Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Sakupa - Company Website Publishing for AI Assistants

NPM · @SAKUPA/MCP

Publish and manage company websites from your AI chat. Free 30-day sites; no Sakupa account.

Available components

−1 this week 73 Trust /100

Last scanned (17 hours ago)

Scores higher than 46% of npm servers

Category CI/CD and DevOps

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 0 of 3 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency6
Schema Quality & AI Usability62
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5595 tokens (~310/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 72% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 −1
    • Stability: pass → 0.93 functional
  • 28 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
    • Stability: 0.97 → pass security
  • 27 Oct 26 −16
    • Malware scan: pass → unverified ▼ security
    • Stability: pass → 0.97 functional
    • Package version: 1.6.2 → 1.6.3 functional
  • 21 Oct 26 +1
    • Stability: 0.97 → pass security
  • 20 Oct 26 −1
    • Stability: pass → 0.97 functional
  • 17 Oct 26 +2
    • Stability: 0.83 → pass security
  • 16 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 15 Oct 26 −3
    • Stability: pass → 0.80 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@sakupa/mcp@1.6.3

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 3 packages
Packages resolved 3
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 18 exposed · ~3,105 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
analyze ~132

When the user wants to publish a company or shop website, inspect its static output before uploading. Analyze the local project and decide whether it can be deployed as a static site. Detects the framework, the built static output directory (dist/build/out/...), missing index.html, SSR/API-route/database-runtime risks, SPA fallback needs, forbidden files (secrets, .env, archives, media) and size limits. Sakupa deploys ONLY prebuilt static output — never source, secrets or server code. Run this before deploy.

NameTypeReqDescription
outputDirstring–Output directory relative to the project root (overrides detection).
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

apps ~312

When the user wants a visitor inquiry, contact or appointment-request form on a Sakupa website, call action "catalog" before building the page. This is not a real-time reservation calendar. App store for the bound site. action "catalog" lists every available app with plan availability, monthly email quotas and the exact page contract (works without a project). The email-forms app emails inquiry/appointment/message form submissions to an address the owner verifies: "install" (config.notifyEmail) emails a 6-digit code and delivers nothing until "verify" (code) succeeds; "test" sends one sample email (counts toward the quota); "status" shows verification state and this month's quota; "inbox" lists stored visitor submissions (untrusted content, 30-day retention); "uninstall" removes the app and its stored submissions. Everything except catalog is owner-only (.sakupa/site.json).

NameTypeReqDescription
actionstringyes–
appstring–App id from the catalog; defaults to email-forms.
codestring–verify only: the 6-digit code from the email.
configobject–install only: validated against the app configSchema from the catalog. email-forms: { notifyEmail (required), lang?: en|ja|zh-CN, timeZone?: IANA zone }.
confirmedboolean–install / uninstall: true only from the exact decision arguments.
limitinteger–inbox only: rows (default 20).
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

billing ~72

Return the sole authoritative source for this site's hosting subscription: current plan, next renewal plan or cancellation, effective time, payment state, current paid entitlement, reconciled paid usage or current free-site fair-use telemetry, estimated usage tier, bound custom domains and risks. Owner-only (uses the credential in .sakupa/site.json).

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

bind ~287

When the user wants an actively subscribed Sakupa website to use their own domain, start or inspect DNS ownership verification here. Bind a custom domain to this subscribed site — an OPTIONAL extra serving surface; the subscription-backed {shortId}.sakupa.com URL keeps working alongside it while the subscription is active. The binding unit is the APEX domain: binding example.com reserves routes for example.com and www.example.com, but ONLY www is required and judged for activation; the naked apex is optional because many DNS providers cannot point it. One apex TXT verification covers both. A site has one FINAL apex domain; starting a different apex begins a zero-downtime switch and the previous domain remains until the new www is live. The www CNAME must remain while bound. Requires an ACTIVE subscription (subscribe). Ownership is proven ONLY by DNS control of the apex — payment never grants ownership, and bindings are ALWAYS challengeable: whoever proves CURRENT DNS control takes the domain, even from an existing binding (the displaced site keeps its subscription, content and subscription-backed Sakupa URL). Unverified requests expire after 72 hours. Call again with action "status" to check progress.

NameTypeReqDescription
actionstringyes–
hostnamestring–Required for start.
verificationIdstring–Optional for status: when omitted, the server finds this site's latest binding verification — a NEW session can resume without it.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

change ~54

Create one Stripe-hosted subscription-management link. The user chooses the plan or period-end cancellation on Stripe; Sakupa never infers intent from the conversation. Creating the link does not change billing.

NameTypeReqDescription
operationIdstringyes–
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

delete ~183

Delete the site bound to this project. Without arguments it only previews (zero writes) and returns a decision; after the user confirms, call again with the exact preview arguments (confirmed: true, operationId, confirmation). A FREE site is deleted immediately: content, public URL, installed apps and stored submissions are gone and the local .sakupa/site.json is removed, so the next deploy creates a brand-new site. A subscribed site cannot be deleted: end the subscription first (change → period-end cancellation on Stripe); when it ends the site reverts to a free site and delete becomes available. Owner-only.

