@sakupa/mcp 0.7.0 → 0.7.2

package/dist/bin.js

@@ -7,6 +7,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 var SERVICE_DOMAIN = "sakupa.com";
 var DEFAULT_API_BASE_URL = "https://api.sakupa.com";
 var FREE_SITE_URL_SUFFIX = `.${SERVICE_DOMAIN}`;
+var TEST_ACCESS_HEADER = "x-sakupa-test-token";
 var FREE_SITE_TTL_HOURS = 24;
 var FREE_SITE_MAX_TOTAL_BYTES = 10 * 1024 * 1024;
 var PAID_SITE_MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
@@ -127,7 +128,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.0";
+var SAKUPA_MCP_VERSION = "0.7.2";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -464,6 +465,31 @@ var utf8Encoder = new TextEncoder();
 // ../core/dist/services/subscriptions.js
 var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 
+// src/config.ts
+var TEST_API_BASE_URL = "https://api-test.sakupa.com";
+function previewHostPatternFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+}
+function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
+  const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
+  if (apiBaseUrl === TEST_API_BASE_URL) {
+    if (testAccessToken.length === 0) {
+      throw new Error(
+        "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
+      );
+    }
+    return { apiBaseUrl, projectDir, testAccessToken };
+  }
+  if (testAccessToken.length > 0) {
+    throw new Error(
+      `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
+    );
+  }
+  return { apiBaseUrl, projectDir };
+}
+
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -1371,6 +1397,7 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   return targets.length;
 }
 function registerTools(server, ctx) {
+  const previewHostPattern = previewHostPatternFor(ctx.apiBaseUrl);
   server.registerTool(
     "analyze_site",
     {
@@ -1404,7 +1431,7 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy_site",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://{shortId}.sakupa.com) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -1587,7 +1614,7 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
   server.registerTool(
     "subscribe_site",
     {
-      description: `Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (${planCatalog()}). Paying makes the site PERMANENT on its {shortId}.sakupa.com URL \u2014 no more 24h expiry; that is the core value of paying. Binding a custom domain afterwards (bind_domain) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first. If the site outgrows its plan, Sakupa shows an over-limit notice and never changes billing automatically. The owner can explicitly choose another plan through Stripe Customer Portal. Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Opening and completing Stripe Checkout is the final subscription confirmation.`,
+      description: `Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (${planCatalog()}). Paying makes the site PERMANENT on its ${previewHostPattern} URL \u2014 no more 24h expiry; that is the core value of paying. Binding a custom domain afterwards (bind_domain) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first. If the site outgrows its plan, Sakupa shows an over-limit notice and never changes billing automatically. The owner can explicitly choose another plan through Stripe Customer Portal. Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Opening and completing Stripe Checkout is the final subscription confirmation.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
@@ -1632,7 +1659,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind_domain",
     {
-      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -2195,8 +2222,23 @@ function registerLifecycleTools(server, ctx) {
 // src/transport.ts
 var FetchTransport = class {
   baseUrl;
-  constructor(baseUrl) {
+  testAccessToken;
+  constructor(baseUrl, options = {}) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
+    if (options.testAccessToken && this.baseUrl !== TEST_API_BASE_URL) {
+      throw new Error(`Test access credentials may only be sent to ${TEST_API_BASE_URL}.`);
+    }
+    this.testAccessToken = options.testAccessToken;
+  }
+  testAccessHeadersFor(_url) {
+    if (!this.testAccessToken) return {};
+    let target;
+    try {
+      target = new URL(_url);
+    } catch {
+      return {};
+    }
+    return target.origin === TEST_API_BASE_URL ? { [TEST_ACCESS_HEADER]: this.testAccessToken } : {};
   }
   async request(req) {
     let url = `${this.baseUrl}${req.path}`;
@@ -2207,7 +2249,8 @@ var FetchTransport = class {
       accept: "application/json",
       [MCP_VERSION_HEADER]: MCP_VERSION,
       ...req.body !== void 0 ? { "content-type": "application/json" } : {},
-      ...req.headers
+      ...req.headers,
+      ...this.testAccessHeadersFor(url)
     };
     const res = await fetch(url, {
       method: req.method,
@@ -2233,7 +2276,10 @@ var FetchTransport = class {
     }
     const res = await fetch(target.url, {
       method: target.method,
-      headers: target.headers,
+      headers: {
+        ...target.headers,
+        ...this.testAccessHeadersFor(target.url)
+      },
       body
     });
     if (!res.ok) {
@@ -2246,25 +2292,25 @@ var FetchTransport = class {
 };
 
 // src/server.ts
-var INSTRUCTIONS = `Sakupa publishes AI-made static websites. AI-made pages, live in seconds.
+var instructionsFor = (hostPattern) => `Sakupa publishes AI-made static websites. AI-made pages, live in seconds.
 
