List capabilities

GET/api/capabilities

Lists everything homebutler can do, with its risk class (read, write or destructive), what it can be pointed at, and the route that reaches it. A capability with no method and path has no route: absent says why.

Authorizations

Authorizationstringheader

The token you start the server with: homebutler serve --token <token>, or web.token in the config file. Send it as Authorization: Bearer <token>. When the server has a token, every /api/ route except the CORS preflight requires it, reads included.

Response

200 · application/json

The capabilities, sorted by name. The example is shortened.

namestringrequired

The capability name, the same as the MCP tool name.

descriptionstringrequired

What it does.

riskstringrequired

What a call can cost.

Available options: readwritedestructive

targetsstring[]required

What it can be pointed at.

methodstring

The HTTP method of its route.

pathstring

The path of its route.

absentstring

Why it has no route. Present only when method and path are absent.

cURLcURLPythonJavaScript

curl --request GET \
  --url 'http://localhost:8080/api/capabilities' \
  --header 'Authorization: Bearer <token>'

[
  {
    "name": "alerts",
    "description": "Check resource alerts for CPU, memory, and disk usage against configured thresholds. It reads and compares; nothing is sent anywhere and nothing is recorded, which is what a running watcher does instead",
    "risk": "read",
    "targets": [
      "local",
      "server"
    ],
    "method": "GET",
    "path": "/api/alerts"
  },
  {
    "name": "alerts_history",
    "description": "Show recorded alert and remediation history. Entries are only written while a watcher is running, so an empty list means nothing was recording rather than nothing went wrong",
    "risk": "read",
    "targets": [
      "local",
      "server"
    ],
    "absent": "no view built for it yet"
  },
  {
    "name": "backup_create",
    "description": "Create a Docker compose backup archive for all services or one service. Volumes are read while the containers run, so a database mid-write can land inconsistent; an archive is not evidence it restores, which is what backup_drill answers",
    "risk": "write",
    "targets": [
      "local",
      "server"
    ],
    "method": "POST",
    "path": "/api/backup"
  }
]