Quickstart
- Create a named bearer token that follows your account’s current project and site roles.
- Store it server-side or in your MCP client.
- Use
POST /mcpor the REST endpoints. - Use
project_idfor AI workspace and task operations; supplysite_idonly for a site-specific API.
POST https://pocketpapi.com/mcp Authorization: Bearer YOUR_TOKEN
The base /mcp URL defaults to compact tool discovery. Existing cached direct calls remain permission-checked; use ?profile=full for the original full catalog.
Authentication
Authorization: Bearer YOUR_SITE_COMMANDER_TOKEN
Owner-approved MCP device enrollment
OAuth-blocked MCP clients can request a short-lived enrollment. The agent must keep device_code in its secure credential flow. An authorized settings administrator reviews the client name, exact project list, MCP permissions, and expiry before the agent can exchange the code. The resulting bearer token is returned once and must be saved directly to the client’s secure credential vault. This custom flow is separate from OAuth discovery.
POST /api/control-plane/mcp/device-code
Content-Type: application/json
{"client_name":"Site Design Agent"}
POST /api/control-plane/mcp/device-token
Content-Type: application/json
{"device_code":"DEVICE_CODE_FROM_THE_SECURE_AGENT_FLOW"}
Enrollment expires after 10 minutes. An authorized settings administrator explicitly selects projects, MCP permissions, and credential expiry before approval. Poll using the returned interval; handle authorization_pending, slow_down, access_denied, and expired_token. The public code request is rate-limited. Neither device code nor bearer token belongs in chat, shell history, or logs. Manage approved clients at /admin-settings/mcp-api.
Project intake sources
Authorized workspace.write clients can update the owner-confirmed primary research URL without changing the site's production domain. Intake can also inspect up to three additional owner-selected public HTTPS sources; the full crawl is capped at six pages. DNS is checked and pinned, redirects are rejected, and all source findings remain unapproved until a project owner reviews them.
POST /api/control-plane/ai/workspace
Authorization: Bearer SC_TOKEN
Content-Type: application/json
{"action":"intake_url_set","site_id":123,"research_url":"https://example.com/","confirm":true}
POST /api/control-plane/ai/workspace
{"action":"intake_run","site_id":123,"source_urls":["https://example.org/","https://shop.example.net/"]}
Discovery
/mcp · /llms.txt · /.well-known/ai-plugin.json · /openapi.json · /api/control-plane/guide.md
Public effects catalog
The public catalog contains 68 recipes and requires no bearer token. Every result reports studio_compatibility so clients can tell which native recipes stage directly and which are code-composition starters that need markup or a third-party runtime. Compose accepts bounded trigger, duration, intensity, palette, direction, stagger, and child-object options. A video background result requires an authorized Site Studio apply operation plus a site-approved video asset; the public compose endpoint returns copyable code and never writes a website.
GET /api/effects?q=scroll
GET /api/effects/{effect_id}
POST /api/effects/compose
{"effect_id":"cinematic-float","target_selector":".hero-art","reduced_motion":true,
"animation":{"trigger":"scroll","duration":18,"intensity":1.2,"palette":"sunset",
"object_mode":"media","object_motion":"mixed","stagger_ms":260,"direction":"alternate"}}
The public composer only returns code. Authorized bearer clients with site.edit can list approved video/poster assets and stage the same compatible effects on a unique existing page element:
GET /api/control-plane/site-studio/media?site_id=123&media_type=video
GET /api/control-plane/site-studio/media?site_id=123&media_type=poster
Authorization: Bearer SC_TOKEN
POST /api/control-plane/site-studio/effects
Authorization: Bearer SC_TOKEN
Content-Type: application/json
{"site_id":123,"confirm":true,"path":"index.html","effect_id":"video-cinema-stage","selector":".hero",
"animation":{"background_video_asset_id":42,"background_video_poster_asset_id":18,"trigger":"loop","palette":"ocean"}}
Authorized site.edit clients can also import one selected public image into the exact site's private media library; it does not modify the page or publish anything:
POST /api/control-plane/site-studio/media/import
Authorization: Bearer SC_TOKEN
Content-Type: application/json
{"site_id":123,"confirm":true,"source_url":"https://images.example.com/hero.png","name":"Hero","asset_kind":"image","idempotency_key":"hero-image-import-01"}
Only JPEG, PNG, WebP, and GIF are accepted (20 MiB and 100 megapixels maximum). Set asset_kind to logo only after the owner identifies the selected image as the company logo; this adds the onboarding logo role without changing page files. The default kind is image. PocketPapi pins the HTTPS fetch to a verified public DNS address, rejects redirects/private targets, and verifies the image bytes before saving. Effect writes return the exact preview and change set in Site Studio staging. Video and poster assets must belong to that same authorized site; each is limited to 5 MiB. Publishing remains a separate exact-revision approval.
