Developers

API and MCP

The web app, a script and an admin agent all talk to the same routes. This page lists the ones that are live today, with the authentication each one really uses.

What is live today

The product API authenticates with your signed-in session cookie; the only MCP endpoint is the admin agent MCP, authenticated by an admin key. There is no public product API key and no user-facing MCP yet — personal keys (sk_…) can be created in Settings when an admin turns that feature on, but no product route accepts them.

Product JSON API

Every product action in the app is a JSON route under /api. Authentication is the same better-auth session cookie the browser carries; a script has to send that cookie too. These are not bearer-token endpoints.

Authentication: Signed-in session cookie (better-auth)
Response shape: JSON envelope: code, message, data — code 0 is success; errors keep an HTTP status (401 / 402 / 429 / 502 / 503).

Method	Path	What it does	Cost
GET	/api/projects	Projects, status counts, plan and project limit.	0
GET/PATCH/DELETE	/api/projects/:id	Project detail with items and timeline; update status or notes; delete.	0
POST	/api/validations	Start the validation pipeline; the run is async, poll the id.	10 credits
GET	/api/validations/:id	Run status and the verdict cards.	0
GET	/api/radar/boards	Growth and trending boards, trimmed by plan.	0
POST	/api/radar/add-to-project	Turn a radar card into a project (no credit cost).	0
POST	/api/linkcheck	Submit links for checking; returns a job id.	1 credit / 10 URLs
GET	/api/linkcheck/:id	Job progress and verdicts; ?format=csv for Pro.	0
POST	/api/domains/check	Domain availability screen.	1 credit / 10 domains
GET	/api/credits	Balance, credit buckets and the ledger.	0
GET	/api/entitlements	Plan and quota usage the server actually gates on.	0
GET/POST	/api/watch-rules	List or create watch rules.	0

Paths and payloads may change while the product is in beta. Credits are charged by the server catalog; a failed upstream call is void and refunded.

Admin agent MCP

Admin only

Site admins can attach Claude, Cursor or another MCP client to the admin panel. The endpoint is machine-only: it accepts an admin agent key (sa_admin_…) as a bearer token, rejects cookies and foreign browser origins, and exposes only the tools the key’s RBAC roles allow.

Endpointhttps://grovelark.com/api/admin/agent/mcp

How it behaves

Tool discovery is filtered by the agent’s roles — a read-only role never sees write tools.
Read tools take only input; write tools also require idempotencyKey (8–128 characters) so a retry acts once.
Every call is audited, and revoking the key in the admin panel cuts access immediately.
A local stdio bridge ships in the repository (pnpm admin:mcp, docs/admin-agent.md) for clients that cannot send bearer headers.

mcp.json

{
  "mcpServers": {
    "grovelark-admin": {
      "type": "http",
      "url": "https://grovelark.com/api/admin/agent/mcp",
      "headers": { "Authorization": "Bearer sa_admin_…" }
    }
  }
}

Not available yet

Listed so nobody builds against them. When they ship, this page and the pricing page change in the same release.

Public product API keys that authenticate /api routes
A user-facing MCP for projects, radar and validation results
OAuth authorization for MCP clients
Webhooks and a published OpenAPI schema

Start with the product

Run a radar → project → verdict loop, then decide whether you need the API.

Start free See pricing