Snapshot Site

Snapshot Site MCP

Official MCP server for the Snapshot Site API

Tools

• screenshot
• analyze
• compare

These tools are annotated for MCP clients as:

• read-only
• idempotent
• open-world

They also include richer titles, category metadata, and example intents to improve tool selection in Claude Desktop and Cursor.

Two ways to connect

Hosted, with OAuth — point your client at https://mcp.snapshot-site.com/mcp and sign in. There is no local process to run and no API key in your client config; the server resolves your account from the OAuth session.

Local, with an API key — run the package yourself over stdio and provide SNAPSHOT_SITE_API_KEY. The server calls the Snapshot Site API directly.

Either way, calls count against the same plan quota as direct API calls. Nothing is metered differently because it came through MCP.

Credentials

The hosted server needs no credential — you sign in through OAuth and the server resolves your account from the session. Skip this section unless you run the server yourself over stdio.

For local stdio mode you need a Snapshot Site API key.

1. Sign up for a Snapshot Site Console account.
2. Create an API key on the API Keys page.

1. Pass the key to the server as the SNAPSHOT_SITE_API_KEY environment variable.
2. Leave SNAPSHOT_SITE_BASE_URL at its default (https://api.prod.ss.snapshot-site.com) unless you're pointed at a self-hosted or staging instance.

Compatibility

Requires Node.js 20.9 or later. Built against @modelcontextprotocol/sdk v1.28 and tested with Claude Desktop and Cursor over stdio, and with any client that speaks the streamable HTTP transport against the hosted endpoint.

Usage

Not sure which options to use? Preview a capture and its parameters in the Screenshot console playground before wiring them into a tool call.

OAuth discovery flow

What a client does when connecting to the hosted server:

1. Discovery

Claude -> GET https://mcp.snapshot-site.com/.well-known/oauth-protected-resource

MCP -> responds: authorization_servers = https://mcp.snapshot-site.com

2. Authorization

Claude -> must know client_id -> opens: https://mcp.snapshot-site.com/oauth/v2/authorize ?client_id=... &redirect_uri=https://claude.ai/api/mcp/auth_callback &response_type=code &code_challenge=...

3. Token

Claude -> receives an access token -> calls the MCP server: POST https://mcp.snapshot-site.com/ Authorization: Bearer

The server then validates the token against the issuer and resolves the account it belongs to before running the tool.

Verifying the deployment

curl -s https://mcp.snapshot-site.com/.well-known/oauth-protected-resource | jq

curl -s https://mcp.snapshot-site.com/.well-known/openid-configuration | jq curl -i https://mcp.snapshot-site.com/ curl -i -X POST https://mcp.snapshot-site.com/mcp -H 'content-type: application/json' --data '{}'

Manual vs implicit client_id

• The client_id is only needed for the authorization step.
• If your client cannot discover that client_id beforehand, enter it manually in the connector UI.
• It cannot be injected later once the OAuth flow has started.
• The server can publish an experimental implicit mode by exposing a preferred_client_id in /.well-known/oauth-protected-resource.
• Clients that read this metadata may then skip the manual entry. Clients that ignore the field still require a manual client_id.

Environment

export SNAPSHOT_SITE_API_KEY=ss_live_xxx

export SNAPSHOT_SITE_BASE_URL=https://api.prod.ss.snapshot-site.com

Build

pnpm install

pnpm run build

Local stdio mode

export SNAPSHOT_SITE_API_KEY=ss_live_xxx

snapshot-site-mcp

Claude Desktop configuration

{

"mcpServers": { "snapshot-site": { "command": "node", "args": ["/absolute/path/to/snapshot-site-mcp/build/server.js"], "env": { "SNAPSHOT_SITE_API_KEY": "ss_live_xxx", "SNAPSHOT_SITE_BASE_URL": "https://api.prod.ss.snapshot-site.com" } } } }

Cursor configuration

{

"mcpServers": { "snapshot-site": { "command": "node", "args": ["/absolute/path/to/snapshot-site-mcp/build/server.js"], "env": { "SNAPSHOT_SITE_API_KEY": "ss_live_xxx" } } } }

Remote HTTP mode

This package also supports a hosted MCP endpoint for clients using mcp-remote.

Start the HTTP server:

pnpm start:http

or:

npx snapshot-site-mcp-http

Environment variables:

export PORT=3000

export HOST=0.0.0.0 export MCP_PATH=/mcp export HEALTH_PATH=/healthz export MCP_ALLOWED_HOSTS=mcp.snapshot-site.com export SNAPSHOT_SITE_BASE_URL=https://api.prod.ss.snapshot-site.com

Remote client configuration with direct API key header:

{

"mcpServers": { "Snapshot Site MCP": { "command": "npx", "args": [ "mcp-remote", "https://mcp.snapshot-site.com/mcp", "--header", "x-snapshotsiteapi-key: ss_live_xxx" ] } } }

The hosted server is stateless. Each request authenticates with x-snapshotsiteapi-key, which makes the service safe to run on multiple replicas without session affinity.

Zitadel / OAuth

The remote HTTP server also supports OAuth bearer tokens validated against an OIDC issuer such as Zitadel.

Environment variables:

export OIDC_ISSUER_URL=https://auth.snapshot-site.com

export OIDC_AUDIENCE=snapshot-site-mcp export OIDC_REQUIRED_SCOPE=claudeai export OIDC_DISCOVERY_CLIENT_ID=366546620977775166 export RESOURCE_SERVER_URL=https://mcp.snapshot-site.com export ALLOW_API_KEY_AUTH=false export SNAPSHOT_SITE_API_KEY=ss_server_side_xxx

In bearer-token mode, the MCP server validates the incoming access token against the issuer JWKS and then uses the server-side Snapshot Site API key to call the backend API.

It also exposes and proxies:

GET /.well-known/oauth-protected-resource

GET /.well-known/openid-configuration GET/POST /oauth/v2/* GET /ui/* GET/POST /oauth/register

so MCP clients can discover the authorization server metadata automatically.

When OIDC_DISCOVERY_CLIENT_ID is set, the protected resource metadata also includes:

{

"resource_name": "Snapshot Site MCP", "preferred_client_id": "366546620977775166", "oauth_client_metadata": { "client_id": "366546620977775166", "token_endpoint_auth_method": "none" } }

This is an experimental compatibility hint for clients that can infer the OAuth public client automatically. Manual client_id entry remains the reliable fallback.

The MCP server also exposes a lightweight registration_endpoint compatibility shim at:

POST https://mcp.snapshot-site.com/oauth/register

This shim currently returns the preconfigured public PKCE client instead of provisioning a brand-new Zitadel client per installation. It validates and reflects the redirect_uris requested by the client, as long as they are valid HTTPS URLs. It is meant to improve compatibility with clients that expect DCR-style discovery, while keeping the existing manual flow as fallback.