API & Security

JWT-protected REST on central (/api/*). The React SPA proxies same-origin. Optional MCP stdio tools call the same API.

Guide	Content
Authentication	Login, roles, agent tokens
Routes	REST route map
Security reporting	Private vulnerability reporting + posture

Discover agent tools: GET /api/agent/tools (Bearer JWT).

---

Table of contents

• Authentication
• Routes
• Security