Loading…
Deploy from Claude Code in one call. Write-enabled MCP host, flat price, sell the site you built.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The mcp-typescript server on vercel MCP server exposes 114 tools, focused primarily on filesystem, database, and communication capabilities. Its published description reads: "Deploy from Claude Code in one call". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates mcp-typescript server on vercel F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Unguarded destructive tools" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check mcp-typescript server on vercel's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add mcp-typescript server on vercel to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://shiply.now/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Publish files to the web → live URL at <slug>.shiply.now. UPDATING: never create a new site for changes — re-call with claimToken (anonymous sites) or slug (sites you own with a Bearer key) and the SA
Check any shiply slug or custom hostname: TLS certificate (issuer, days left) + HTTPS probe. ready=true means live.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: delete_site
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ite PERMANENTLY delete a site and all stored files. Irreversible — confirm with the user first. {"RecommendationAnnotate destructive tools and require human approval.
tool: rollback_site
A tool description tries to alter the model’s use of another tool.
ersion ids from get_site. Serving updates immediately.RecommendationDescriptions must describe only their own tool.
tool: list_versions
A tool description tries to alter the model’s use of another tool.
t 20. Pair with rollback_site: pick a version id from here and re-point the sRecommendationDescriptions must describe only their own tool.
tool: pull_site
A tool description tries to alter the model’s use of another tool.
same slug with publish_site. Static sites return editable source; frameworkRecommendationDescriptions must describe only their own tool.
tool: set_handle
A tool description tries to alter the model’s use of another tool.
your sites, use set_profile instead — that lives at shiply.now/@<handle>.)RecommendationDescriptions must describe only their own tool.
tool: set_link
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: set_site_access
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "password"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_site_access
A tool description tries to alter the model’s use of another tool.
counterpart to set_site_access — check before changing it.RecommendationDescriptions must describe only their own tool.
tool: drive_put_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
drive_put_file Write a drive file Write a file into a Drive (driveId = drv_… or "RecommendationAnnotate destructive tools and require human approval.
tool: drive_delete_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ive_delete_file Delete a drive file Delete a file from a Drive. {"$schema":"http://json-schema.orRecommendationAnnotate destructive tools and require human approval.
tool: set_profile
A tool description tries to alter the model’s use of another tool.
shiply.now, use set_handle instead. enable shows the profile; autoAdd autoRecommendationDescriptions must describe only their own tool.
tool: set_variable
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
value). Use for API keys the user's sites/agents need, e.g. SUPABASE_URLRecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_variable
A tool description tries to alter the model’s use of another tool.
cific site with attach_variable (takes effect on that site's next function deplRecommendationDescriptions must describe only their own tool.
tool: list_variables
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: create_database
A tool description tries to alter the model’s use of another tool.
h it later with attach_database.RecommendationDescriptions must describe only their own tool.
tool: attach_database
A tool description tries to alter the model’s use of another tool.
name chosen at create_database time). Takes effect on the site's next functionRecommendationDescriptions must describe only their own tool.
tool: add_domain
A tool description tries to alter the model’s use of another tool.
lves. Poll with check_domain.RecommendationDescriptions must describe only their own tool.
tool: add_custom_domain
A tool description tries to alter the model’s use of another tool.
tach sites with add_subdomain.RecommendationDescriptions must describe only their own tool.
tool: add_subdomain
A tool description tries to alter the model’s use of another tool.
lves. Poll with check_domain.RecommendationDescriptions must describe only their own tool.
tool: check_custom_domain
A tool description tries to alter the model’s use of another tool.
nect_provider / add_subdomain to confirm the domain is serving. Returns per-sRecommendationDescriptions must describe only their own tool.
tool: check_domain
A tool description tries to alter the model’s use of another tool.
ain (by id from list_domains).RecommendationDescriptions must describe only their own tool.
tool: create_test
A tool description tries to alter the model’s use of another tool.