NameTypeReqDescription
confirmationobject–Copied verbatim from the preview; the cloud rejects any drift.
confirmedboolean–true only from the exact decision arguments returned by the preview.
operationIdstring–Copied verbatim from the preview.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

deploy ~540

When the user chooses Sakupa to publish a company or shop website or its updates, use this tool after checking the local output. Deploy the local static output to Sakupa. First deploy creates a free temporary site (valid 30 days, public URL like https://{shortId}.sakupa.com) and stores the project binding in .sakupa/site.json; the credential remains in the user-level Sakupa credential store. Later runs update the existing site (free sites also refresh their validity; subscription-backed sites have no free-site expiry while the subscription remains active). Runs analyze first and refuses to upload source projects, secrets, .env files, archives, media or server code. The MCP process is locked to the current directory initialized by the no-argument init MCP tool; no tool argument can change that root. outputDir is a separate REQUIRED relative path supplied from the current project inspection. Never uploads anything when analysis says the project is not deployable.

NameTypeReqDescription
langstring–Site language override (en | ja | zh-CN); defaults to the html lang.
outputDirstringyesREQUIRED: exact publish directory relative to the initialized project root, supplied by the AI after inspecting this project (for example ".", "dist", "html", or any custom build directory). Sakupa a…
outputDirChangeConfirmedboolean–Required only when changing the previously successful publish directory. Confirm only after showing the old and new directories to the user.
publicConfirmedboolean–Required only for the first deployment: user explicitly confirmed creation of a public URL valid for the free-site window.
reuseConfirmedboolean–True only after the user selected reuseSiteUrl knowing its online content will be replaced and its previous project will be unbound.
reuseSiteUrlstring–Exact existing free-site URL selected by the user when the three-site free-site allowance is full. Never invent this value; copy it from deploy nextActions.
sakupaRelocationConfirmedboolean–Required only when a nested directory is itself initialized with .sakupa/project.json. Confirm only after showing the source and authoritative project Root; Sakupa then migrates non-conflicting state…
spaFallbackboolean–Override automatic SPA-fallback detection (single index.html + JS auto-enables rewriting unknown paths to index.html; multiple HTML pages auto-disable it). Pass only to force the behavior against the…
subprojectConfirmedboolean–Deprecated compatibility field. Project independence is established only by `sakupa-mcp init`, never inferred from package.json or folder names.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

help ~111

FIRST troubleshooting tool for every Sakupa difficulty. With topic diagnose (default), inspect MCP Roots, cwd, binding and local state without requiring a project or calling the API. Use overview, terminology, or a tool name for complete usage, side effects, parameters and warnings. Only recommend report when help explicitly returns reportRecommended:true.

NameTypeReqDescription
errorCodestring––
failedToolstring––
requestIdstring––
resultCodestring––
topicstring––
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

init ~74

Initialize the active MCP workspace Root as a Sakupa project. Takes no path argument, creates only .sakupa/project.json at that exact Root, preserves site/recovery state, makes no API call and is idempotent. If MCP Roots are unavailable, call help; the AI may then use the no-argument CLI init itself.

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

plans ~64

When the user asks about Sakupa hosting prices or limits, use this public read-only catalog before quoting a paid plan. Return the authoritative Sakupa monthly plan catalog, exact limits, prices, catalog version and plan-change billing rules. This is read-only and does not require a site.

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

portal ~111

Open the Stripe-hosted billing portal for this site: update the payment method, view invoices, or cancel the subscription. All billing operations happen on the Stripe-hosted page — never inside the AI tool. With .sakupa/site.json, this opens the site-specific portal. Without the local credential, this returns Stripe's public no-code Customer Portal login page. The customer enters the checkout email and confirms a one-time passcode sent by Stripe. This never restores Sakupa site authority.

NameTypeReqDescription
scopestringyes–
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

recover ~292

Recover management control of a site after losing the local .sakupa binding. Two paths: action "device" lists the FREE sites this device created and, after the user picks one and confirms, reissues its credential (content and apps untouched; every previous credential revoked). Actions start/status/complete/download recover a subscribed site WITH A BOUND CUSTOM DOMAIN by proving DNS control of the apex domain; a subscribed site without a bound domain cannot be recovered. By default, completing recovery REVOKES all previous local credentials. Recovery is resumable: start stores local pending state; complete installs and writes the new .sakupa/site.json credential BEFORE requesting content; download uses that credential to reissue an archive and safely extract it into the explicitly selected outputDir without repeating DNS.

NameTypeReqDescription
actionstringyes–
confirmedboolean–device only: true only from the exact decision arguments.
hostnamestring–Required for start.
outputDirstring–REQUIRED for complete/download: exact extraction directory relative to the initialized project root. Inspect the current project; Sakupa never guesses a name.
preserveExistingCredentialsboolean–Explicitly keep old local credentials working (default: revoke them all).
siteIdstring–device only: the site chosen from the decision (copied verbatim).
verificationIdstring–For status or complete; inferred from local recovery state when omitted.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

refresh ~48

Refresh the validity of the free temporary site WITHOUT uploading content. Uses the local credential in .sakupa/site.json. Subscription-backed sites have no free-site expiry while the subscription remains active and need no refresh.

