Manage your Appside test store with an AI agent

Appside's publisher MCP adapter lets a coding agent (Claude Code, Codex, Cursor, or any MCP client) read and edit your store draft, configure offers and promo codes, confirm products and publish a test version, through the same checks the Studio applies. It runs on your machine, authenticates as your existing publisher account, and is read-only unless you opt in to writes.

This is a v0, local adapter for TEST stores. It is not a hosted connector, there are no scoped API tokens yet, and it never moves real money.

Install from the download

mkdir appside-publisher-agent && cd appside-publisher-agent
curl -O https://appside.build/docs/downloads/publisher-mcp-0.1.0.tgz
curl -O https://appside.build/docs/downloads/publisher-mcp-0.1.0.tgz.sha256
shasum -a 256 -c publisher-mcp-0.1.0.tgz.sha256      # expect: OK
tar -xzf publisher-mcp-0.1.0.tgz                      # server.mjs, stdio.mjs, package.json, README.md

It's a plain archive, not an npm package, and it has no dependencies beyond Node 20+. Don't use npx with the package name.

Configure your MCP client

Run node /absolute/path/appside-publisher-agent/stdio.mjs as a stdio server. Credentials go in the environment, never in tool arguments:

Variable	Meaning
`APPSIDE_AGENT_EMAIL`, `APPSIDE_AGENT_PASSWORD`	An existing publisher account. Alternatively `APPSIDE_AGENT_SESSION`, an existing session token
`APPSIDE_AGENT_ORIGIN`	Defaults to `https://app.appside.build`. HTTPS is required except on loopback
`APPSIDE_AGENT_WRITES=1`	Opt in to draft edits, product confirmation and publishing. Default: read-only

Example for a client that takes a JSON config:

{"mcpServers":{"appside-publisher":{"command":"node","args":["/absolute/path/appside-publisher-agent/stdio.mjs"],"env":{"APPSIDE_AGENT_EMAIL":"you@studio.example","APPSIDE_AGENT_PASSWORD":"…"}}}}

Tools

Read (always available): get_agent_capabilities, list_games, get_store, get_analytics, get_checkout_link.

Write (with APPSIDE_AGENT_WRITES=1): set_theme_tokens, set_product, set_promo_code, set_section, set_banner, set_payment_methods, set_translation, confirm_product, publish_store.

Setters take {tenant, revision, value} after a get_store. A product, promo code, section or banner value replaces one complete item; theme tokens and regional payment settings merge top-level keys. If the draft changed in the Studio since the agent read it, the call is refused with a revision conflict and nothing is overwritten: the agent re-reads and reapplies deliberately.

Two actions need an explicit confirmation string in the call, so an agent can't stumble into them: confirm_product needs "confirmation":"PUBLISHER_APPROVED_PRODUCT", and publish_store needs "confirmation":"PUBLISHER_APPROVED_PUBLICATION" plus the expected liveVersion. Publishing also needs the owner role, and the server runs the same publish checks as the Studio (confirmed products, legal links, readable colours).

What "personalization" means here

An offer can target a minimum player level, a spender tier, a country or new players. Those values come from the signed player attributes your backend puts in the player token. The adapter configures the rule; it doesn't guess a player profile or run a model.

Checkout and analytics

get_checkout_link returns an existing published store link. Player sign-in, payment and delivery stay with the SDK, the checkout and your signed webhook: the agent can't spend on a player's behalf. get_analytics returns the backend's test aggregates (revenue in minor units for today and the last 7 days, refunds, top pack, funnel). They describe the test purchase flow, not visitors, attribution or production revenue.

Verify the adapter

Without credentials, the server still answers initialize and lists the five read-only tools:

printf '%s\n%s\n' \
 '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"check","version":"0"}}}' \
 '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' | node stdio.mjs

Expected: server appside-publisher-local 0.1.0, then get_agent_capabilities, list_games, get_store, get_analytics, get_checkout_link.

Security notes

The adapter only talks to an exact HTTPS origin, refuses redirects, and times out after 15 seconds.
The session cookie lives in process memory. Errors from the server are redacted before they reach the agent.
Tool arguments are validated strictly; tenant IDs can't contain path segments.
The adapter treats store text it reads as data, not instructions.
Orders, audit rows, secrets, refunds, grants, team management, key rotation and AI generation are not exposed.

Two different MCP connections

The public https://appside.build/mcp is read-only documentation for coding agents: it searches the docs, returns SDK examples and the published price, and needs no account. The publisher adapter on this page manages a store you own. Start with the MCP docs page for the first, and this page for the second.