d progress with get_test_status.RecommendationDescriptions must describe only their own tool.
tool: read_thread
A tool description tries to alter the model’s use of another tool.
ical order. Use list_inbox first to get a threadId.RecommendationDescriptions must describe only their own tool.
tool: reply_to_thread
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ng to the right conversation. {"$schema":"http://json-schema.org/draft-07/scRecommendationRemove side-channel parameters; constrain tool inputs.
tool: reply_to_thread
A tool description tries to alter the model’s use of another tool.
hars. Use after read_thread to make sure you're replying to the right conveRecommendationDescriptions must describe only their own tool.
tool: mark_thread_read
A tool description tries to alter the model’s use of another tool.
but not acted. read_thread already calls this implicitly; use this expliciRecommendationDescriptions must describe only their own tool.
tool: archive_thread
A tool description tries to alter the model’s use of another tool.
face again with list_inbox filter=archived. Reverse with unarchive_thread.RecommendationDescriptions must describe only their own tool.
tool: unarchive_thread
A tool description tries to alter the model’s use of another tool.
list. Pair with list_inbox filter=archived to find archived threadIds firsRecommendationDescriptions must describe only their own tool.
tool: list_unsubscribes
A tool description tries to alter the model’s use of another tool.
Shortcut for list_inbox with filter=unsubscribes — shows every thread tRecommendationDescriptions must describe only their own tool.
tool: add_suppression
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: remove_suppression
A tool description tries to alter the model’s use of another tool.
sion by id. Use list_suppressions first to find the id.RecommendationDescriptions must describe only their own tool.
tool: get_project
A tool description tries to alter the model’s use of another tool.
der. Use before update_brief / regenerate_brief.RecommendationDescriptions must describe only their own tool.
tool: archive_project
A tool description tries to alter the model’s use of another tool.
tore later with restore_project.RecommendationDescriptions must describe only their own tool.
tool: create_listing
A tool description tries to alter the model’s use of another tool.
s='ready' — see get_connect_status). priceCents = whole-dollar between 100 and 999RecommendationDescriptions must describe only their own tool.
tool: add_sending_domain
A tool description tries to alter the model’s use of another tool.
ropagates, call verify_sending_domain. Cannot be a shiply.now subdomain.RecommendationDescriptions must describe only their own tool.
tool: verify_sending_domain
A tool description tries to alter the model’s use of another tool.
rds returned by add_sending_domain. Status flips to 'verified' once SPF + DKIM + MRecommendationDescriptions must describe only their own tool.
tool: contract_draft
A tool description tries to alter the model’s use of another tool.
yet), then call contract_send to fire it.RecommendationDescriptions must describe only their own tool.
tool: contract_amend
A tool description tries to alter the model’s use of another tool.
ore send — call contract_send with the returned amendment id to fire it. CannRecommendationDescriptions must describe only their own tool.
tool: remove_cron
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
g whose cron to remove"},"path":{"type":"string","minLength":1,"maxLength":300RecommendationAnnotate destructive tools and require human approval.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: site_status
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_site
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_site
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ite PERMANENTLY delete a site and all stored files. Irreversible — confirm with the user first. {"RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: drive_list_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
rive_list_files List drive files List files in a Drive (driveId = drv_…, or "default"). OptRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: drive_put_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
drive_put_file Write a drive file Write a file into a Drive (driveId = drv_… or "default"). coRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: drive_put_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: drive_delete_file
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: drive_delete_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ive_delete_file Delete a drive file Delete a file from a Drive. {"$schema":"http://json-schema.orRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: drive_delete_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: delete_variable
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: detach_variable
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_database
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: add_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_subdomain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: connect_provider
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: sync_dns
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: check_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: check_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_broadcast
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: resend_confirmation
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: summarize_thread
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: reply_to_thread
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: forward_thread
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_suppression
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: regenerate_brief
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: list_project_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
t_project_files List files uploaded to a project Return the customer-uploaRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: resend_intake_invite
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: delete_listing
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: refund_order
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: add_sending_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_sending_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_sending_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: contract_send
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_function
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_secret
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_cron
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_cron
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
g whose cron to remove"},"path":{"type":"string","minLength":1,"maxLength":300RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: send_email
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: send_mailbox_broadcast
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Edge-check a shiply slug or custom hostname and return a structured readiness report: status (LIVE/PENDING), SSL details (valid, issuer, daysLeft), HTTP probe, and a presigned thumbnail URL when avail
List the sites owned by this API key. Optional clientId filters to one client.
