Koshra REST API and MCP server

Get a key

A space owner or admin opens API & MCP in Koshra, names a key and picks its scopes. The key is shown once, and Koshra stores only a hash of it. A key acts as the admin who made it, in that one space only, and stops working if that person leaves the space or stops being an admin. Revoke it on the same page. Each key is limited to 120 requests a minute.

• bots:read: list bots
• tasks:read: read the Tasks board and task status
• tasks:write: make plans and start allowed work

REST API

Send the key as Authorization: Bearer. The endpoints live under https://app.koshra.com/api/koshra/v1, described by an OpenAPI 3.1 spec at /api/koshra/v1/openapi.json on the app.

• GET /me: the key's space and scopes
• GET /bots: bots with their model and permission mode
• GET /tasks: the Tasks board, with columns, items, owner bot and status
• POST /tasks: make a plan for a task, and start it if policy allows
• GET /tasks/{id}: the status of a plan, a dispatch or a chat task

MCP server

Koshra is also an MCP server, over streamable HTTP at https://app.koshra.com/api/koshra/mcp with the same Bearer key. Its tools are list_bots, read_tasks_board, get_task_status and create_task, and a client only sees the tools its key's scopes allow.

Safety rules that still apply

• Every task becomes a plan first and gets a policy decision
• Allowed work starts only when you ask it to
• Work that needs approval never starts from a key; it waits on the Tasks board for a person in Koshra
• Blocked work never starts
• Outbound Slack, email and other external actions still need an approval card inside Koshra
• The API does not change any bot's permission mode

Agent guide

The app publishes a short guide for agents with examples, and an llms.txt of its own.

How agents can read this site