Authorized site.edit clients can upload a selected local file to the exact site's private Project Media library. Inline MCP upload accepts files up to 5 MiB; use multipart REST for larger files within the hosting limit:
POST /api/control-plane/site-studio/media/upload Authorization: Bearer SC_TOKEN Content-Type: multipart/form-data site_id=123&confirm=true&name=Hero&idempotency_key=hero-upload-01&media=[file]
JPEG, PNG, WebP, GIF, MP3, M4A, OGG, WAV, MP4, WebM, and QuickTime are accepted after MIME verification; image dimensions are decoded and checked. Original bytes are stored privately. Uploads do not modify pages or production.
Import an existing public site
When the owner asks to import an existing live website, use the public URL import to crawl same-origin pages and assets into the site's current Site Studio staging draft. It runs the manifest, managed runtime, theme, layout, SEO, and project-knowledge checks. The response includes page-level coverage and leaves forms unready until their staged behavior is verified. Production remains unchanged.
POST /api/control-plane/site-studio/import-url
Authorization: Bearer SC_TOKEN
Content-Type: application/json
{"site_id":123,"confirm":true,"source_url":"https://www.example.com/","idempotency_key":"example-site-import-01"}
The crawl pins verified public DNS, rejects private targets and redirects, and stops before staging if discovery is incomplete. Limits: 120 pages, 500 files/requests, 8 MiB per file, 40 MiB total, and 22 seconds. Review import_readiness, source_import.page_coverage, seo_coverage, and form_coverage before calling the import ready.
Open the full effects library and previews →
MCP project creation
Create a project for the token owner and attach its first Site Studio site record using the separate projects.create permission. The action is idempotent and adds only the resulting project/site to the calling token’s existing scope without changing its permissions. It does not provision hosting, verify registrar/DNS ownership, write site files, or publish production.
POST /api/control-plane/projects
Authorization: Bearer SC_TOKEN
Content-Type: application/json
{"name":"New project","domain":"example.com","confirm":true,"idempotency_key":"new-project-20261014"}
Control-plane reads
GET /api/control-plane/status
GET /api/control-plane/projects
GET /api/control-plane/sites
GET /api/control-plane/easyapp
GET /api/control-plane/sync-health
GET /api/control-plane/error-audit?scope=all&category=all
GET /api/control-plane/tasks
GET /api/control-plane/activity?site_id=SITE_ID
GET /api/control-plane/site-search?site_id=SITE_ID&q=SEARCH&type=link
GET /api/control-plane/conversations?site_id=SITE_ID
GET /api/control-plane/messages?conversation_id=CONVERSATION_ID
GET /api/control-plane/tickets?site_id=SITE_ID
GET /api/control-plane/ticket-messages?ticket_id=TICKET_ID
GET /api/control-plane/galleries?site_id=SITE_ID&page=home
GET /api/control-plane/gallery-image?site_id=SITE_ID&asset_id=ASSET_ID
GET /api/control-plane/site-services?site_id=SITE_ID
POST /api/control-plane/site-services {"site_id":SITE_ID,"action":"save","title":"..."}
GET /api/control-plane/site-forms?site_id=SITE_ID
GET /api/control-plane/error-audit and MCP sitecommander_error_audit return categorized PocketPapi platform errors (platform administrators only), authorized customer-site errors/reports, and failed API/MCP calls. Use scope=all, authorized_sites, site, project, or platform; filter category=site_error for customer-site runtime/hosting errors only. Severity is critical (source marked critical or repeat failures need prompt verification), warning (possible workflow/application failure), info (often expected rejection or throttling), or unassessed (feedback without technical evidence). Recommendation levels explain whether to verify, prepare a fix, wait for cooldown, or consider an optional improvement. Historical records do not prove a current defect. Each source has its own cursor; continue while its has_more is true. The audit asks whether to implement confirmed high-priority fixes, stage recommended customer-site fixes, or outline optional improvements. It is read-only and never stages or publishes a fix.
