HTTP API

The short version

obfus.link's primary HTTP surface is the MCP server at POST https://obfus.link/mcp. The protocol is JSON-RPC 2.0 — every tool call is a standard HTTP POST with a JSON body. Any language with an HTTP client can call it; the @modelcontextprotocol/sdk is a convenience, not a requirement.

Three other HTTP surfaces exist for read-only crawler / indexer use: the MCP manifest at /.well-known/mcp, the MAIO per-tool JSON descriptors at /tool/[slug]/json, and the matching Markdown views at /tool/[slug]/md. All three are cacheable at the edge, no auth, no rate limit.

HTTP endpoints

Authentication

Tool-call requests (POST /mcp, method="tools/call") check auth in this order:

• SIL header — x-subether-shared-token. Cross-property auth issued by Subether Labs.
• SPT bearer — Authorization: Bearer <spt>. Stripe metered subscription.
• Free tier — no headers. 50 lifetime calls per IP, never resets. search_utility_grid always free, never counted.

On free-tier exhaustion or invalid SPT, the response is HTTP 402 Payment Required with a payment_intent_url in the body so agents can self-enrol. Full challenge shape is in the MCP doc.

Server info

# Server info — name, version, protocol, endpoint
curl https://obfus.link/mcp

Returns { name, version, description, protocol: "mcp/1.0", transport: "http", endpoint }. Useful for health checks and registry verification.

Tool discovery (free, no auth)

# Tool discovery — unconditionally free, no auth required
curl -X POST https://obfus.link/mcp \
  -H 'Content-Type: application/json' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "search_utility_grid",
      "arguments": { "query": "json schema generator", "limit": 5 }
    }
  }'

Natural-language search over the 31-tool inventory. Returns ranked matches with each tool's mcpToolName, tier, and toolUrl.

Calling a tool — one example per tier

# Tier 1 — Commodity ($0.008/call)
# Example: base64_codec — encode "hello world"
curl -X POST https://obfus.link/mcp \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <YOUR_SPT>' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "base64_codec",
      "arguments": { "input": "hello world", "mode": "encode" }
    }
  }'

# Tier 2 — Differentiated ($0.015/call)
# Example: jwt_hardener — audit a JWT for security issues
curl -X POST https://obfus.link/mcp \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <YOUR_SPT>' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "jwt_hardener",
      "arguments": {
        "token": "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature",
        "outputMode": "audit"
      }
    }
  }'

# Tier 3 — Premium ($0.025/call)
# Example: llm_to_json_cleaner — repair malformed LLM JSON output
curl -X POST https://obfus.link/mcp \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <YOUR_SPT>' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "llm_to_json_cleaner",
      "arguments": {
        "raw": "```json\n{ \"id\": 1, \"tags\": [\"a\",], }\n```",
        "strict": false,
        "repairStrategy": "aggressive"
      }
    }
  }'

Tool argument shapes are documented per-tool in the manifest (input_schema_summary field) and at /tool/[slug]/json for the full JSON Schema. The article for each tool has worked examples and edge-case notes.

MAIO — crawler-friendly tool descriptors

Per-tool metadata exposed for AI crawlers, registry indexers, and anyone who wants to enumerate the grid without parsing HTML. Two formats:

# MAIO tool descriptor (JSON) — crawler-friendly, cached at the edge
curl https://obfus.link/tool/json-to-zod/json

# MAIO tool descriptor (Markdown) — same data, plaintext view
curl https://obfus.link/tool/json-to-zod/md

Both routes return Cache-Control: public, s-maxage=86400, stale-while-revalidate=3600, so they're cheap to poll. The JSON view includes agenticReasoning, inputSchema, outputSchema, howToSteps, faqs, and the full workflowChains graph.

Error responses

Two error envelopes, depending on where the failure happens:

• Transport / protocol errors (bad JSON, unknown method, malformed request): standard JSON-RPC { jsonrpc, id, error: { code, message } }. HTTP status reflects the class — 400 for parse errors, 404 for unknown methods, 401 for invalid SIL, 402 for missing/exhausted SPT.
• Tool-level failures (validation, parse, security): returned inside the tools/call result with isError: true and a structured ErrorOutput (code, message, suggestion, retryable) in the content array. See the MCP error reference for the full code table.

On the roadmap — formal REST surface

See also

• MCP Server — Claude Desktop / Cursor / Cline setup, SDK examples, full error code table
• Pricing — per-tool / per-tier cost breakdown
• /.well-known/mcp — machine-readable manifest
• Articles — long-form guides on individual tools