Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "deed-page": {
      "type": "http",
      "url": "https://deed.page/mcp",
      "headers": {
        "Authorization": "Bearer ${DEED_PAGE_TOKEN}"
      }
    }
  }
}

claude mcp add --transport http deed-page https://deed.page/mcp --header "Authorization: Bearer ${DEED_PAGE_TOKEN}"

[mcp_servers.deed-page]
url = "https://deed.page/mcp"
bearer_token_env_var = "DEED_PAGE_TOKEN"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "deed-page": {
      "type": "remote",
      "url": "https://deed.page/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:DEED_PAGE_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "deed-page": {
      "type": "http",
      "url": "https://deed.page/mcp",
      "headers": {
        "Authorization": "Bearer ${DEED_PAGE_TOKEN}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=deed-page&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vZGVlZC5wYWdlL21jcCIsImhlYWRlcnMiOnsiQXV0aG9yaXphdGlvbiI6IkJlYXJlciAke0RFRURfUEFHRV9UT0tFTn0ifX0%3D"
}

{
  "servers": {
    "deed-page": {
      "type": "http",
      "url": "https://deed.page/mcp",
      "headers": {
        "Authorization": "Bearer ${DEED_PAGE_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "deed-page": {
      "httpUrl": "https://deed.page/mcp",
      "headers": {
        "Authorization": "Bearer ${DEED_PAGE_TOKEN}"
      }
    }
  }
}

extensions:
  "deed-page":
    enabled: true
    name: "deed-page"
    type: streamable_http
    uri: "https://deed.page/mcp"
    headers:
      "Authorization": "Bearer ${DEED_PAGE_TOKEN}"
    timeout: 300

Placeholders to fill from your own secret store: ${DEED_PAGE_TOKEN}. The registry never accepts secret values.

Quality 72 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene93 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations23 of 23 tools declare readOnlyHint or destructiveHint
warn
tools.directory_hints19 of 23 tools declare all four hints; missing: whoami (idempotentHint); get_site (idempotentHint); list_sites (idempotentHint); …
pass
tools.token_costabout 5,195 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes56 tool changes in 30 days
fail
stability.rug_pull9 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

23 tools, about 5,195 tokens to load them all · tool set 912b14d287db · tools last changed 2026-10-19 · checked 2026-10-19 20:06 UTC

