Croisa MCP

Websites that can be built, understood, and improved through conversation.

Croisa is an AI-native website platform. Its Model Context Protocol server gives an authenticated AI client a structured way to create websites, inspect live and draft state, make safe edits, manage content and memberships, and publish only after review.

Connect to Croisa Explore capabilities

At a glance

Endpoint: https://www.croisa.com/mcp
Transport: Streamable HTTP with JSON-RPC
Authentication: OAuth 2.0 authorization code + PKCE
Scopes: mcp:read · mcp:write
Tool surface: 75 authenticated tools
Documentation: https://www.croisa.com/en/docs/mcp

01 · Connection

Connect the MCP endpoint to an AI client

The machine endpoint and this human-readable page have different jobs. Put the endpoint in the connector configuration. Put this page in the connector's documentation field.

Hosted MCP endpoint

https://www.croisa.com/mcp

Croisa speaks MCP over HTTPS. The client discovers the server and its tools through the protocol; the endpoint is not a normal HTML page.

Example endpoint configuration

{
  "mcpServers": {
    "croisa": {
      "url": "https://www.croisa.com/mcp"
    }
  }
}

The exact configuration shape depends on the client. The important value is the hosted URL above.

OAuth discovery and authorization

Protected resource metadata: https://www.croisa.com/.well-known/oauth-protected-resource/mcp
Authorization server metadata: https://www.croisa.com/.well-known/oauth-authorization-server
Flow: Authorization code grant with PKCE using S256. Access tokens are sent as bearer tokens.

02 · Product overview

What Croisa is trying to do

Croisa turns a website brief into a maintainable, multilingual web presence. The important distinction is that a Croisa website is not only a rendered page: it has structured business data, page schemas, reusable components, drafts, locale state, integrations, and publishing state that an AI client can inspect and update.

Build from intent

A user can start with a business name, a brief, and locale choices. Croisa creates the initial website foundation and returns a previewable state.

Edit structure, not just pixels

The MCP tools expose page data, themes, component presets, custom sections, and data bindings. An agent can make targeted changes and keep them reviewable.

Serve real business needs

Websites can include services, reviews, carousels, forms, structured collections, memberships, digital passes, domains, and language configuration.

Keep publishing deliberate

Changes live in a versioned draft workflow. Preview, version recovery, deletion confirmation, and publication are separate operations.

03 · Operating model

How a conversation becomes a website change

Croisa keeps the AI client focused on intent while the server owns identity, validation, state transitions, and access checks.

Authenticate

The client completes OAuth. Croisa validates the Cognito access token before a tool call can run.

Discover

The agent lists the user's websites and pages, then loads the relevant preview or model metadata.

Draft

The agent changes a structured page, data model, setting, or membership configuration. The server validates the operation and persists draft state.

Review and publish

The user reviews the returned preview or private link. A separate publish call makes approved draft changes live.

Identity

The handler accepts an OAuth bearer token or the Croisa access-token cookie. It verifies the JWT signature, issuer, audience, and access-token use.

Authorization

Website-scoped operations check that the authenticated user owns or can access the requested website. Sharing and membership workflows use the same website context.

State

MCP request handling is stateless at the transport layer. Website drafts, versions, content, and entitlements remain in Croisa's server-side systems.

04 · Capabilities

What an AI client can do with Croisa

The server is designed for end-to-end website work. An agent can move from a high-level request to a concrete, inspectable change without bypassing the platform's content and publishing model.

Create and shape a site

• Create a site from a business brief and selected locales.
• Add pages and import a page from an existing URL.
• Inspect supported theme and component presets before changing visual design.
• Add custom sections with scoped HTML, CSS, JavaScript, data bindings, and backend actions.
• Generate, upload, and process visual assets inside the authoring workflow.

Operate a real business website

• Manage services, reviews, carousels, domains, languages, and private preview access.
• Define collections and singletons that can power pages and forms.
• Review moderated form assets and control entry visibility.
• Configure membership offers, payments, wallets, passes, redemptions, and scanners.
• Load and run validated SEO research operations when the website is entitled and within budget.