Site Studio search
New Site Studio starter sites index labeled links from public, indexable pages as a separate Links result category. Use the site-scoped REST route or sitecommander_site_search. Production reads the latest published index by default; pass environment=staging to search an authorized staging index. The public search page reads its local index and never receives a bearer token.
GET /api/control-plane/site-search?site_id=123&q=donate&type=link
Authorization: Bearer SC_TOKEN
MCP: sitecommander_site_search {"site_id":123,"q":"donate","type":"link"}
Site Studio links and social bar
sitecommander_site_studio_edit accepts per-link affiliate_provider, affiliate_tracking_id, and (for eBay) affiliate_custom_id on add_link_list, and the same tracking fields on insert_link. A supplied link ID takes priority; blank values use the selected site's Shop connection and then PocketPapi's central Shop connection. Amazon Partner Tags apply only to Amazon URLs. eBay item links use the official Browse API affiliate URL; use an eBay-generated Partner Network URL for other destinations. Affiliate anchors receive sponsored/nofollow attributes and an adjacent disclosure. Set social_bar:true with social_platform on a link item or inserted link to add its HTTPS profile to the social icon bar, or use operation:add_social_bar with social_links to manage the bar directly.
Additional targeted edits are add_profile_search_form (accessible GET search under one profile heading), remove_link_list_section (one exact link-list heading), and update_link_label_by_url (one exact HTTPS URL with its destination preserved). Set source_environment=production only to read the live page as a staging baseline; every write remains in Site Studio. Writes without change_set_id autosave into the current site staging draft and return the same draft ID plus its preview. sitecommander_site_studio_widget_embed_stage enables or disables only the selected site's exact widget embed across public/unlisted pages and never returns its key.
Before completing an AI Command Center task, save its exact-result review with sitecommander_completion_review (MCP) or completion_review_create (AI workspace REST action). It requires the shared five-step premortem: seven ranked failure modes, likely/dangerous verdict and hidden assumption, adversary analysis, applied rebuild plus 3–5 evidence-backed checks, and seven dated tripwires. Fatal flaws and failed checks block completion. Then call task_complete with its premortem_review_id. Site-mode scheduled tasks and bundled local runners run the same review before recording completion. Before a Site Studio publish, customer-facing social schedule/post/reply, commerce publish, issue resolution that closes a linked AI task, or least-privilege system-error resolution, create an MCP action review bound to the exact action arguments and pass the review ID when retrying that action. This does not replace separate owner approval to publish. AI Command Center task calls require workspace.write and MCP write scope; they do not publish site changes.
sitecommander_site_studio_edit {
"site_id":123,"confirm":true,"operation":"add_link_list","path":"index.html",
"heading":"Featured","links":[
{"label":"My Amazon pick","url":"https://www.amazon.com/dp/ASIN","affiliate_provider":"amazon","affiliate_tracking_id":"yourstore-20"},
{"label":"Facebook","url":"https://www.facebook.com/example","social_bar":true,"social_platform":"Facebook"}
]
}
Complete Site Studio MCP controls
The MCP contract includes the no-AI structural and visual controls exposed in Site Studio: sitecommander_site_studio_block_add supports the editor's block catalog; sitecommander_site_studio_media lists approved site images or MP4/WebM videos; sitecommander_site_studio_media_import saves one owner-selected public HTTPS image; sitecommander_site_studio_media_import_source crawls the complete discoverable same-host website for public photo references and imports them in batches of two, or imports images linked from a public Facebook Photos/posts page, without per-image confirmation. If server-side HTML misses a public gallery rendered in the connected browser, up to two visible photo_url/image_url pairs and browser_total can be supplied per offset; the server re-fetches only profile-matching Facebook photo links and fbcdn.net images; sitecommander_site_studio_effect_apply applies compatible managed effects, including an approved lazy-loaded video background with an optional poster; sitecommander_site_studio_page_role assigns Home/team/customer routing; and sitecommander_site_studio_pagespeed audits one public page. Media imports stay in the exact site's private library and do not alter a page or production. PageSpeed sends only the public page URL to Google, refuses sign-in protected pages, and allows four audits per site per minute from one client. A throttled result contains no score.