Site settings + version history for one of my sites.
PERMANENTLY delete a site and all stored files. Irreversible — confirm with the user first.
Re-point a site to any finalized version (rollback or roll-forward). Get version ids from get_site. Serving updates immediately.
List a site's finalized deploys newest-first (id, createdAt, isLive, fileCount, bytes), capped at 20. Pair with rollback_site: pick a version id from here and re-point the site to it.
Download the current files of a site you own (or created via a platform connection) so you can edit and republish to the same slug with publish_site. Static sites return editable source; framework/SSR
Give ONE site a vanity URL: rename it to <handle>.shiply.now (3-30 chars, a-z 0-9 -). The old address 301-redirects for 30 days. (For a portfolio page listing all your sites, use set_profile instead —
Server-side copy of an owned site under a new slug — instantly live. Copies files + title; does NOT copy access settings, domains, or data. Great for iterating on variants.
Copy the EXACT live bytes of one owned site (srcSlug — your preview) into another owned site (destSlug — your production site / custom domain), no rebuild. Dest keeps its slug, domains, and access set
Path-mounting: serve an owned target site at a path on an owned host site (host/docs -> target). location is a path like "docs", or "__root__" for the host root. Both sites must be owned by you. Pass
Protect an owned site (paid plans). mode 'public' (anyone), 'password' (supply password), or 'restricted' (supply allowedEmails and/or allowedDomains — only those can request a login code). Changing a
Read an owned site's current access policy (mode: public/password/restricted, allowedEmails, allowedDomains, hasPassword). Read-only counterpart to set_site_access — check before changing it.
Return a JSON bundle of the user's profile, sites, Site Data, drives, and metadata (secrets excluded). Data portability.
Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.
Get the signed-in account's plan, capabilities, and upgrade URL. Call this FIRST when figuring out what features you have access to — it tells you exactly what's available and what's blocked. The upgr
List the user's private cloud Drives (id, name). Optional clientId filters to one client.
Create a private cloud Drive (plan-limited). Pass client to file it under a client.
List files in a Drive (driveId = drv_…, or "default"). Optional prefix filter.
Write a file into a Drive (driveId = drv_… or "default"). content is utf8 or base64. Use for agent memory, notes, context, assets.
Delete a file from a Drive.
Snapshot a Drive (or a prefix of it) into a new live site at <slug>.shiply.now. Files copied server-side.
Create or update the user's public PORTFOLIO page at shiply.now/@<handle> (handle 3-30 chars a-z0-9-) — a landing page listing the user's sites. This is NOT a site's address: to give one site a vanity
Toggle whether an owned, public site appears in the public shiply Explore gallery (https://shiply.now/explore). Only public-access sites are eligible.
Upsert a key/value in the user's encrypted variable store (UPPER_SNAKE name, ≤8 KiB value). Use for API keys the user's sites/agents need, e.g. SUPABASE_URL. NOTE: saving alone does NOT expose it to a
List the encrypted variables. Values are masked unless reveal=true.
Remove one variable by name.
Expose one saved variable to ONE owned site's Worker env (plain_text binding). Opt-in per site — unattached variables are never injected, because the Worker runs the site's own code. Takes effect on t
Stop exposing a variable to a site's Worker env. Takes effect on the site's next function deploy.
Names of the variables attached to an owned site's Worker env (values never shown here).
