Proxies & Raw-Data Passthroughs

These endpoints pass caller requests through to an upstream data source. They exist to:

1. Hide upstream API keys server-side
2. Work around CORS
3. Add caching + per-IP rate limiting
4. Normalize response shapes

<Warning> Most proxies are intended for **our own dashboard** and are lightly gated. They are not part of the public API contract and may change or be removed without notice. Prefer the domain RPC services (`/api/<domain>/v1/*`) for stable integrations. </Warning>

Raw-data passthroughs

Endpoint	Upstream	Purpose
GET /api/opensky	OpenSky Network	Live ADS-B state vectors. Used by the flights layer.
GET /api/polymarket	Polymarket gamma-api	Active event contracts.
GET /api/gpsjam	gpsjam.org	GPS interference hotspot reports.
GET /api/oref-alerts	OREF (Israel Home Front Command)	Tzeva Adom rocket alert mirror.
GET /api/supply-chain/hormuz-tracker	Internal AIS + registry	Real-time Hormuz transit dashboard data.

All proxies:

• Respect the origin CORS allowlist.
• Apply per-IP rate limits via api/_rate-limit.js or server/_shared/rate-limit.ts (600 req/min/IP default) where the handler opts in, with stricter per-route budgets declared in ENDPOINT_RATE_POLICIES — see Rate Limits. Rate limiting is per-route, not platform-wide: /api/polymarket opts in, while /api/opensky, /api/gpsjam and /api/oref-alerts are currently unmetered.
• Cache aggressively (s-maxage varies by upstream).

Content proxies

GET /api/rss-proxy?url=<allowed-feed>

Fetches an RSS/Atom feed and returns the parsed JSON. The URL must match one of the patterns in _rss-allowed-domains.js — arbitrary URLs are refused to prevent SSRF.

Skills registry

POST /api/skills/fetch-agentskills

Fetches a single agentskills.io skill definition — pass either url or id in the JSON body — and returns its name, description, and instructions, truncated to 2,000 characters. Only the three agentskills.io hosts are accepted and redirects are refused, so the route cannot be used to reach an arbitrary host. Used by the settings skill importer. Limited to 30 req/min/IP; a successful lookup is cached in Redis for one hour.

Legacy / internal

POST /api/fwdstart

Forward-starting scenario helper used by the desktop app during first-run. Internal.

GET /api/mcp-proxy

Legacy MCP shim — forwards to the current MCP route. Deprecated; use /api/mcp directly.