---
title: "Tunnel Schemas"
method: POST
path: "/tunnel/schemas"
---

# Tunnel Schemas

`POST /tunnel/schemas`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/tunnel/schemas`
- Auth: none declared

A go-server registers the SCHEMAS it implements, keyed by their own hash. Called only
when a hello_ok returned schemas_needed:true, so it is rare despite tunnel churn.

Why this exists at all, and why it is not folded into /tunnel/catalog: that endpoint keys
on the NAMES hash, which two servers with the same tool names and different parameters
share exactly. Serving schemas out of a names-keyed entry would hand one server's contract
to the other — the HIGH review's P1 on this PR.

Same auth argument as /tunnel/catalog, and it is what makes 'no auth' safe here too: the
hash is validated against the content, so a caller can only register a (hash, schemas)
pair that is internally consistent. A hash no hello ever declares is inert, and an
unknown hash substitutes NOTHING rather than falling open.

The payload is the artifact's own shape, validated by the artifact's own validator — one
contract, two transports (file for CI, wire for production).

## Request body

- TunnelSchemasBody
  - `machine_id` string
  - `catalog` object

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)