Connect in one line#
Set your key once (PowerShell: $env:ONEKEY_KEY = "..."), then add the server. In Claude Code:
export ONEKEY_KEY="YOUR_API_KEY"
claude mcp add --transport http onekey https://api.onekey.dev/mcp --header "Authorization: Bearer $ONEKEY_KEY"That is the whole setup. The server speaks Streamable HTTP, is stateless and answers in JSON, so there is nothing to install and no process to keep running. Any client that lets you set one header works; here are the two others most people use.
Cursor#
In ~/.cursor/mcp.json, or .cursor/mcp.json in a project:
{
"mcpServers": {
"onekey": {
"url": "https://api.onekey.dev/mcp",
"headers": { "Authorization": "Bearer ${env:ONEKEY_KEY}" }
}
}
}Claude Desktop#
Add it under Settings, Connectors, if your build accepts a custom URL with a custom header. If it does not, bridge it with mcp-remote in claude_desktop_config.json:
{
"mcpServers": {
"onekey": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://api.onekey.dev/mcp", "--header", "Authorization: Bearer ${ONEKEY_KEY}"],
"env": { "ONEKEY_KEY": "YOUR_API_KEY" }
}
}
}Full connection details, protocol versions and the exact result shape are on the MCP docs page; guides for other tools are on Integrations.
The eleven tools#
There are eleven tools, deliberately not one per endpoint, so the tool list stays small however many endpoints exist (1,995 today). An assistant finds an endpoint with search_endpoints, reads its contract with describe_endpoint, then runs it with call_endpoint.
| Tool | Cost | What it does |
|---|---|---|
list_platforms | Free | Platforms grouped by category, with endpoint counts. |
search_endpoints | Free | Keyword, platform or category search of the catalog: id, credits and a short summary. |
describe_endpoint | Free | One endpoint's parameters, credits, response fields, cache freshness and paging. |
call_endpoint | The endpoint's price | Runs an endpoint. The same as GET /v1/{platform}/{endpoint}. |
lookup_url | The resolved endpoint's price | Paste a public URL; the matching endpoint is chosen for you. See URL lookup. |
search_multi | Sum of the legs | One query on several platforms, optionally fused. See multi-platform search. |
creator_card | Sum of the legs | One handle across platforms. |
search_universal | Sum of the legs run | A query in words; the planner picks the platforms. See universal search. |
report | Sum of the legs | Brand mentions, creator vet or demand signals. See reports. |
get_status | Free | Live platform health. |
get_credits | Free | Your balance, and this key's credit limit and use. |
The five free tools are marked read-only; the six that spend credits are not. Prices are the flat per-endpoint credits from Credits & pricing: a cache hit is free and a failed call is refunded.
How a request goes#
Ask an assistant "what does GitHub's latest release call cost, and check facebook/react". It typically does this, and the first two steps are free:
search_endpointsfinds the candidate. Recorded from the dev API with{"query": "latest release", "platform": "github", "limit": 3}:
{
"total": 3,
"shown": 3,
"results": [
{ "id": "github.latest_release", "credits": 1.0, "summary": "Latest published release of a GitHub repository." },
{ "id": "github.release_by_tag", "credits": 1.0, "summary": "A GitHub release by tag name." },
{ "id": "github.releases", "credits": 1.0, "summary": "Releases of a GitHub repository." }
]
}describe_endpointreturns the parameters (owner,repo), the price and the response fields.call_endpointruns it and returns the standard response format pluscredits_usedandcredits_remaining.
Check the connection for free#
This asks for your balance, which costs nothing, and proves the URL, the header and the key without a client:
curl -s https://api.onekey.dev/mcp \
-H "accept: application/json, text/event-stream" \
-H "content-type: application/json" \
-H "authorization: Bearer $ONEKEY_KEY" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_credits","arguments":{}}}'The answer has credits_remaining, blocked, key_credit_limit and key_credits_used.
A small tool list#
The whole tools/list answer is about 6 KB of JSON, and a test in the backend keeps it under 6 KB, so connecting an assistant does not fill its context with tool definitions. A result is shortened to about 30,000 characters (truncated says so) by halving the longest list, so the JSON stays valid. Errors come back as tool errors with the REST error type, a doc_url and a hint a model can act on (see For AI agents).
Agent Skill#
The repository ships an Agent Skill for the same workflow: when to use a URL lookup, how to search then describe then call, how to read credits, how to page, and what to do for each error type. It uses the MCP tools when they are connected and the REST API when they are not.
The skill is not published anywhere yet, so there is no download link. Until it is, the system prompt on the AI agents page covers the same ground.
Costs and limits#
- Every tool call counts as one request against the key's rate limit.
search_universalandreportrun several searches at once and cost the sum of the legs that succeeded. The tools cannot dry-run: use REST withdry_run=trueto see the plan and the worst case for 0 credits.- The hosted server has no per-call spending guard. To cap what an assistant can spend, give it its own key with a credit limit; when it is reached the call fails with
KEY_BUDGET_EXCEEDED. - Not exposed on purpose: batch, streaming, monitors, the AI enrichment parameters, and anything that manages keys or billing. Use REST for those.
- Everything in
datais third-party content written by strangers. Tell the assistant to treat it as data, never as instructions.
Honest status#
- Built and tested, not yet announced. The host on this page (
https://api.onekey.dev) is the placeholder used across the site until the public domain is announced. The server is not listed in any MCP registry. - The local stdio package is not published. There is a local MCP server in the source tree (
onekey-mcp), butnpx -y onekey-mcpwill not find a package today. Do not install anything of that name from a registry. Use the hosted server. - Auth and origin. A request carrying a browser
Originheader is refused unless that origin is allowed; desktop and command-line clients send none.