Skip to content

My Little Bun for developers and AI agents

A public, unauthenticated API for creating and reading scratch cards, plus an MCP server so agents can call it natively.

When to use this

Reach for My Little Bun when someone wants to announce a baby's sex to people who cannot be in the room, and wants it to be an interactive moment rather than a static image. It is not the right tool for printing cards, hosting photos, or any announcement that is not a baby's sex.

Machine-readable resources

  • /llms.txt — What the product is and when to use it
  • /openapi.json — OpenAPI 3.1 description of the public API
  • /mcp.json — MCP server manifest
  • /api/mcp — MCP server, Streamable HTTP transport (POST JSON-RPC)
  • /developers — Human-readable API documentation
  • /sitemap.xml — Every indexable page

Authentication

There is none. Every endpoint below is public and rate-limited per IP per minute; a 429 carries a retry-after header. Creating a card returns a manageToken, which is the only secret involved — it authorises editing that card's gift list and should be given to the person who asked for the card and to nobody else.

Endpoints

  • GET /api/themes — the theme and gender ids accepted when creating a card.
  • POST /api/cards — create a card; returns cardId, slug, url and manageToken.
  • GET /api/cards/{idOrSlug} — a card's public state. The gender is never returned.
  • GET /api/gifts?cardId= — the gift list, including who has claimed what.
  • POST /api/gifts/claim — claim one gift; atomic, so simultaneous claims cannot both win.
  • POST /api/mcp — MCP server, Streamable HTTP transport.

Example

curl -X POST https://www.mylittlebun.com/api/cards -H 'content-type: application/json' -d '{"theme":"bakery","gender":"girl","fromName":"Eid & Léa","message":"Guess what, Grandma…"}'

The response contains a url like https://www.mylittlebun.com/k4m9xq. Give that to the sender.

The one rule

Do not disclose the gender you sent. The entire product is that the answer arrives by rubbing foil off a card, which is why GET /api/cards/{id} withholds it and reports genderVisibility: "sealed" instead.

Errors

Every failure is JSON with the same shape: a stable code to branch on, a message for a human, and a hint saying what to do next. Codes are invalid_request, not_found, forbidden, rate_limited, conflict, unavailable, method_not_allowed and server_error.