sealgate-ai Client Stdio API

openapi: 3.2.0
info:
  title: SealGate Client Stdio API
  description: Open-source MCP security, aggregation, and monitoring. Self-hosted MCP proxy.
  version: 0.19.0
tags:
- name: client-stdio
paths:
  /api/v1/client/mcp-requests:
    get:
      tags:
      - client-stdio
      summary: List Mcp Requests
      description: List only requests owned by the principal in its bound organisation.
      operationId: list_mcp_requests_api_v1_client_mcp_requests_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/McpRequestListResponse'
        '401':
          description: A valid client installation credential is required
        '403':
          description: The client credential lacks the required scope
      security:
      - ClientBearer: []
    post:
      tags:
      - client-stdio
      summary: Create Mcp Request
      description: Submit an exact-device-bound stdio request for human approval.
      operationId: create_mcp_request_api_v1_client_mcp_requests_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClientCreateMcpRequestBody'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateMcpRequestResponse'
        '401':
          description: A valid client installation credential is required
        '403':
          description: The client credential lacks the required scope
        '409':
          description: The device is unavailable or a pending request conflicts
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
      - ClientBearer: []
      parameters:
      - name: Idempotency-Key
        in: header
        required: false
        description: Optional client-generated key that makes this write operation safe to retry. Reusing the same key returns the original response instead of performing the operation a second time. Keys are scoped to the caller and expire after 24 hours.
        schema:
          type: string
          maxLength: 255
  /api/v1/client/mcp-requests/{name}:
    delete:
      tags:
      - client-stdio
      summary: Withdraw Mcp Request
      description: Withdraw this user's pending request by name, without touching servers.
      operationId: withdraw_mcp_request_api_v1_client_mcp_requests__name__delete
      security:
      - ClientBearer: []
      parameters:
      - name: name
        in: path
        required: true
        schema:
          type: string
          title: Name
      responses:
        '204':
          description: Successful Response
        '401':
          description: A valid client installation credential is required
        '403':
          description: The client credential lacks the required scope
        '404':
          description: A matching pending request was not found
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /api/v1/client/servers:
    get:
      tags:
      - client-stdio
      summary: List Servers
      description: List stdio servers bound to this principal's exact device row.
      operationId: list_servers_api_v1_client_servers_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientServerListResponse'
        '401':
          description: A valid client installation credential is required
        '403':
          description: The client credential lacks the required scope
      security:
      - ClientBearer: []
components:
  schemas:
    McpRequestListResponse:
      properties:
        requests:
          items:
            $ref: '#/components/schemas/McpRequestEntry'
          type: array
          title: Requests
          description: List of MCP server requests
      type: object
      required:
      - requests
      title: McpRequestListResponse
    ClientServerListResponse:
      properties:
        items:
          items:
            $ref: '#/components/schemas/ClientServerEntry'
          type: array
          title: Items
      type: object
      required:
      - items
      title: ClientServerListResponse
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    McpRequestEntry:
      properties:
        id:
          type: integer
          title: Id
          description: Request ID
        requester_user_id:
          type: string
          title: Requester User Id
          description: Requester user UUID
        name:
          type: string
          title: Name
          description: Proposed server name
        display_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Display Name
          description: Human-readable server label
        command:
          anyOf:
          - type: string
          - type: 'null'
          title: Command
          description: Command for stdio servers
        args:
          items: {}
          type: array
          title: Args
          description: Command-line arguments
        env:
          additionalProperties:
            type: string
          type: object
          title: Env
          description: Environment variables
        url:
          anyOf:
          - type: string
          - type: 'null'
          title: Url
          description: URL for HTTP/SSE servers
        headers:
          additionalProperties:
            type: string
          type: object
          title: Headers
          description: Custom HTTP headers for HTTP/SSE servers
        server_type:
          type: string
          title: Server Type
          description: 'Server type: stdio, sse, or http'
          default: stdio
        source_app:
          anyOf:
          - type: string
          - type: 'null'
          title: Source App
          description: App where server was discovered
        source_path:
          anyOf:
          - type: string
          - type: 'null'
          title: Source Path
          description: Config file path
        roots:
          items:
            type: string
          type: array
          title: Roots
          description: Root paths
        from_marketplace_id:
          anyOf:
          - type: string
          - type: 'null'
          title: From Marketplace Id
          description: Marketplace ID
        justification:
          anyOf:
          - type: string
          - type: 'null'
          title: Justification
          description: User's reason for requesting
        template_fields:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Template Fields
          description: Template field definitions
        status:
          type: string
          title: Status
          description: 'Request status: pending, approved, rejected'
          default: pending
        quarantined:
          type: boolean
          title: Quarantined
          description: True if a non-admin raised the request while the org's auto-quarantine flag was on. Requests filed from the dashboard (origin 'dashboard') are never quarantined. Distinguishes the dashboard's quarantine queue from the new-server-requests queue.
