Shiply

Send a draft contract to the customer. Validates all 8 fields are non-empty, computes content_hash, flips project to contract_sent, fires the customer email. Same handler works for amendment drafts — sending an amendment does not move project state.

Read the current state of a contract: status, sent_at, viewed_at, signed_at, signer info, content_hash, plus any amendments. Use this to check whether a customer has signed yet. Returns { contract, amendments } — the contract row matches GET /api/v1/contracts/{id}.

Provision a SQL database — D1 (default, free) or Neon Postgres (--postgres, developer plan). Optionally attach it to an owned site's Worker env in the same call (siteSlug); otherwise attach it later with attach_database.

Create a private cloud Drive (plan-limited). Pass client to file it under a client.

Publish (or upsert) a marketplace listing for an owned site. Requires Stripe Connect set up (status='ready' — see get_connect_status). priceCents = whole-dollar between 100 and 999900. termsMode='standard' uses shiply's template; 'custom' requires termsCustom ≥50 chars. jurisdiction is required (e.g. 'California, USA').

Spin up a new customer-intake project on the dev's account. Returns the project row plus intakeUrl — the public link the customer fills out (10-step wizard). If customerEmail is provided, shiply also emails them the intake invite. Use originatedFromSiteId to link a project to an existing site (e.g. 'redesign this site').

Provision a demand test in one call: deploys a landing page with a native email-capture form and creates a confirmed-subscriber segment. Returns testId + live siteUrl. Share the siteUrl to collect signups; each signup gets a double-opt-in confirmation. Read progress with get_test_status.

Return up to `limit` records (default 1000, max 5000) from a collection — for snapshotting into agent context. For larger sets use the CLI: `shiply data export <slug> <collection>`.

Insert one record into a collection. Goes through the same public visitor endpoint a browser would use — manifest access.insert decides whether it is allowed. Use to seed waitlist data, test forms end-to-end, etc.

List collections declared in an owned site's .shiply/data.json with current record counts. Empty list means the site has no manifest yet — scaffold one with `shiply data init`.

Page records from an owned site's collection, newest-first. limit ≤ 200 (default 50). cursor from a previous response's nextCursor.

PERMANENTLY delete a database and all its data. Irreversible — confirm with the user first.

Take a listing off the public marketplace by moving it to status='draft'. Marketplace v1 keeps the row so analytics + future re-listing work — there's no hard delete. Sold listings can't be modified. Use to stop accepting offers without losing pricing history.

PERMANENTLY delete a site and all stored files. Irreversible — confirm with the user first.

Remove one variable by name.

Deploy a Worker function to a site. The function runs on every request to <slug>.shiply.now and can receive webhooks, run on cron triggers, and access bindings (D1, secrets, env vars). Requires Developer plan. Use when the user wants webhook receivers, cron jobs, or a backend for their site.

Stop exposing a variable to a site's Worker env. Takes effect on the site's next function deploy.

Delete a file from a Drive.

List files in a Drive (driveId = drv_…, or "default"). Optional prefix filter.

Write a file into a Drive (driveId = drv_… or "default"). content is utf8 or base64. Use for agent memory, notes, context, assets.

Server-side copy of an owned site under a new slug — instantly live. Copies files + title; does NOT copy access settings, domains, or data. Great for iterating on variants.

Return a JSON bundle of the user's profile, sites, Site Data, drives, and metadata (secrets excluded). Data portability.

Toggle whether an owned, public site appears in the public shiply Explore gallery (https://shiply.now/explore). Only public-access sites are eligible.

Forward a message from a thread (default: the most recent message) to a NEW recipient with an optional intro note. Body is composed as note + standard '---------- Forwarded message ----------' quote of the original. Goes from the thread's existing shiply alias so replies still route through the inbox. Subject defaults to 'Fwd: <original>'.

Get the signed-in account's plan, capabilities, and upgrade URL. Call this FIRST when figuring out what features you have access to — it tells you exactly what's available and what's blocked. The upgrade_url is human-clickable; show it in chat when a feature requires a higher plan. Returns plan id + name + subscription status, hard limits (sites, databases, custom domains, drives), and a capability matrix listing every gated feature (workers_lite, databases_neon_postgres, custom_domains, etc.) with whether you have access and the minimum plan needed.

