# API Reconnaissance Findings - Phase 2
## Date: 2026-10-12T21:27:00+03:00

### Endpoint Discovery Summary

| Endpoint | Status | Type | Notes |
|----------|--------|------|-------|
| `api.cumin.dev` | ✅ ACTIVE | REST + MCP | Token works, 49 MCP tools |
| `api.cumin.dev/health` | ✅ 200 OK | JSON | `{"status":"OK"}` |
| `api.cumin.dev/mcp` | ✅ 200 OK | MCP Protocol | Session initialized |
| `deploy.ghaymah.systems` | ✅ 200 OK | React SPA | Vite-built, client-side routing |
| `api.ghaymah.systems` | ❌ TIMEOUT | N/A | Port not open / unreachable |
| `api.ghaymah.systems/health` | ❌ TIMEOUT | N/A | Port not open |
| `api.ghaymah.systems/mcp` | ❌ TIMEOUT | N/A | Port not open |

### Critical Finding: Ghaymah uses Cumin API Backend
- The Ghaymah UI (`deploy.ghaymah.systems`) is a branded frontend
- The actual API backend is `api.cumin.dev` (shared platform)
- The Cumin token works for both platforms

### MCP Tools (49 total - up from ~12):
```json
["add_star","app_logs","constellation_logs","create_api_token","create_app",
"create_bucket","create_constellation","create_key","create_postgres","create_project",
"create_pull_secret","create_secret","create_volume","delete_api_token","delete_app",
"delete_bucket","delete_constellation","delete_key","delete_postgres","delete_project",
"delete_pull_secret","delete_secret","delete_star_files","delete_volume","exec_in_app",
"get_star_files","invoke_star","list_api_tokens","list_apps","list_buckets",
"list_constellations","list_keys","list_postgres","list_projects","list_pull_secrets",
"list_secrets","list_stars","list_volumes","patch_star_files","postgres_logs",
"remove_star","replace_star_files","update_app","update_bucket","update_constellation",
"update_postgres","update_project","update_pull_secret","update_secret"]
```

### Existing Deployed Apps:
- `soc-gateway` (ID: `0db0f9b0-f452-4d9a-9379-c5dd9e209df3`) - running
- `soc-backend` (ID: `d1309ed4-9442-4623-adde-0419c99c8d70`) - running