Sahul

Developer notes

Short, and honest about what is finished. One thing works today; the rest is designed and building.

Available now — the catalogue, as static JSON

The catalogue is served as plain JSON from the CDN. No key, no account, no rate limit, and it sends Access-Control-Allow-Origin: *, so you can fetch it from a browser as well as a server.

⚠️ These are unversioned build artefacts. The shape can change when the catalogue is rebuilt. A versioned path is planned for anyone who needs to pin one — until then, do not build something fragile on top of them without saying hello first.

Much of the underlying data belongs to publishers and to community projects who gave permission for this use, not for redistribution. Using it to build something is welcome; re-hosting the lot is not. Ask — the answer is usually yes.

Being built — a read-write API

/v1/*, bearer-token authenticated, versioned, for your own account's data: collection, lists, logged games, photos. Scoped tokens, so a script that reads your collection cannot empty it.

Being built — MCP

A remote MCP server, so an AI assistant can work with your collection directly — read and write, behind scopes you grant and can revoke. Some things will never be reachable by any token, whatever permissions you hold: deleting an account, granting permissions to others, changing how you sign in, or transferring ownership of anything.

Not supported: browser clients for the authenticated API

The authenticated API is for servers, native apps and MCP clients— not for JavaScript running in someone else's web page. No CORS headers are sent on it, so browsers block cross-origin requests, and that is deliberate rather than an oversight.

The reason is narrow and worth stating: enabling CORS on an origin that also serves cookie-authenticated endpoints is a good way to hand every site on the internet the ability to act as your logged-in users. Keeping it off entirely is a guarantee rather than a configuration nobody revisits.

This does not apply to the catalogue JSON above, which is public data with no credentials attached and is fetchable from a browser today. If a genuine browser-client case turns up, get in touch — it is a decision, not a technical wall.

Get in touch

Building something? Say hello atprivacy@sahul.net — it is a one-person project and a conversation beats guessing.