Daily page views per site for the last 30 days.

Return the seller's Stripe Connect state: not_started | in_progress | pending_verification | ready | disabled. When status != 'ready' the user can't list sites. Includes a one-shot onboardingUrl (if not_started or in_progress) and dashboardUrl (if ready). Refreshes from Stripe on every call.

Return the deployed function source + metadata for a site, or null if no function deployed.

Read recent runtime logs for a site's per-site Worker (console output, request summaries, exceptions) from Cloudflare Workers Observability — 7-day retention, newest first. Use this to debug a deployed function: each event has timestamp, level, message, outcome, statusCode, requestId, and CPU/wall time. Also returns a CF dashboard deep-link.

Read one of the dev's projects by id — includes label, status, customer details, intake responses, AI brief, drive folder. Use before update_brief / regenerate_brief.

Site settings + version history for one of my sites.

Read an owned site's current access policy (mode: public/password/restricted, allowedEmails, allowedDomains, hasPassword). Read-only counterpart to set_site_access — check before changing it.

ONE consolidated object: page funnel (views, signups, confirmed, conversion) ⊕ email events (delivered/opened/clicked/bounced) ⊕ a computed verdict. The single place to check progress — never query email separately.

Return threads tagged as complaints (spam reports) OR bounces (recipient rejected). Read these before any further sending.

List cron triggers for a site's deployed function. Each cron is (path, schedule, lastRunAt).

List registered custom domains grouped with their subdomains, each subdomain's site and status, and the detected provider.

List the SQL databases (D1 or Neon Postgres) on my account, including which owned site (if any) each is attached to. Call this BEFORE db_query/db_schema-style work to discover a databaseId — those live on a per-database MCP server reached via GET /api/v1/databases/{id} (see llms.txt), which this id feeds.

List connected custom domains with status.

List the user's private cloud Drives (id, name). Optional clientId filters to one client.

List the user's email inbox threads (outbound demand-test sends + inbound replies / unsubscribes / complaints / bounces). Filter by tag.

Return every marketplace listing the seller owns (any status: draft, live, paused, sold). Includes site slug and current price. Use to see what's for sale across the account.

List captured contacts for a (site, collection) mailbox, optionally filtered by status (signed_up/confirmed/unsubscribed). Returns email, status, confirmedAt, createdAt, and captured fields.

Return every marketplace order the user PURCHASED. Most recent first. Shows the acquired site, paid amount, and whether the order is still inside the 30-day refund window. Use to recap what the user owns by purchase.

Return every marketplace order for sites the user sold (incl. pending, paid, refunded, failed, disputed). Most recent first. Use to surface revenue + which orders are still inside the 30-day refund window (refundExpiresAt > now).

Return the customer-uploaded files for one project (path, size, contentType, createdAt). Empty when no drive folder exists yet (no uploads). Use to inspect what intake assets the customer attached.

List the dev's customer-intake projects (newest first). Optional filters: status (draft|intake_open|brief_ready|brief_failed|archived), q (case-insensitive match on label or customer email), limit (default 100). Use to triage what's in flight before opening a specific project.

List secret names (values not returned) for a site's deployed function.

Return every BYO sending domain the user has added (id, domain, fromAddress, status: pending|verified|failed, DNS records). Use to inspect verification state or find the id of a domain to verify/remove.

Read the email threads (received, sent, web captures) for the agent's sites. Optionally scoped to one site by slug.

Names of the variables attached to an owned site's Worker env (values never shown here).

List the sites owned by this API key. Optional clientId filters to one client.

Return the user's suppression list — addresses (and full domains) that shiply skips when sending. Bounces, complaints, manual user adds, and AI-detected unsubscribes all land here.

Return every active demand test's reply / inbound address (<slug>@<sitesDomain>). Use this when you need to TELL someone where to email — e.g. drafting a reply or sharing a test's contact address. Mail sent to these aliases lands in /dashboard/inbox tied to the test.

