API Reference

Programmatic access is powered by the Atheros MCP server — usable from any MCP-compatible client such as Claude Code, Cursor, Codex, or your own agents.

Access: the MCP server is available to Atheros AI Pass (read-only) and Atheros AI Ultra subscribers. Free accounts are refused.

What each plan can do. Pass connections are read-only: search, fetch and validate. Write tools — listed below and marked write — are an Ultra capability, switched on by the current MCP access level; a write tool that is not enabled is not registered on the connection, and a call to one is refused.

Access changes arrive without a reconnect — an existing project key picks up write access the moment it is enabled for your plan.

Authentication

There are two kinds of key, and the difference matters.

Project keys — minted in Dashboard → Projects → your project → API keys. A project key is confined to the project it was issued for: it reads and writes that project only, and the rest of your account is invisible to it. This is the key to hand a coding agent, and the one to give a contractor working on a single project.

Account keys — minted in Settings → Connections or Dashboard → API keys. An account key reaches every project you own but is permanently read-only on every plan, including Ultra. It carries no project context, so pass a project slug to tools like get_builder_md when you need one.

Both are shown once, at creation. Store the key somewhere safe — you can rotate or revoke it later, but you cannot read it back.

Point your MCP client at the server:

{
  "mcpServers": {
    "atheros": {
      "url": "https://mcp.atheros.ai/v1",
      "headers": {
        "Authorization": "Bearer <your-api-key>",
        "x-atheros-client": "cursor"
      }
    }
  }
}

Or, for Claude Code:

claude mcp add atheros --transport http https://mcp.atheros.ai/v1 --header "Authorization: Bearer <your-api-key>"

Name the server after the project when you connect more than one: MCP clients key their config by server name, so reusing a single name replaces the previous project's entry. The generated snippets do this for you — a project key gets atheros-<project-slug>, and an account key, which spans every project, keeps the bare atheros.

The x-atheros-client header is optional. It identifies which agent is connecting so the connection shows up in Settings → Connections; both the project API keys tab and the connect wizard generate this config for you with the key already filled in.

Rate limits. Pass connections are limited to 20 requests per minute and 2,000 per day, Ultra connections to 60 per minute and 10,000 per day — counted per user across all your keys. search_components returns at most 50 results per call, and reading the source of more than 200 distinct components in a day is refused.

Available tools

Tools marked write require write access, which Pass never has and Ultra has once the write rollout is enabled. Template tools additionally require an admin account.

Area	Read	Write
Discovery	`search_components`, `get_template`, `list_frameworks`, `list_starter_kits`, `list_template_categories`	—
Your components	`list_my_components`, `get_component`, `get_component_versions`	—
Components	—	`create_component`, `save_component`, `clone_component`, `publish_component`, `delete_component`, `restore_component`, `restore_version`
Design systems	`list_design_systems`, `get_design_system`, `list_my_design_systems`	`create_design_system`, `import_design_md`, `update_design_system`, `delete_design_system`
Projects	`list_projects`, `get_project`, `get_builder_md`	`create_project`, `update_project`, `delete_project`, `add_component_to_project`, `remove_component_from_project`
Design-system checks	`validate_component`, `validate_project`	—
Templates (admin)	—	`create_template`, `update_template`, `add_template_variant`, `save_variant`, `request_template_deletion`, `restore_template`
Account	`get_me`, `get_credit_balance`, `get_credit_usage`	—

Key management is not available over MCP on any connection: keys are minted, rotated and revoked only in the dashboard, so a prompt-injected agent can never mint itself a credential.

Design-system enforcement

Each project can pin a design system, and the server holds agents to it. Call get_builder_md to load your project's framework, design tokens, and component inventory into context, and validate_component to check generated code against those tokens — it reports raw hex colors, off-scale spacing, and raw font families, with an auto-fix prompt that maps each to the nearest token. Enforcement also runs at the write boundary: save_component and create_component reject error-level violations before saving, so off-token code never lands as a new version. Pass force: true to override a specific save.

A typical agent workflow

get_builder_md — load your project's framework, tokens, and existing components.
search_components for something close to what you need, then get_template to pull its source. For a component you built yourself, list_my_components then get_component.
Have your agent adapt the code locally to your stack.
validate_component against your design tokens to check the result.

With write access (Ultra), the workflow continues: clone_component brings a component into your project, and save_component saves your changes back as a new version.

← Licensing