---
title: "Tunnel Catalog"
method: POST
path: "/tunnel/catalog"
---

# Tunnel Catalog

`POST /tunnel/catalog`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/tunnel/catalog`
- Auth: none declared

ADR-0010: a go-server tunnel registers the catalog of tools it implements, keyed by
its tool_catalog_hash. Called ONLY when a hello_ok returned catalog_needed:true (cache-miss
or eviction), so it's rare despite tunnel churn.

No auth needed: the hash is validated against the content (sha256), so a caller can only
register a (hash, tools) pair that is internally consistent — it cannot make a hash map to
a different list of tools without a sha256 collision. A bogus hash that no hello ever sends
is inert: filtering only kicks in for a tunnel whose declared hash matches, and unknown
hashes fail open to the full catalog.

## Request body

- TunnelCatalogBody
  - `machine_id` string
  - `platform` string
  - `hash` string
  - `tools` string[]

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)