Developer API

Ask your AI assistant about any quest. PandaBase speaks the Model Context Protocol (MCP), so an assistant that supports MCP (for example Claude Desktop or Claude Code) can look up quests, who gives them and where, NPC and object locations, item drops, zones, flight routes, best-in-slot lists and the data changelog – for Mists of Pandaria Classic, and for TBC Anniversary, Classic Era and WoW Forever where the site has their data – and, if you allow it, your own characters. Free, and read only: an agent can never change anything here.

Start in three steps

Sign in with Battle.net. Reading this page needs no account; making a key does.
Make a key here. It is free, lives 182 days and can only read.
Paste it into your MCP client’s settings (examples below), and ask away: “Who gives quests in The Jade Forest, and where do they stand?”, “What does this NPC drop?”, “Best in slot for a frost death knight?”

Connect your agent

The MCP server is at https://pd.zroot.it/mcp (Streamable HTTP, HTTPS only). Two ways in: sign in from the application (OAuth, which Claude’s connectors use), or a developer key sent in every request as Authorization: Bearer pqk_…. A client that can only add a fixed header may send the key alone as X-PandaQuest-Key: pqk_… or X-API-Key: pqk_… instead.

Claude (claude.ai, Claude Desktop and the mobile apps)

In Claude, open Settings → Connectors and choose Add custom connector (on a Team or Enterprise plan, an owner adds it under Organization settings → Connectors).
Name: PandaBase. Remote MCP server URL: https://pd.zroot.it/mcp.
Authentication: leave it on signing in through the server (OAuth). Leave OAuth Client ID and OAuth Client Secret empty: Claude registers itself here. Leave Request headers empty.
Choose Add, then Connect. Claude opens this site: sign in with Battle.net if asked, check that the page says you will be sent back to claude.ai, and choose Allow.
The connection appears under “Connected applications” on this page, where you can revoke it.

If your Claude asks for a client ID you registered yourself, make one under “Your OAuth clients” above and paste its ID; leave the secret blank. To use a developer key instead of signing in, put X-API-Key with your pqk_… key in Request headers (where your plan offers them). Claude Code signs in the same way: claude mcp add --transport http pandaquest https://pd.zroot.it/mcp, then /mcp to sign in.

Claude Code

claude mcp add --transport http pandaquest https://pd.zroot.it/mcp \
  --header "Authorization: Bearer pqk_YOUR_KEY"

Claude Desktop

In claude_desktop_config.json, through the mcp-remote bridge (needs Node.js), which adds the header for you:

{
  "mcpServers": {
    "pandaquest": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://pd.zroot.it/mcp",
               "--header", "Authorization:${PQ_KEY}"],
      "env": { "PQ_KEY": "Bearer pqk_YOUR_KEY" }
    }
  }
}

ChatGPT and other MCP clients

Any client that can send a header to a Streamable HTTP server works. Cursor (.cursor/mcp.json) and VS Code (.vscode/mcp.json, key "servers" and "type": "http") take:

{
  "mcpServers": {
    "pandaquest": {
      "url": "https://pd.zroot.it/mcp",
      "headers": { "Authorization": "Bearer pqk_YOUR_KEY" }
    }
  }
}

ChatGPT’s connectors and other clients that sign in with OAuth take the server URL alone and open the same consent page. To try the server by hand:

curl -s https://pd.zroot.it/mcp -H "Authorization: Bearer pqk_YOUR_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"search","arguments":{"query":"jade temple"}}}'

Tools

Every tool takes version: mop (Mists of Pandaria Classic, the default), forever, era or anniversary. Most data exists for mop only; a tool says so when it has none. Answers are JSON; coordinates are percent of the zone map. Where a tool takes a region, EU is the default: leave it out and a name found in both EU and US answers with the EU one; pass us for the US one. WoW Forever has no realms to choose, only an EU and a US environment, and its lists count both together.

