Keelcroft · Garage documentation
Garage
Connects a user's car to Meta Muse through Smartcar (46 brands in the United States). Read-only at launch; proactive alerts from live vehicle data.
Endpoints
| Purpose | URL |
|---|---|
| MCP (Streamable HTTP, JSON-RPC) | https://garage.keelcroft.com/mcp |
| REST alternative | https://garage.keelcroft.com/v1/… — described by openapi.json |
| Authorization-server metadata | /.well-known/oauth-authorization-server |
| Protected-resource metadata | /.well-known/oauth-protected-resource |
| Dynamic client registration | https://garage.keelcroft.com/oauth/register |
| Connector manifest | /.well-known/muse-connector.json |
| Health | /health |
Authentication
OAuth 2.1 authorization code with PKCE (S256). Clients register dynamically or present a Client-ID Metadata Document. Access tokens are bearer tokens valid for one hour; refresh tokens rotate on use. Scopes: vehicle:read, alerts:read, vehicle:control (commands; not granted at launch). API keys (Authorization: Bearer gk_…) are available from the account page for scripts and for adding Garage to Muse as a custom connector before the directory listing is live.
The authorization flow shows a consent page, then Smartcar Connect where the user signs in with their car maker account and approves permissions. Garage never sees car-maker credentials. If the user has no active subscription, a checkout hosted by Dodo Payments (merchant of record) runs before the tokens are issued.
Tools
| Tool | Approval | Description |
|---|---|---|
list_vehicles | no | Vehicles on the account with ids, names, make/model/year, powertrain. |
get_vehicle_state | no | Battery or fuel level, range (km), charging status, odometer (km), lock state, tire pressures (kPa), oil life, last known location. Cached by default; refresh=true polls the car. |
get_recent_alerts | no | Alerts derived from live data since an ISO-8601 timestamp: low battery, charging complete or interrupted, low fuel, oil change due, low tire pressure, service interval, safety recall. |
check_recalls | no | Open NHTSA safety recalls for the vehicle's make, model and year. |
set_alert_preferences | no | Thresholds for the alerts above. |
lock_vehicle, unlock_vehicle, start_charging, stop_charging, set_charge_limit | yes | Disabled at launch. Each is marked requires_user_approval in the manifest. |
Distances are kilometres and pressures kPa in tool output; the agent converts to the user's units. Tool results include both human-readable text and structuredContent.
Data flow
Vehicle data is pushed to Garage by Smartcar webhooks when a monitored signal changes (state of charge, charging status, fuel level, oil life, lock status, odometer, tire pressure) and stored as the latest value per signal. Garage reads Smartcar directly only when the agent asks for a live refresh. Signals collected: battery state of charge and range, charging status, fuel level, oil life, odometer, lock status, tire pressures, precise location, nickname and VIN — nothing else is requested from the car.
Access requirements
- United States; a Smartcar-compatible vehicle with an active car-maker connected-services account (Tesla requires the Smartcar virtual key for command support, not for reading).
- Subscription: $6.99 per vehicle per month after a 14-day free trial, billed by Dodo Payments. No subscription is needed for reviewers using the test path.
- Rate limits: none imposed by Garage beyond Smartcar's per-vehicle limits; live refreshes should be occasional (data is pushed).
Reviewer test path
No real car or card is needed. Meta reviewers receive a private reviewer link that starts Smartcar Connect in simulated mode with a pre-provisioned demo vehicle and a 90-day entitlement; the link and simulated-vehicle credentials are supplied with the submission, not published here.
Data handling
Collected: Smartcar user id; vehicle ids, make/model/year; latest values of the permitted signals; alerts derived from them; billing email. Shared with Smartcar (vehicle connectivity), Dodo Payments (billing) and the connected agent (only what it requests). Never sold or used for advertising. Retained while connected; deleted on disconnect plus a request to support@keelcroft.com. Full text: privacy policy, terms.
Support
support@keelcroft.com · security reports: same address, subject “Security”.