Build with the snapWONDERS API

Hide, reveal, forensically analyse, and convert media over one REST API — call it directly, from an AI agent over MCP, or through an official SDK.

REST API MCP SDKs

1 Getting started — your first call

Everything is one REST API at https://snapwonders.com/api. Your very first call needs no key and no upload — just confirm the service is up:

# Health check — no key required. Returns {"status":"UP", ...} curl https://snapwonders.com/api/status

Then make your first authenticated call — creating a hide session. A working key returns an upload_uid; a 401 tells you exactly what to fix (see the next step):

curl -X POST https://snapwonders.com/api/session \ -H "X-Api-Key: sw_your_key_here" \ -H "Content-Type: application/json" \ -d '{"type":"hide"}'
Prefer to skip the raw HTTP? Jump to the SDKs — they wrap the whole flow (including file upload) into a single call.

2 Get your API key

Create a key on your account, then send it as the X-Api-Key header on every request. Keys start with sw_ — send the whole key.

  • Create an account, then click the activation link we email you. Keys created on an unverified account are rejected by the API — this is the most common reason a brand-new key returns 401.
  • Generate a key at snapwonders.com/profile/api-keys — free accounts work, no credit card.
  • Header on every authenticated call: X-Api-Key: sw_your_key_here
  • Health and the get-started/discovery calls need no key.

If a call returns 401, the error code tells you exactly what is wrong, so you are never guessing:

  • missing_api_key — no X-Api-Key header was sent.
  • malformed_api_key — a header is present but not a valid key shape.
  • invalid_api_key — a well-formed key that is not recognised, revoked, or expired.
  • account_not_verifiedyour key is fine. The account that owns it has not verified its email address. Click the activation link, then retry with the same key. Generating a new one will fail in exactly the same way.
  • account_inactive — your key is fine, but the account cannot use the API.

3 The APIs

Three products share one session → job → poll → download shape. Files upload over plain HTTP — one request per file — then you start a job and poll it to completion.

Steganography — hide & reveal

Conceal an encrypted file inside a cover image or video, and reveal it again with the passphrase. Lossless output.

Forensic analysis

Deep media inspection — manipulation, hidden content, faces, OCR text, watermarks, and C2PA provenance — graded per file.

Media conversion

Convert between image and video formats (AVIF, HEIC, JXL, WebP, PNG, MP4, MKV, …) with quality and resize controls.

Full reference

Every endpoint, parameter, and response is in the interactive Swagger UI, with the raw OpenAPI spec.

Two upload methods. Direct is one POST /api/upload per file — the file as the request body, plain headers, no protocol to implement. Use it for anything under the size limit. Resumable (TUS, /api/tus) is for large files, unreliable connections, and progress reporting — it is what this site and the mobile apps use. File bytes never travel inside an MCP tool call, so an agent orchestrates over MCP and sends the file with that one HTTP request. The SDKs pick the right method for you — see SDKs below.

4 MCP — for AI agents

The same capabilities are exposed as tools over the Model Context Protocol, so an AI agent (Claude, Cursor, VS Code Copilot, and others) can call them directly. Transport is Streamable HTTP, spec 2025-03-26.

  • Endpoint: https://snapwonders.com/mcp
  • Auth: the same X-Api-Key header (three discovery tools — status, vaultify_get_started, snapwonders_get_started — need no key).

For example, adding it to Claude Code is one line:

claude mcp add --transport http snapwonders https://snapwonders.com/mcp --header "X-Api-Key: sw_your_key_here"
That is just one client. Ready-to-paste config for Claude Desktop, Cursor, Windsurf, VS Code, and Gemini CLI — plus the full list of MCP tools — is in the MCP section of the Swagger UI. Note: MCP is clearnet-only — AI clients cannot reach the Tor or I2P addresses.