Tool	What it answers	Arguments	Example
`search` public:read	Search quests, zones, professions, NPCs, objects and items by name or id, ranked the way the site's own search ranks them: exact name, then prefix, then word start, then anywhere. Returns each kind's best matches with their ids and page links. Use the ids with the get_* tools.	`query`*, `kinds`, `limit_per_kind`, `version`	`{"query": "jade temple", "kinds": ["quest", "zone"]}`
`get_quest` public:read	One quest as its page shows it: level and level range, faction, races and classes, zone, objectives, quest givers and turn-ins with their coordinates (percent of the zone map), rewards, money and experience, reputation, the quests before and after it, and -- once enough players stand behind it -- the community's median time.	`quest_id`*, `version`	`{"quest_id": 29408}`
`get_npc` public:read	One NPC: its details (level, classification, reaction, faction, health), where it spawns, what it sells and drops, and the quests it starts, ends or is an objective of, with coordinates.	`id`*, `version`	`{"id": 53566}`
`get_object` public:read	One game object: where it is, what it contains, and the quests it starts, ends or is part of.	`id`*, `version`	`{"id": 209596}`
`get_item` public:read	One item: item level, required level, quality, vendor sell price and tooltip lines when the site has them, and the quests that reward it, start with it or need it.	`id`*, `version`	`{"id": 72092}`
`get_zone` public:read	A zone or continent of the world map, by name, slug or uiMapID: its level range, continent, flight points and (for mop) every quest giver standing in it with the quests they start and their coordinates. A continent lists its zones.	`zone`*, `version`	`{"zone": "The Jade Forest"}`
`list_realms` public:read	Every realm the site has player data for, with how many public characters it has.	`version`	`{}`
`get_character` characters:read	One character by realm and name: level, class, race, faction, a gear summary, and the quest progress the site has (quests attempted and completed, kills, deaths, play time). Your own characters are always found, hidden ones included; somebody else's only while their profile and the character are public. A private one answers exactly like one that does not exist.	`realm`, `name`, `region`, `version`	`{"realm": "Hoptallus", "name": "Bananaroot", "region": "eu"}`
`list_my_characters` characters:read	The characters your synced computers have uploaded, with level, class, race and whether each is public.	`version`	`{}`
`get_bis` public:read	The best-in-slot list for one class and specialisation: the stat priority and the top items of every slot with item level and where each drops. Slugs are lower case with dashes, e.g. class "death-knight", spec "frost".	`class`, `spec`, `mode`, `phase`, `per_slot`, `version`	`{"class": "monk", "spec": "windwalker", "phase": "pre-raid"}`
`get_flight_route` public:read	The fastest and the cheapest flight route between two flight points, by name or id, as the site's /flights planner finds it: the stops, each leg's time, the total time and the base price. Times players measured are marked measured; the rest are estimated from the path's length.	`from`, `to`, `faction`, `version`	`{"from": "Paw'Don Village, Jade Forest", "to": "Halfhill, Valley of the Four Winds", "faction": "alliance"}`
`get_changelog` public:read	What was added, updated, fixed or removed in the site's game data since a date, newest first: quests, NPCs, objects, items, zones and more.	`since`*, `kind`, `limit`, `version`	`{"since": "2026-10-01", "kind": "quest"}`

* required.

Limits and terms

60 requests a minute per key, and 120 for all your keys together.
5000 requests a day per key, and 10000 for all your keys together; the day is UTC.
Over a limit, the answer is 429 with Retry-After. Every answer carries X-RateLimit-Limit, X-RateLimit-Daily-Limit, X-RateLimit-Daily-Remaining and X-RateLimit-Reset (seconds to midnight UTC).
A request body is at most 64 KiB, and one tool call at most 10 seconds.
Answers are cached for a few minutes, so the same question asked again is fast and may be up to that old.
Fair use: this is for your own agent and your own questions. No bulk scraping, no mirroring the site's data, and no sharing a key. A key that is misused is revoked.
Other players' characters are shown only while their profile and the character are public, and a BattleTag only while its owner's profile is public – exactly as on the site's own pages.
What is kept about your keys: their names, scopes and dates, the day each was last used and how many requests each made per day. Never what your agent asked. See the privacy statement; your keys are in your data export and go when you delete your account. The same goes for connected applications: their name, scopes and dates and the day each was last used, a hash of their tokens and never a token.