Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: corsproxy.dev MCP API
version: 0.1.0
description: 'Managed CORS proxy API. Programmatic surface for the hosted runtime at
`https://api.corsproxy.dev`. The same wire protocol is implemented by
the MIT-licensed Go runtime at
if you want to self-host.
Auth: an API key, as `?key=sk_live_…` (browsers) or the `X-API-Key`
header (servers). Keys are locked to their allowed origins, so server
callers also send an allowed `Origin` header. API keys only work on the
endpoints below; account management happens in the dashboard.
Rate limits:
- Free plan: 500 requests/day per account, enforced atomically by a
per-user Durable Object. Over the limit returns `429`.'
contact:
name: corsproxy.dev support
email: contact@corsproxy.dev
url: https://corsproxy.dev/
license:
name: MIT (runtime)
url: https://github.com/melihbirim/corsproxy/blob/main/LICENSE
servers:
- url: https://api.corsproxy.dev
description: Production
tags:
- name: MCP
description: Remote MCP server for AI assistants and agents.
paths:
/mcp:
post:
tags:
- MCP
summary: Remote MCP server (Streamable HTTP, JSON-RPC 2.0)
description: 'Model Context Protocol endpoint for AI assistants and agents. Tools:
fetch_url, check_quota, explain_error. Authenticate with X-API-Key plus
an Origin header allowed on the key. See https://corsproxy.dev/docs/#mcp'
security:
- apiKey: []
requestBody:
required: true
content:
application/json:
schema:
type: object
description: One JSON-RPC 2.0 message (initialize, tools/list, tools/call, ping).
responses:
'200':
description: JSON-RPC response.
'202':
description: Notification accepted.
'401':
description: Missing or invalid API key (MISSING_API_KEY, INVALID_API_KEY, API_KEY_REVOKED).
'403':
description: Origin not allowed for this key (API_KEY_ORIGIN_NOT_ALLOWED).
operationId: postMcp
x-operation-id-source: derived
components:
securitySchemes:
apiKey:
type: apiKey
in: header
name: X-API-Key