How it works

When you add a website, a build agent starts a headless Chromium browser in an isolated Vercel Sandbox. It uses the site like a person would while recording the network traffic, which shows the JSON APIs, GraphQL operations and form posts behind every page and button.

The agent then writes each tool as a declarative spec: a short, fixed sequence of HTTP requests with the arguments placed into them, plus a projection that keeps only the useful fields of the response. It runs every tool against the live site before it is published.

A build takes up to 25 minutes and stops at a fixed budget. You can ask for changes at any time; the agent starts from the current version and its notes, and every version is kept so you can restore an earlier one.

No AI runs at call time. mcpthis.io interprets the tool’s spec: it fills in the arguments, sends the requests from our servers, follows only redirects to the hosts the MCP declared, and returns the projected result. The same call with the same site state always does the same thing. You can see each tool’s requests on the MCP’s page.

Tools that change things, such as placing an order, are marked so your MCP client can ask you before running them.

MCP clients connect with OAuth: the first time, a mcpthis.io window asks you to sign in and approve the client. If the site needs an account, you can enter your own details there or on the MCP’s page. Each person uses their own account; details are never shared between users.

Site credentials are encrypted at rest and are only ever sent to the hosts listed on the MCP’s page. Logins are cached as a session and renewed automatically when the site asks for it.

An MCP can be private (you, plus admins of the organization it belongs to), shared with everyone in your organization, or public. Public MCPs are listed on the Explore page; anyone using one still signs in and connects their own site account.

mcpthis.io is free during the beta, so usage is capped: 6 builds per person per day, one build at a time, and 60 tool calls per minute per MCP. Sites protected by CAPTCHAs or aggressive bot detection may not work.