AQUA Application Hub Developers

AQUA developer portal

An application infrastructure API lets developers programmatically access reusable application answers, opportunity fit scoring, and application graph data. The AQUA Application Hub REST API exposes these capabilities with typed operations, a local MCP server with 27 tools for agent environments, and an Appfeeder browser extension for capturing answers from program websites. All REST routes require a Supabase session cookie or Bearer JWT.

Quickstart

AQUA is an authenticated product — there is no unauthenticated public API. Sign in at /login to get a session cookie, or retrieve a Bearer JWT from GET /api/auth/token for extension or agent use. Start with the OpenAPI document for typed operations and error models.

# Get your auth token (requires active session)
curl https://mos2es.xyz/api/auth/token

# Match a question against your answer bank
curl -X POST https://mos2es.xyz/api/match-question \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <JWT>" \
  -d '{"text": "Tell us what you have built", "limit": 5}'

# Read the OpenAPI spec
curl https://mos2es.xyz/openapi.json | jq .info

OpenAPI specification

The full OpenAPI 3.0.3 document is published at /openapi.json. It documents 10 operations across matching, applications, answers, hub, review, drafting, and auth. Every operation has a unique operationId, typed request/response schemas, and ProblemDetails error models (RFC 9457).

  • matchQuestion — match a question against the user answer bank
  • intakeApplication — ingest raw application text and extract questions
  • captureAnswer — capture an answer from a form field (extension)
  • smartMatcher — compute fit scores for a target program
  • checkAutofillEligibility — check auto-fill eligibility thresholds
  • stressTestAnswer — run a reviewer-persona stress test
  • generateDraft — generate a draft answer via BYOK or platform LLM

Authentication

AQUA uses Supabase Auth. Two credential types are accepted:

Session cookie (browser)

After login at /login, Supabase sets an sb-access-token cookie. The web app and browser extension use this automatically.

Bearer JWT (extension/agent)

Send Authorization: Bearer <JWT> with API requests. Get the JWT from GET /api/auth/token while logged in.

MCP server

The AQUA MCP server exposes 27 tools across programs, questions, rankings, intelligence, and user-authenticated operations. It runs locally via stdio (Claude Desktop, Cursor, Windsurf) or self-hosted via Streamable HTTP transport. There is no public hosted MCP endpoint at mos2es.xyz — the server runs in the user agent environment and connects to the user Supabase session.

The MCP manifest is published at /.well-known/mcp. Source code is in the repository under application-hub-mcp-server/.

# Install via npm (published)
npm install -g application-hub-mcp-server

# Or run directly without installing
npx -y application-hub-mcp-server

# Or clone and build from source
git clone https://github.com/SunrisesIllNeverSee/application-hub
cd application-hub/application-hub-mcp-server
npm install && npm run build
node dist/index.js

# Run via Streamable HTTP (self-hosted)
TRANSPORT=http PORT=3000 node dist/index.js

Public tools (11)

Program search, detail, rankings, heat scores, questions, similar questions, universal questions, program DNA, question significance, acceptance stats. No auth required.

Authenticated tools (16)

Profile answers, application readiness, fit score, find best programs, rank answers, log draft runs, save answers, review context, stress test, intake, fill, borrow threshold, answer bank search. Requires Supabase JWT.

Appfeeder browser extension

The Appfeeder Chrome extension captures answers directly from application form fields. It uses the /api/answers/capture and /api/match-question endpoints with a Bearer JWT. Source is in the repository under appfeeder/.

Error handling

All API error responses use a ProblemDetails shape (RFC 9457) with machine-readable error codes, human-readable title and detail, and a resolution hint suggesting the next step.

{
  "error": "Unauthorized",
  "title": "Authentication required",
  "status": 401,
  "detail": "A valid Supabase session cookie or Bearer JWT is required.",
  "resolution": "Sign in at /login or include Authorization: Bearer <JWT>"
}

Agent integration

For agent guidance including when-to-use, how-to-use, limitations, and Markdown content negotiation, see llms.txt. For Contribution Exchange behavior, see the agent guide. The MCP manifest at /.well-known/mcp describes the tool surface in machine-readable form.

Repository

Full source code is available at github.com/SunrisesIllNeverSee/application-hub. The MCP server is in application-hub-mcp-server/, the Next.js app is in app/, and the Appfeeder extension is in appfeeder/.

OpenAPI specMCP manifestAgent guidance (llms.txt)About AQUAContact