Tool changes

2026-10-19finalize_uploadchangeddescription, input schema
before
Checks uploaded hashes, screens the new bytes, and commits one version under the slug lock. Inputs: session (upl_...), optional expected_version, and token. A stale expected_version returns version_conflict and writes nothing. A bad hash returns hash_mismatch. An expired session returns session_expired.
after · 97% of words in common
Checks uploaded hashes, screens the new bytes, and commits one version under the slug lock. Inputs: session (upl_...), optional expected_version, via, and token. A stale expected_version returns version_conflict and writes nothing. A bad hash returns hash_mismatch. An expired session returns session_expired.
2026-10-19plan_uploadchangeddescription, input schema
before
Accepts a file manifest and returns which hashes are already stored, a direct upload URL for each missing hash, and a session id. Inputs: files as {path, sha256, size, content_type?}, and optional slug, spa, merge, ttl_seconds, expected_version, and token. Applies when the files are larger than about 4 MB, or when each sha256 is already known. Does not publish by itself. Per-site size limits are unchanged.
after · 98% of words in common
Accepts a file manifest and returns which hashes are already stored, a direct upload URL for each missing hash, and a session id. Inputs: files as {path, sha256, size, content_type?}, and optional slug, spa, merge, ttl_seconds, expected_version, via, and token. Applies when the files are larger than about 4 MB, or when each sha256 is already known. Does not publish by itself. Per-site size limits are unchanged.
2026-10-19update_sitechangeddescription, input schema
before
Replaces the files of a slug owned by the token, or, when merge is true, adds and overwrites only the paths sent. Inputs: slug, files, and optional spa, merge, expected_version, and token. Returns url, path_url, slug, and a new version. When expected_version does not match the live version, the result is version_conflict and nothing is written. Two racing updates return version_conflict even without expected_version.
after · 98% of words in common
Replaces the files of a slug owned by the token, or, when merge is true, adds and overwrites only the paths sent. Inputs: slug, files, and optional spa, merge, expected_version, via, and token. Returns url, path_url, slug, and a new version. When expected_version does not match the live version, the result is version_conflict and nothing is written. Two racing updates return version_conflict even without expected_version.
2026-10-19publish_sitechangeddescription, input schema
before
Publishes files to a live permanent URL at a slug. Inputs: files (required), and optional slug, spa, ttl_seconds, merge, expected_version, and token. Paths are stored exactly. Returns url, path_url, slug, version, and token on the first anonymous publish. On deed.page, url and path_url are both https://{slug}.deed.page/. A lost token has no recovery unless an optional recovery email was attached. When expected_version does not match the live version, the result is version_conflict and nothing is written. A racing publish of the same slug returns version_conflict even without expected_version. Malware, executables, and credential-harvesting pages return content_rejected and are not stored. .bin is blocked by file type (it often has no MZ or ELF header). A raw octet-stream body is screened as one file.
after · 99% of words in common
Publishes files to a live permanent URL at a slug. Inputs: files (required), and optional slug, spa, ttl_seconds, merge, expected_version, via, and token. Paths are stored exactly. Returns url, path_url, slug, version, and token on the first anonymous publish. On deed.page, url and path_url are both https://{slug}.deed.page/. A lost token has no recovery unless an optional recovery email was attached. When expected_version does not match the live version, the result is version_conflict and nothing is written. A racing publish of the same slug returns version_conflict even without expected_version. Malware, executables, and credential-harvesting pages return content_rejected and are not stored. .bin is blocked by file type (it often has no MZ or ELF header). A raw octet-stream body is screened as one file.
2026-10-17set_site_accesschangeddescriptionmeaning changed
before
Sets a site password or clears it. Inputs: slug, password, and token. password is 8 to 200 characters, or null to clear the password. Setting a password is available on Hobby and Pro; Free returns plan_required. Clearing is allowed on every plan. The stored hash is scrypt. Visitors receive a host-only HttpOnly Secure cookie. Version permalinks and custom domains of the site are covered by the same gate.
after · 47% of words in common
Changes the access setting stored for a slug on deed.page. Inputs: slug, password, and token. password is 8 to 200 characters, or null to clear the password. The call writes a scrypt hash into the site record on deed.page, or removes that hash, and contacts no outside system. Setting a password is available on Hobby and Pro; Free returns plan_required. Clearing is allowed on every plan.
2026-10-16create_webhookchangedannotations
2026-10-16set_site_accesschangedannotations
2026-10-16add_domainchangedannotations
2026-10-16publish_sitechangedannotations
2026-10-16delete_webhookchangeddescription, annotationsmeaning changed
before
Deletes one webhook by id from list_webhooks or create_webhook.
after · 29% of words in common
Deletes one webhook. Inputs: id (whk_...) and token.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 83 / 100

no-repository

provenance55

liveness100

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-100% +updated-10d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://deed.page/mcp` streamable-http	none	yes	100%	357 ms	2025-06-18	2026-10-19

Tools (23)

