# Hamster OSS API

> How agents and scripts call Hamster OSS: the MCP server on each team instance (OAuth, scope system:access), the account MCP server and REST API at https://tryhamster.dev (OAuth with tryhamster.dev as the authorization server), the public release catalog, and the machine-readable files that describe them. The site-wide index is https://tryhamster.dev/llms.txt.

Each instance's MCP server is `https://<your-team>.tryhamster.dev/mcp`. Clients discover its authorization server from `/.well-known/oauth-protected-resource/mcp` on the instance host, register at `/oauth/register`, and use the authorization code flow with S256 PKCE. The account server at `https://tryhamster.dev/mcp` and its REST twin `https://tryhamster.dev/api/v1/agent/*` take tokens from tryhamster.dev itself; the 401 challenge names `https://tryhamster.dev/.well-known/oauth-protected-resource/mcp` (or `/.well-known/oauth-protected-resource` for REST). Access is self-serve, with no API key to request: an agent registers its own public client with `POST https://tryhamster.dev/oauth/register` (RFC 7591 dynamic client registration, no secret), and the person approves it in the browser. The human dashboard API under /api/v1 never accepts agent tokens.

## API docs

- [Hamster OSS API](https://tryhamster.dev/developers.md): authentication, endpoints and example requests
- [Hamster OSS MCP server](https://tryhamster.dev/docs/mcp.md): both MCP servers, their tools, sign-in and client setup
- [OpenAPI 3.1 document](https://tryhamster.dev/openapi.json): the six agent REST operations under /api/v1/agent, `callMcp`, the OAuth metadata operations and `getReleaseTracks`
- [API versioning and deprecation](https://tryhamster.dev/docs/api-versioning.md): MCP protocol revisions, catalog schema version, Deprecation and Sunset headers

## Machine-readable files

- [Instance MCP server card](https://tryhamster.dev/.well-known/mcp/server-card.json): `dev.tryhamster/system`, the templated per-instance server
- [Hamster OSS account MCP server](https://tryhamster.dev/mcp): `get_pricing`, `search_docs`, `fetch_doc` and `get_install_command` without a token; `status`, `create_instance`, `get_instance`, `add_payment_method`, `add_funds` and `redeem_code` with one
- [API catalog](https://tryhamster.dev/.well-known/api-catalog): RFC 9727 linkset with service-desc, service-doc and status
- [AI catalog](https://tryhamster.dev/.well-known/ai-catalog.json): ARD entries for the instance and account MCP servers, the OpenAPI document, the API catalog and the skills index
- [Agent skills index](https://tryhamster.dev/.well-known/agent-skills/index.json): connect to an instance; install the CLI
- [Agent view](https://tryhamster.dev/?mode=agent): endpoints, authentication and capabilities as JSON
- [Release catalog](https://dl.tryhamster.dev/channels/tracks.json): the signed track catalog the installer reads