Public API

Everything from zeromcp import ... exposes — what each name is and where to read more.

Resources

Name	Kind	Use it for
`BaseResource`	class	Base class for every CRUD resource. See BaseResource.

Routing

Name	Kind	Use it for
`get_routes(endpoints, **kwargs)`	function	Build the URL patterns for your resources. Pass `docs_public`, `title`, `version`, `description`. See Quickstart.

Middlewares

Name	Kind	Use it for
`SecurityMiddleware`	class	Block scanners, bad UAs, 4xx-flooders. See Middlewares.
`AuthMiddleware`	class	Resolve session cookie and expose `request.user/account/session`.
`ExceptionMiddleware`	class	Render `HTTPException` as JSON.

Anti-replay token (HMAC-SHA256)

Name	Kind	Use it for
`make_token(session_token, nonce, timestamp_ms=None)`	function	Mint an `X-Token` value. Returns `<ts>.<nonce>.<hmac>`.
`validate_token(token, session_token, max_drift_ms=None)`	function	Verify an `X-Token` value (format, drift, HMAC). Raises `HTTPException(403)` on any failure. Returns `(nonce, timestamp_ms)` for callers that want to consume the nonce themselves. `max_drift_ms=None` resolves to `MCP['TOKEN_MAX_DRIFT_MS']` (default 30000ms).
`validate_token_async(token, session_token, max_drift_ms=None)`	async function	Same as `validate_token` plus replay protection: reserves the nonce in Redis with `SET NX PX` for `2 * max_drift_ms`. Reused nonces inside the window raise `HTTPException(403)`. This is what `BaseResource._enforce_token` uses.

Exceptions

Name	Kind	Use it for
`HTTPException(status, detail)`	class	Raise from anywhere to return a JSON error response. See HTTPException.

Multi-tenant

Name	Kind	Use it for
`aset_tenant(account_id)`	async function	Switch the active DB connection. See Multi-tenant.
`set_tenant(account_id)`	sync function	Sync wrapper — Celery, management commands, signals.
`get_tenant()`	function	Returns the current tenant id from `db_state`, or `None`.
`set_default(account_id)`	async function — script-only	Replaces the global `default` connection with the tenant's connection. Not safe inside ASGI request handling (mutates process-wide state). Import directly from `zeromcp.tenant.tenant`; not re-exported from `0-mcp`. Use `aset_tenant` for per-request switching.
`unset_default(account_id)`	async function — script-only	Restores the original `DEFAULT_DATABASE`. Same caveats as `set_default`.
`get_account(domain)`	async function	Resolve an account by its domain.
`get_master_user(email, password)`	async function	Look up a user on the master DB by credentials. Used by `/login` flows.
`db_state`	ContextVar	Holds the active connection name. Read it directly when you need to know the current tenant DB.
`DBRouter`	class	Database router. Add to `DATABASE_ROUTERS` in settings.

Filters

Name	Kind	Use it for
`OrmFilter`	class	Build Django Q expressions from JSON filter trees. Used internally by resources; useful standalone for custom queries. Re-exported as `OrmFilter` (the underlying class is `zeromcp.filters.Filter`).

Schemas & OpenAPI

Name	Kind	Use it for
`openapi(summary, description, request, response, tags)`	decorator	Attach OpenAPI metadata to custom route handlers. See Custom routes.
`build_spec(endpoints, title, version, description)`	function	Generate an OpenAPI 3.0.3 spec dict. Useful for testing or exporting the spec to disk.

MCP

Available out of the box — MCP is bundled in the base install.

Name	Kind	Use it for
`MCPResource`	class	BaseResource subclass for the JSON-RPC endpoint. Inherit to customize. See MCP server.
`mcp_view(endpoints, **attrs)`	function	Convenience factory — returns a Django view for the given registry. Usage: `path('mcp/', mcp_view(endpoints))`.
`list_tools(endpoints)`	function	List of tool definitions (with internal metadata). For programmatic inspection.
`list_tools_public(endpoints)`	function	Same, without internal metadata — safe to expose.
`handle_rpc(message, tools, ctx)`	async function	Pure JSON-RPC dispatcher. Used by both HTTP and stdio transports.

Cache stats

Name	Kind	Use it for
`get_cache_stats()`	async function	Return `{hits, misses, total, ratio, by_model}`. See Cache.
`reset_cache_stats()`	async function	Zero out hit/miss counters in Redis.

Importing

Everything is importable from the top-level zeromcp package:

from zeromcp import (
    BaseResource,
    HTTPException,
    AuthMiddleware,
    ExceptionMiddleware,
    SecurityMiddleware,
    get_routes,
    DBRouter,
    aset_tenant,
    set_tenant,
    get_tenant,
    get_account,
    get_master_user,
    db_state,
    OrmFilter,
    openapi,
    build_spec,
    get_cache_stats,
    reset_cache_stats,
    make_token,
    validate_token,
    validate_token_async,
    validate_conditions,
    set_default,
    unset_default,
    MCPResource,            # if [mcp] extra installed
    mcp_view,
    list_tools,
    list_tools_public,
)

📦

Names that are not in this list (e.g. zeromcp.calc.get_results, zeromcp.helpers.*, zeromcp.client_ip.get_client_ip) are internal. They may still be useful, but they are not part of the public API and may change between releases.

0-mcp by Stamatios Stamou Jr — github.com/ssjunior/0-mcp