05 · Safety and control

The server remains the authority

Tool descriptions and annotations help an AI client plan. They do not replace the checks in the handler. Croisa enforces authorization and state transitions when the request reaches the server.

Authentication on calls

Every registered tool advertises the OAuth security scheme, and the request handler rejects unauthenticated tools/call requests with an OAuth resource challenge.

Website access checks

Most website-scoped tools resolve the authenticated user and verify access to the requested websiteId. A valid token alone does not grant access to another user's site.

Draft boundaries

Edits are returned as previewable draft state. Publishing is a distinct operation, so a client can show the user what will go live before it changes the public site.

Destructive actions

Page deletion has a request-and-confirm flow. Version recovery requires a prior version listing. These workflow rules are enforced in the tool handlers.

Membership delegation

Payment and membership adapters pass the authenticated website context to the typed membership services, which own payment, entitlement, and persistence rules.

SEO research controls

The SEO tools expose a server-curated catalog, validate arguments, enforce website access and entitlements, use caching, and apply budget and provider-cost controls. Some research operations can consume a paid research budget.

Client responsibility: never place an access token, provider credential, or private website data in public documentation, prompts, logs, or custom-section source. Treat tool output as user data and ask for user confirmation before consequential changes when the client experience supports it.

06 · Tool inventory

The live tool surface

Croisa currently exposes 75 tools. The groups below explain the intent of each tool. The protocol's tools/list response and each tool's input schema are authoritative if implementation and this overview ever differ.

Website discoveryFind the websites available to the authenticated user, inspect their pages, and load a preview context.+

list_websites

List the websites owned by or available to the authenticated user.

list_all_pages_for_website

List the pages and locale state for one authorized website.

preview_website_page

Load the current page data and renderable draft state for review.

Website and page authoringCreate websites, add pages, import existing pages, work with media, and extend a site with custom sections.+

create_website

Create the initial structured website foundation from a name, brief, and locale configuration.

create_page

Create a new page in an authorized website.

edit_preview_page

Apply structured JSON Patch operations to a page draft and return the updated preview state.

create_custom_section

Add a custom HTML/CSS/JS section with optional data bindings and backend actions.

describe_custom_component

Inspect a custom section source, bindings, actions, and field hashes before editing it.

patch_custom_section_code

Apply guarded, hash-aware edits to custom section HTML, CSS, or JavaScript.

request_image_upload

Request an upload target for an image asset used by a website.

process_image

Process or generate an image and attach the resulting asset to the website workflow.

capture_page_reference

Capture a page reference for inspection or authoring context.

inspect_resource

Inspect a remote resource that is relevant to a page or import workflow.

import_page_from_url

Import a page from a URL into an authorized Croisa website.

Drafts, versions, and publishingKeep edits reviewable. Croisa separates draft mutation, version recovery, deletion confirmation, and publication.+

list_draft_versions

List the available versions for a page draft.

revert_preview_page_version

Restore a previously listed page draft version.

redo_preview_page_version

Restore a newer page draft version after a prior revert.

request_page_deletion

Prepare and validate a page deletion request without deleting the page.

confirm_page_deletion

Confirm and perform a page deletion after the request step.

publish_preview_changes

Publish the reviewed draft changes to the live website.

Structured CMS dataDefine collections and singletons, evolve their fields, and manage entries that can power pages and forms.+

define_data_collection

Define a collection data model for structured, repeatable entries.

update_data_model_metadata

Update metadata for an existing data model.

list_data_models

List the data models available for an authorized website.

resolve_data_model

Resolve a model reference to its canonical data model.

describe_data_model

Describe fields, bindings, and configuration for a data model.

find_data_references

Find page and component references to a data model or field.

add_data_field

Add a field to a collection or singleton model.

move_data_field

Move a field within a data model.

rename_data_field

Rename a field while preserving the model operation contract.

remove_data_field

Remove a field from a data model.

