---
title: Manage your store with an AI agent
nav: Agent store management
order: 10
---
# Manage your Appside test store with an AI agent

> **Try it on your game, no signup:** paste your App Store or Google Play link at [appside.build/#preview](https://appside.build/?utm_source=docs&utm_medium=docs&utm_campaign=w45-preview&utm_content=docs-agent-store#preview) and see a draft store in seconds.

Appside's **publisher MCP adapter** lets a coding agent (Claude Code, Codex, Cursor, or any MCP client) read and edit your store draft, configure offers and promo codes, confirm products and publish a test version, through the same checks the Studio applies. It runs on your machine, authenticates as your existing publisher account, and is **read-only unless you opt in to writes**.

This is a v0, local adapter for **TEST stores**. It is not a hosted connector, there are no scoped API tokens yet, and it never moves real money.

## Install from the download

```sh
mkdir appside-publisher-agent && cd appside-publisher-agent
curl -O https://appside.build/docs/downloads/publisher-mcp-0.1.0.tgz
curl -O https://appside.build/docs/downloads/publisher-mcp-0.1.0.tgz.sha256
shasum -a 256 -c publisher-mcp-0.1.0.tgz.sha256      # expect: OK
tar -xzf publisher-mcp-0.1.0.tgz                      # server.mjs, stdio.mjs, package.json, README.md
```

It's a plain archive, not an npm package, and it has no dependencies beyond Node 20+. Don't use `npx` with the package name.

## Configure your MCP client

Run `node /absolute/path/appside-publisher-agent/stdio.mjs` as a stdio server. Credentials go in the environment, never in tool arguments:

| Variable | Meaning |
|---|---|
| `APPSIDE_AGENT_EMAIL`, `APPSIDE_AGENT_PASSWORD` | An existing publisher account. Alternatively `APPSIDE_AGENT_SESSION`, an existing session token |
| `APPSIDE_AGENT_ORIGIN` | Defaults to `https://app.appside.build`. HTTPS is required except on loopback |
| `APPSIDE_AGENT_WRITES=1` | Opt in to draft edits, product confirmation and publishing. Default: read-only |

Example for a client that takes a JSON config:

```json
{"mcpServers":{"appside-publisher":{"command":"node","args":["/absolute/path/appside-publisher-agent/stdio.mjs"],"env":{"APPSIDE_AGENT_EMAIL":"you@studio.example","APPSIDE_AGENT_PASSWORD":"…"}}}}
```

## Tools

**Read (always available):** `get_agent_capabilities`, `list_games`, `get_store`, `get_analytics`, `get_checkout_link`.

**Write (with `APPSIDE_AGENT_WRITES=1`):** `set_theme_tokens`, `set_product`, `set_promo_code`, `set_section`, `set_banner`, `set_payment_methods`, `set_translation`, `confirm_product`, `publish_store`.

Setters take `{tenant, revision, value}` after a `get_store`. A product, promo code, section or banner value replaces one complete item; theme tokens and regional payment settings merge top-level keys. If the draft changed in the Studio since the agent read it, the call is refused with a revision conflict and nothing is overwritten: the agent re-reads and reapplies deliberately.

Two actions need an explicit confirmation string in the call, so an agent can't stumble into them: `confirm_product` needs `"confirmation":"PUBLISHER_APPROVED_PRODUCT"`, and `publish_store` needs `"confirmation":"PUBLISHER_APPROVED_PUBLICATION"` plus the expected `liveVersion`. Publishing also needs the owner role, and the server runs the same publish checks as the Studio (confirmed products, legal links, readable colours).

## What "personalization" means here

An offer can target a minimum player level, a spender tier, a country or new players. Those values come from the signed player attributes your backend puts in the player token. The adapter configures the rule; it doesn't guess a player profile or run a model.

## Checkout and analytics

`get_checkout_link` returns an existing published store link. Player sign-in, payment and delivery stay with the SDK, the checkout and your signed webhook: the agent can't spend on a player's behalf. `get_analytics` returns the backend's **test** aggregates (revenue in minor units for today and the last 7 days, refunds, top pack, funnel). They describe the test purchase flow, not visitors, attribution or production revenue.

## Verify the adapter

Without credentials, the server still answers `initialize` and lists the five read-only tools:

```sh
printf '%s\n%s\n' \
 '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"check","version":"0"}}}' \
 '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | node stdio.mjs
```

Expected: server `appside-publisher-local` 0.1.0, then `get_agent_capabilities`, `list_games`, `get_store`, `get_analytics`, `get_checkout_link`.

## Security notes

- The adapter only talks to an exact HTTPS origin, refuses redirects, and times out after 15 seconds.
- The session cookie lives in process memory. Errors from the server are redacted before they reach the agent.
- Tool arguments are validated strictly; tenant IDs can't contain path segments.
- The adapter treats store text it reads as data, not instructions.
- Orders, audit rows, secrets, refunds, grants, team management, key rotation and AI generation are **not** exposed.

## Two different MCP connections

The public **https://appside.build/mcp** is read-only documentation for coding agents: it searches the docs, returns SDK examples and the published price, and needs no account. The publisher adapter on this page manages a store you own. Start with the [MCP docs page](/docs/mcp/) for the first, and this page for the second.