App Studio is also available through shared MCP: sitecommander_app_studio lists, saves, or stages a web target in the current Site Studio draft; sitecommander_app_studio_source reads or edits generated files. Both follow the authorized site scope and require explicit confirmation for writes. Review the returned staging preview before separately approving any publish. Outputs include responsive web, iOS/xTool SwiftPM, and Android/Gradle source. Native source can be sent to an optional HTTPS build runner after explicit owner approval; AccuWeb itself does not run native SDKs or signing.
sitecommander_site_studio_blocks {}
sitecommander_site_studio_block_add {"site_id":123,"confirm":true,"path":"index.html","block_key":"link_list","heading":"Featured links","link_items":[{"label":"Capital One Shopping","url":"https://i.capitalone.com/JEcMjImOz"}]}
sitecommander_site_studio_media {"site_id":123,"media_type":"video"}
sitecommander_site_studio_media {"site_id":123,"media_type":"poster"}
sitecommander_site_studio_media_import {"site_id":123,"confirm":true,"source_url":"https://images.example.com/hero.png","name":"Hero","asset_kind":"image","idempotency_key":"hero-image-import-01"}
sitecommander_site_studio_media_import {"site_id":123,"confirm":true,"source_url":"https://images.example.com/logo.png","name":"Company logo","asset_kind":"logo","idempotency_key":"company-logo-import-01"}
sitecommander_site_studio_media_import_source {"site_id":123,"confirm":true,"source_url":"https://www.example.com/gallery/","source_type":"website","offset":0,"limit":2,"idempotency_key":"business-gallery-import-01"}
sitecommander_site_studio_media_import_source {"site_id":123,"confirm":true,"source_url":"https://www.facebook.com/people/example/61552250065597/?sk=photos","source_type":"social_photos","offset":0,"limit":2,"browser_total":2,"browser_photos":[{"photo_url":"https://www.facebook.com/photo.php?fbid=123456789012345&set=pb.61552250065597.-2207520000","image_url":"https://scontent.example.fbcdn.net/photo-1.jpg","name":"Repair photo"},{"photo_url":"https://www.facebook.com/photo.php?fbid=123456789012346&set=pb.61552250065597.-2207520000","image_url":"https://scontent.example.fbcdn.net/photo-2.jpg"}],"idempotency_key":"facebook-gallery-import-01"}
sitecommander_site_studio_effect_apply {"site_id":123,"confirm":true,"path":"index.html","effect_id":"video-cinema-stage","selector":".hero","animation":{"background_video_asset_id":42,"background_video_poster_asset_id":18}}
sitecommander_site_studio_pagespeed {"site_id":123,"path":"/","strategy":"mobile"}
Site Studio galleries are project/site-scoped and reuse approved central media. Saving with POST /api/control-plane/galleries autosaves into the current site draft and returns its preview; generated sites read only the published gallery snapshot through a server-side bridge, so bearer tokens and storage paths never reach the browser.
Service management is site-scoped through sitecommander_services, sitecommander_service_save, and sitecommander_service_delete or GET/POST /api/control-plane/site-services. Writes attach the current catalog to the same staging draft. Add the Site Studio service_catalog block to imported Home or Services pages; its server-side runtime renders only the published snapshot, uses same-site approved media, and shows a clear empty state. Publishing remains separate and requires approval of the reviewed draft.
Site Studio forms are project/site-scoped. Saving a field set, CTA, or helper note with POST /api/control-plane/site-forms autosaves into the current site staging draft and returns its preview. The generated site keeps its published form until the reviewed draft is explicitly published; public runtime reads never expose drafts.
