Tools API
Retrieve tool schemas available to the agent and proxy web fetch requests through the backend.
This is the MisarCoder gateway
These endpoints are served by the MisarCoder MoE gateway at https://api.misar.io/coder, not by the MisarDev product API at https://api.misar.io/dev. See the MisarCoder docs for the full gateway reference.
Overview
The Tools API exposes two capabilities: fetching the schemas for all tools the agent can invoke, and a server-side web fetch proxy that converts raw HTML into clean readable text.
Schema List
/toolsReturns the JSON Schema definitions for all built-in tools available to the agent.
Response fields
toolsarrayTool definitions. Each includes name, description, and input_schema.
countnumberTotal number of tools returned.
GET /tools
Authorization: Bearer YOUR_API_KEY{
"tools": [
{
"name": "read_file",
"description": "Read the contents of a file at the given path.",
"input_schema": {
"type": "object",
"properties": {
"path": { "type": "string", "description": "Relative path to the file" }
},
"required": ["path"]
}
}
],
"count": 31
}Schema List with Validation
/tools/v2Identical to v1 but each schema includes an additional validation block with constraints the agent must respect (e.g. path restrictions, size limits, permission requirements).
Response fields
toolsarrayTool definitions. Each includes name, description, input_schema, and a validation block.
countnumberTotal number of tools returned.
schema_versionstringSchema version identifier — "2" for this endpoint.
GET /tools/v2
Authorization: Bearer YOUR_API_KEY{
"tools": [
{
"name": "write_file",
"description": "Write content to a file.",
"input_schema": { ... },
"validation": {
"requires_permission": true,
"max_bytes": 524288,
"blocked_paths": [".env", ".misar/hooks/"]
}
}
],
"count": 31,
"schema_version": "2"
}Use v2 when building custom agent integrations that need to enforce permission gates or size limits before sending tool results back to the backend.
Web Fetch Proxy
/tools/web-fetchFetch a URL server-side and receive clean, readable text. The proxy strips navigation, ads, and boilerplate, returning only the main content — suitable for injecting into an agent's context.
Request body
urlstringbodyrequiredURL to fetch. Must be HTTPS.
max_bytesnumberbodydefault: 10240Maximum response size in bytes (max: 10 KB).
Response fields
urlstringThe URL that was fetched (may differ from input if redirected).
titlestringPage title extracted from the HTML.
contentstringMain page content converted to readable plain text.
content_bytesnumberSize of the returned content in bytes.
fetched_atstringISO 8601 timestamp of when the fetch occurred.
POST /tools/web-fetch
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json{
"url": "https://docs.example.com/api/authentication",
"max_bytes": 10240
}{
"url": "https://docs.example.com/api/authentication",
"title": "Authentication — Example Docs",
"content": "## Authentication\n\nAll requests require a Bearer token...",
"content_bytes": 3412,
"fetched_at": "2026-03-21T15:00:00Z"
}Only HTTPS URLs are accepted. HTTP URLs and private network addresses (localhost, RFC 1918 ranges) are rejected with a 400 error.
Status codes
- 400 — Invalid URL, HTTP URL, or private network address.
- 422 — URL is reachable but returned non-HTML content.
- 502 — Upstream fetch failed or timed out.
- 429 — Rate limit exceeded.