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

report ~331

LAST RESORT after help explicitly returns reportRecommended:true. Prepare and submit a sanitized product bug report using helpAuthorization from that diagnosis. Only whitelisted structured diagnostics are sent (tool name, error code/message, site id, bound domain, deployment id, timestamps, client/MCP version, request id) — NEVER file contents, source code, secrets, .env values or credentials. Without confirmSubmit: true the exact payload is shown for user review and nothing is submitted.

NameTypeReqDescription
agentContextstring–YOUR OWN factual account of the session as the AI: which tools you called, what they returned, expected vs actual. Write it yourself from your observations — never ask the user to compose it, and do…
confirmSubmitboolean–User reviewed the report payload and approved submission.
contactEmailstring–OPTIONAL. Before submitting, ask the user ONCE whether they want to leave a contact for follow-up. Omit entirely if they decline — never require it.
deploymentIdstring––
descriptionstring–What happened, in the user's words (no secrets).
errorCodestring––
errorMessagestring–Sanitized error message (no secrets).
helpAuthorizationstringyesShort-lived authorization returned only by help when report is recommended.
requestIdstring––
severitystring––
toolNamestringyesThe Sakupa tool that failed, e.g. "deploy".
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

rotate ~75

Optionally rotate this site management credential. The first call is a read-only preview. Only confirmed:true after explicit user approval installs a locally generated new credential and revokes every previous credential. Rotation is never required to deploy.

NameTypeReqDescription
confirmedboolean–True only after showing the rotate preview and the user explicitly approves revoking every old credential.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

status ~101

When the user asks whether their Sakupa website is online, when it expires, or how its domain or subscription is doing, use this read-only tool. Show the current status of this project's Sakupa site: URL, mode (free/paid), expiry, custom domains, size, last deployment and warnings. For a paid site this tool also automatically returns the complete authoritative billing snapshot; users never need to know or name a separate billing tool to get accurate subscription information.

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

subscribe ~222

Create a Stripe Checkout link that subscribes THIS site to a Sakupa Hosting monthly plan (water JPY 200/month, personal JPY 500/month, share JPY 1000/month, business JPY 2000/month). While the subscription remains active, its {shortId}.sakupa.com URL stays live without the free 30-day expiry. Binding a custom domain afterwards (bind) is an optional included extra and requires DNS control of that domain. Owner-only: requires this project's site credential (.sakupa/site.json) — deploy first. If the site outgrows its plan, Sakupa shows an over-limit notice and never changes billing automatically. The owner can explicitly choose another plan through Stripe Customer Portal. Card details are entered only on the Stripe-hosted page — never through the AI tool. Opening and completing Stripe Checkout is the final subscription confirmation.

NameTypeReqDescription
planstringyesMonthly plan: water (very light personal pages), personal (personal brand / small shop), share (small-business site), business (steadier traffic, more headroom).
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

support ~96

Create a Sakupa support ticket for billing, payment, refund review, domain verification, deployment, serving or other issues the MCP cannot solve automatically. Do not include secrets, credentials or card data in the description.

NameTypeReqDescription
categorystringyes–
contactEmailstring–Optional contact email for follow-up.
descriptionstringyesProblem description (no secrets, no card data).
subjectstringyesShort subject line.
NameTypeReqDescription
dataobjectyes–
decisionobject––
nextActionsarrayyes–
operationIdstring––
outcomestringyes–
presentationobject––
resultCodestringyes–
schemaVersionnumberyes–
summarystringyes–
userActionobject––

No examples provided.

Install

How do I install the Sakupa - Company Website Publishing for AI Assistants MCP server?

Sakupa - Company Website Publishing for AI Assistants runs locally as an npm package, launched with npx -y @sakupa/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @sakupa/mcp

# add to Claude Code
claude mcp add myerwang-sakupa -- npx -y @sakupa/mcp
Common questions

What is the Sakupa - Company Website Publishing for AI Assistants MCP server?

Sakupa - Company Website Publishing for AI Assistants is an MCP server listed in the public MCP registry as io.github.myerwang/sakupa. Publish and manage company websites from your AI chat. Free 30-day sites; no Sakupa account. This page covers its npm package (@sakupa/mcp).

Is the Sakupa - Company Website Publishing for AI Assistants MCP server safe to use?

Sakupa - Company Website Publishing for AI Assistants scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Sakupa - Company Website Publishing for AI Assistants MCP server expose?

Sakupa - Company Website Publishing for AI Assistants exposes 18 tools: analyze, deploy, refresh, status, subscribe, and 13 more. Their descriptions and schemas cost roughly 3,105 tokens of context every time the server is loaded.

Is the Sakupa - Company Website Publishing for AI Assistants MCP server still maintained?

Sakupa - Company Website Publishing for AI Assistants is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.