Reference

Capabilities

Each row comes from the capability’s capa.manifest.json, so this table matches the code.

Capability	Entrypoint	Operations	Namespaces	Auth	Body
github	GithubCapability	1,230	36	Bearer	JSON
kubernetes	KubernetesCapability	1,190	6	Bearer	JSON
gitlab	GitlabCapability	1,072	50	Private-Token	JSON
jira	JiraCapability	602	76	Basic	JSON
stripe	StripeCapability	559	75	Bearer	Form
box	BoxCapability	295	56	Bearer	JSON
discord	DiscordCapability	246	17	Bearer	JSON
sentry	SentryCapability	245	6	Bearer	JSON
twilio	TwilioCapability	197	2	Basic	Form
slack	SlackCapability	174	174	Bearer	Form
zoom	ZoomCapability	155	14	Bearer	JSON
twitch	TwitchCapability	149	30	Bearer	JSON
blooio	BlooioCapability	58	9	Bearer	JSON
twilio-messaging	TwilioMessagingCapability	58	5	Basic	Form
twilio-verify	TwilioVerifyCapability	57	5	Basic	Form
htmlcsstoimage	HtmlcsstoimageCapability	38	9	Basic	JSON

Secrets

Set these on the capability Worker. Your own Worker needs none of them. When a capability runs behind capa-gateway, each user’s key comes from their vault instead.

Capability	Required	Optional
github	GITHUB_API_KEY	None
kubernetes	KUBERNETES_API_KEY	None
gitlab	GITLAB_API_KEY	GITLAB_BASE_URL_OVERRIDE, CF_ACCESS_CLIENT_ID, CF_ACCESS_CLIENT_SECRET
jira	JIRA_API_KEY	JIRA_BASE_URL_OVERRIDE
stripe	STRIPE_API_KEY	None
box	BOX_API_KEY	None
discord	DISCORD_API_KEY	None
sentry	SENTRY_API_KEY	None
twilio	TWILIO_API_KEY	None
slack	SLACK_API_KEY	None
zoom	ZOOM_API_KEY	None
twitch	TWITCH_API_KEY, TWITCH_CLIENT_ID	None
blooio	BLOOIO_API_KEY	None
twilio-messaging	TWILIO_MESSAGING_API_KEY	None
twilio-verify	TWILIO_VERIFY_API_KEY	None
htmlcsstoimage	HTMLCSSTOIMAGE_API_KEY	HTMLCSSTOIMAGE_USER_ID

JIRA_API_KEY uses the format email:token. To pass a key for one call only, use options.auth. See Runtime auth.

Method shape

Every method returns the same shape:

{ result: T | null; evidence: EvidenceBundle }

result is null when evidence.verdict is "fail".

Path parameters come first, then the request body, then options:

await env.STRIPE.paymentIntents.retrieve("pi_123", undefined, { auth: { apiKey } });
await env.GITHUB.repos.retrieve("cloudflare", "workers-sdk");
await env.HTMLCSSTOIMAGE.image.renderFormat(id, "png", { query: { width: 1200 } });

Option	Type	What it does
auth.apiKey	string	Uses this key for one call instead of the Worker secret.
auth.username, auth.password	string	Basic auth for one call.
auth.headers	Record<string, string>	Extra headers for one call.
query	object	Query string parameters. Arrays repeat the key.

Evidence record

type EvidenceBundle = {
  capability: string;
  operationId: string;
  namespace: string;
  method: string;
  http: string;
  path: string;
  risk: "low" | "medium" | "high";
  startedAt: string;
  durationMs: number;
  act: { request: { method: string; url: string }; status: number };
  assert: Array<{ kind: string; expected: unknown; actual: unknown; passed: boolean }>;
  verdict: "pass" | "fail";
};

Field	Meaning
operationId	The operation ID from the OpenAPI spec.
path	The request path with parameters filled in.
risk	low for list, retrieve, and search methods. high for money-moving namespaces such as charges and refunds. medium for everything else.
act	The method, the URL, and the HTTP status. Request headers and keys are not recorded.
assert	Every check that ran. The HTTP status check always runs. Overrides add more.
verdict	"pass" when every check passed.

Codegen CLI

cd tools/codegen
bun src/cli.ts \
  --spec <url-or-path> \
  --out ../../capabilities/<name> \
  --name <name> \
  --base-url <upstream-base-url>

Flag	Required	Default	Values
--spec	Yes		URL or path to an OpenAPI 3 or Swagger 2 spec
--out	Yes		Output directory
--name	Yes		Capability name, for example stripe
--base-url	Yes		Upstream base URL
--prefix	No	/v1	Path prefix to strip when building method names
--auth	No	bearer	bearer, private-token, basic
--content-type	No	form	form, json
--naming	No	path	path, operationId

--naming operationId names methods after the spec’s operation IDs instead of the URL path. Use it when path names are unclear.

Example

bun src/cli.ts \
  --spec https://raw.githubusercontent.com/stripe/openapi/master/openapi/spec3.sdk.json \
  --out ../../capabilities/stripe --name stripe \
  --base-url https://api.stripe.com --prefix /v1 \
  --auth bearer --content-type form

To add a capability to the catalog, see CONTRIBUTING.md.

Repo layout

Path	What it holds
tools/codegen/	The OpenAPI to capability generator
capabilities/<name>/src/generated/	Generated code. Do not edit.
capabilities/<name>/src/overrides.ts	Extra checks for single methods
capabilities/<name>/src/index.ts	The Worker entry
gateway/	The MCP gateway for agents
docs/	This site