# ModuleSnap — modulesnap (modulesnap.modulesnap.com)

This host is a ModuleSnap tenant. Anything that can be done here can be done by a machine,
through the same HTTP door the UI uses: operate the tenant's data, and author this tenant's
own modules — typed client screens and governed server code. There is nothing to install;
this host serves its own agent surface.

ModuleSnap is proprietary software, licensed per client. This page is the only thing readable
without a credential: the catalog, the data, the docs and the worked source examples an
agent programs from are all behind the token.

## 1. Get a token

    curl -X POST https://modulesnap.modulesnap.com/api/token \
        -H 'Content-Type: application/json' \
        -d '{"email": "<email>", "password": "<password>"}'

It returns {"token": "..."} — a machine credential carrying that user's own permissions (an
agent is one more principal, never privileged). Send it as "Authorization: Bearer <token>"
on everything below.

An account that signs in with a passkey is refused here (403): a bearer is never minted on
a password alone. Sign in in the browser instead and issue a named credential from the
security settings — the same door that scopes one down:

    POST https://modulesnap.modulesnap.com/api/credentials/issue   {"name": "...", "permissions": ["..."]}

The token comes back once, and "permissions" limits it to those grants and nothing else,
which is how a token is handed to one narrow job. Either kind is revoked by trashing the
credential; a credential can never issue another.

## 2. Connect an agent (MCP) — the recommended door

    https://modulesnap.modulesnap.com/mcp

A Model Context Protocol server, spoken over stateless Streamable HTTP (one JSON-RPC
message per POST) — always this deployment's own version. In Claude Code:

    claude mcp add --transport http modulesnap https://modulesnap.modulesnap.com/mcp \
        --header "Authorization: Bearer <token>"

Its tools cover both jobs. To OPERATE: list_modules and describe_module give an endpoint's
input schema, "call" runs it, query_db inspects this tenant's own database. To AUTHOR: a
developer tree worked with grep, read_file and write_file — this tenant's own modules
(writable), the public modules' real production source read-only (bookings, billing, … —
the worked examples to copy the patterns from), the widget reference, the design rules, the
sandbox API your server code compiles against, and this tenant's log with full error
traces. A write is type-checked and rule-checked on the spot, "migrate" materializes the
models you wrote, "run_tests" runs the module's tests. So a module can be written from
scratch here, against real examples, without a copy of the platform.

Call tools/list for the surface; the handshake's instructions say how to work with it.

## 3. Or operate directly over HTTP (discovery → call)

    GET https://modulesnap.modulesnap.com/api/modules            # what is installed here
    GET https://modulesnap.modulesnap.com/api/module?name=<name> # its endpoints + input schema, referenced models inlined
    GET https://modulesnap.modulesnap.com/api/models             # the model catalog
    GET https://modulesnap.modulesnap.com/api/model?name=<name>  # one model's fields and display metadata
    GET https://modulesnap.modulesnap.com/api/endpoints          # the platform's own endpoints

Every model on the surface also carries free CRUD under its qualified name
(billing_document, bookings_booking, …):

    GET    https://modulesnap.modulesnap.com/api/<model>?filter=<where>&sort=<field [desc]>&page=1&pageSize=50
    GET    https://modulesnap.modulesnap.com/api/<model>/<id>
    POST   https://modulesnap.modulesnap.com/api/<model>         # create, or update when the body carries an id
    PATCH  https://modulesnap.modulesnap.com/api/<model>/<id>    # partial update
    DELETE https://modulesnap.modulesnap.com/api/<model>/<id>

"filter" is a closed subset of a SQL WHERE over the model's own fields — comparisons,
AND/OR, parentheses, LIKE, IN, BETWEEN, IS [NOT] NULL — for example
"price <= 20 AND city = 'Madrid'"; it is parsed and bound as parameters, never
concatenated. Discovery lists the rest (export, bulk delete, trash and restore, import).

The schema IS the call contract: input is validated closed-by-default, so a wrong field
comes back as a 400 naming it. The MCP tools above are faces over these very endpoints.