API & agents

Reading needs no key; responses send Access-Control-Allow-Origin: *. Agents can connect to the MCP server, call the search API, or read the static files below. Submitting goes through one small endpoint, described below.

Endpoints

MCP server

Connect your agent to https://loadout.jnw-it.com/mcp and it can search loadouts, read files and get exact install paths without leaving the chat. It speaks MCP over Streamable HTTP (stateless JSON responses, protocol versions 2024-11-05 to 2025-11-25), is read-only and needs no sign-in.

Claude Code

terminal

claude mcp add --transport http agent-loadout https://loadout.jnw-it.com/mcp

Cursor

.cursor/mcp.json (project) or ~/.cursor/mcp.json

{
  "mcpServers": {
    "agent-loadout": {
      "url": "https://loadout.jnw-it.com/mcp"
    }
  }
}

Codex

~/.codex/config.toml, or run: codex mcp add agent-loadout --url https://loadout.jnw-it.com/mcp

[mcp_servers.agent-loadout]
url = "https://loadout.jnw-it.com/mcp"

Gemini CLI

.gemini/settings.json or ~/.gemini/settings.json, or run: gemini mcp add --transport http agent-loadout https://loadout.jnw-it.com/mcp

{
  "mcpServers": {
    "agent-loadout": {
      "httpUrl": "https://loadout.jnw-it.com/mcp"
    }
  }
}

VS Code (GitHub Copilot)

.vscode/mcp.json

{
  "servers": {
    "agent-loadout": {
      "type": "http",
      "url": "https://loadout.jnw-it.com/mcp"
    }
  }
}

Tools

A typical flow: search_loadouts with the user's agent and stack → get_loadout → get_install_instructions → fetch files with get_loadout_file. The agent should still show the user what it will write and never overwrite an existing AGENTS.md or CLAUDE.md without asking.

Limits: 120 requests a minute per IP (HTTP 429 with Retry-After after that), 64 KB request bodies, files up to 100 KB. GET /mcp returns 405 because there is no server-to-client stream. A server card is served at /mcp/server-card (draft MCP server-card extension). Test it with npx @modelcontextprotocol/inspector --cli https://loadout.jnw-it.com/mcp --transport http --method tools/list.

Search API

GET https://loadout.jnw-it.com/api/v1/search. All parameters are optional; with none it lists the catalogue, featured and verified loadouts first.

curl -s 'https://loadout.jnw-it.com/api/v1/search?q=supabase+auth&agent=cursor&limit=1'
{
  "query": { "q": "supabase auth", "terms": ["supabase", "auth"], "agent": "cursor", ... },
  "match": "all",
  "total": 2,
  "count": 1,
  "results": [{
    "id": "nextjs-supabase-saas",
    "title": "Next.js + Supabase SaaS",
    "summary": "...",
    "score": 7,
    "matched_terms": ["supabase", "auth"],
    "tags": ["nextjs", "react", "typescript", "supabase", "postgres"],
    "agents": { "claude-code": "native", "codex": "adapter", "cursor": "native", ... },
    "contains": { "rules": 2, "skills": 1, "mcp": 1 },
    "verification": { "status": "verified", "verified": true, "checked_at": "..." },
    "agent_tests": { "status": "untested", "per_agent": { ... } },
    "urls": { "page": "...", "json": "...", "raw_base": "...", "source_zip": "...", "zips": { "cursor": "..." } }
  }]
}

Responses are cacheable for five minutes. Errors are JSON: 400 invalid_parameter (with field), 414 for URLs over 2,048 characters, 429 rate_limited after 60 searches a minute per IP. The index behind it is built with the site and published at /api/search-index.json.

Install a loadout from an agent

1. Fetch /api/loadouts/<id>.json.
2. Read install.<your-agent-id>.files: each item has a raw_url and a target path relative to the project root.
3. Before writing, check whether the target exists. If it does, show the user a merge rather than overwriting.
4. Tell the user about any manual_steps (usually MCP configs in another format) and any requires.env values.

curl -s https://loadout.jnw-it.com/api/loadouts/discord-bot-ts.json | jq '.install["claude-code"].files'

Agent ids and paths

These paths follow each tool's published conventions as of October 2026. The Level 1 verifier checks every loadout installs to exactly these paths and that the resulting layout is discovered correctly; it does not run the agents themselves, so treat them as documented and layout-checked rather than agent-tested.

Verification (Level 1)

Each loadout in /api/index.json carries a verification summary, and /api/loadouts/<id>.json adds every check:

"verification": {
  "level": "verified-install",
  "status": "verified",          // verified | failing | incomplete | stale | none
  "verified": true,
  "checked_at": "2026-10-16T21:36:19Z",
  "agent_tests": "not-run",      // Level 1 never runs an AI agent
  "checks": [{ "id": "install-paths", "status": "pass", "summary": "…", "details": ["…"] }, …]
}

Checks: listing, parse, adapters, install-paths, mcp, safety, references, size, licence, starter-build. Each is pass, fail, skip (could not run) or n/a (does not apply, with the reason). stale means the files changed after the last run. Per-agent results live separately in tested.per_agent.

Submit a loadout

The submit form and agents use the same endpoint. Submissions are stored as pending, checked automatically for credentials and risky shell, then run through the Level 1 verifier and reviewed by a person before they are listed. Submitted files are never executed on intake.

Authentication

• Agents and scripts send Authorization: Bearer alk_…. Keys are issued by hand while we are small; ask through the contact form on jnw-it.com. With no key, use the form. Each key has its own daily limit (20 by default).
• Browsers (the form) send a Cloudflare Turnstile token and a signed form token instead, from an allowed origin, and are limited per network per hour. Cross-site browser requests are refused.

Body

curl -s -X POST https://loadout.jnw-it.com/api/v1/submissions \
  -H "Authorization: Bearer $AGENT_LOADOUT_KEY" \
  -H "Content-Type: application/json" \
  --data @submission.json

# submission.json
{
  "name": "Phaser platformer jam",
  "summary": "Phaser 3 rules and a ship skill so your agent helps you finish a platformer in a weekend jam.",
  "category": "gamedev",
  "stacks": [
    "phaser",
    "javascript"
  ],
  "agents": [
    "claude-code",
    "cursor"
  ],
  "licence": "MIT",
  "author": {
    "name": "Your Name",
    "github": "your-handle"
  },
  "rights_confirmed": true,
  "files": [
    {
      "path": "AGENTS.md",
      "content": "# Phaser jam rules\n- ..."
    }
  ]
}

Errors

Errors are JSON: { ok: false, error, message, issues? }. issues lists each field path and what to fix.

Risky patterns such as curl … | sh to an unknown host, hidden Unicode or prompt-injection wording do not block a submission; they mark it flagged for a closer human review.

Coming next

• Per-agent test results from real runs, with dates.