Developers

The Drel API & MCP server.

A small, read-only API and an MCP server that expose your AI Security Review cases — clearance decision, required controls, findings, and sign-off state — to your dashboards, CI checks, and coding agents.

Read the OpenAPI spec Get a demo →

OpenAPI specification

Full machine-readable schema for the REST API and the MCP JSON-RPC endpoint — endpoints, parameters, response shapes, error codes.

View /openapi.json

MCP server

Streamable HTTP MCP server exposing published AI Security Reviews as resources. Connect Claude Code, Cursor, or Windsurf directly.

How it works

API keys

Generate and rotate your workspace-scoped Drel API key — the same key authenticates both the REST API and the MCP server.

Manage API keys

llms.txt

A structured index of every public Drel page, written for language models rather than search crawlers.

View llms.txt

Authentication

Both auth options — an unscoped API key for unattended use, or Clerk OAuth 2.0 (cases:read scope) for a human-authorized agent.

View /auth.md

OAuth discovery

RFC 9728 Protected Resource Metadata — where to authenticate (Clerk) and what scope to request, for OAuth-capable clients.

View oauth-protected-resource

API catalog

RFC 9727 machine-readable catalog of Drel's APIs (REST + MCP), for tooling that discovers APIs by crawling /.well-known/.

View /.well-known/api-catalog

MCP Server Card

Structured MCP server metadata (SEP-1649) — serverInfo, transport, capabilities — for clients that discover MCP servers this way.

View server-card.json

Agent Skills

How an agent should use Drel to check or request an AI Security Review — when to reach for it, the read path, and what not to infer.

View skills index

Quickstart

Three steps to your first call.

1. Generate an API key

From your workspace, go to Settings → MCP and generate a token. It's shown once — the same key authenticates both the REST API and the MCP server.

2. Call the REST API

curl https://app.drel.ai/api/public/v1/cases \
  -H "Authorization: Bearer drel_pk_..."

3. Or connect an MCP client

Add to ~/.claude/settings.json, .cursor/mcp.json, or .windsurf/mcp.json — Streamable HTTP transport, no local process to run.

{
  "mcpServers": {
    "drel": {
      "type": "http",
      "url": "https://app.drel.ai/api/mcp",
      "headers": { "Authorization": "Bearer drel_pk_..." }
    }
  }
}

Endpoints

GET/api/public/v1/casesList AI Security Review cases visible to your API key. 60 req/min.

GET/api/public/v1/cases/{id}/findingsFindings (threats) for one case. 60 req/min.

GET/api/public/v1/cases/{id}/sign-offsSign-off status and history for one case. 60 req/min.

POST/api/mcpJSON-RPC 2.0 / MCP: initialize (no key, 30 req/min/IP), resources/list, resources/read (60 req/min/key).

Full parameter, response, and error schemas: /openapi.json. Every response carries RateLimit-* headers so you can self-throttle; see Errors below and Versioning & deprecation.

Errors

Every 4xx/5xx response is RFC 9457 (application/problem+json): type, title, status, detail, plus two Drel extensions — code (branch on this, not on detail text) and hint (how to recover). The full schema is Problem in /openapi.json, referenced by every error response — never inlined.

401unauthorizedMissing or invalid credentials (API key or OAuth access token).

403insufficient_scopeValid OAuth access token, but missing the required scope. Doesn't apply to API keys, which are unscoped.

404not_foundThe resource (or endpoint) doesn't exist, or isn't visible to your credential.

405method_not_allowedWrong HTTP method for this endpoint — see the Allow header.

429rate_limitedBudget exceeded — check RateLimit-Reset or Retry-After before retrying.

503service_unavailableServer-side configuration issue, not a caller error.

500internal_errorUnexpected server error — retry, then contact hello@drel.ai.

Versioning & deprecation

The API is versioned in the URL path (/api/public/v1/*). A breaking change ships as /api/public/v2/* alongside the existing /v1 — never as an in-place change to a version already shipped.

Before any version is removed, we publish at least 90 days' notice and add Deprecation and Sunset response headers (RFC 8594) to every response on that version, in addition to updating this page and /openapi.json.

Nothing under /v1 is currently deprecated.

Try it on a real case first.

Request a demo and we'll walk through the API and MCP server against a live workspace.

Get a demo