Web console & JSON API
GET / serves a self-contained dashboard (no build step, no external JS)
to browse, search, and facet the whole inventory — by type, tool, and scope —
preview hydration, inspect any item down to its manifest and snapshot, and
export selected capabilities after indexing finishes. A single selection is a
portable JSON file. Multiple selections are bundled into a ZIP containing an
inventory CSV, sanitized raw indexed bodies, and a v1 pack for later repacking.
The dashboard is read-only plus downloads/previews: installs, updates, pinning, and other state changes always run through the MCP tools / JSON API, never through dashboard buttons. Artifact files are never written from the console.
The Devices → Connect a machine card generates copy-ready setup for the
selected Windows, macOS, or Linux architecture. Agent registration switches
between Claude Code, Codex, Gemini CLI, Cursor, Cline, Qwen Code, Grok,
DeepSeek, and a generic Streamable HTTP configuration. Collector setup can use
the no-runtime guided installer, npm from GitHub, or a source
checkout. The page never renders the stored bearer token: previews show
[hidden], and the complete command is assembled only when its copy button is
pressed.
For Codex on Windows, the generated PowerShell command stores the token in
the QUARTERMASTER_MCP_TOKEN user environment variable and registers the MCP
server with Codex’s --bearer-token-env-var option; it does not write the token
into config.toml. Fully quit Codex and the app or terminal that launched it
before reopening it so the new process inherits the variable. Opening only a
new thread inside the existing Codex process is not sufficient. The following
verification command reports a clear error if the fresh process still cannot
see the variable.
On a personal Cloudflare deployment, the setup selector also offers Guided +
Local Companion (advanced). That option adds /LocalCompanion=1 on Windows or
--local-companion on macOS/Linux and prints the command that opens the full
local Drift dashboard. The companion is loopback-only and keeps a separate
local registry; its reports do not appear in the hosted Worker console.
JSON API
Section titled “JSON API”| Route | Returns |
|---|---|
GET /api/census |
total vs unique counts, breakdowns by type/tool/scope |
GET /api/items |
the collapsed inventory for the UI |
GET /api/item/:id |
full body + canonical metadata for one item |
POST /api/export |
portable JSON for one selected capability, or ZIP + inventory CSV for multiple capabilities (≤5,000 locations / 5 MB of sanitized index data) |
GET /api/devices · POST /api/devices |
list / register device profiles |
POST /api/hydration/preview |
a dry-run hydration plan |
POST /api/ingest |
collector push — { device?, items: ScanItem[] }, ≤500 items / 8 MB per call |
POST /api/ingest/reconcile |
{ device, roots, seenPaths } — drop a device’s vanished items (roots-scoped) |
GET | PUT /api/config |
runtime settings: network-updates toggle + optional GitHub token (persisted in config.json beside the DB) |
POST /api/upstream/refresh |
on-demand update check + drift scan over all linked items |
POST /api/upstream/{find,check,pin,unpin} |
per-item drawer actions mirroring the MCP tools — registry metadata only |
GET /api/drift |
persisted drift reports (the Drift tab’s data) |
GET /health |
{"status":"ok","indexed":N,"scanning":bool} |
If AUTH_TOKEN is set, /mcp and /api require
Authorization: Bearer <token>. Binding off loopback (HOST=0.0.0.0)
refuses to start without a token, and loopback binds are protected by a
DNS-rebinding guard (Host/Origin pinning).