Kolaboro / Open data and API / MCP server

MCP server for AI agents

Give Claude, or any agent that speaks the Model Context Protocol, read-only access to every tracked off-plan project and market. No key, no sign-up. Every answer carries an Ed25519 signature, so an agent, or you, can prove the numbers came from us unchanged.

https://kolaboro.com/mcp

Transport: Streamable HTTP, JSON-RPC 2.0. Auth: none. Access: read-only, public data only. Limit: 60 requests a minute per IP.

Checking the server live from your browser…

Add it to your AI tool

Claude (web and desktop): Settings, Connectors, Add custom connector. Name it Kolaboro and paste https://kolaboro.com/mcp. Leave the OAuth fields empty: no sign-in is needed.
Claude Code: run this once in your terminal:

claude mcp add --transport http kolaboro https://kolaboro.com/mcp

Other clients: most MCP hosts (Cursor, Windsurf and others) take a JSON entry like this one in their MCP settings. Key names vary by client: VS Code, for example, uses "servers" instead of "mcpServers".

{ "mcpServers": { "kolaboro": { "type": "http", "url": "https://kolaboro.com/mcp" } } }

Your own code: the official SDKs connect directly.

# Python: pip install mcp import asyncio, json from mcp import Client async def main(): async with Client("https://kolaboro.com/mcp") as c: r = await c.call_tool("market_stats", {"market": "Bali"}) print(json.loads(r.content[0].text)["markets"]) asyncio.run(main())

// TypeScript: npm i @modelcontextprotocol/sdk import { Client } from "@modelcontextprotocol/sdk/client/index.js"; import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"; const c = new Client({ name: "my-agent", version: "1.0.0" }); await c.connect(new StreamableHTTPClientTransport(new URL("https://kolaboro.com/mcp"))); console.log(await c.callTool({ name: "get_project", arguments: { id: "BALI-014" } }));

Or explore it in the official inspector: npx @modelcontextprotocol/inspector, transport Streamable HTTP, URL above.

Tools

Tool	What it returns
`search_projects`	Projects filtered by market, country, stage, minimum checks public or confirmed, all six public, flagged or not. Same records as /api/open/projects. Up to 100 per call, with offset.
`get_project`	One project by id: the six checks, how each was confirmed, developer claims tested, public problems, questions to ask before paying. With `as_of`, the project as published on a past day.
`market_stats`	Per market: projects, average checks public and confirmed, share with a public permit, share with deposit protection, transparency index.
`database_stats`	Totals: projects, markets, countries, claims tested by result, verification levels, overdue and delayed projects.
`public_log`	The signed checkpoint of the public log and its latest daily heads.
`dataset_files`	The daily Parquet files of the whole database, with SHA-256 re-checked by the server. Same files as SQL in your browser.
`verify_signature`	Checks that a body was signed by a published Kolaboro key.

Signed answers

Each tool result has two text blocks. The first is the exact body, byte for byte the same as the open API answer it came from. The second holds the signature: an Ed25519 signature over kolaboro-sig-v1, a newline and the SHA-256 hex of that body, the key id, and the SHA-256 of the dataset file it was computed from. The public keys, their validity dates and our rotation policy are at /.well-known/kolaboro-keys.json. Check it with the verify_signature tool, with kolaboro-verify.js, or with any Ed25519 library. A signature proves the answer is ours and unchanged. It does not prove a developer's documents are genuine: that is what the verification levels in the data describe.

curl -s https://kolaboro.com/mcp \ -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \ -H 'mcp-protocol-version: 2025-11-25' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_project","arguments":{"id":"BALI-014"}}}'

Protocol details

Protocol versions 2026-07-28 (stateless: version, client info and capabilities in each request's _meta, server/discover, Mcp-Method and Mcp-Name headers checked against the body) and 2025-11-25, 2025-06-18, 2025-03-26 (with initialize). Tested with the official TypeScript SDK, the Python SDK in both modes, and the MCP inspector.
No sessions and no server-sent streams: every answer is one JSON object. GET on the endpoint answers 405.
Any browser origin may call it (CORS *): it is public, read-only and uses no cookies or credentials.
The rate limit is counted per IP and per minute in Cloudflare's edge cache. It is a ceiling, not an exact counter: requests landing in different data centres are counted separately.

What the data is, and is not

Projects are anonymous (ids like BALI-014) until verification is complete and the developer has had time to reply, so the server never returns a developer or project name. Scores say how much each project makes public and how much of it we could confirm in a registry or an independent source. Advertised yields are what developers advertise. Nothing here is financial or legal advice. Licence CC BY 4.0, credit Kolaboro.

Also: Open data API · SQL in your browser · Verify evidence · Engineering