# steadybuild — agent access

Preferred interface: the MCP server at POST https://www.steadybuild.dev/api/mcp.
It speaks JSON-RPC 2.0 (initialize, tools/list, tools/call). Handshake
methods are open. Admin tools require a bearer token.

## Machine interfaces

- MCP server (streamable HTTP, JSON-RPC 2.0): POST https://www.steadybuild.dev/api/mcp
  Alias for validators behind bot protection: https://www.steadybuild.dev/.well-known/mcp
- OpenAPI 3.1: https://www.steadybuild.dev/api/openapi.json
  Also at https://www.steadybuild.dev/openapi.json and https://www.steadybuild.dev/.well-known/openapi.json
- A2A agent card: https://www.steadybuild.dev/.well-known/agent-card.json
  Earlier-draft path https://www.steadybuild.dev/.well-known/agent.json redirects there (308).
- MCP server card (Smithery static format): https://www.steadybuild.dev/.well-known/mcp/server-card.json
- llms.txt: https://www.steadybuild.dev/llms.txt
- This file: https://www.steadybuild.dev/agents.txt
- Human docs: https://www.steadybuild.dev/docs/machine-interfaces

## Tools (MCP)

Admin (Authorization: Bearer required):
  analytics_summary
  contact_inbox

## Plans

Every plan starts with a 14-day free trial.
- Starter: $19/month — 5 projects, 1 team seats, 10,000 events/month
- Pro: $49/month — 50 projects, 10 team seats, 1,000,000 events/month

## Auth

- Admin tools: `Authorization: Bearer <token>`. The token is the
  deployment's MCP_AUTH_TOKEN. This file never contains the value.
- initialize, ping, and tools/list of non-admin tools need no credential.
- A missing or wrong bearer on an admin tool is 401 with
  `WWW-Authenticate: Bearer realm="mcp"`.

## House rules

- Call MCP or the OpenAPI routes. Do not scrape the HTML app.
- Respect robots.txt. Gated paths (/dashboard, /settings, /admin) are not a data API.
- Support: support@steadybuild.app