List the SQL databases (D1 or Neon Postgres) on my account, including which owned site (if any) each is attached to. Call this BEFORE db_query/db_schema-style work to discover a databaseId — those liv
Provision a SQL database — D1 (default, free) or Neon Postgres (--postgres, developer plan). Optionally attach it to an owned site's Worker env in the same call (siteSlug); otherwise attach it later w
PERMANENTLY delete a database and all its data. Irreversible — confirm with the user first.
Bind an existing database to one owned site's Worker env (the binding name chosen at create_database time). Takes effect on the site's next function/publish deploy.
List collections declared in an owned site's .shiply/data.json with current record counts. Empty list means the site has no manifest yet — scaffold one with `shiply data init`.
Page records from an owned site's collection, newest-first. limit ≤ 200 (default 50). cursor from a previous response's nextCursor.
Insert one record into a collection. Goes through the same public visitor endpoint a browser would use — manifest access.insert decides whether it is allowed. Use to seed waitlist data, test forms end
Return up to `limit` records (default 1000, max 5000) from a collection — for snapshotting into agent context. For larger sets use the CLI: `shiply data export <slug> <collection>`.
Serve a site on a domain the user owns. Returns the CNAME to add (hostname → cname.shiply.now); the certificate issues automatically once DNS resolves. Poll with check_domain.
Register a registrable domain (e.g. example.com) the user owns and detect its DNS provider. Returns the provider and whether one-click connect is available. Then attach sites with add_subdomain.
Serve an owned site at <subdomain>.<domain> (use subdomain "@" or "" for the apex — apex needs a provider with CNAME flattening/ALIAS, e.g. Cloudflare). Auto-registers the parent domain. Returns the C
Mark a hostname as the primary (canonical) URL for its site. Sibling hostnames (apex + www both pointed at the same site) start 301-redirecting to it, preserving path + query. The host-side fix for th
List registered custom domains grouped with their subdomains, each subdomain's site and status, and the detected provider.
Start one-click DNS connect for a registered custom domain. For Cloudflare-hosted domains this returns an authorize URL — SHOW THE USER the url as a clickable link; after they authorize, records are w
For a connected custom domain, (re)write the CNAME records for all its subdomains automatically and report what changed. For unconnected domains, returns the records to add manually.
Check whether a custom domain's subdomains are live: re-polls Cloudflare cert status + probes DNS/TLS/HTTPS on each subdomain. Poll this after connect_provider / add_subdomain to confirm the domain is
Remove a registered custom domain and all its subdomains; they stop serving immediately.
List connected custom domains with status.
Refresh certificate status + live TLS/HTTPS probe for a connected domain (by id from list_domains).
Remove a connected domain (by id). It stops serving immediately.
Daily page views per site for the last 30 days.
Provision a demand test in one call: deploys a landing page with a native email-capture form and creates a confirmed-subscriber segment. Returns testId + live siteUrl. Share the siteUrl to collect sig
List your demand tests with signups + confirmed counts.
ONE consolidated object: page funnel (views, signups, confirmed, conversion) ⊕ email events (delivered/opened/clicked/bounced) ⊕ a computed verdict. The single place to check progress — never query em
Send a campaign to this test's confirmed (double-opt-in) subscribers — the "we're live" email. An unsubscribe link is added automatically. Fails if there are no confirmed subscribers yet.
Re-send the double-opt-in confirmation to a signup that has not confirmed yet.
Confirm a pairing code shown in the user's browser at https://shiply.now/claim/<slug>?pair=1. Use ONLY in the agent session that originally published the site — it reads the claimToken from .shiply.js
List the user's email inbox threads (outbound demand-test sends + inbound replies / unsubscribes / complaints / bounces). Filter by tag.
Return the thread metadata + all messages in chronological order. Use list_inbox first to get a threadId.
One-paragraph summary of the thread, oriented to the most actionable signal (interest, complaint, question, unsubscribe).
