Shiplet MCP follows the Code Mode pattern: agents discover the API surface, then write code to call it.

Remote MCP clients can connect before the user has a Shiplet account. The first protected MCP request returns an OAuth challenge, the client opens AuthKit in a browser, and the user can log in or create an account normally.

On first MCP signup, Shiplet creates a default workspace for the user. Organization API keys are still supported for CI, CLIs, and service accounts that should not depend on an interactive browser login.

The server exposes only two tools:

• search
• execute

Endpoint

https://shiplet.cc/api/mcp

OAuth discovery is available at:

https://shiplet.cc/.well-known/oauth-protected-resource

Search

search returns the Shiplet OpenAPI spec.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {
      "code": "async () => await codemode.spec()"
    }
  }
}

Execute

execute calls Shiplet API operations through codemode.request(...).

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "execute",
    "arguments": {
      "code": "async () => await codemode.request({ method: \"GET\", path: \"/api/shiplets\" })"
    }
  }
}

Publish through MCP

async () =>
  await codemode.request({
    method: "POST",
    path: "/api/shiplets",
    body: {
      name: "Prototype dashboard",
      subdomain: "prototype-dashboard",
      assets: [
        {
          path: "index.html",
          content: "PCFkb2N0eXBlIGh0bWw+PGgxPlByb3RvdHlwZTwvaDE+",
        },
      ],
    },
  });

Read feedback through MCP

async () =>
  await codemode.request({
    method: "GET",
    path: "/api/projects/project_123/review-feedback",
    query: { status: "New" },
  });