Call the local HTTP interface.

Keep the interfaces separate

The local HTTP server exposes discovery and tool invocation endpoints alongside MCP transport. The optional request-compression proxy is a different service. The SDK’s Engine transport has its own versioned contract.

Do not reuse an endpoint, token or port just because another interface has a similar name.

Start a local server deliberately

lean-ctx serve --host 127.0.0.1 --port 8080

Run this from the intended project root. It starts a server process. The reviewed HTTP configuration defaults to loopback and generates a token when no explicit token is provided. Non-loopback binding requires explicit authentication.

Use the token from your own server startup privately. Keep host checks enabled and avoid placing tokens in shared logs or source files.

Discover the contract

Request	Purpose
GET /v1/manifest	Tool definitions and schemas
GET /v1/tools	Paginated tool discovery
GET /v1/capabilities	Runtime capability information
GET /v1/openapi.json	The server’s API contract
POST /v1/tools/call	Invoke a named tool with arguments

These routes use the server’s authentication middleware. Capability descriptions and registered endpoints can include implementation or compatibility surfaces; consult feature status before treating them as public product promises.

Authenticate a discovery request

Set LEANCTX_HTTP_TOKEN in your local environment to the token belonging to this server. In Bash / zsh on macOS or Linux, run:

curl --fail --silent --show-error \
  -H "Authorization: Bearer $LEANCTX_HTTP_TOKEN" \
  http://127.0.0.1:8080/v1/manifest

In PowerShell on Windows, use its native HTTP client:

$requestHeaders = @{ Authorization = "Bearer $env:LEANCTX_HTTP_TOKEN" }
Invoke-RestMethod -Uri "http://127.0.0.1:8080/v1/manifest" -Headers $requestHeaders

Windows PowerShell can alias curl to a different command, so its arguments are not interchangeable with the Bash example. The variable name is an example for these commands, not a runtime configuration key. Never send a token to an unrelated endpoint.

Handle failure as part of the contract

Expect authentication failures, body-size limits, rate/concurrency limits, timeouts and tool errors. Inspect both the HTTP response and the returned tool outcome. Do not treat a successful transport response as proof that the underlying operation succeeded.

For application embedding, prefer the SDK’s versioned interfaces and their typed errors.

Sources & versions3 references · Reviewed 17 Sept 2026

• config.rsrust/src/http_server/config.rsGitHub
• mod.rsrust/src/http_server/mod.rsReviewed checkout
• openapi-v1.snapshot.jsondocs/reference/openapi-v1.snapshot.jsonGitHub

Core checkout

0ce2207ee4

Installed runtime

3.10.2

SDK release

1.1.0

Separate baselines for source, CLI/configuration and SDK contracts. Review does not certify every platform or integration.

Versions & compatibility