GET /api/control-plane/site-protection?site_id=SITE_ID POST /api/control-plane/site-protection
Copyright protection is site-scoped and supports off, light, balanced, and strict modes with page, Shop, and Gallery areas. The restrictions.disable_print option omits protected images from browser print/PDF output with a notice. These are deterrence controls, not DRM; they cannot prevent screenshots, cameras, or determined browser inspection.
Sender photos and BIMI
Manage site-scoped sender profiles and domain-level BIMI from the authenticated site page or the bearer API. Hosted sender photos are available to systems that support public avatar assets; they cannot override recipient-managed Gmail, Microsoft 365, or Outlook contact photos.
GET /api/control-plane/mail/profiles?site_id=SITE_ID POST /api/control-plane/mail/profiles GET /api/control-plane/bimi/status?site_id=SITE_ID POST /api/control-plane/bimi/prepare POST /api/control-plane/bimi/verify GET /api/control-plane/bimi/record?site_id=SITE_ID
Use photo_base64 for a PNG, JPEG, or WebP up to 4 MB. Use svg_base64 for a validated SVG Tiny PS logo and certificate_pem_base64 for an optional VMC/CMC chain. The prepare response gives the DNS name and TXT record; PocketPapi never changes DNS.
{"site_id":123,"sender_email":"hello@example.com","sender_name":"Example Company","photo_base64":"data:image/png;base64,..."}
{"site_id":123,"selector":"default","dkim_selector":"resend","avatar_preference":"brand","svg_base64":"data:image/svg+xml;base64,..."}
The verify response distinguishes `ready`, `yahoo_eligible`, and `not_ready`. Gmail generally needs a VMC or CMC for BIMI display; Yahoo also considers volume, reputation, and engagement; Outlook profile photos are normally controlled by the Microsoft account, Exchange directory, or contact.
Activity and custom fields
Send messages, subscriptions, contacts, and leads with your own taxonomy:
POST /api/control-plane/events
{"site_id":123,"type":"message","external_id":"crm-8842","category":"support","subcategory":"billing","folder":"vip","source":"contact-widget","status":"open","priority":"high","tags":["enterprise"],"custom_fields":{"plan":"pro"},"message":"I need help."}
Additional keys are preserved as metadata. Duplicate external IDs for the same site are ignored.
Site-scoped server connection
Open a site's details in the authenticated command center and choose Connect site to command center. The owner receives a site-scoped scc_... bearer token exactly once. Store it in the site's server environment and rotate it from the same page if it is lost or exposed. It cannot access another site or the protected internal Current Site workspace.
COMMAND_CENTER_URL=https://YOUR-COMMAND-CENTER.example.com
SITE_COMMANDER_SITE_ID=123
SITE_COMMANDER_TOKEN=scc_...
POST /api/control-plane/events
Authorization: Bearer SITE_COMMANDER_TOKEN
{"site_id":123,"type":"lead","source":"website-form","email":"jordan@example.com","message":"Please call me."}
Use this credential for site-scoped REST reads, approved chat replies, and POST /mcp. The command center records the interface, action, site, result, duration, and safe error text in Audit Logs.
Google reviews
GET /api/control-plane/reviews?site_id=SITE_ID GET /api/control-plane/zernio/reviews?site_id=SITE_ID POST /api/control-plane/reviews/reply
Conversations and support tickets
Website conversations and their messages are shared across the visitor widget, Support Inbox, MCP, API, and PocketPapi mobile app. Support tickets created from the site are available through the tickets and ticket-messages reads.
POST /api/control-plane/messages/reply
{"conversation_id":456,"message":"Thanks — we will follow up.","metadata":{"category":"support","folder":"vip"}}
PocketPapi mobile client
Pocket Papi is the shared iOS and Android client for connected sites. Every project receives Pocket Papi; public sites appear automatically, while private sites are added with a one-time configuration code generated from Project Setup. Discovery is not data access: users still sign in with an existing Pocket Papi workspace account before the app can load leads or reply to live chats. The older /api/easyapp/* paths remain only as compatibility routes.