 Workflow:
 1. analyze_site \u2014 check whether this project has deployable static output. If a build is needed
    (Vite/Vue/React/Svelte/Astro/Next static export/Nuxt generate), run the build LOCALLY first,
    then re-run analyze_site.
 2. deploy_site \u2014 uploads ONLY the built static output. The first deploy creates a free temporary
-   site (public URL {shortId}.sakupa.com, valid 24 hours, free banner shown) and stores the
+   site (public URL ${hostPattern}, valid 24 hours, free banner shown) and stores the
    management credential in .sakupa/site.json. Deploying again updates the site and refreshes
    its validity; refresh_site extends validity without uploading.
 3. To make the site PERMANENT, subscribe it to a monthly hosting plan (subscribe_site ->
    Stripe-hosted checkout; water/personal/share/business). Paying makes the
-   {shortId}.sakupa.com URL permanent \u2014 that is what payment buys. Usage over the chosen plan
+   ${hostPattern} URL permanent \u2014 that is what payment buys. Usage over the chosen plan
    shows an over-limit notice by default. An external AI may periodically query usage and
    recommend a plan, but Sakupa never changes a subscription automatically.
 4. Optionally bind a custom domain to the subscribed site (bind_domain): an included extra
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
-   billing_status, change_subscription_plan, manage_billing and recover_domain_site manage the paid
+   change_subscription_plan, manage_billing and recover_domain_site manage the paid
    lifecycle. Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
    A cancellation keeps the site paid through the current period. Sakupa reverts it to a free
    24h site and removes paid data after Stripe sends the signed final-cancellation webhook.
@@ -2279,10 +2325,12 @@ Safety boundaries:
   Stripe's public no-code portal login, where the customer verifies the checkout email with a
   Stripe one-time passcode; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
-  const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
+  const client = opts.client ?? new HttpApiClient(
+    new FetchTransport(opts.apiBaseUrl, { testAccessToken: opts.testAccessToken })
+  );
   const server = new McpServer(
     { name: "sakupa", version: MCP_VERSION },
-    { instructions: INSTRUCTIONS }
+    { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
   registerTools(server, {
     client,
@@ -2304,13 +2352,12 @@ function createSakupaMcpServer(opts) {
 
 // src/bin.ts
 async function main() {
-  const apiBaseUrl = process.env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL;
-  const projectDir = process.env["SAKUPA_PROJECT_DIR"] ?? process.cwd();
-  const server = createSakupaMcpServer({ apiBaseUrl, projectDir });
+  const config = loadMcpRuntimeConfig();
+  const server = createSakupaMcpServer(config);
   const transport = new StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${apiBaseUrl}, project: ${projectDir})`
+    `[sakupa-mcp] v${MCP_VERSION} connected (api: ${config.apiBaseUrl}, project: ${config.projectDir})`
   );
 }
 main().catch((err) => {

package/dist/index.js

@@ -1,6 +1,8 @@
 // ../core/dist/domain/constants.js
 var SERVICE_DOMAIN = "sakupa.com";
+var DEFAULT_API_BASE_URL = "https://api.sakupa.com";
 var FREE_SITE_URL_SUFFIX = `.${SERVICE_DOMAIN}`;
+var TEST_ACCESS_HEADER = "x-sakupa-test-token";
 var FREE_SITE_TTL_HOURS = 24;
 var FREE_SITE_MAX_TOTAL_BYTES = 10 * 1024 * 1024;
 var PAID_SITE_MAX_TOTAL_BYTES = 2 * 1024 * 1024 * 1024;
@@ -121,7 +123,7 @@ var FORBIDDEN_PATH_SEGMENTS = [
 var ALLOWED_HIDDEN_PATHS = [".well-known/"];
 
 // ../core/dist/domain/version.js
-var SAKUPA_MCP_VERSION = "0.7.0";
+var SAKUPA_MCP_VERSION = "0.7.2";
 
 // ../core/dist/domain/errors.js
 var HTTP_STATUS = {
@@ -462,11 +464,51 @@ var WEBHOOK_PROCESSING_LEASE_MS = 5 * 60 * 1e3;
 var MCP_VERSION = SAKUPA_MCP_VERSION;
 var CLIENT_TYPE = "sakupa-mcp";
 