List your demand tests with signups + confirmed counts.

Shortcut for list_inbox with filter=unsubscribes — shows every thread tagged as an opt-out request.

List the encrypted variables. Values are masked unless reveal=true.

List a site's finalized deploys newest-first (id, createdAt, isLive, fileCount, bytes), capped at 20. Pair with rollback_site: pick a version id from here and re-point the site to it.

Zero the unread counter for a thread. Useful after the agent has read but not acted. read_thread already calls this implicitly; use this explicitly when you want to clear unread without re-fetching the thread body.

Copy the EXACT live bytes of one owned site (srcSlug — your preview) into another owned site (destSlug — your production site / custom domain), no rebuild. Dest keeps its slug, domains, and access settings; only the served bytes change.

Snapshot a Drive (or a prefix of it) into a new live site at <slug>.shiply.now. Files copied server-side.

Publish files to the web → live URL at <slug>.shiply.now. UPDATING: never create a new site for changes — re-call with claimToken (anonymous sites) or slug (sites you own with a Bearer key) and the SAME URL gets the new version. Unchanged files are hash-skipped server-side, so re-publishing (including retrying a failed publish) is cheap — always update the same site rather than creating a new one. Works WITHOUT auth (anonymous: 24h lifetime, returns claimToken/claimUrl — SAVE THEM). With a Bearer shp_ key sites are permanent. ≤50 files / 2 MB inline; bigger: REST flow per https://shiply.now/ll…

Download the current files of a site you own (or created via a platform connection) so you can edit and republish to the same slug with publish_site. Static sites return editable source; framework/SSR sites return the built bundle (`.shiply/bundle/*`), not original source.

Return the thread metadata + all messages in chronological order. Use list_inbox first to get a threadId.

Issue a full refund on a paid order the user sold. Must be inside the 30-day refund window (server enforces). Triggers a Stripe refund; the webhook flips the order to 'refunded' and reverts site ownership to the seller. Idempotent on already-refunded orders.

Re-run the MiniMax/Anthropic brief generator from the project's current intake_responses and persist the result. Flips status to brief_ready on success or brief_failed on error. Use after the customer edits answers post-submit, or when the first AI attempt failed.

Remove a cron trigger from a site's deployed function.

Remove a registered custom domain and all its subdomains; they stop serving immediately.

Remove a connected domain (by id). It stops serving immediately.

Remove the deployed Worker function from a site (and all its routes, secrets, and cron triggers). Site falls back to static-only serving. Irreversible.

Remove a secret from a site's deployed function. The binding disappears on next request.

Delete a BYO sending domain. Any demand tests bound to it fall back to the managed shiply sender. Also GCs the underlying Resend domain. Irreversible — re-adding requires re-verifying DNS.

Delete one suppression by id. Use list_suppressions first to find the id.

Send an email reply on an existing thread. Goes FROM the original recipient address (the <slug>@shiply.now alias the sender used) and TO the original sender. Threaded via RFC 5322 In-Reply-To so Gmail/Outlook group it with the original. Subject defaults to 'Re: <original>' when omitted. Cap at 20,000 chars. Use after read_thread to make sure you're replying to the right conversation.

Re-send the double-opt-in confirmation to a signup that has not confirmed yet.

Re-fire the 'your developer sent you a project intake' email to the project's customer. Throws invalid_request if the project has no customerEmail (the dev needs to set one via the dashboard first — customer email isn't agent-patchable). Use when the customer says they didn't receive the link.

Move an archived project back to status='draft' so it reappears in the active list. Idempotent on non-archived projects? No — server rejects the transition unless the project is currently archived.

Re-point a site to any finalized version (rollback or roll-forward). Get version ids from get_site. Serving updates immediately.

Send a campaign to this test's confirmed (double-opt-in) subscribers — the "we're live" email. An unsubscribe link is added automatically. Fails if there are no confirmed subscribers yet.

