Staticbot

Staticbot MCP server

Give Codex, Claude, Cursor, and other MCP-compatible agents safe access to Staticbot. The server exposes typed tools for deploying websites, migrating application backends, and operating continuous sync while Staticbot keeps credentials and long-running workflow state outside the model context.

Two ways to connect

Connect the hosted server — no install, no API key. Point an MCP client that supports remote servers with OAuth at:

https://mcp.staticbot.dev/mcp

You sign in to Staticbot, choose what to grant, and the client stores the connection. If you do not have a Staticbot account yet, one is created when you first connect.

Run it locally — for clients that launch MCP servers as a local process. Needs Node.js 20 or newer and a Staticbot API key from app.staticbot.dev/developer.

Both expose the same tools. The hosted server acts as the person who authorized it and never sees an API key; the local server uses the API key you give it.

Install as a Codex plugin

This repository is also a Codex plugin. Its manifest bundles the Staticbot MCP server with four intent-focused skills:

• deploy-web-app-with-staticbot deploys a repository without making the agent choose a cloud provider. Staticbot analyzes the repo, classifies the workload, and selects the supported AWS or Cloudflare target plus its customer-owned or Staticbot-managed ownership model.
• migrate-vibe-coded-app moves Base44, Lovable, Bolt, or Firebase backends to customer-owned Supabase infrastructure with discovery and approval gates.
• sync-vibe-coded-app keeps migrated projects synchronized while preserving destructive-change review.
• live-migrate-ai-built-app cuts a live Lovable or Base44 app over to the migrated stack during a planned maintenance window: test migration, cutover plan, maintenance page, source write freeze, fresh final copy, verification, and domain switch. The builder-specific freeze steps are in live-migrate-lovable-app and live-migrate-base44-app.

The general staticbot skill remains available as a direct REST API fallback.

Add the public GitHub marketplace, then install Staticbot:

codex plugin marketplace add bitfiction/staticbot-mcp

codex plugin add staticbot@staticbot

Restart the ChatGPT desktop app or Codex after adding the marketplace if Staticbot does not appear immediately. This preview plugin uses the local MCP transport, so set STATICBOT_API_KEY in the environment that launches the app. The hosted OAuth connection at https://mcp.staticbot.dev/mcp remains the lowest-friction option when you only need MCP tools rather than the bundled skills.

Install as a Claude Code plugin

Claude Code does not require Staticbot to be accepted into a central plugin registry. Add the self-hosted marketplace directly from this GitHub repository, then install the plugin:

/plugin marketplace add bitfiction/staticbot-mcp

/plugin install staticbot@staticbot

Set STATICBOT_API_KEY in the environment that launches Claude Code. The plugin starts the published @staticbot/mcp package with npx and inherits that environment; STATICBOT_API_URL remains optional for self-hosted or local Staticbot APIs.

The installed skills are namespaced by the plugin. For example, use /staticbot:deploy-web-app-with-staticbot, /staticbot:migrate-vibe-coded-app, /staticbot:sync-vibe-coded-app, or /staticbot:live-migrate-ai-built-app. Restart Claude Code or run /reload-plugins after installation if the plugin is not immediately available.

Configure your MCP client directly

Hosted (OAuth)

For clients that support remote MCP servers, add https://mcp.staticbot.dev/mcp and authorize when prompted. The client discovers where to sign in from the server itself; there is nothing to copy or paste, and no credential is stored on your machine.

Local (API key)

Add the published package to your project or global MCP configuration:

{

"mcpServers": { "staticbot": { "command": "npx", "args": ["-y", "@staticbot/mcp"], "env": { "STATICBOT_API_KEY": "sk-your-api-key-here" } } } }

Hosted Staticbot at https://app.staticbot.dev is the default. Do not set STATICBOT_API_URL for the hosted service; override it only when using a self-hosted or local Staticbot API.

Keep the API key in your MCP client's secret or environment configuration. Do not paste it into chat or commit it to a repository.

What agents can do

The server groups its tools around user outcomes:

• Analyze a public website URL for its platform, backend and supported migration/hosting paths, without requiring connected integrations
• Inspect templates, stacks, deployments, and integration connections
• Resolve the repository to work on from a connected GitHub or GitLab account, private repositories included
• Create and monitor static-site and SSR deployments
• Inspect deployment DNS, safely push deployment-owned records to linked Cloudflare zones, and recheck custom-hostname verification
• Choose where a Cloudflare Workers app is hosted — Staticbot's account, or the user's own connected Cloudflare account — and check a hostname is deployable before creating anything
• Choose whether an AWS-hosted static site is deployed into Staticbot's managed account or the user's own connected AWS account
• Create a customer-owned Supabase project, wait until it is healthy, and use it as a migration target
• Migrate Lovable, Bolt, Firebase, and Base44 projects to Supabase targets
• Inspect migration discovery results and guide users through approval and choice gates
• Set a migration's live-app URL, read its scan and inspect retained live-commit comparisons
• Create previews and download portable migration packages
• Build connected-project previews, switch live deployment to the builder branch, or sync a migration preview onto live
• Inspect shared repository-webhook scope and explicitly set up, reset or disable GitHub push automation
• Trigger, review, retry, or skip continuous-sync runs
• Roll back or redeploy a website using valid pinned versions returned by Staticbot

The tool schemas and descriptions are the runtime contract seen by MCP clients. They contain the operational instructions an agent needs at the moment it selects a tool.