create_data_entry

Create an entry in an authorized collection.

patch_data_entry

Patch values in an existing data entry.

review_form_asset

Review an asset attached to a form submission before exposing it.

hide_data_entry

Hide a data entry from the public collection view.

show_data_entry

Show a previously hidden data entry.

move_data_entry

Move an entry within a collection.

reorder_data_entries

Reorder entries in a collection.

query_data_entries

Query entries, including moderated or hidden entries when authorized.

get_data_entry

Read one data entry by identifier.

define_data_singleton

Define a singleton model for one structured site-wide value.

set_data_singleton

Set the value of a singleton model.

patch_data_singleton

Patch part of a singleton value.

get_data_singleton

Read one singleton value.

Theme and component guidanceInspect the bounded design system before making visual changes so edits use supported presets and fields.+

describe_theme_presets

Describe available color, font, and border presets.

describe_static_component_presets

Describe supported component variants and configuration fields.

Operations and platform settingsManage domains, languages, sharing, private previews, services, reviews, carousels, and Croisa subscriptions.+

manage_domains

Inspect or manage website domain configuration.

manage_languages

Inspect or manage the locales enabled for a website.

share_website_access

Manage access sharing for an authorized website.

generate_private_preview_link

Generate a private link for reviewing a website preview.

manage_services

Manage service information used by a website.

manage_reviews

Manage review content used by a website.

manage_carousel

Manage carousel content used by a website.

manage_croisa_subscription

Inspect or manage the Croisa platform subscription workflow.

Memberships and digital passesConfigure membership programs, offers, wallets, pass templates, redemptions, and scanner access.+

get_membership_setup

Read the membership setup state for an authorized website.

open_stripe_connect_setup

Open the Stripe Connect setup workflow for membership payments.

configure_membership_program

Configure the membership program for a website.

create_membership_offer

Create a membership offer.

set_membership_sales

Configure membership sales settings.

set_membership_wallet

Configure the digital wallet settings for memberships.

set_membership_wallet_branding

Configure wallet pass branding.

describe_pass_template_capabilities

Describe supported digital pass template capabilities.

list_pass_templates

List membership pass templates.

get_pass_template

Read one pass template.

save_pass_template

Save a pass template.

validate_pass_template

Validate a pass template before use.

preview_pass_template

Preview a pass template.

update_membership_program

Update an existing membership program.

list_membership_members

List membership members.

update_membership_status

Update the status of a membership.

list_membership_redemptions

List membership redemptions.

create_scanner_pairing

Create a pairing for a membership scanner.

send_member_pass_link

Send a member a link to access their digital pass.

SEO and market researchUse a server-curated, read-only research catalog for an authorized website. Availability and budget are enforced by the server.+

load_data_for_seo_tools

Load the allowed SEO research catalog for a website.

call_data_for_seo_tool

Run one validated, server-allowed read-only research operation.

07 · Recommended workflows

A good first conversation with Croisa

The tool surface is broad, but the common workflows are straightforward. Start from identity and context, make the smallest useful draft change, inspect the result, and publish only when the user is ready.

Create a new website

create_website → preview_website_page → edit_preview_page → publish_preview_changes

Use the returned website and page identifiers for the next calls. Keep the initial design in draft until it has been reviewed.

Improve an existing page

list_websites → list_all_pages_for_website → preview_website_page → inspect presets → edit → preview → publish

Use component and theme descriptions to stay inside Croisa's supported design system before reaching for custom code.

Use research responsibly

load_data_for_seo_tools → choose an exact catalog entry → call_data_for_seo_tool

Only request research for the authorized website, pass the catalog's schema, and treat budget or provider errors as a reason to continue without the research.

Use these two URLs

One endpoint for machines. One page for people.

Hosted MCP endpoint

https://www.croisa.com/mcp

API or MCP documentation

https://www.croisa.com/en/docs/mcp

The documentation page is an overview for people and reviewers. The MCP endpoint, OAuth metadata, tool descriptions, annotations, and JSON schemas are the machine-readable contract.