The TokenRoster API.
A public, read-only REST API for the TokenRoster registry — companies, DAOs, nonprofits, accelerators, incubators, VCs, tokens, people, and assessment programs. No API key, no authentication, no rate-limit paperwork.
The base URL is https://tokenroster.com. Every endpoint is an unauthenticated GET returning JSON in a { data, pagination? } envelope. The full machine-readable contract lives at /openapi.json.
curl "https://tokenroster.com/api/v1/companies?page=1&pageSize=5"
{
"data": [
{ "id": "example-co", "name": "Example Co", "symbol": "EXC", ... }
],
"pagination": { "page": 1, "pageSize": 5, "pageCount": 12, "total": 58 }
}curl "https://tokenroster.com/api/v1/companies/example-co"
{
"data": {
"company": { "id": "example-co", "name": "Example Co", ... },
"distribution": { ... },
"proposals": [ ... ],
"positions": [ ... ],
"capTable": [ ... ]
}
}TokenRoster runs an MCP (Model Context Protocol) server over the Streamable HTTP transport at https://tokenroster.com/api/mcp — no authentication required. It exposes the registry as tools: list_companies, get_company, list_people, get_person, list_frameworks, get_framework (plus list_scoring_frameworks, get_scoring_framework, list_program_frameworks, and get_program_framework for one kind), get_registry_stats, and list_company_form_options. The manifest lives at /.well-known/mcp.json.
A second, authenticated MCP server at https://tokenroster.com/api/manage/mcp covers manage flows for your own listings: list_my_companies, get_my_company, update_my_company, get_my_profile, update_my_profile, list_company_form_options, list_my_documents, get_credits, upload_document (or create_document_upload + complete_document_upload for large files), delete_document, and running assessment reports (start_report_run, execute_report_run, get_report_run_status, get_report). It requires a Authorization: Bearer header with a personal access token — create one at /manage/tokens; see the authentication guide.
{
"mcpServers": {
"tokenroster": {
"type": "streamable-http",
"url": "https://tokenroster.com/api/mcp"
},
"tokenroster-manage": {
"type": "streamable-http",
"url": "https://tokenroster.com/api/manage/mcp",
"headers": {
"Authorization": "Bearer trpat_..."
}
}
}
}The manage MCP server lets an AI assistant work on your own account: edit your profile and companies, upload and delete documents, and run assessment reports. Everything it does is limited to what you own.
Connect with sign-in (recommended). Add https://tokenroster.com/api/manage/mcp as a server with no token. Your client opens a TokenRoster page where you sign in and approve it, and it renews access on its own. In claude.ai or Claude Desktop, add it as a custom connector (Settings → Connectors → Add custom connector). Claude Code, Cursor and VS Code support this too; for example:
claude mcp add --transport http tokenroster-manage "https://tokenroster.com/api/manage/mcp" # then run /mcp in Claude Code and choose Authenticate
Or use a token for scripts and clients without sign-in support. Create a personal access token at /manage/tokens. It starts with trpat_ and is shown once, so copy it somewhere safe; anyone with it can act as you. Add it to your client as below, replacing trpat_..., then reconnect the client so it loads the tools.
claude mcp add --transport http tokenroster-manage \ "https://tokenroster.com/api/manage/mcp" \ --header "Authorization: Bearer trpat_..."
// ~/.cursor/mcp.json
{
"mcpServers": {
"tokenroster-manage": {
"url": "https://tokenroster.com/api/manage/mcp",
"headers": { "Authorization": "Bearer trpat_..." }
}
}
}// .vscode/mcp.json
{
"servers": {
"tokenroster-manage": {
"type": "http",
"url": "https://tokenroster.com/api/manage/mcp",
"headers": { "Authorization": "Bearer trpat_..." }
}
}
}Then ask in plain language. The assistant picks the tools itself. For example:
- “Show me my company profile and fill in anything that’s missing from our website.”
- “Set our industry to fintech and add the AI and analytics themes.”
- “Upload sales/pitch-deck.pdf to my company as a public pitch deck.”
- “Which of my documents are private? Delete the old v11 deck.”
- “Score my latest deck against the VC framework and summarize the result.”
Large files. An assistant can't paste a big file into a tool call, so uploads over a few kilobytes use two steps: the assistant asks for a one-time upload link, sends the file from your computer with a single command (curl or PowerShell), then confirms the upload. Clients that can run shell commands, like Claude Code, Cursor and VS Code, handle this on their own. Chat apps like claude.ai and Claude Desktop can't, so upload large files at /manage/documents instead.
Still in the web app: creating a new listing, changing a logo or profile picture, and billing. Connected apps and tokens are listed on /manage/tokens, where you can disconnect or revoke them.
Every non-2xx response is structured JSON — never an HTML error page. Branch on error.code (bad_request, not_found, method_not_allowed, internal_error); error.hint says how to resolve it.
curl "https://tokenroster.com/api/v1/companies/does-not-exist"
{
"error": {
"code": "not_found",
"message": "No company with slug \"does-not-exist\".",
"hint": "List valid slugs with GET /api/v1/companies — the `id` field of each item is its slug."
}
}The v1 API and registry MCP server are read-only and serve only public registry data, so they require no credentials of any kind. Owner-scoped access — your companies, documents, and report runs — goes through the manage MCP server at /api/manage/mcp, either with OAuth 2.1 (authorization code + PKCE, dynamic client registration) or a personal access token created at /manage/tokens, sent as Authorization: Bearer. The authentication guide has the details.
The API is versioned in the URL (/api/v1). Within v1, changes are additive only — new fields and endpoints may appear, but existing fields, parameters, and response shapes will not change or disappear. Breaking changes ship as a new version (/api/v2) with v1 kept running in parallel. If an endpoint is ever deprecated, its responses will carry Deprecation and Sunset headers at least 90 days before removal, and the change will be noted here and in the OpenAPI spec.
Found a gap in the docs or need an endpoint that isn’t here yet? Get in touch.