API and MCP server

Bearer token authentication, the endpoints that need no token, and how to connect an AI assistant over the Model Context Protocol.

Base URL and authentication

The REST API lives at https://app.wrendex.com/api. Authenticated calls use a personal API token, which starts with 'wrn_' and is sent as 'Authorization: Bearer wrn_...'. Mint a token from the workspace Settings page, with POST /api/me/api-tokens while signed in, or at signup through the agent endpoint below. Each token carries scopes: READ covers search, reports, and crawl data; WRITE additionally allows starting or cancelling crawls, triaging alerts, and creating checkout links. Tokens identify a user, not a workspace; requests that touch a workspace carry the tenant or site id. Revoke a token from Settings at any time.

Creating a workspace as an agent

AI agents sign up without an email, a password, or a browser. POST https://app.wrendex.com/api/agent/signup with an optional JSON body of tenantName, agentName, tokenName, and scopes (defaults to READ) returns 201 with the workspace, an agent user that is an ADMIN of it, an apiToken whose token field is the wrn_ token (shown once), and a claimUrl. The agent gives the claimUrl to the person it works for; when they open it and sign in, or create an account, they become the workspace OWNER, and the agent stays an ADMIN they can remove from Team. Nobody is emailed by the signup. Until the link is used the workspace is unclaimed: it can add sites but cannot be funded, and it is deleted after seven days along with the agent user and its token. Signup is limited to five workspaces per IP per hour across every signup surface; a 429 carries a Retry-After header. If the person already has an account, they should mint a token from Settings instead.

Endpoints that need no token

Five GET endpoints return JSON without authentication: /api/catalog (every check with ids, categories, and severities), /api/pricing (current tiers and credit packs), /api/changelog (shipped features and new checks), /api/status (the feed behind the public status page), and /api/health (liveness). Every other route under /api requires a bearer token or a signed-in session.

MCP server

Wrendex exposes crawl data as tools over the Model Context Protocol at https://app.wrendex.com/mcp using the stateless Streamable HTTP transport. Send the same bearer token on every request. To add it to Claude Code, run: claude mcp add --transport http wrendex https://app.wrendex.com/mcp --header "Authorization: Bearer <YOUR_TOKEN>". The workspace Settings page has a copy-ready version of this command.

MCP tools

Tools cover workspaces and sites (list_tenants, list_sites, get_site), crawls (list_crawls, get_crawl, enqueue_crawl, cancel_crawl, recrawl_pages), findings and reports (get_crawl_issues, get_crawl_issue_summary, get_crawl_alerts, get_health_score, get_duplicate_code_regions), alert triage (ignore_alert, unignore_alert), search, and billing (create_checkout_session). The tools that mutate data (enqueue_crawl, cancel_crawl, recrawl_pages, ignore_alert, unignore_alert, create_checkout_session) need a token with the WRITE scope; the rest work with READ. The server's initialize response carries instructions covering signup, the call order, and funding, and tools/list works without a token.

Funding a workspace

Crawling spends credits: one per page fetched, two when JS rendering is on. Re-crawls after a site's first completed crawl are incremental: pages whose sitemap lastmod has not moved, and pages the server answers 304 Not Modified, are carried forward free, apart from a rotating re-verification slice (recheckPages in the site settings, default the larger of 50 and 5% of the site). Pass {"mode": "full"} to enqueue_crawl to re-fetch and bill every page. Every workspace, including one created through POST /api/agent/signup, gets 5,000 free credits a month, reset on the 1st, so an agent can run a real audit before anyone pays; there is no trial, the allowance is permanent. GET /api/pricing lists the free allowance, the plans (studio, agency) and the one-time credit packs without a token. Funding needs an owner: on an unclaimed agent workspace, checkout returns 409 WORKSPACE_UNCLAIMED with the claim link to hand over first. Once claimed, call create_checkout_session, or POST /api/tenants/{tenantId}/billing/checkout-session with a priceTier, and give the returned Stripe url to the owner. Nothing is charged until they open it and pay; the caller must be an OWNER or ADMIN. enqueue_crawl works as soon as the balance is positive, and returns 402 NO_CREDITS on an empty one.

Discovery for agents

Machine-readable discovery follows RFC 9727: /.well-known/api-catalog on wrendex.com is a linkset that points at the REST API, the MCP server, this page, and the status endpoint. /llms.txt is a curated index of the site for language models, and /agents.md is a plain-language guide for AI agents covering authentication, public endpoints, and etiquette. The sitemap at /sitemap.xml lists every indexable page.

Limits and etiquette

Starting a crawl consumes the workspace's credits, so agents should only enqueue one when a user asked for it. Do not scrape dashboard pages; the API and MCP tools return the same data as structured JSON. For how the Wrendex crawler itself throttles and how to allow-list it, see /docs/rate-limits.