@sendtoapp/mcp

An MCP server for SendToApp. Point an agent at it and it can read the reference, register an app, mint and revoke links, wire up branded domains, and check that the association files iOS and Android fetch are actually correct.

Node 22 or newer. No runtime dependencies beyond @sendtoapp/protocol.

Configure

Hosted, or local

The server also runs on the platform, which needs no install at all:

claude mcp add --transport http sendtoapp https://sendtoapp.com/mcp \
  --header "Authorization: Bearer stak_..."

Reach for this package when your client only speaks stdio, or to point at a deployment other than sendtoapp.com.

{
  "mcpServers": {
    "sendtoapp": {
      "command": "npx",
      "args": ["-y", "@sendtoapp/mcp"],
      "env": { "SENDTOAPP_ACCOUNT_KEY": "stak_…" }
    }
  }
}

In Claude Code that file is .mcp.json in the project, or claude mcp add. In Claude Desktop it is claude_desktop_config.json.

The credential

One: SENDTOAPP_ACCOUNT_KEY. Create it under Account → Account keys in the dashboard; it is shown once.

| Variable | Needed for | | --- | --- | | SENDTOAPP_ACCOUNT_KEY | everything: registering apps, and working on every app the account owns | | SENDTOAPP_EMAIL + SENDTOAPP_PASSWORD | the older way to prove the same account; an account key is better | | SENDTOAPP_BASE_URL | pointing at something other than https://sendtoapp.com |

The account key reaches every app the account owns, including apps registered after the key was made, so there is nothing to configure per app. Ten apps is one key, not ten.

It cannot change the password or the email address, close the account, create another key, or open the operator console. Revoking it changes nothing else — no password change, no device signed out.

An app API key is not a credential for this server. register_app and rotate_api_key return one, and it belongs in your own backend's secrets, where confining a leak to one app is worth something. It cannot register an app or read the account, so as an agent's credential it was strictly worse than the account key while taking longer to set up. Setting SENDTOAPP_API_KEY here does nothing.

Both variables are optional and the server starts without either — the reference tools still work, and whoami says what is missing.

The password is used once, locally, to derive the same key the browser derives (PBKDF2-SHA256, 600,000 iterations). It is never sent. What travels is the derived key, and what is kept is a session cookie held in memory for the life of the process.

Tools

Reference — search_reference, read_reference. Bundled, so they work offline and match the version of the server that is running.

Account — whoami, get_account, list_apps, register_app.

App — get_app, update_app, rotate_api_key, delete_app.

Links — create_link, list_links, revoke_link.

Branded domains — list_domains, add_domain, verify_domain, set_primary_domain, remove_domain.

Integration — integration_snippets returns the exact files to add for Expo or React Native CLI with the host filled in; check_association fetches both association files and reports what would stop iOS or Android accepting them.

revoke_link, remove_domain, rotate_api_key and delete_app are marked destructive so a client asks before running them.

The six reference documents are also exposed as MCP resources under sendtoapp://reference/….

What it will not do

There is no tool to read an API key back. Keys are stored as digests, so no such tool could exist — rotate_api_key issues a replacement instead, and the old key stops working immediately.

There is no tool to change a password, change the account email or close the account. Those need the current password on every call by design, and routing them through an agent would weaken that.

Testing

tests/mcp.test.js in the platform repository drives this server against the real Worker over an injected fetch with an in-memory D1 — no ports, but every request is genuinely parsed, authorised and answered by production code.

npm run test:mcp runs the whole customer journey against the real binary over real pipes: create an account, connect, read the reference, register an app, check the association files iOS and Android would fetch, mint a link and follow it as each platform, bring a branded domain online through DNS, replace the key and confirm the old one is dead, revoke, and shut down cleanly. It starts workerd, a DNS stub and a virtual-host proxy itself, so it needs nothing running.

npm run test:mcp:live points the same transport checks at a deployment that is already up:

SENDTOAPP_BASE_URL=https://sendtoapp.com \
SENDTOAPP_EMAIL=… SENDTOAPP_PASSWORD=… SENDTOAPP_APP_HOST=… \
npm run test:mcp:live

Credentials are optional there; the run skips the tools that need them and says so.

Documentation

Full documentation is at sendtoapp.com/docs, and sendtoapp.com is what the platform does in one page.

Quick start · Expo and React Native · Install recovery · Knowing when a link failed · Troubleshooting · HTTP API

The rest of SendToApp

• @sendtoapp/react-native — Expo and React Native, with the config plugin that writes the native declarations
• @sendtoapp/expo — Expo, with Google Play install recovery through the Expo module system
• @sendtoapp/react-native-referrer — Bare React Native, with Google Play install recovery
• @sendtoapp/core — Link resolution with no UI framework attached
• @sendtoapp/protocol — The wire format the other packages share

MIT licensed. Built by SendToApp.