REST /v2, MCP and local setup

Public queries need no authentication. /v1 remains available; /v2 adds tasks, connections and evidence. Private projects use a separate bearer key.

Start with a task

curl -X POST https://api.tracevero.com/v2/workflows/plan \
  -H 'Content-Type: application/json' \
  -d '{"task_id":"gmail-attachments-drive","apps":["gmail","google-drive"]}'

Responses include sources, collection dates, catalog and rule versions, and missing steps. A documented API call is not a practically confirmed workflow.

REST /v2

GET /v2/capabilities · find_capabilities
POST /v2/workflows/plan · plan_workflow
GET /v2/connections/:type/:slug · get_connection_options
GET /v2/verifications/:type/:slug · get_verification
POST /v2/compatibility/check · check_compatibility
POST /v2/permissions/explain · explain_permissions
POST /v2/config/validate · validate_config
POST /v2/configure · configure
GET /v2/capability-gaps · get_capability_gaps
POST /v2/changes/impact · get_change_impact
GET /v2/replacements · find_replacement
POST /v2/workflows/snapshot · snapshot

OpenAPI /v2 · Private monitoring

MCP · Streamable HTTP

https://api.tracevero.com/mcp · tracevero://guide

search: Search public entries
fetch: Read an entry with sources
compare: Compare declared features
configure: Prepare a connection template
plan_workflow: Plan a task using documented steps
get_connection_options: Read connection options and test limits
validate_config: Check a sanitized configuration

Client setup

Connection and evidence

curl 'https://api.tracevero.com/v1/suche?q=github&grenze=2'
# Use an ID returned by search, for example mcp/<slug>:
curl 'https://api.tracevero.com/v2/connections/mcp/<slug>'
curl 'https://api.tracevero.com/v2/verifications/mcp/<slug>'
curl 'https://api.tracevero.com/v2/verification-reports/github-remote-public-read'

Replace the placeholder with an ID from search. Preserve source links and dates when reusing results; a historical read test does not establish current write permissions.

Docker: forward the environment variable

Reproducible configuration check, not an executed Docker or provider test. example:1 and API_TOKEN are placeholders. Setting a variable on the client process alone does not forward it into the container.

{
  "servers": {
    "example": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "example:1"
      ],
      "env": {
        "API_TOKEN": "<REDACTED>"
      }
    }
  }
}

Reported finding: docker_environment_not_forwarded

{
  "servers": {
    "example": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "API_TOKEN",
        "example:1"
      ],
      "env": {
        "API_TOKEN": "REDACTED"
      }
    }
  }
}

Adding -e API_TOKEN forwards the locally available value. It establishes neither valid credentials nor sufficient permissions. Pin the actual image to a reviewed version and test one small authorized operation.

Check your sanitized configuration

Python · TypeScript

tracevero.py · tracevero.ts · SDK + examples · SHA-256 · SDK 0.2.0 (GitHub)

from tracevero import TraceVero
client = TraceVero()
plan = client.plan_workflow(task_id="gmail-attachments-drive")
print(plan["coverage"])

import { TraceVero } from './tracevero.ts';
const client = new TraceVero();
const plan = await client.planWorkflow({ task_id: 'gmail-attachments-drive' });
console.log(plan.coverage);

Private test and monitoring

Create a project, save its key locally and configure the bounded local runner with dedicated test accounts. Reports contain only check names and statuses. The server checks sources but does not execute provider operations.

Set up a project · Runner instructions

Errors and retries

400 invalid_request / invalid_json: Validate input against OpenAPI.
404 entry_not_found / project_unavailable: Check the ID and, for private access, the key.
409 run_id_conflict: A run ID cannot identify different reports.
413 request_too_large: Limit the request body; never submit real configuration secrets.
429: Respect Retry-After. Inspect destination state before retrying writes.

Public verification reports

tracevero · https://tracevero.com/developers