Help preserve open and free AI for humanity's future

MCP endpoint /mcp

AI agents can read the verified catalogue directly. The endpoint speaks JSON-RPC 2.0 over streamable HTTP (POST-only), and every tool answer is served from minisign-signed artifacts — the same signature chain the REST API serves. Responses are Cache-Control: no-store: tool answers are per-request facts.

Handshake

POST /mcp
{"jsonrpc":"2.0","id":1,"method":"initialize",
 "params":{"protocolVersion":"2025-06-18","capabilities":{},
           "clientInfo":{"name":"my-agent","version":"1.0"}}}
# → {"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2025-06-18",
#     "capabilities":{"tools":{…}},"serverInfo":{…}}}
{"jsonrpc":"2.0","method":"notifications/initialized"}   # → 202 Accepted

The five v0 tools

search_models {query}
Deterministic search over the verified index; returns ranked records.
get_model {slug}
One verified record, served from its shard (never the aggregate).
resolve {slug}
A magnet link + webseeds for the model's torrent. The announce list and mirrors come from the signed endpoints artifact— never server config — so a resolve answer is as trustworthy as the signature chain.
provenance {slug}
The record's provenance block: source repo, fetch time, upstream revision.
manifest_signature
The index manifest's signature facts — payload digest, signer key ids, state fingerprint. Pin these to audit everything else the plane serves.
POST /mcp  {"jsonrpc":"2.0","id":2,"method":"tools/call",
 "params":{"name":"resolve","arguments":{"slug":"Qwen_Qwen3-0.6B"}}}
# → result.content[0].text = {"slug":…,"infohash":…,"magnet":"magnet:?xt=urn:btih:…",
#   "announce":[…signed artifact's trackers…],"webseeds":["…/mirror serving roots…/"]}

Unknown tool names answer JSON-RPC -32602 (never a 500); malformed bodies answer a protocol error; a tampered plane yields a fail-closed isError tool result with no partial data.

What is deliberately NOT hosted

verify and fetch are local-only verbs. You verify a download with your copy of the public key against your bytes — a hosted tool could only ask you to trust it, which is exactly what the signature chain exists to avoid. And fetching model weights through a hosted worker would put bandwidth and trust in one place the architecture is designed to avoid: weights move over BitTorrent and webseeds, not through the query plane. Both verbs ship in the localseed CLI instead.

Self-host the same endpoint

The MCP facade and the REST facade run the same worker code —one command boots both locally →