MCP server - SideShift

SideShift exposes a remote Model Context Protocol server, so an AI agent can operate a SideShift company directly — listing campaigns, reading posts, creating contracts, running payouts — instead of you writing HTTP calls. There is nothing to download. The server is hosted at https://app.sideshift.app/api/mcp and you connect a client to it.

What you get

The MCP server fronts the same OAuth-scoped capabilities as the REST API. Every capability scope maps to tools, so the tool set mirrors the REST surface, plus a whoami tool for checking which company and scopes a token is bound to.

Read scopes expose read-only tools
Write and sensitive tools carry a confirmation guardrail in their description
The claim-link capability is available as create_quickpay_claim_link

Before you start

You need three things.

An MCP-capable client

Claude Desktop, Claude Code, Cursor, VS Code, or any client that speaks MCP over Streamable HTTP.

A registered OAuth client

The MCP server uses the same OAuth 2.1 flow as the REST API — there is no MCP-specific auth scheme. Register via Dynamic Client Registration to get a client_id. See Platform API.

An access token

Run the authorization-code flow with PKCE (S256) to get a bearer token. Tokens minted for MCP are multi-audience, so one token works for both /api/oauth/v1 and /api/mcp — you do not need a separate credential.

If a request arrives unauthorized, the server replies 401 with a WWW-Authenticate challenge pointing at the RFC 9728 protected-resource metadata. Compliant clients use this to discover the authorization server automatically, so many clients can complete setup from the URL alone.

Connect a client

Claude Code
Claude Desktop
Cursor
VS Code

claude mcp add --transport http sideshift https://app.sideshift.app/api/mcp

Claude Code will walk you through the OAuth flow on first use.

Settings → Connectors → Add custom connector, then enter:

https://app.sideshift.app/api/mcp

Approve the SideShift consent screen when it appears, choosing the company and scopes to grant.

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "sideshift": {
      "url": "https://app.sideshift.app/api/mcp"
    }
  }
}

Add to .vscode/mcp.json in your workspace:

{
  "servers": {
    "sideshift": {
      "type": "http",
      "url": "https://app.sideshift.app/api/mcp"
    }
  }
}

Setup snippets follow each client’s documented format for remote HTTP MCP servers. Client configuration changes often — if one is rejected, check that client’s current docs. The server URL and the OAuth flow are the parts that come from the SideShift specification.

Using the tools

Once connected, confirm which company you’re operating on before doing anything else:

Use the whoami tool to show which SideShift company and scopes I'm connected with.

Then work in plain language:

List my active campaigns and show how many creators applied to each.

Every request is bound to the tenant and the exact scopes granted at consent, so an agent can only do what it was authorized to do. Requesting a capability outside those scopes fails rather than silently doing something else.

Safety rules

These are enforced server-side, not by the client.

Rule	Behavior
Sandbox grants	Sensitive tools — anything that moves money or triggers outbound side-effects — are rejected for test and sandbox grants
Global kill switch	`MCP_SAFE_MODE` disables sensitive tools server-wide
Idempotency	Money-moving operations require an `Idempotency-Key`, so a retried call never double-charges
Scope binding	Tokens are bound to one company (`company_id`); an agent cannot reach across tenants

payouts:write and settings:write are flagged sensitive in the specification because they move money and change company configuration. Grant them only when an integration genuinely needs them.

Docs server

Separately from the product API above, this documentation site publishes its own MCP server so an agent can read these pages:

https://docs.sideshift.app/mcp

That one needs no authentication and grants no access to your SideShift data — it only reads documentation. You can also add it from the Copy page menu at the top of any page, which has one-click setup for Cursor and VS Code.

	Product server	Docs server
URL	`app.sideshift.app/api/mcp`	`docs.sideshift.app/mcp`
Auth	OAuth 2.1 required	None
Can do	Operate a company	Read these docs

​What you get

​Before you start

​Connect a client

​Using the tools

​Safety rules

​Docs server

What you get

Before you start

Connect a client

Using the tools

Safety rules

Docs server