All API requests require an X-API-Key header. Keys are prefixed with sk_. Never expose your key in client-side code or version control.

Pass the ecosystem slug as the ecosystem parameter in any API call. Core ecosystems are available on all tiers. All others require a Pro subscription.

When you exceed your monthly limit the API returns a 429 status. Limits reset on the first day of each calendar month.

To increase your limit, upgrade to Pro.

Base URL: https://usestrata.dev/api/v1

In local dev: http://localhost:3000/api/v1

Returns AI-verified best practices for a given ecosystem and category.

Parameters

Response fields

Returns aggregated news for an ecosystem. Free tier receives items older than 24 hours. Pro tier receives results updated every 12 hours.

Parameters

Response fields

Returns ranked integrations and MCP servers for an ecosystem.

Parameters

Response fields

Full-text search across all verified content. Returns results ranked by relevance.

Parameters

Response fields

All error responses share the same shape:

The tier field is included only on 403 and 429 responses.

# Get Claude best practices
curl -s "https://usestrata.dev/api/v1/best-practices?ecosystem=claude" \
  -H "X-API-Key: sk_your_api_key_here"

# Search across all ecosystems
curl -s "https://usestrata.dev/api/v1/search?query=function+calling" \
  -H "X-API-Key: sk_your_api_key_here"

# Poll for latest news (page 1)
curl -s "https://usestrata.dev/api/v1/news?ecosystem=openai&limit=5" \
  -H "X-API-Key: sk_your_api_key_here"

# Page 2 (offset-based)
curl -s "https://usestrata.dev/api/v1/news?ecosystem=openai&limit=5&offset=5" \
  -H "X-API-Key: sk_your_api_key_here"

All routes accept X-API-Key or Authorization: Bearer headers. Compliance reporting (/api/compliance/report) and agent creation use session cookie auth — sign in via the dashboard first.

Verify any MCP server by GitHub URL, npm package name, or hosted endpoint. Returns two trust scores, capability flags, injection status, and a real-time circuit breaker state.

Pass exactly one of url, npm, or endpoint.

Verify an x402 payment endpoint before your agent pays anything. Checks SSL validity, domain age, payment amount reasonableness. Returns a trust score and risk flags. Results cached for 24 hours.

Issue an Ed25519-signed JWT credential for an agent identity. Requires dashboard session cookie — authenticate via /login first. The returned credential is shown once only.

Also available: POST /api/v1/agents/verify (API key auth) to verify a credential with live revocation check, and GET /.well-known/jwks.json for offline JWKS verification.

Record a data flow between two MCP servers. Builds an auditable lineage graph visible in the dashboard. Use the MCP tool track_data_flow to call this automatically from inside your agent.

Query the real-time threat feed — changes to MCP server risk signals (quarantines, dangerous capability additions, score drops, injection detections). Use affected_only=true to surface only events for servers you've connected to.

Generate a SOC 2 or ISO 27001 compliance evidence package from the Agent Activity Ledger. Includes tamper evidence (HMAC spot-check), agent activity summary, risk posture, and tool breakdown. Requires dashboard session cookie.

List behavioral anomaly events detected against your rolling baselines. Three detector types: volume_spike (5× baseline), high_risk_surge (3× baseline), net_egress_surge (3× baseline, escalates off-hours). Detection requires 7 days of history and 50+ calls.

Acknowledge an event: POST /api/v1/anomalies/:id/acknowledge

Returns the complete dependency graph for the authenticated profile — all MCP servers your agents have connected to, their current risk state, data flows between them, and circuit breaker status. Pass period=7d|30d|90d|all to control the lookback window.

Strata is available as a native MCP server. Any MCP-compatible client — Claude.ai, Cursor, Windsurf, or a custom agent — can call all four tools without making individual REST requests.

Remote connection (Streamable HTTP)

Strata works with any MCP-compatible client and any model that can make HTTP requests — not just Claude.

Add via the CLI:

Local connection (stdio)

For local development with Claude Desktop, clone the repo and add to claude_desktop_config.json:

{
  "mcpServers": {
    "strata": {
      "command": "npx",
      "args": [
        "tsx",
        "/path/to/strata/scripts/mcp-stdio.ts"
      ],
      "env": {
        "STRATA_API_KEY": "sk_your_api_key_here"
      }
    }
  }
}

The stdio transport works with any client that supports local MCP servers via command + args config, including Cursor and Windsurf.

Available tools (10)