+// src/config.ts
+var TEST_API_BASE_URL = "https://api-test.sakupa.com";
+function previewHostPatternFor(apiBaseUrl) {
+  return apiBaseUrl === TEST_API_BASE_URL ? "{shortId}-test.sakupa.com" : "{shortId}.sakupa.com";
+}
+function loadMcpRuntimeConfig(env = process.env, cwd = process.cwd()) {
+  const apiBaseUrl = (env["SAKUPA_API_URL"] ?? DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+  const projectDir = env["SAKUPA_PROJECT_DIR"] ?? cwd;
+  const testAccessToken = env["SAKUPA_TEST_ACCESS_TOKEN"]?.trim() ?? "";
+  if (apiBaseUrl === TEST_API_BASE_URL) {
+    if (testAccessToken.length === 0) {
+      throw new Error(
+        "The Sakupa Test API requires SAKUPA_TEST_ACCESS_TOKEN. Anonymous Test access is disabled."
+      );
+    }
+    return { apiBaseUrl, projectDir, testAccessToken };
+  }
+  if (testAccessToken.length > 0) {
+    throw new Error(
+      `SAKUPA_TEST_ACCESS_TOKEN may only be used with ${TEST_API_BASE_URL}. Remove it before connecting to any other API.`
+    );
+  }
+  return { apiBaseUrl, projectDir };
+}
+
 // src/transport.ts
 var FetchTransport = class {
   baseUrl;
-  constructor(baseUrl) {
+  testAccessToken;
+  constructor(baseUrl, options = {}) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
+    if (options.testAccessToken && this.baseUrl !== TEST_API_BASE_URL) {
+      throw new Error(`Test access credentials may only be sent to ${TEST_API_BASE_URL}.`);
+    }
+    this.testAccessToken = options.testAccessToken;
+  }
+  testAccessHeadersFor(_url) {
+    if (!this.testAccessToken) return {};
+    let target;
+    try {
+      target = new URL(_url);
+    } catch {
+      return {};
+    }
+    return target.origin === TEST_API_BASE_URL ? { [TEST_ACCESS_HEADER]: this.testAccessToken } : {};
   }
   async request(req) {
     let url = `${this.baseUrl}${req.path}`;
@@ -477,7 +519,8 @@ var FetchTransport = class {
       accept: "application/json",
       [MCP_VERSION_HEADER]: MCP_VERSION,
       ...req.body !== void 0 ? { "content-type": "application/json" } : {},
-      ...req.headers
+      ...req.headers,
+      ...this.testAccessHeadersFor(url)
     };
     const res = await fetch(url, {
       method: req.method,
@@ -503,7 +546,10 @@ var FetchTransport = class {
     }
     const res = await fetch(target.url, {
       method: target.method,
-      headers: target.headers,
+      headers: {
+        ...target.headers,
+        ...this.testAccessHeadersFor(target.url)
+      },
       body
     });
     if (!res.ok) {
@@ -1413,6 +1459,7 @@ async function uploadAll(ctx, targets, files, outputAbs) {
   return targets.length;
 }
 function registerTools(server, ctx) {
+  const previewHostPattern = previewHostPatternFor(ctx.apiBaseUrl);
   server.registerTool(
     "analyze_site",
     {
@@ -1446,7 +1493,7 @@ Next action: ${analysis.suggestedNextAction}`,
   server.registerTool(
     "deploy_site",
     {
-      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://{shortId}.sakupa.com) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
+      description: `Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid ${FREE_SITE_TTL_HOURS}h, public URL like https://${previewHostPattern}) and stores the management credential in .sakupa/site.json. Later runs update the existing site (free sites also refresh their validity; subscribed sites are permanent). Runs analyze_site first and refuses to upload source projects, secrets, .env files, archives, media or server code. Never uploads anything when the analysis says the project is not deployable.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -1629,7 +1676,7 @@ Free sites stay live for ${FREE_SITE_TTL_HOURS} hours after each deploy or refre
   server.registerTool(
     "subscribe_site",
     {
-      description: `Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (${planCatalog()}). Paying makes the site PERMANENT on its {shortId}.sakupa.com URL \u2014 no more 24h expiry; that is the core value of paying. Binding a custom domain afterwards (bind_domain) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first. If the site outgrows its plan, Sakupa shows an over-limit notice and never changes billing automatically. The owner can explicitly choose another plan through Stripe Customer Portal. Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Opening and completing Stripe Checkout is the final subscription confirmation.`,
+      description: `Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (${planCatalog()}). Paying makes the site PERMANENT on its ${previewHostPattern} URL \u2014 no more 24h expiry; that is the core value of paying. Binding a custom domain afterwards (bind_domain) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) \u2014 deploy_site first. If the site outgrows its plan, Sakupa shows an over-limit notice and never changes billing automatically. The owner can explicitly choose another plan through Stripe Customer Portal. Card details are entered only on the Stripe-hosted page \u2014 never through the AI tool. Opening and completing Stripe Checkout is the final subscription confirmation.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
@@ -1674,7 +1721,7 @@ Once payment confirms, the site becomes permanent on its current URL. Binding a
   server.registerTool(
     "bind_domain",
     {
-      description: "Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent {shortId}.sakupa.com URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.",
+      description: `Bind a custom domain to this subscribed site \u2014 an OPTIONAL extra serving surface; the permanent ${previewHostPattern} URL keeps working alongside it. The binding unit is the APEX domain: binding example.com automatically includes www.example.com (both serve the same content, one apex TXT verification covers both), and one site binds at most ONE apex domain \u2014 a second domain needs a second subscribed site. Requires an ACTIVE subscription (subscribe_site). Ownership is proven ONLY by DNS control of the apex \u2014 payment never grants ownership. A binding request never reserves the domain: whoever proves DNS control first gets it, and unverified requests expire after 72 hours. Call again with verificationId to check progress.`,
       outputSchema: STRUCTURED_TOOL_OUTPUT_SCHEMA,
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
       inputSchema: {
@@ -2238,25 +2285,25 @@ function registerBillingTools(server, ctx) {
 }
 
