Connect MCP API — VerditNxtGen Developer Documentation

Authentication

Header-Only Auth.
Never in the body.

All API keys are passed exclusively via the X-VerditNxtGen-Key HTTP request header. This is enforced at the Cloudflare edge — no exceptions, no workarounds.

⚠ Security Notice Never log, commit, or expose your X-VerditNxtGen-Key in:
· Client-side JavaScript or HTML
· GitHub Actions run: step outputs
· Environment variable logs
Store in GitHub Secrets or a secrets manager and inject at runtime only.

Correct authentication pattern

// ✓ CORRECT — key in header
fetch('https://verditnxtgen.com/api/v1/tools/langgraph-server', {
  headers: { 'X-VerditNxtGen-Key': 'vnxt_your_key_here' }
});

// ✗ WRONG — key in body (P3-01 vulnerability, returns 401)
fetch('/api/v1/tools/langgraph-server', {
  method: 'POST',
  body: JSON.stringify({ api_key: 'vnxt_your_key_here' }) // ← NEVER
});

🔑

Security requirement: Passing keys inside the request body (e.g. api_key JSON field) was a confirmed P3-01 vulnerability and has been eradicated from the API. Any client sending a key in the body will receive a 401 Unauthorized response.

Your Key

Get your free API key.

Enter your work email and get an API key instantly — 1,000 calls/month, no credit card. Keys are prefixed vnxt_.

By generating a key you agree to our Terms of Service. No credit card required.

Rate Limits & Quotas

Limits by tier.

Tier	Calls/Month	Calls/Min	Burst (10s)	Audit PDFs
FREE	1,000	20	50	0
PRO	Unlimited	200	500	Unlimited
ENTERPRISE	Unlimited	Custom	Custom	Unlimited

Exceeding limits returns 429 with Retry-After. Limits enforced at Cloudflare edge — no origin latency penalty within burst.

API Reference

Endpoints.

GET /api/v1/tools/:slug Score, Bloat Index, OWASP status, deploy verdict FREE

GET /api/v1/tools Paginated list — ?category=, ?sort=score|bloat|stars FREE

GET /api/v1/audit/:slug Signed PDF, SBOM, OWASP detail, SOC 2 mapping PRO

POST /api/v1/alerts Webhook subscription for score-drop alerts (HMAC signed) PRO

POST /api/mcp JSON-RPC MCP — tools/list, tools/call — requires signature PRO

MCP Payload Security

HMAC-SHA256 Signature.

The /api/mcp endpoint requires a signature field in every JSON-RPC payload. Server rejects unsigned calls with 403.

HMAC-SHA256 Generation — Node.js

import { createHmac } from 'node:crypto';

const body = JSON.stringify(payload);
const sig  = createHmac('sha256', process.env.VNXT_WEBHOOK_SECRET)
  .update(body).digest('hex');

fetch('https://verditnxtgen.com/api/mcp', {
  method: 'POST',
  headers: {
    'X-VerditNxtGen-Key': process.env.VNXT_API_KEY,
    'X-VNG-Signature':    sig
  },
  body: JSON.stringify({ ...payload, signature: sig })
});

_kvRecordVerify uses constant-time comparison. Include a ts (Unix timestamp) field — payloads older than 60s are rejected.

CI/CD Integration

Block PRs that introduce failing AI dependencies.

Add the VerditNxtGen GitHub Action to your workflow. It reads your package.json or pyproject.toml, queries the API for each AI tool listed, and fails the PR if any tool scores below your configured threshold.

✓ Configurable score threshold (default: 60)
✓ PR comment with Bloat Index and OWASP status per tool
✓ Stores VNXT_API_KEY in GitHub Secrets — never in source
✓ Zero configuration beyond the single step below

View on GitHub →

.github/workflows/verdit-check.yml

name: VerditNxtGen Dependency Audit
on: [pull_request]

jobs:
  verdit-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Audit AI dependencies
        uses: ShopFarnow/verdit-action@v1
        with:
          api-key:         ${{ secrets.VNXT_API_KEY }}
          min-score:       60
          fail-on-owasp:   true
          post-pr-comment: true
          # Key is injected via header internally — never in payload

Integrate theGhost Swarm API.

Header-Only Auth.Never in the body.