openhammer-apiSAFE
Comprehensive Warhammer 40K API with 2,748 units across 35 factions and 2 game editions (10th and 11th). Built with FastAPI, featuring 29 endpoints. Also available as a live MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
REST API for Warhammer 40,000 unit data — also available as an MCP server, so Claude (or any MCP client) can query it directly instead of you making manual HTTP calls. Edition-namespaced — currently serving 10th Edition (1,380 units across 35 factions) and 11th Edition (1,368 units across 35 factions).
Live API: https://openhammer-api-production.up.railway.app
Interactive Docs: https://openhammer-api-production.up.railway.app/docs
Live MCP Server: https://openhammer-mcp-production.up.railway.app/mcp
Table of Contents
- Usage
- Quick Start (Local)
- Testing
- MCP Server
- API Overview
- Data Coverage
- API Endpoints
- JSON Structure
Usage
All endpoints are namespaced by edition: /v1/{edition}/resource. The root endpoint lists all available editions.
The API is live at https://openhammer-api-production.up.railway.app
Python
import requests
BASE = 'https://openhammer-api-production.up.railway.app'
edition = '10e'
# Get all factions
factions = requests.get(f'{BASE}/v1/{edition}/factions').json()
# Search for Space Marine units
units = requests.get(f'{BASE}/v1/{edition}/units?name=Marine&limit=10').json()
# Get a random unit
random_unit = requests.get(f'{BASE}/v1/{edition}/units/random').json()JavaScript
const BASE = 'https://openhammer-api-production.up.railway.app';
const edition = '10e';
// Get API statistics
const stats = await fetch(`${BASE}/v1/${edition}/stats`).then(r => r.json());
// Search Necrons units
const units = await fetch(`${BASE}/v1/${edition}/units?faction=Necrons`).then(r => r.json());curl
BASE="https://openhammer-api-production.up.railway.app" EDITION="10e" # Get all factions curl "$BASE/v1/$EDITION/factions" # Search for Terminator units curl "$BASE/v1/$EDITION/units?name=Terminator" # Get faction de
46b05bbb7163OBSERVED · 2026-10-10Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
compare_units | read | Fetch multiple units by ID for side-by-side comparison. Unknown |
faction_details | read | Get a faction |
get_unit | read | Get a single unit |
list_editions | read | List available Warhammer 40K rules editions (e.g. |
list_factions | read | List factions for an edition, optionally filtered by faction_type |
random_unit | read | Get a random unit, optionally restricted to a faction_type |
search_abilities_or_rules | read | Search unit abilities or special rules by (partial, case-insensitive) |
search_units | read | Search/filter units. name is a partial, case-insensitive match; |
search_weapons | read | Search for a weapon by (partial, case-insensitive) name and find |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
streamable-http
pytest, httpx
requests, lxml
Gates applied: no_behavioural_pass.
46b05bbb7163full audit observations/trust-audit/mcp-server/eshanprakash__openhammer-api.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 46b05bbb7163 | SAFE | B | 89 | first audit |
Questions
What is the openhammer-api MCP server?
Comprehensive Warhammer 40K API with 2,748 units across 35 factions and 2 game editions (10th and 11th). Built with FastAPI, featuring 29 endpoints. Also available as a live MCP server.
What tools does openhammer-api expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is openhammer-api safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does openhammer-api need?
No credential environment variables were found in its source, so it appears to need none.
How does openhammer-api run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (46b05bbb7163), read on 2026-10-10. The repository is watched and re-audited when it changes.