For developers
MCP, for AI assistants
An endpoint an AI assistant can hold a token for. Six tools, scoped to exactly one site.
https://app.lemonadehost.com/api/mcpJSON-RPC over HTTP, authenticated with the same deploy token as the API:
Authorization: Bearer lm_…The tools
All six, including the two that change things. An assistant you have connected can call any of them.
| Tool | Does |
|---|---|
list_sites | The site this token reaches, its address and status. |
get_site_files | The live files, as text. |
deploy_site | Publish files. Replaces everything. |
get_deploy_status | Recent releases, each with its id. |
restore_release | Put one of those releases back. |
trash_site | Take the site offline. Guarded — see below. |
Read before you replace
deploy_site replaces the whole site. An assistant asked to fix a typo in the footer, with no way to see the site first, will compose a deploy containing only the file it was thinking about and silently delete the other twelve.
get_site_files is what turns a replace into an edit. Read, change, send the whole set back. On a site built from one of our designs it refuses, the same as the download button does.
Undo
get_deploy_status lists recent releases and each carries an id beginning dp_. Hand one to restore_release and that release serves again. Releases stay restorable for 7 days.
Taking a site down
trash_site requires confirm to be the site's exact subdomain. The guard exists so that a vague instruction — "tidy up my sites" — cannot reach it: the assistant has to have looked at which site it is about to take offline.
Trashing is a soft delete. The site stops serving, stays restorable for 30 days from your dashboard, and its address is held so nobody else can take it.
Restoring is not an MCP tool and will not be: putting a site back decides whether it is paid or unpaid, and a token scoped to publishing files does not move billing.
trash_site is the last thing that token will ever be told — which is why it carries the link to the dashboard.What a token cannot do
Nothing outside its one site. No billing, no account, no other site. A tool call with no token is refused with 401; a token pointed at another site gets the same concealed 404 the HTTP API gives.
Handshake and tool discovery work before authentication, so a misconfigured client gets a useful protocol error instead of a bare 401 it cannot interpret. Every tool call needs the token.
There is no account-level token today, so an assistant cannot create a site — only publish to one you have already made and handed it a token for.