HLA-Verify MCP API

openapi: 3.2.0
info:
  title: HLA-Verify MCP API
  version: 1.0.0
  description: 'Deterministic validation of HLA nomenclature and donor-recipient match arithmetic against IPD-IMGT/HLA 3.66.0. No LLM; nothing stored. What to send: allele names, typing strings, GL strings and report text about HLA typing. What never to send: patient identifiers of any kind (names, medical record numbers, dates of birth, accession or case identifiers, other patient details). The service neither needs nor wants them, request bodies are processed in memory and never stored, and de-identifying before sending is the caller''s responsibility. This is a nomenclature and reference-release checker: not a diagnostic aid, not clinical decision support, and it does not recommend a donor. Limits are a daily call quota plus a per-call batch cap, both per tier: free 100 calls/day per IP and 250 typings per /v1/normalize call, free_key 1,000/250 (the instant self-serve key), starter 500/250, lab 10,000/5,000, scale 1,000,000/5,000, enterprise uncapped/5,000, academic 10,000/5,000 (hand-issued to accredited institutions, never sold); ''pro'' is the legacy name for ''lab''. Quotas reset at UTC midnight and every billable response carries x-hla-verify-daily-limit, -daily-remaining, -daily-reset and -max-typings. /healthz, /docs, /openapi.json, /pricing, /v1/checkout, /v1/beta-signup, /v1/research-access, /v1/keys, /v1/report and /v1/usage are not billable. Per-key usage reporting: GET /v1/usage returns the caller''s own calls and units for today/7d/30d, by endpoint and by status, plus the tier''s daily quota; cached 60s per key; 401 without a key. Free for anyone: anonymous access stays open, and anyone can get a free API key instantly (1,000 calls/day, 250 typings per call) at https://hlaverify.com/research or with POST /v1/research-access. Verified labs that need more can have the Lab tier (10,000 calls/day) by request. Nothing is for sale. Enterprise and self-hosting: hello@hlaverify.com.'
  contact:
    email: hello@hlaverify.com
    url: https://hlaverify.com
servers:
- url: https://api.hlaverify.com
- url: https://hlaverify.com
security:
- {}
- ApiKey: []
tags:
- name: MCP
paths:
  /mcp:
    post:
      summary: Remote MCP endpoint (Streamable HTTP transport, JSON-RPC 2.0, stateless)
      description: 'Tools: verify_text, normalize_allele, allele_info, match_score, check_typing, donor_compat, validate_gl_string, pgx_lookup, pgx_pair, translate_names, release_diff, allele_history, beta_signup, research_access, about. Every tool call but about, beta_signup and research_access consumes one call of the caller''s daily quota, the same one /v1/* spends. donor_compat, pgx_lookup and pgx_pair are decision support only; not a medical device. beta_signup and research_access are the only tools that write. Same input rule as REST: send allele names, typing strings, GL strings and HLA report text, never patient identifiers. See the MCP for agents section above.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - jsonrpc
              - method
              properties:
                jsonrpc:
                  type: string
                  enum:
                  - '2.0'
                id: {}
                method:
                  type: string
                params:
                  type: object
      responses:
        '200':
          description: JSON-RPC 2.0 response or error
        '202':
          description: notification acknowledged (no body)
        '405':
          description: GET not supported
        '429':
          description: 'rate limited (per-minute burst). A spent DAILY quota is not a 429 here: it is a 200 JSON-RPC result whose tool result has isError:true and names the UTC-midnight reset, with x-hla-verify-daily-remaining: 0 and Retry-After on the response.'
      tags:
      - MCP
      operationId: postMcp
      x-operation-id-source: derived
components:
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: X-API-Key