GET /api/easyapp/sites
POST /api/easyapp/configure
{"configuration_code":"EA-..."}
POST /api/easyapp/auth/login
{"site_key":"...","email":"owner@example.com","password":"..."}
Authorization: Bearer EA_TOKEN
GET /api/easyapp/me
GET /api/easyapp/leads
POST /api/easyapp/leads/status
GET /api/easyapp/conversations
GET /api/easyapp/messages?conversation_id=456
POST /api/easyapp/messages/reply
PocketPapi sessions expire after 30 days and are stored only as hashes. Never put an MCP token in a mobile bundle. Replies are written to the same conversation records used by the website widget and Support Inbox.
Authorized MCP/API clients can idempotently prepare the connected app workspace from the builder without receiving private configuration codes or signing credentials:
POST /api/control-plane/easyapp
Authorization: Bearer SC_TOKEN
{"site_id":123,"app_name":"PocketPapi","enabled":true,"visibility":"private"}
MCP: sitecommander_easyapp_ensure
Optional PocketPapi command-center app
The native PocketPapi iOS/Android app includes a project-scoped Agents workspace. It uses the signed-in account's selected Staff project to create and message missions, review exact agent-proposed notes or one email draft, read encrypted agent inbox messages, explicitly share one selected message with the project provider for a private summary mission, manage project agent identities, and control an optional external computer task. Its bearer-token endpoints ignore posted project scope; credential values remain in the server-encrypted vault and are never returned to the app. Phone assignment uses a number already configured for that project and reserves it to one agent across provider accounts and projects; legacy duplicate assignments are flagged for owner resolution. Computer tasks require an exact owner confirmation and a configured external runner; AccuWeb does not run a browser worker.
Authorization: Bearer MOBILE_TOKEN
GET /api/mobile/agent-missions
GET /api/mobile/agent-missions/{room_id}
POST /api/mobile/agent-missions
POST /api/mobile/agent-missions/{room_id}/messages
POST /api/mobile/agent-missions/{room_id}/memory
POST /api/mobile/agent-missions/{room_id}/status
POST /api/mobile/agent-missions/{room_id}/actions/{action_request_id}
POST /api/mobile/agent-missions/{room_id}/computer
POST /api/mobile/agent-missions/{room_id}/computer/{job_id}/refresh
POST /api/mobile/agent-missions/{room_id}/computer/{job_id}/control
POST /api/mobile/agent-identities/setup
GET /api/mobile/agent-identities/{agent_id}/inbox
POST /api/mobile/agent-identities/{agent_id}/inbox/{message_id}/mission
POST /api/mobile/agent-identities/phone/assign
POST /api/mobile/agent-identities/phone/clear
These endpoints use the Staff project saved on the mobile token. Request-supplied project identifiers do not change authorization. Action review requires the exact payload hash returned with the mission conversation. Inbox review requires an explicit disclosure confirmation; selected message content is sent only to the saved project provider and stays encrypted at rest. Email approval sends one displayed plain-text message from the agent's project alias; transport acceptance does not confirm inbox delivery.
The native source contract also supports the portal in a native client. It uses the existing account, returns only accessible projects, sites, tasks, activity, and business-growth inventory, and does not include the protected internal Current Site workspace. Source export remains an internal compatibility workflow; there is no separate Apps destination in the portal.
POST /api/command-center/auth/login
{"email":"owner@example.com","password":"..."}
Authorization: Bearer SCM_TOKEN
GET /api/command-center/summary
GET /api/command-center/projects
GET /api/command-center/sites
GET /api/command-center/marketing
GET /api/command-center/tasks
GET /api/command-center/activity
GET /api/command-center/integration-logs
The integration-log endpoint is permission-gated for administrator troubleshooting and never returns bearer tokens or request bodies.
Central Zernio gateway
GET /api/control-plane/zernio/accounts?site_id=SITE_ID GET /api/control-plane/zernio/reviews?site_id=SITE_ID POST /api/control-plane/zernio/posts?site_id=SITE_ID
The gateway uses encrypted central Zernio credentials, enforces site scope, and audit logs operations. One shared PocketPapi social profile serves authorized projects; PocketPapi assigns individual connected accounts to projects from the social account cards, and site IDs select only the assigned accounts. This does not create separate provider profiles or forward arbitrary Zernio URLs.
