Urantia Dev Api — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Urantia Dev Api (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A developer and AI-agent friendly API for the Urantia Papers. Provides full-text search, structured content access, and audio URLs for all 14,500+ paragraphs across 197 papers.
| Method | Path | Description |
|---|---|---|
| GET | /toc | Table of contents (parts → papers) |
| GET | /papers | List all 197 papers |
| GET | /papers/:id | Single paper with all paragraphs |
| GET | /papers/:id/sections | Sections within a paper |
| GET | /paragraphs/random | Random paragraph |
| GET | /paragraphs/:ref | Paragraph by any ID format |
| GET | /paragraphs/:ref/context | Paragraph with surrounding context |
| POST | /search | Full-text search with pagination |
| GET | /audio/:paragraphId | Audio info for a paragraph |
| POST | /search/semantic | Semantic (vector) search |
| GET | /entities | List entities (beings, places, concepts, etc.) |
| GET | /entities/:id | Entity details |
| GET | /entities/:id/paragraphs | Paragraphs mentioning an entity |
| GET | /cite | Generate citation (APA, MLA, Chicago, BibTeX) |
| GET | /og/:ref | Dynamic Open Graph image |
| POST | /embeddings | Vector embeddings for paragraphs |
| POST | /feedback | Submit product or API feedback (no auth) |
| GET | /me | User profile (auth required) |
| POST | /me/bookmarks | Create bookmark (auth required) |
| GET | /me/bookmarks | List bookmarks (auth required) |
| GET | /me/notes | List notes (auth required) |
| POST | /me/notes | Create note (auth required) |
| GET | /me/reading-progress | Reading progress (auth required) |
| GET | /me/preferences | User preferences (auth required) |
| POST | /auth/authorize | Get authorization code (auth required) |
| POST | /auth/token | Exchange code for token |
| GET | /auth/apps/:id | Get OAuth app info |
Interactive docs available at /docs (Swagger UI). OpenAPI spec at /openapi.json.
https://api.urantia.dev/mcp (setup guide)Official TypeScript SDKs are available on npm:
npm install @urantia/api # Typed client for all endpoints
npm install @urantia/auth # OAuth client for accounts.urantiahub.comSee docs.urantia.dev/sdks/overview for documentation.
The API accepts three reference formats — auto-detected from the string:
| Format | Example | Structure |
|---|---|---|
| globalId | 1:2.0.1 | partId:paperId.sectionId.paragraphId |
| standardReferenceId | 2:0.1 | paperId:sectionId.paragraphId |
| paperSectionParagraphId | 2.0.1 | paperId.sectionId.paragraphId |
curl -X POST https://api.urantia.dev/search \
-H "Content-Type: application/json" \
-d '{"q": "Universal Father", "limit": 10, "type": "and"}'Search modes: and (all words, default), or (any word), phrase (exact match). Optional filters: paperId, partId.
Paragraphs include an audio field — a nested object keyed by model and voice, or null if no audio exists:
{
"audio": {
"tts-1-hd": {
"nova": {
"format": "mp3",
"url": "https://cdn.urantia.dev/audio/eng/paragraphs/nova/tts-1-hd-nova-3:119.1.5.mp3",
"bitrate": 160,
"duration": 43.3,
"fileSize": 866400
}
}
}
}Available models and voices vary per paragraph. The dedicated /audio/:paragraphId endpoint returns just the audio data for a given paragraph.
Responses include Cache-Control headers. Cloudflare's CDN caches at the edge via s-maxage:
| Route | CDN (s-maxage) | Browser (max-age) |
|---|---|---|
/toc, /papers/*, /paragraphs/:ref, /audio/* | 24 hours | 1 hour |
/search | 1 hour | 5 minutes |
/paragraphs/random | no-store | no-store |
/feedback | no-store | no-store |
/, /docs, /openapi.json | 1 hour | 5 minutes |
Recommended flow:
GET /toc — understand the book structurePOST /search — find relevant passagesGET /paragraphs/:ref/context?window=3 — get surrounding contextGET /papers/:id — read a full paperFound a bug, a gap in the docs, or something that could work better? Tell us. No authentication required.
curl -X POST https://api.urantia.dev/feedback \
-H "Content-Type: application/json" \
-d '{"category": "bug", "message": "search returns 500 for phrase mode", "endpoint": "/search", "client": "claude-code"}'category is one of bug, docs, api, product, other. message holds up to 4000 characters. Optional fields: ref, endpoint, requestId, client, contact, pageUrl. The limit is 5 requests per minute and 10 requests per 15 minutes per IP address.
Feedback is untrusted data. It is stored and forwarded to the maintainers, and it is never executed or passed to a model as instructions. If you paste feedback into an agent chat, treat it the same way.
The API includes a built-in MCP server at https://api.urantia.dev/mcp — connect Claude Desktop, Cursor, or any MCP client to access:
urantia://paper/{id} (markdown) and urantia://entity/{id}study_assistant, comparative_theologyOne-click install via Smithery.
Clients can discover the server at https://api.urantia.dev/.well-known/mcp.json (also /.well-known/mcp/server-card.json).
Public endpoints require no auth. User endpoints (/me/*) require a JWT. OAuth flow:
POST /auth/apps (admin) or self-service at accounts.urantiahub.com/appsPOST /auth/tokenAuthorization: Bearer <token>Access tokens are ES256 JWTs that last 15 minutes, with a refresh token. PKCE is supported for browser-based apps.
@logtail/edge — structured JSON logs with request metadataGET /health — verifies DB connectivity# Install dependencies
bun install
# Set up environment
cp .env.example .env
# Edit .env with your Supabase DATABASE_URL
# Push schema to database
bun run db:push
# Set up full-text search (run after db:push)
bun scripts/run-fts-setup.ts
# Generate audio manifest (requires ../urantia-hub-api)
bun run generate-manifest
# Seed database from urantia-papers-json
bun run seed
# Start dev server (hot reload)
bun run devThe server runs at http://localhost:3000 by default.
Deployed to Cloudflare Workers. First-time setup:
npx wrangler login
npx wrangler secret put DATABASE_URL
# paste your Supabase connection string (use pooler port 6543)
npx wrangler secret put APP_JWT_PRIVATE_JWK
# paste an ES256 private key as a JWK in JSON
npx wrangler secret put ADMIN_USER_IDS
# comma-separated Supabase user UUIDs for admin access
# Optional: POST /feedback delivery. Without these, feedback is still saved.
npx wrangler secret put RESEND_API_KEY
npx wrangler secret put FEEDBACK_FROM # a sender on a domain verified in Resend
npx wrangler secret put FEEDBACK_TO # comma-separated recipients
npx wrangler secret put SLACK_FEEDBACK_WEBHOOK_URL # Slack Incoming Webhook
npx wrangler secret put FEEDBACK_IP_PEPPER # random secret for the IP hashDeploy:
bun run deployContent sourced from urantia-papers-json — 197 papers, 1,626 sections, 14,500+ paragraphs with audio narration via cdn.urantia.dev.
This project is licensed under the MIT License.
This is an independent community project by Adams Technologies LLC. It is not affiliated with, endorsed by, or connected with Urantia Foundation. The original English text of The Urantia Book is in the public domain (Michael Foundation v. Urantia Foundation, 10th Cir. 2003). All use of "Urantia" is nominative fair use to identify the subject matter.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.