 // src/server.ts
-var INSTRUCTIONS = `Sakupa publishes AI-made static websites. AI-made pages, live in seconds.
+var instructionsFor = (hostPattern) => `Sakupa publishes AI-made static websites. AI-made pages, live in seconds.
 
 Workflow:
 1. analyze_site \u2014 check whether this project has deployable static output. If a build is needed
    (Vite/Vue/React/Svelte/Astro/Next static export/Nuxt generate), run the build LOCALLY first,
    then re-run analyze_site.
 2. deploy_site \u2014 uploads ONLY the built static output. The first deploy creates a free temporary
-   site (public URL {shortId}.sakupa.com, valid 24 hours, free banner shown) and stores the
+   site (public URL ${hostPattern}, valid 24 hours, free banner shown) and stores the
    management credential in .sakupa/site.json. Deploying again updates the site and refreshes
    its validity; refresh_site extends validity without uploading.
 3. To make the site PERMANENT, subscribe it to a monthly hosting plan (subscribe_site ->
    Stripe-hosted checkout; water/personal/share/business). Paying makes the
-   {shortId}.sakupa.com URL permanent \u2014 that is what payment buys. Usage over the chosen plan
+   ${hostPattern} URL permanent \u2014 that is what payment buys. Usage over the chosen plan
    shows an over-limit notice by default. An external AI may periodically query usage and
    recommend a plan, but Sakupa never changes a subscription automatically.
 4. Optionally bind a custom domain to the subscribed site (bind_domain): an included extra
    serving surface alongside the permanent URL. Ownership is proven only by DNS control; the
    first verified request wins; unverified requests expire after 72 hours. billing_status,
-   billing_status, change_subscription_plan, manage_billing and recover_domain_site manage the paid
+   change_subscription_plan, manage_billing and recover_domain_site manage the paid
    lifecycle. Plan changes are confirmed only on Stripe and synchronized by Stripe webhook.
    A cancellation keeps the site paid through the current period. Sakupa reverts it to a free
    24h site and removes paid data after Stripe sends the signed final-cancellation webhook.
@@ -2271,10 +2318,12 @@ Safety boundaries:
   Stripe's public no-code portal login, where the customer verifies the checkout email with a
   Stripe one-time passcode; it never restores site authority.`;
 function createSakupaMcpServer(opts) {
-  const client = opts.client ?? new HttpApiClient(new FetchTransport(opts.apiBaseUrl));
+  const client = opts.client ?? new HttpApiClient(
+    new FetchTransport(opts.apiBaseUrl, { testAccessToken: opts.testAccessToken })
+  );
   const server = new McpServer(
     { name: "sakupa", version: MCP_VERSION },
-    { instructions: INSTRUCTIONS }
+    { instructions: instructionsFor(previewHostPatternFor(opts.apiBaseUrl)) }
   );
   registerTools(server, {
     client,
@@ -2298,9 +2347,11 @@ export {
   FetchTransport,
   HttpApiClient,
   MCP_VERSION,
+  TEST_API_BASE_URL,
   analyzeProject,
   createSakupaMcpServer,
   deleteSiteFile,
+  loadMcpRuntimeConfig,
   readSiteFile,
   registerLifecycleTools,
   registerTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sakupa/mcp",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Sakupa MCP server: publish AI-made static sites from your AI tool. AI-made pages, live in seconds.",
   "type": "module",
   "main": "dist/index.js",