Send an email reply on an existing thread. Goes FROM the original recipient address (the <slug>@shiply.now alias the sender used) and TO the original sender. Threaded via RFC 5322 In-Reply-To so Gmail
Zero the unread counter for a thread. Useful after the agent has read but not acted. read_thread already calls this implicitly; use this explicitly when you want to clear unread without re-fetching th
Soft-archive the thread (sets archivedAt). Hidden from the default inbox view; surface again with list_inbox filter=archived. Reverse with unarchive_thread.
Restore an archived thread (clears archivedAt). It reappears in the default inbox list. Pair with list_inbox filter=archived to find archived threadIds first.
Forward a message from a thread (default: the most recent message) to a NEW recipient with an optional intro note. Body is composed as note + standard '---------- Forwarded message ----------' quote o
Return every active demand test's reply / inbound address (<slug>@<sitesDomain>). Use this when you need to TELL someone where to email — e.g. drafting a reply or sharing a test's contact address. Mai
Shortcut for list_inbox with filter=unsubscribes — shows every thread tagged as an opt-out request.
Return the user's suppression list — addresses (and full domains) that shiply skips when sending. Bounces, complaints, manual user adds, and AI-detected unsubscribes all land here.
Add an address (or whole domain) to the user's suppression list. Future confirmations and broadcasts will skip it across every test. Use kind='email' for a single address, kind='domain' for everyone @
Delete one suppression by id. Use list_suppressions first to find the id.
Return threads tagged as complaints (spam reports) OR bounces (recipient rejected). Read these before any further sending.
List the dev's customer-intake projects (newest first). Optional filters: status (draft|intake_open|brief_ready|brief_failed|archived), q (case-insensitive match on label or customer email), limit (de
Spin up a new customer-intake project on the dev's account. Returns the project row plus intakeUrl — the public link the customer fills out (10-step wizard). If customerEmail is provided, shiply also
Read one of the dev's projects by id — includes label, status, customer details, intake responses, AI brief, drive folder. Use before update_brief / regenerate_brief.
Overwrite the project's working brief (jsonb). Hard-capped at 500 KB. Use to revise the AI-generated brief by hand; the original AI output is preserved separately in briefAiOriginal so you can always
Re-run the MiniMax/Anthropic brief generator from the project's current intake_responses and persist the result. Flips status to brief_ready on success or brief_failed on error. Use after the customer
Move a project to status='archived'. Hidden from the default dashboard list. Optional reason is shown on the project page. Restore later with restore_project.
Move an archived project back to status='draft' so it reappears in the active list. Idempotent on non-archived projects? No — server rejects the transition unless the project is currently archived.
Return the customer-uploaded files for one project (path, size, contentType, createdAt). Empty when no drive folder exists yet (no uploads). Use to inspect what intake assets the customer attached.
Re-fire the 'your developer sent you a project intake' email to the project's customer. Throws invalid_request if the project has no customerEmail (the dev needs to set one via the dashboard first — c
Return every marketplace listing the seller owns (any status: draft, live, paused, sold). Includes site slug and current price. Use to see what's for sale across the account.
Publish (or upsert) a marketplace listing for an owned site. Requires Stripe Connect set up (status='ready' — see get_connect_status). priceCents = whole-dollar between 100 and 999900. termsMode='stan
Patch a listing by siteSlug — change price, pitch, terms, jurisdiction, or status (draft|live|paused). Sold listings cannot be edited. Status transitions enforced server-side. Use to pause sales or dr
Take a listing off the public marketplace by moving it to status='draft'. Marketplace v1 keeps the row so analytics + future re-listing work — there's no hard delete. Sold listings can't be modified.
