REST API
A public REST API for RuleFix is on the roadmap but not available yet. Until it ships, use the MCP server — from an AI agent or from your own code.
Status
Planned — not available yet
RuleFix does not have a public REST API today. There is no live REST base URL, and no REST endpoints, SDKs or webhooks you can call. This page will document the API when it ships; until then, nothing here is a contract.
What to use today
Most of what the REST API is meant to cover is already possible through the MCP server or the dashboard:
| You want to… | Use today |
|---|---|
| Scan files from a script or pipeline | rulefix_scan_files over MCP (stateless, nothing stored) |
| Record a scan in a project | rulefix_report_scan, or Scan now for imported repositories |
| List a project's open issues | rulefix_get_issues |
| Get a fix for a finding | rulefix_suggest_fix, then rulefix_verify_fix |
| Export evidence | The JSON download in Reports (signed-in users) |
| Read the rule catalogue | rulefix_list_rules or the rules reference |
- Use today
- rulefix_scan_files over MCP (stateless, nothing stored)
- Use today
- rulefix_report_scan, or Scan now for imported repositories
- Use today
- rulefix_get_issues
- Use today
- rulefix_suggest_fix, then rulefix_verify_fix
- Use today
- The JSON download in Reports (signed-in users)
- Use today
- rulefix_list_rules or the rules reference
Calling RuleFix from your own code
MCP is JSON-RPC over HTTPS, so you don't need an AI agent to use it. Any MCP client library can call the tools directly with an API key. With the official TypeScript SDK (@modelcontextprotocol/sdk):
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
import { readFile } from "node:fs/promises";
const transport = new StreamableHTTPClientTransport(new URL("https://rulefix.in/mcp"), {
requestInit: { headers: { Authorization: `Bearer ${process.env.RULEFIX_API_KEY}` } },
});
const client = new Client({ name: "my-compliance-script", version: "1.0.0" });
await client.connect(transport);
const result = await client.callTool({
name: "rulefix_scan_files",
arguments: { files: [{ path: "src/signup.ts", content: await readFile("src/signup.ts", "utf8") }] },
});
console.log(result.structuredContent); // { summary, score, findings, skipped, ... }
await client.close();The same limits and errors apply as for agents. Keep the key in an environment variable or your CI secret store.
What's planned
The REST API is intended to cover, with API-key auth and JSON:
- starting repository scans and reading their status and results;
- listing and filtering issues, and changing their status;
- exporting evidence reports;
- webhooks when a scan finishes.
Scope and shape may change before release. If you need one of these, tell us what you're building — it shapes what ships first. Planned items are also tracked under Not available yet.