Website URL checks

scan_website starts or reuses an authenticated workspace check through POST /api/v1/site-scans. It needs a Staticbot account but no repository, database, or cloud integration. Poll the returned scan.id with get_website_scan (GET /api/v1/site-scans/{id}), waiting pollAfterMs between requests while the scan is queued or running. Terminal results include detection, support and hosting/migration estimates, or an explicit failure. A check never starts a deployment or migration.

This uses the existing workspace scanner with its quotas, cache, target throttle, bounded queue and public-address protections. The anonymous marketing-page API keeps its separate Turnstile flow. API/MCP results contain the customer summary rather than raw extracted scripts or contact history.

Connected-project operations

Read get_connected_project_operations before preview/live/webhook changes. It returns the current builder/live branches, effective role permissions and repository-webhook consumers. Mutation tools require explicit confirmation; live operations require those exact branch names and webhook actions require the returned repository configuration ID. A changed target returns 409 and needs fresh inspection and approval. Feature flags, workspace roles, persisted-link validation and agency-client restrictions remain enforced by the backend. Webhook reset/deletion uses the existing best-effort upstream removal, so a local configuration change is not proof that GitHub deleted the old hook.

The backend route must be deployed before enabling these tools in the hosted MCP server. See the capability audit for the remaining dashboard/API differences.

Platform updates and pending actions

list_pending_actions and list_platform_updates expose the same post-migration fixes as the project's Sync tab. check_platform_updates refreshes the evidence and may enqueue approved automatic fixes; it is a mutating operation. apply_platform_updates applies the selected fixes only after the user approves the returned effects. Customer-owned branches get pull requests, never direct pushes. dismiss_platform_update declines optional fixes; required fixes cannot be dismissed. refresh_platform_update re-runs the read-only refresh of an update marked canRefresh (Refresh account connections); it installs nothing and changes no credentials or user connections. Follow the returned sync run and PR links. The server feature flag may keep these operations disabled during rollout.

Backend controls and source updates

get_backend_workflows inspects the shared backend for exactly one connected project or migration. Present every affected stage and the observed flags before using operate_backend_workflows. These controls manage Staticbot's migrated Base44 scheduler on Supabase Cloud; unknown outcomes remain unknown and are never retried automatically.

For tracked feature branches, inspect list_connected_project_previews and get_feature_branch_preview_settings. A build requires the exact commit and build hint, including any preview removed by the plan limit. Automatic settings keep the existing hosting-plan limits. trigger_sync optionally redeploys all functions only after explicit confirmation; normal sync requests stay compatible.

preview_migration_source_update resolves a chosen template version to its exact commit without applying it. update_migration_source requires approval of that exact pair and prepares a new plan for separate review; it does not approve target writes.

For a frontend hosted elsewhere, inspect get_external_auth_domain before approving its exact backend and new public origin through set_external_auth_domain. This changes authentication configuration, not frontend hosting or DNS. Even an UPDATED result needs real sign-in, reset and magic-link testing.

Cutover status and late source changes

get_connected_project_cutover reads retained Switch-tab evidence without starting a check. check_connected_project_cutover scans the live app and checks the old backend for late writes; it never copies data. Unknown, blocked or truncated checks remain qualified.

For Base44 catch-up, present the source, target, copy window and copy mode before using copy_connected_project_late_changes. INSERT_ONLY leaves differing target records for review; FULL_UPDATE overwrites them. Both require confirmed=true and the exact inspected stateVersion as expectedState. A 409 requires new inspection and approval. Follow the returned sync run; never retry an unknown outcome automatically.

mark_cutover_conflicts_reviewed requires a separate, explicit user decision about that copy's conflicts. It advances Staticbot's watch window and does not repair database records. Partial conflict lists require review of the remaining results in the dashboard. These additions need the corresponding backend and hosted MCP release before clients can use them.

Example requests

• “Deploy this repository with Staticbot and tell me what DNS records I need.”
• “Push this deployment's required records to my linked Cloudflare zone, then recheck verification.”
• “Migrate my Base44 app to my Supabase project. Stop for approval before making changes.”
• “Show me what changed in the latest sync run and explain any destructive SQL.”
• “List valid rollback versions for this deployment, but do not roll back yet.”

Safety contract

Staticbot tools are designed around explicit human control:

• Discovery results are presented before a migration is confirmed.
• Choi