Send an email from <slug>.shiply.now's managed sender. The site can send transactional/notification email — no SMTP setup. Rate-limited and spam-checked; replies route back to the site inbox.

Send a one-shot broadcast to the confirmed (double-opt-in) subscribers of a (site, collection) mailbox. Spam-checked; unsubscribe footer auto-added. Fails if no confirmed subscribers exist yet.

Set or update a cron trigger on a site's deployed function. Schedule is crontab syntax (UTC). Path is the URL the cron handler should fire on (for the worker's scheduled() handler context).

Give ONE site a vanity URL: rename it to <handle>.shiply.now (3-30 chars, a-z 0-9 -). The old address 301-redirects for 30 days. (For a portfolio page listing all your sites, use set_profile instead — that lives at shiply.now/@<handle>.)

Path-mounting: serve an owned target site at a path on an owned host site (host/docs -> target). location is a path like "docs", or "__root__" for the host root. Both sites must be owned by you. Pass remove=true to unmount.

Turn a Site Data collection into a mailbox: double opt-in, owner notifications, sending domain, branding. Call once per (site, collection) to configure how captured leads are handled.

Mark a hostname as the primary (canonical) URL for its site. Sibling hostnames (apex + www both pointed at the same site) start 301-redirecting to it, preserving path + query. The host-side fix for the duplicate-content SEO problem. The first subdomain you add for a site is primary by default; call this only when you need to switch.

Create or update the user's public PORTFOLIO page at shiply.now/@<handle> (handle 3-30 chars a-z0-9-) — a landing page listing the user's sites. This is NOT a site's address: to give one site a vanity URL like <handle>.shiply.now, use set_handle instead. enable shows the profile; autoAdd auto-lists new sites. Use after publishing to give the user a shareable portfolio.

Set a CF Worker secret on a site's deployed function. Value is encrypted-at-rest and accessible as env.<NAME> inside the worker. Use for Stripe keys, Resend API keys, etc.

Protect an owned site (paid plans). mode 'public' (anyone), 'password' (supply password), or 'restricted' (supply allowedEmails and/or allowedDomains — only those can request a login code). Changing any setting signs out existing visitors.

Upsert a key/value in the user's encrypted variable store (UPPER_SNAKE name, ≤8 KiB value). Use for API keys the user's sites/agents need, e.g. SUPABASE_URL. NOTE: saving alone does NOT expose it to any site Worker's env — attach it to a specific site with attach_variable (takes effect on that site's next function deploy).

Check any shiply slug or custom hostname: TLS certificate (issuer, days left) + HTTPS probe. ready=true means live.

One-paragraph summary of the thread, oriented to the most actionable signal (interest, complaint, question, unsubscribe).

For a connected custom domain, (re)write the CNAME records for all its subdomains automatically and report what changed. For unconnected domains, returns the records to add manually.

Restore an archived thread (clears archivedAt). It reappears in the default inbox list. Pair with list_inbox filter=archived to find archived threadIds first.

Overwrite the project's working brief (jsonb). Hard-capped at 500 KB. Use to revise the AI-generated brief by hand; the original AI output is preserved separately in briefAiOriginal so you can always compare. Does not change status.

Patch a listing by siteSlug — change price, pitch, terms, jurisdiction, or status (draft|live|paused). Sold listings cannot be edited. Status transitions enforced server-side. Use to pause sales or drop the price.

Confirm a pairing code shown in the user's browser at https://shiply.now/claim/<slug>?pair=1. Use ONLY in the agent session that originally published the site — it reads the claimToken from .shiply.json in the current working directory and proves to Shiply that this agent session is authorised to claim the site. After verification the user is auto-redirected to /welcome and the site binds to their account.

Trigger Resend to re-check the domain's DNS records, persist the new status. Call after adding the DNS records returned by add_sending_domain. Status flips to 'verified' once SPF + DKIM + MX all check out.

Edge-check a shiply slug or custom hostname and return a structured readiness report: status (LIVE/PENDING), SSL details (valid, issuer, daysLeft), HTTP probe, and a presigned thumbnail URL when available. Use this after publishing to confirm the site is reachable.

Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.