Project designs and product drafts
GET /api/control-plane/design/assets?site_id=SITE_ID POST /api/control-plane/design/assets GET /api/control-plane/design/ideas?site_id=SITE_ID POST /api/control-plane/design/ideas POST /api/control-plane/design/product-draft
These endpoints and the matching MCP tools are scoped to one authorized project site. Agent writes use project-scoped site.edit to upload private design assets and create or revise ideas; approval stays with a person in AI Command Center. Multipart uploads follow the current AccuWeb PHP upload limit; MCP base64 is capped at 4 MiB. Product drafts require a previously approved idea and compatible private asset. Read the complete prepared product payload and confirm only with its exact preparation ID and hash; confirmation creates a private $0 draft without publishing or ordering. Product drafting also requires commerce.write and project Shop access.
MCP
Connect to https://pocketpapi.com/mcp. Use sitecommander_api_guide to read the complete Markdown contract. Read tools include the token owner’s authorized projects/sites, enabled agents, status, tasks, activity, conversations, chat messages, support tickets, ticket messages, reviews, and the shared Zernio account pool. Use project_id for AI workspace and task actions. sitecommander_site_search searches public Site Studio content, including the Links category. Site Studio MCP exposes page content/SEO, navigation, page roles, all supported no-AI blocks, approved-media image replacement, managed effects, forms, galleries, protection, and public-page PageSpeed audits. Link controls support per-link affiliate IDs and social bar links. Use sitecommander_agents before linking an agent to a scheduled Site or Local task. sitecommander_send_message replies to live website chats and appears in the site widget and Support Inbox.
Agent missions are available at /ai/agents/missions and /api/agent-missions, with MCP tools for project-scoped rooms, delegation, owner-maintained mission notes, reversible opt-in sharing of approved project knowledge, and owner-confirmed review of a selected encrypted inbox message. The coordinate_agents MCP prompt guides Site Studio clients through scoped missions, optional computer-runner setup, and approval limits. Mission creation defaults to excluding approved project knowledge. Owners may explicitly share up to 8 current/future approved project-level documents (6,000 characters per run) with the saved project provider and turn that off later through `POST /api/agent-missions/{room_id}/context`; the matching mobile endpoint is `/api/mobile/agent-missions/{room_id}/context`. Email-review-only missions cannot enable broader context. Conversation reads include proposed actions and their exact payload hashes. POST /api/agent-missions/{room_id}/actions/{action_request_id} and sitecommander_agent_mission_action_review support exact owner review of mission-memory updates and one-recipient plain-text email drafts. Email approval sends the displayed message once from the agent's ready project alias through PHP mail(); a successful handoff is not proof of inbox delivery. sitecommander_agent_computer and the computer routes support mission-scoped task start, status refresh, pause, resume, and stop only when a configured external runner passes its health/isolation and network-egress handshake; summaries are screened, and cPanel cron prunes terminal history after 90 days. AccuWeb does not run the browser worker. Agents cannot create accounts, send SMS, place calls, buy numbers, edit files, or publish through the email/note review path. /ai/agents/identities and /api/agent-identities manage numbered plus-address identities on each project's existing shared mailbox, configured provider numbers, and encrypted account credentials. Owners may store API/OAuth tokens. Saving a password also requires project-level manage_project access, an explicit checkbox for the named signup, and a private app encryption key of at least 32 bytes; this records approval to store a secret only and does not create an account. Credential reads expose metadata only, and credentials stay unavailable to agents until an exact-scope server-side adapter exists. GET /api/agent-identities/{agent_id}/inbox and POST /api/agent-identities/{agent_id}/inbox/{message_id}/mission provides encrypted-at-rest email to an authenticated project agent manager; message bodies are not returned through MCP or sent to AI automatically. An owner may explicitly start one private review mission from a selected email after confirming provider disclosure; content stays encrypted at rest, verification-code/credential-shaped messages are rejected, and the review-only mission cannot reply or queue agent actions. MCP can read labels and status, never raw credentials; `sitecommander_agent_missions` action `from_inbox` requires `confirm=true` after the owner approves sharing that exact message with the selected project provider. Mission agents cannot retrieve tokens, passwords, or hosting secrets.
Security
- Bearer tokens are private credentials.
- Site-scoped requests require a site ID.
- The internal Current Site workspace is never exposed.
- Zernio keys are never returned.
- Gateway actions are audit logged.