono/mcp) — see MCP OverviewImplemented
Registry/api/registryTool catalog, source registration, searchImplemented
Policy/api/policyRole management and access resolutionStub
Audit/api/auditAudit trail for tool invocationsStub
Elicitation/api/elicitationPending approval storage and resolutionStub

​
Health check

GET /api/health
→ { "ok": true }

​
Local development

# Copy env template and fill in credentials
cp apps/server/.env.example apps/server/.env.local

# Start the dev server (loads .env.local automatically)
pnpm --filter @toolshed/server dev
The server runs at http://localhost:3000 by default.