SiteGPT
REMOTE · SITEGPT.AI
Manage SiteGPT chatbots and account resources through the SiteGPT API v2.
Available components
Last scanned (10 hours ago)
Scores higher than 40% of remote servers
Reachable. Last reached 6 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security100
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Tool Safety0
- Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 6 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm. Claim this server and supply a read-only token to verify it and lift the score.
Checks we ran (5)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
Checks we could not complete (6)
These are gaps on our side, not findings about this hosted endpoint. We only credit what we can confirm, so a category made up entirely of them scores 0.
- Transport in Transport & Reachability (scores 0 for this)Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http.
- Schema quality in Schema Quality & AI Usability (scores 0 for this)Schema blocked by authentication: the endpoint requires auth we don't have to read it.
- Stability in Stability & Change Management (scores 0 for this)Stability not yet verified: not enough scan history yet (needs a 30-day window).
- Tool coverage in Tool Coverage (scores 0 for this)Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.
- Tool safety in Tool Safety (scores 0 for this)Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.
- Capabilities in Capabilities (scores 0 for this)Capabilities blocked by authentication: the endpoint requires auth we don't have to read them.
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 6 Nov 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Aug 26 0
- Endpoint reachability: reachable → behind authorisation ▼ security
- Tool safety: pass → unverified ▼ security
- Transport: pass → unverified ▼ security
- Stability: 0.17 → unverified ▼ security
- Authorization: The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: unverified → 0.03 ▲ functional
- 24 Aug 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Probed https://sitegpt.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=sitegpt.ai | CN=WE1,O=Google Trust Services,C=US | 5 Nov 2026 | 3 Feb 2027 | ECDSA 256 | ECDSA-SHA256 | e921a058b76ad5fe0e4ee578e660beec |
| SANs: sitegpt.ai, convex.sitegpt.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of sitegpt.ai. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | DS published | 1814, 3799 | 8, 8 | Verified |
| sitegpt.ai. | DS published | 2371 | 13 | Verified |
| sitegpt.ai. | Verified address RRset verified with the apex keys |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://sitegpt.ai/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://sitegpt.ai/.well-known/oauth-protected-resource/mcp"| Header | Value |
|---|---|
| strict-transport-security | max-age=0; includeSubDomains; preload |
| x-content-type-options | nosniff |
| www-authenticate | Bearer realm="OAuth", resource_metadata="https://sitegpt.ai/.well-known/oauth-protected-resource/mcp" |
Protected resource metadata
| Document | https://sitegpt.ai/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://sitegpt.ai/mcp |
| Authorisation server | https://sitegpt.ai/oauth/mcp |
| https://sitegpt.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://sitegpt.ai/mcp | Auth required | 401 | |
| http (plaintext) | http://sitegpt.ai/mcp | HTTPS enforced | 301 | https://sitegpt.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
authorize_knowledge_source Authorize Knowledge Source ~88
Get a fresh browser authorization URL for an existing knowledge source connection (for example one still pending OAuth). Uses POST /api/v2/chatbots/{chatbotId}/knowledge/sources/{connectionId}/authorize.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| connectionId | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| authorizationUrl | string|null | yes | OAuth URL to open in a browser to finish connecting the source. |
| chatbotId | string | yes | – |
| nextStep | string|null | yes | – |
| source | object | yes | – |
No examples provided.
create_knowledge_source Connect Knowledge Source ~194
Create a new OAuth knowledge source connection (Notion, Google Drive, Dropbox, OneDrive, Box, SharePoint, or Confluence) and get the browser authorization URL to finish connecting it. Confluence additionally requires the site domain (e.g. your-team.atlassian.net). GitHub is not available here — its connections carry an access token and must be set up in the SiteGPT dashboard. Uses POST /api/v2/chatbots/{chatbotId}/knowledge/sources.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| connector | string | yes | OAuth connector type. GitHub is dashboard-only. |
| domain | string | – | Confluence site domain (e.g. your-team.atlassian.net). Required when connector is CONFLUENCE; ignored otherwise. |
| name | string | yes | Display name. |
| Name | Type | Req | Description |
|---|---|---|---|
| authorizationUrl | string|null | yes | OAuth URL to open in a browser to finish connecting the source. |
| chatbotId | string | yes | – |
| nextStep | string|null | yes | – |
| source | object | yes | – |
No examples provided.
