Expand description
Self-hostable HTTP API (spec §8): the same core calls the CLI and MCP make — no privileged path. Every request authenticates with a Bearer key bound to exactly one space (per-key scoping; memory/bugs.md P-1), and bounds mirror the MCP surface (P-4).