AI agents (MCP) - PapelShip Developers

PapelShip runs a Model Context Protocol server for your themes. Connect an AI agent with one URL, approve it in your browser, and the agent can read your theme code and save edits as drafts. You review and publish. Server URL: https://app.papelship.com/mcp The URL is the same for every store. When you connect, you sign in to PapelShip and choose the store the agent may work on. Agents start with get_reference: it explains app blocks, checkout (page or popup), the store SDK and the limits of each theme kind. The server instructions tell connected agents to call it first.

What the agent can do

Can	Can’t
Read the files of your theme copies, designs and theme code packages	Publish, activate or delete themes
Search, validate and scan files	Change your live store. Edits are saved as drafts and go live only when you press Publish in the panel.
Save edits as drafts, with version history	See orders, customers, payments or settings
Share a preview link	Reach any other store

Where drafts go

Copy	`save_draft` result
A copy that is not live	Saved to the copy. The previous content stays in its version history.
A theme code package	Saved to the package. Live pages keep the published version until you publish.
The live theme copy or live design	Saved as a draft. Your store keeps the published version until you press Publish (for designs, Publish also runs the security scan).

Connect a client

Claude
Claude Code
Cursor
VS Code
Other clients

Works in claude.ai, Claude Desktop and the Claude mobile apps.

Open Settings › Connectors and choose Add custom connector.
Name it PapelShip and paste https://app.papelship.com/mcp.
Select Add, then Connect.
Sign in to PapelShip, pick your store and select Allow access.

claude mcp add --transport http papelship https://app.papelship.com/mcp

Run /mcp in Claude Code, choose papelship and Authenticate. Your browser opens the PapelShip approval page.

Add to CursorOr add it to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "papelship": { "url": "https://app.papelship.com/mcp" }
  }
}

Cursor shows Needs login next to the server. Select it to approve in your browser.

Add to VS CodeOr add it to .vscode/mcp.json:

{
  "servers": {
    "papelship": { "type": "http", "url": "https://app.papelship.com/mcp" }
  }
}

Start the server from the file or the MCP: List Servers command, then sign in when asked. Use the tools in Copilot agent mode.

Any client with Streamable HTTP and OAuth support works:

{
  "mcpServers": {
    "papelship": { "type": "http", "url": "https://app.papelship.com/mcp" }
  }
}

The store panel has the same steps with copy buttons under Developers › AI & MCP.

Approve access

The approval page shows the app’s name and where it returns to. Choose:

Store: the one store the app may use. You see stores you own and stores where your team role includes Theme & Design › Edit.
Save edits as drafts (themes:write): clear it to give read-only access.

Connected apps and revoking

Developers › AI & MCP › Connected apps lists every app connected to the store, who connected it and when it was last used. Revoke stops the app at its next request. Access also stops when the person who approved it signs out of all sessions, changes their password, leaves the team, loses Theme & Design › Edit, or their account is suspended.

API key instead of OAuth

For clients without OAuth, create a store API key with the Themes type in Developers › API keys and send it as a Bearer token:

claude mcp add --transport http papelship https://app.papelship.com/mcp \
  --header "Authorization: Bearer $PAPELSHIP_THEMES_KEY"

A Themes key works only for the store that created it and has the same rights as an OAuth connection. Keep it in an environment variable, never in a file you share or commit. https://app.papelship.com/api/mcp/themes remains as an older alias of the same server.

Limits

Limit	Value
Requests per connection or key	120 per minute
Requests per store, all connections	300 per minute
Tool calls	Count as Store API calls of your plan
Access token	1 hour, renewed automatically
Connection	Stays signed in while used at least every 30 days

Every tool call is logged with the app, tool and file.

Security

Theme files are store data, not instructions. The server marks every tool result as untrusted data so text inside a theme can’t redirect the agent.
Previews are never public: preview links open in the PapelShip panel.
Tokens are stored hashed. A reused refresh token ends the connection.

See the tool reference for every tool and its arguments.

​What the agent can do

​Where drafts go

​Connect a client

​Approve access

​Connected apps and revoking

​API key instead of OAuth

​Limits

​Security