          default: false
        reviewer_user_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer User Id
          description: Reviewer user UUID
        reviewer_notes:
          anyOf:
          - type: string
          - type: 'null'
          title: Reviewer Notes
          description: Reviewer notes
        icon_url:
          anyOf:
          - type: string
          - type: 'null'
          title: Icon Url
          description: Brand icon URL (e.g. logo.dev) resolved from the server URL at submission time, for rendering in the pending-requests list. Null when no logo could be derived.
        hostname:
          anyOf:
          - type: string
          - type: 'null'
          title: Hostname
          description: Machine the server was discovered on (local/stdio requests)
        device_status:
          anyOf:
          - type: string
          - type: 'null'
          title: Device Status
          description: 'Online status of the host''s stdiod device for a stdio request: ''online'', ''offline'', or ''unknown''. Null for HTTP/SSE requests. The Approve action is only allowed when this is ''online''.'
        created_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Created At
          description: Creation timestamp (ISO 8601)
        updated_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Updated At
          description: Last update timestamp (ISO 8601)
      type: object
      required:
      - id
      - requester_user_id
      - name
      title: McpRequestEntry
    ClientCreateMcpRequestBody:
      properties:
        name:
          type: string
          maxLength: 100
          minLength: 1
          title: Name
        display_name:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: Display Name
        command:
          type: string
          maxLength: 500
          minLength: 1
          title: Command
        args:
          items:
            type: string
          type: array
          maxItems: 1000
          title: Args
      additionalProperties: false
      type: object
      required:
      - name
      - command
      title: ClientCreateMcpRequestBody
      description: The only stdio request fields accepted from stdiod.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    CreateMcpRequestResponse:
      properties:
        status:
          type: string
          title: Status
          description: Operation result
          default: success
        message:
          type: string
          title: Message
          description: Human-readable message
        request_id:
          type: integer
          title: Request Id
          description: Created request ID
        auto_approved:
          type: boolean
          title: Auto Approved
          description: True if the backend immediately approved the request (admin/owner submitter). Clients should skip any follow-up approve call when this is set.
          default: false
      type: object
      required:
      - message
      - request_id
      title: CreateMcpRequestResponse
    ClientServerEntry:
      properties:
        name:
          type: string
          title: Name
        display_name:
          type: string
          title: Display Name
        enabled:
          type: boolean
          title: Enabled
        tool_count:
          type: integer
          title: Tool Count
        device_id:
          type: string
          title: Device Id
      type: object
      required:
      - name
      - display_name
      - enabled
      - tool_count
      - device_id
      title: ClientServerEntry
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
    ClientBearer:
      type: http
      description: Opaque ewc_ client installation credential
      scheme: bearer
    ServiceToken:
      type: http
      description: 'A SealGate service token: `sgt_acct_...` (account token) or `sgt_org_...` (org token). Mint an account token in the dashboard.'
      scheme: bearer
    MCPGatewayOAuth:
      type: oauth2
      description: OAuth 2.1 authorization-code flow (PKCE required) against the SealGate MCP gateway's authorization server. Request only the scopes an agent needs; unrequested scopes are not granted.
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          refreshUrl: /oauth/token
          scopes:
            mcp: Connect to the MCP gateway and call the tools exposed by your enabled servers. Every call is still evaluated by the policy engine.
            offline_access: Issue a refresh token so the client can renew access without a new browser sign-in.