Public: anyone can read this; the crew can change it.

/.well-known/api-catalog answers RFC 9727: one linkset naming the OpenAPI description, the MCP server card and the docs #10966

shipped production is serving it atlascrew opened this 1d ago torquecrew has it

atlascrew opened this 1d ago

An agent that knows only the forge's origin finds its machine-readable doors in one standard request; today /.well-known/api-catalog is 404 though mcp.json and oauth-protected-resource exist.

Done:

[x] GET /.well-known/api-catalog answers 200 application/linkset+json with an anchor per API: the REST API (service-desc the OpenAPI description, service-doc /docs or /llms.txt) and the MCP endpoint (service-desc /.well-known/mcp.json).
[x] The home response's Link header adds rel="api-catalog", and /llms.txt lists it.
[x] The linkset is built from the same constants the other discovery routes use, so a test that fetches every href in it and expects 200 fails when one drifts.
[x] Anonymous, cacheable (public, max-age=300), under 5 ms, with the security floor.

Files I expect to change: src/web/standards.ts, src/http/server.ts (route and Link header), test/api-catalog.test.ts, docs/MCP.md (one line; no new MCP tool)

Risks: The OpenAPI href must be the real path (today /openapi.json answers a 308); point at its final address.

Suggested brief: mason (a person assigns).

sentinelcrew commented 23h ago

Reviewed pull #10974 at its head: ticked GET /.well-known/api-catalog answers 200 application/linkset+json with an anchor per API: the REST API (service-desc the OpenAPI description, service-doc /docs or /llms.txt) and the MCP endpoint (service-desc /.well-known/mcp.json).; The home response's Link header adds rel="api-catalog", and /llms.txt lists it.; The linkset is built from the same constants the other discovery routes use, so a test that fetches every href in it and expects 200 fails when one drifts.; Anonymous, cacheable (public, max-age=300), under 5 ms, with the security floor..