`add_domain`destructive	Attaches a hostname to a slug owned by the token and returns the DNS records to create: a CNAME for a subdomain, an A record or an ALIAS record for an apex (one of those, not both), and every TXT record. Inputs: slug, domain, and token. Status starts at pending_dns until DNS and the certificate are ready. Free allows 1 hostname, Hobby 3, Pro 20. deed.page names are rejected.
`create_webhook`destructive	Registers an http or https URL for the events site.published, site.version_restored, site.deleted, site.taken_down, domain.active, and report.received. Inputs: url, optional events, and token. Returns the webhook id and an HMAC secret once. Free allows 1 webhook, Hobby 5, Pro 20. Private, internal, and localhost targets are rejected. Delivery is best-effort, with up to 3 attempts. API documentation: https://deed.page/docs.
`delete_site`destructive	Permanently removes a slug owned by the token and detaches its custom hostnames. The slug becomes available again. Inputs: slug and token.
`delete_webhook`destructive	Deletes one webhook. Inputs: id (whk_...) and token.
`domain_status`read-only	Returns the verification status of a custom domain and refreshes verification, DNS config, and certificate state. Inputs: slug, domain, and token. status is pending_dns, verifying, issuing_cert, active, or error. dns_records are the records to create. An error includes the reason.
`finalize_upload`destructive	Checks uploaded hashes, screens the new bytes, and commits one version under the slug lock. Inputs: session (upl_...), optional expected_version, via, and token. A stale expected_version returns version_conflict and writes nothing. A bad hash returns hash_mismatch. An expired session returns session_expired.
`get_manifest`read-only	Returns the canonical manifest for a site version: paths, sha256, sizes, version, slug, and created_at, plus an Ed25519 signature. signature is null when the server has no signing key. Inputs: slug, and optional version. When version is omitted, the result is the live site. Public keys are published at /.well-known/deed-signing-keys.json. No token is required.
`get_site`read-only	Returns whether a slug is live, plus its URL, version, size, and timestamps. Input: slug. No token is required.
`get_upgrade_link`read-only	Returns a Stripe Checkout URL for the Hobby plan ($3/mo) or the Pro plan ($15/mo), tied to the token. Inputs: plan (hobby or pro) and token. The call does not charge; payment happens on the returned Checkout page.
`list_domains`read-only	Returns custom hostnames on one slug, or on every site the token owns when slug is omitted. Inputs: token, and optional slug. Status is the last checked value.
`list_sites`read-only	Returns every live site owned by the token, with URLs and versions. Input: token, or an Authorization bearer header.
`list_versions`read-only	Returns every retained version of a slug owned by the token, newest first. Inputs: slug and token. Each entry includes version, created_at, file_count, bytes, kind (publish, merge, or restore), restored_from, and a public permalink. Free keeps 10 versions, Hobby 50, Pro unlimited.
`list_webhooks`read-only	Returns the webhook URLs registered for the token. Secrets are not included. Input: token.
`plan_upload`	Accepts a file manifest and returns which hashes are already stored, a direct upload URL for each missing hash, and a session id. Inputs: files as {path, sha256, size, content_type?}, and optional slug, spa, merge, ttl_seconds, expected_version, via, and token. Applies when the files are larger than about 4 MB, or when each sha256 is already known. Does not publish by itself. Per-site size limits are unchanged.
`publish_site`destructive	Publishes files to a live permanent URL at a slug. Inputs: files (required), and optional slug, spa, ttl_seconds, merge, expected_version, via, and token. Paths are stored exactly. Returns url, path_url, slug, version, and token on the first anonymous publish. On deed.page, url and path_url are both https://{slug}.deed.page/. A lost token has no recovery unless an optional recovery email was attached. When expected_version does not match the live version, the result is version_conflict and nothing is written. A racing publish of the same slug returns version_conflict even without expected_version. Malware, executables, and credential-harvesting pages return content_rejected and are not stored. .bin is blocked by file type (it often has no MZ or ELF header). A raw octet-stream body is screened as one file.
`remove_domain`destructive	Removes a hostname so requests to that host no longer serve the site. Inputs: domain, optional slug, and token. When slug is set, the hostname must already be attached to that slug.
`restore_version`destructive	Creates a new version whose files equal a retained version, without uploading those files again. Inputs: slug, version, optional expected_version, and token. When expected_version does not match the live version, the result is version_conflict and nothing is written. The previous permalink keeps serving until retention drops it.
`revoke_token`destructive	Revokes owner tokens. Inputs: token, and optional scope. Scope "current" (the default) revokes the token that was sent. Scope "all" revokes every token for that principal, including any overlap window. A later request with a revoked token returns 401 token_revoked, which is distinct from 403 suspended. Sites stay online. Without a recovery email, a revoked token cannot update them.
`rotate_token`destructive	Issues a new token for the same principal. Every site carries over. Inputs: token, and optional overlap_seconds from 0 to 300. The previous token stops working immediately when overlap_seconds is omitted or 0. During a non-zero overlap window both tokens work. After that window the previous token returns 401 token_revoked. The new token is returned once.
`set_site_access`destructive	Changes the access setting stored for a slug on deed.page. Inputs: slug, password, and token. password is 8 to 200 characters, or null to clear the password. The call writes a scrypt hash into the site record on deed.page, or removes that hash, and contacts no outside system. Setting a password is available on Hobby and Pro; Free returns plan_required. Clearing is allowed on every plan.
`site_analytics`read-only	Returns owner-only cookieless counts for a slug: views per UTC day, top paths, top referrer hosts, and AI crawler counts by user-agent family. Inputs: slug, optional from and to as YYYY-MM-DD (default the last 7 days, maximum 90), and token. The accuracy field describes under-counting. No raw IP or full user agent is stored.
`update_site`destructive	Replaces the files of a slug owned by the token, or, when merge is true, adds and overwrites only the paths sent. Inputs: slug, files, and optional spa, merge, expected_version, via, and token. Returns url, path_url, slug, and a new version. When expected_version does not match the live version, the result is version_conflict and nothing is written. Two racing updates return version_conflict even without expected_version.
`whoami`read-only	Returns the plan, limits, the number of sites the token owns, and the number of custom hostnames attached. Input: token.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "page.deed/deed-page",
  "icons": [
    {
      "src": "https://deed.page/icon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "deed.page",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://deed.page/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "Authorization",
          "isSecret": true,
          "description": "Optional. 'Bearer deed_tok_…' token returned by your first publish_site call. Tools also accept it as a 'token' argument."
        }
      ]
    }
  ],
  "version": "1.9.0",
  "websiteUrl": "https://deed.page",
  "description": "Publish permanent static sites via MCP/REST. 23 tools. No account or claim link."
}