Return every marketplace order for sites the user sold (incl. pending, paid, refunded, failed, disputed). Most recent first. Use to surface revenue + which orders are still inside the 30-day refund wi
Return every marketplace order the user PURCHASED. Most recent first. Shows the acquired site, paid amount, and whether the order is still inside the 30-day refund window. Use to recap what the user o
Issue a full refund on a paid order the user sold. Must be inside the 30-day refund window (server enforces). Triggers a Stripe refund; the webhook flips the order to 'refunded' and reverts site owner
Return the seller's Stripe Connect state: not_started | in_progress | pending_verification | ready | disabled. When status != 'ready' the user can't list sites. Includes a one-shot onboardingUrl (if n
Return every BYO sending domain the user has added (id, domain, fromAddress, status: pending|verified|failed, DNS records). Use to inspect verification state or find the id of a domain to verify/remov
Register a domain the user owns for outbound demand-test sends. Returns DNS records (SPF, DKIM, MX) to add at the DNS provider. After DNS propagates, call verify_sending_domain. Cannot be a shiply.now
Trigger Resend to re-check the domain's DNS records, persist the new status. Call after adding the DNS records returned by add_sending_domain. Status flips to 'verified' once SPF + DKIM + MX all check
Delete a BYO sending domain. Any demand tests bound to it fall back to the managed shiply sender. Also GCs the underlying Resend domain. Irreversible — re-adding requires re-verifying DNS.
Draft a contract from a brief_ready project. Auto-fills 8 fields from the AI brief, Stripe Connect default currency, and dev profile. Returns the contract row with status='draft' so the dev can review
Send a draft contract to the customer. Validates all 8 fields are non-empty, computes content_hash, flips project to contract_sent, fires the customer email. Same handler works for amendment drafts —
Create an amendment to a SIGNED parent contract. Scope delta required; fee delta and target date optional. Returns the draft amendment for editing before send — call contract_send with the returned am
Get the signed contract PDF as a base64-encoded download. PDF includes the contract, signature certificate, and any signed amendments. Returns { filename, contentType, base64 }. Errors with conflict:c
Read the current state of a contract: status, sent_at, viewed_at, signed_at, signer info, content_hash, plus any amendments. Use this to check whether a customer has signed yet. Returns { contract, am
Deploy a Worker function to a site. The function runs on every request to <slug>.shiply.now and can receive webhooks, run on cron triggers, and access bindings (D1, secrets, env vars). Requires Develo
Return the deployed function source + metadata for a site, or null if no function deployed.
Remove the deployed Worker function from a site (and all its routes, secrets, and cron triggers). Site falls back to static-only serving. Irreversible.
Set a CF Worker secret on a site's deployed function. Value is encrypted-at-rest and accessible as env.<NAME> inside the worker. Use for Stripe keys, Resend API keys, etc.
List secret names (values not returned) for a site's deployed function.
Remove a secret from a site's deployed function. The binding disappears on next request.
List cron triggers for a site's deployed function. Each cron is (path, schedule, lastRunAt).
Set or update a cron trigger on a site's deployed function. Schedule is crontab syntax (UTC). Path is the URL the cron handler should fire on (for the worker's scheduled() handler context).
Remove a cron trigger from a site's deployed function.
Read recent runtime logs for a site's per-site Worker (console output, request summaries, exceptions) from Cloudflare Workers Observability — 7-day retention, newest first. Use this to debug a deploye
Send an email from <slug>.shiply.now's managed sender. The site can send transactional/notification email — no SMTP setup. Rate-limited and spam-checked; replies route back to the site inbox.
Read the email threads (received, sent, web captures) for the agent's sites. Optionally scoped to one site by slug.
Turn a Site Data collection into a mailbox: double opt-in, owner notifications, sending domain, branding. Call once per (site, collection) to configure how captured leads are handled.
List captured contacts for a (site, collection) mailbox, optionally filtered by status (signed_up/confirmed/unsubscribed). Returns email, status, confirmedAt, createdAt, and captured fields.
Send a one-shot broadcast to the confirmed (double-opt-in) subscribers of a (site, collection) mailbox. Spam-checked; unsubscribe footer auto-added. Fails if no confirmed subscribers exist yet.