> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sideshift.app/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> Let AI agents operate a SideShift company through the Model Context Protocol.

SideShift exposes a remote **Model Context Protocol** server, so an AI agent can operate a
SideShift company directly — listing campaigns, reading posts, creating contracts, running
payouts — instead of you writing HTTP calls.

There is nothing to download. The server is hosted at
`https://app.sideshift.app/api/mcp` and you connect a client to it.

## What you get

The MCP server fronts the **same** OAuth-scoped capabilities as the REST API. Every
capability scope maps to tools, so the tool set mirrors the REST surface, plus a `whoami`
tool for checking which company and scopes a token is bound to.

* Read scopes expose read-only tools
* Write and sensitive tools carry a confirmation guardrail in their description
* The claim-link capability is available as `create_quickpay_claim_link`

## Before you start

You need three things.

<Steps>
  <Step title="An MCP-capable client">
    Claude Desktop, Claude Code, Cursor, VS Code, or any client that speaks MCP over
    Streamable HTTP.
  </Step>

  <Step title="A registered OAuth client">
    The MCP server uses the **same** OAuth 2.1 flow as the REST API — there is no
    MCP-specific auth scheme. Register via Dynamic Client Registration to get a `client_id`.
    See [Platform API](/platform#oauth-2-1).
  </Step>

  <Step title="An access token">
    Run the authorization-code flow with PKCE (`S256`) to get a bearer token. Tokens minted
    for MCP are multi-audience, so **one token works for both** `/api/oauth/v1` and
    `/api/mcp` — you do not need a separate credential.
  </Step>
</Steps>

<Note>
  If a request arrives unauthorized, the server replies `401` with a `WWW-Authenticate`
  challenge pointing at the RFC 9728 protected-resource metadata. Compliant clients use this
  to discover the authorization server automatically, so many clients can complete setup
  from the URL alone.
</Note>

## Connect a client

<Tabs>
  <Tab title="Claude Code">
    ```bash theme={"system"}
    claude mcp add --transport http sideshift https://app.sideshift.app/api/mcp
    ```

    Claude Code will walk you through the OAuth flow on first use.
  </Tab>

  <Tab title="Claude Desktop">
    Settings → Connectors → Add custom connector, then enter:

    ```
    https://app.sideshift.app/api/mcp
    ```

    Approve the SideShift consent screen when it appears, choosing the company and scopes to
    grant.
  </Tab>

  <Tab title="Cursor">
    Add to `~/.cursor/mcp.json`:

    ```json theme={"system"}
    {
      "mcpServers": {
        "sideshift": {
          "url": "https://app.sideshift.app/api/mcp"
        }
      }
    }
    ```
  </Tab>

  <Tab title="VS Code">
    Add to `.vscode/mcp.json` in your workspace:

    ```json theme={"system"}
    {
      "servers": {
        "sideshift": {
          "type": "http",
          "url": "https://app.sideshift.app/api/mcp"
        }
      }
    }
    ```
  </Tab>
</Tabs>

<Warning>
  Setup snippets follow each client's documented format for remote HTTP MCP servers. Client
  configuration changes often — if one is rejected, check that client's current docs. The
  server URL and the OAuth flow are the parts that come from the SideShift specification.
</Warning>

## Using the tools

Once connected, confirm which company you're operating on before doing anything else:

```
Use the whoami tool to show which SideShift company and scopes I'm connected with.
```

Then work in plain language:

```
List my active campaigns and show how many creators applied to each.
```

Every request is bound to the tenant and the exact scopes granted at consent, so an agent
can only do what it was authorized to do. Requesting a capability outside those scopes
fails rather than silently doing something else.

## Safety rules

These are enforced server-side, not by the client.

| Rule               | Behavior                                                                                                                     |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
| Sandbox grants     | Sensitive tools — anything that moves money or triggers outbound side-effects — are **rejected** for test and sandbox grants |
| Global kill switch | `MCP_SAFE_MODE` disables sensitive tools server-wide                                                                         |
| Idempotency        | Money-moving operations require an `Idempotency-Key`, so a retried call never double-charges                                 |
| Scope binding      | Tokens are bound to one company (`company_id`); an agent cannot reach across tenants                                         |

<Warning>
  `payouts:write` and `settings:write` are flagged sensitive in the specification because
  they move money and change company configuration. Grant them only when an integration
  genuinely needs them.
</Warning>

## Docs server

Separately from the product API above, this documentation site publishes its own MCP server
so an agent can read these pages:

```
https://docs.sideshift.app/mcp
```

That one needs no authentication and grants no access to your SideShift data — it only
reads documentation. You can also add it from the **Copy page** menu at the top of any page,
which has one-click setup for Cursor and VS Code.

|        | Product server              | Docs server              |
| ------ | --------------------------- | ------------------------ |
| URL    | `app.sideshift.app/api/mcp` | `docs.sideshift.app/mcp` |
| Auth   | OAuth 2.1 required          | None                     |
| Can do | Operate a company           | Read these docs          |