Working on files on your own machine

The endpoint above is a remote server, which means it cannot see your files — you upload them first, then point the agent at the session. If you would rather say "analyse ~/Downloads/photo.jpg" and have it just work, there is also a local MCP server: it runs on your own machine, so it can read the file, upload it, run the job and save the results back to disk in one step.

pip install snapwonders-mcp

It needs uv and an API key. For Claude Desktop, add this to your MCP configuration:

{ "mcpServers": { "snapwonders": { "command": "uvx", "args": ["snapwonders-mcp"], "env": { "SNAPWONDERS_API_KEY": "sw_your_key" } } } }

Four tools — analyse_file, hide_file, reveal_file and convert_file — each doing a whole task end to end. Source, full configuration and the security notes are in the GitHub repository.

The processing still happens on snapWONDERS servers — "local" means the server process runs on your machine so it can read your disk, not that analysis runs offline. The server acts only on paths supplied with each request and has no tool to list or search your filesystem, but it can read any file you can, so your MCP client's tool-approval prompt is the real gate.

5 SDKs

Official client libraries wrap the API — including picking the right upload method and handling resumable transfers — into one idiomatic call, so a whole hide job is a couple of lines, in Python, JavaScript/TypeScript, PHP, or Go.

PythonPython — snapwonders

# pip install snapwonders from snapwonders import Client client = Client(api_key="sw_...") job = client.stego.hide( ["secret.pdf", "cover.jpg"], password="Str0ng!Pass") for r in job.results(): r.download("out/")

View source on GitHub ↗

JavaScript / TypeScriptJavaScript / TypeScript — @snapwonders/sdk

// npm i @snapwonders/sdk import { Client } from "@snapwonders/sdk"; const client = new Client("sw_..."); const job = await client.stego.hide( ["secret.pdf", "cover.jpg"], { password: "Str0ng!Pass" });

View source on GitHub ↗

PHPPHP — snapwonders/sdk

// composer require snapwonders/sdk use SnapWonders\Client; $client = new Client("sw_..."); $job = $client->stego->hide( ["secret.pdf", "cover.jpg"], password: "Str0ng!Pass");

View source on GitHub ↗

GoGo — snapWONDERS-SDK-Go

// go get github.com/snapWONDERS/snapWONDERS-SDK-Go client := snapwonders.NewClient("sw_...") job, _ := client.Stego.Hide( []string{"secret.pdf", "cover.jpg"}, "Str0ng!Pass") for _, r := range must(job.Results()) { r.Download("out/") }

View source on GitHub ↗

All four SDKs are live. Python and JavaScript on PyPI and npm, PHP on Packagist, Go straight from GitHub with go get. All four are open source on GitHub — Python, JavaScript/TypeScript, PHP, and Go — install with pip install snapwonders, npm i @snapwonders/sdk, composer require snapwonders/sdk, or go get. Questions or early-access notes? Get in touch.

6 Other languages — generate a client

No SDK for your language yet? The API ships a full OpenAPI 3 spec, so you can generate a typed client for Ruby, Java, C#, Kotlin, Swift, Rust, and dozens more with OpenAPI Generator:

# Ruby (swap 'ruby' for java, csharp, kotlin, swift, rust, …) npx @openapitools/openapi-generator-cli generate \ -i https://snapwonders.com/api/openapi.json \ -g ruby -o ./snapwonders-ruby
A generated client covers the plain JSON endpoints. For file upload, point it at POST /api/upload — one request with the file as the body, which any HTTP client can already do. Only files above the size limit need the resumable TUS flow (POST /api/tus → chunked PATCH), which a generated client cannot express; that is why the official SDKs are hand-written. Both methods are documented in the Swagger UI, and you can port the uploader from any official SDK.

More questions? See the FAQ or contact us.

Share the ♥

Browsing Safely
Web SSL Web Browser over SSL
/
Tor
/
I2P

Same snapWONDERS services on all three networks. Read more

Get the App
Download on the
App Store
Get it on
Google Play
Join the waitlist →

Join the Movement

Get updates on new snapWONDERS features, privacy tools, and dark web access improvements — including Vaultify. Nothing else.

Follow the ♥

© 2026 snapWONDERS · All rights reserved.

ABN: 72 080 510 827

snapWONDERS snapWONDERS.com

Analyse & Expose your Digital Media

Forensic Analysis / Metadata Extraction / File Conversion : photos + images + videos

Brought to you by the team at:
goldenSoftwareENGINEERS®