Model Context Protocol over streamable HTTP. Exposes 42 site-publishing tools to MCP-aware agents.

Send EITHER credential, never both: Authorization: Bearer stk_live_… (an API key — no browser, no registration, the same key that drives every REST route), or Authorization: Bearer <oauth-jwt> (OAuth 2.1 + Dynamic Client Registration, for connectors acting for a signed-in human). Session cookies are refused so a browser cannot drive MCP cross-site. An agent with no key can mint one without a human at POST /provision (x402), or with a human but no browser via the RFC 8628 device-code flow at POST /api-keys/device-code. The stdio package stacktree-mcp bridges an API key to these same tools for clients that cannot speak streamable HTTP. The /.well-known/mcp/server-card.json card describes the transport + capabilities. Tools (42): publish_html, update_site, delete_site, restore_site, claim_site, set_password, set_expiry, create_share_link, list_share_links, revoke_share_link, set_client_feedback, set_email_gate, list_sites, get_me, list_client_spaces, set_client, create_client_space, update_client_space, delete_client_space, get_design_guide, get_site, get_content, get_passcode, get_activity, list_versions, restore_version, list_feedback, resolve_feedback, link_wallet, whos_it_for, unopened_pages, get_revision_brief, publish_revision, resolve_comments, request_approval, get_approval_status, list_responses, resolve_addressed_notes, open_html_file, stacktree_pages, publish_card_status, publish_card_open.