MCP integration
Endpoint: POST /mcp — JSON-RPC 2.0. Call initialize, then tools/list, then tools/call. Every listed directory has its own equivalent route (/mcp/registry, /mcp/smithery, /mcp/glama, /mcp/cursor, /mcp/claude, /mcp/openai) so per-directory usage can be counted; all of them serve the same free tools.
Tools
| Tool | Read-only | Needs a connected store | Price |
|---|---|---|---|
get_checkout_health_snapshot | Yes | Yes | Free |
diagnose_revenue_incident | Yes | Yes | Free |
check_checkout_change_risk | Yes | No, if a component is named | Free |
verify_revenue_recovery | Yes | Yes | Free |
Which store an answer is about
No tool takes a store id. The store is decided by the credential on the request — Authorization: Bearer <store_id>.<secret> — because an argument an agent can name is an argument it can name about someone else's shop. Without a credential the tools still list and still describe themselves; the ones that need store data answer not_connected.
Example: diagnose_revenue_incident
{
"jsonrpc": "2.0", "id": 1, "method": "tools/call",
"params": {
"name": "diagnose_revenue_incident",
"arguments": { "symptom": "payment_succeeded_order_pending" }
}
}
The answer carries a timeline, up to three ranked hypotheses with the observations behind each, independent public sources where they exist, counterevidence, what remains unknown, safe next steps and a verification plan — or abstained with a reason.
Sending snapshots
POST /v1/snapshot takes an HMAC-signed envelope: {storeId, timestamp, nonce, signature, body}, where the signature covers storeId.timestamp.nonce.body and body is the exact serialized snapshot. The WordPress plugin does this; the format is documented so anything else can too.
Full input and output JSON Schemas come from tools/list and are the authoritative contract — this page summarises them.