execute_read SiteGPT API Reader ~601
Run read-only SiteGPT API v2 calls (GET only) using JavaScript code. Targets the SiteGPT API v2 (spec: https://sitegpt.ai/api/v2/openapi.json, docs: https://sitegpt.ai/docs/api-reference/v2/getting-started). First use 'search' to find the right endpoints. Requests run through an authenticated host-side bridge scoped to your OAuth grant. Write methods (POST, PUT, PATCH, DELETE) are rejected here — use the execute_write tool for those. Available in your code: interface RequestOptions { method: "GET"; path: string; query?: Record<string, string | number | boolean | undefined>; body?: unknown; contentType?: string; rawBody?: boolean; } // OpenAPI 3.x spec with $refs resolved inline. // The spec object follows the standard OpenAPI 3.x structure. interface OperationObject { summary?: string; description?: string; operationId?: string; tags?: string[]; parameters?: Array<{ name: string; in: "query" | "header" | "path" | "cookie"; required?: boolean; schema?: unknown; description?: string; }>; requestBody?: { required?: boolean; description?: string; content?: Record<string, { schema?: unknown }>; }; responses?: Record<string, { description?: string; content?: Record<string, { schema?: unknown }>; }>; security?: Array<Record<string, string[]>>; deprecated?: boolean; } interface PathItem { summary?: string; description?: string; get?: OperationObject; post?: OperationObject; put?: OperationObject; patch?: OperationObject; delete?: OperationObject; head?: OperationObject; options?: OperationObject; trace?: OperationObject; parameters?: OperationObject["parameters"]; } interface OpenApiSpec { openapi: string; info: { title: string; version: string; description?: string }; paths: Record<string, PathItem>; servers?: Array<{ url: string; description?: string }>; components?: Record<string, unknown>; tags?: Array<{ name: string; description?: string }>; } declare…
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | JavaScript async arrow function to execute |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | The sandboxed code result as text: the returned value, JSON-stringified when not a string, possibly truncated. |
No examples provided.
execute_write SiteGPT API Writer ~684
Create, update or delete SiteGPT API v2 resources (POST, PUT, PATCH or DELETE only) using JavaScript code. Targets the SiteGPT API v2 (spec: https://sitegpt.ai/api/v2/openapi.json, docs: https://sitegpt.ai/docs/api-reference/v2/getting-started). First use 'search' to find the right endpoints and 'execute_read' for any lookups. Requests run through an authenticated host-side bridge scoped to your OAuth grant. GET is rejected here — use the execute_read tool to read data. GitHub knowledge-source connections cannot be created or updated through this tool because they carry an access token — direct users to the SiteGPT dashboard for GitHub setup; OAuth-based connectors (Notion, Google Drive, …) can be created here and finish authorization in the browser. Available in your code: interface RequestOptions { method: "POST" | "PUT" | "PATCH" | "DELETE"; path: string; query?: Record<string, string | number | boolean | undefined>; body?: unknown; contentType?: string; rawBody?: boolean; } // OpenAPI 3.x spec with $refs resolved inline. // The spec object follows the standard OpenAPI 3.x structure. interface OperationObject { summary?: string; description?: string; operationId?: string; tags?: string[]; parameters?: Array<{ name: string; in: "query" | "header" | "path" | "cookie"; required?: boolean; schema?: unknown; description?: string; }>; requestBody?: { required?: boolean; description?: string; content?: Record<string, { schema?: unknown }>; }; responses?: Record<string, { description?: string; content?: Record<string, { schema?: unknown }>; }>; security?: Array<Record<string, string[]>>; deprecated?: boolean; } interface PathItem { summary?: string; description?: string; get?: OperationObject; post?: OperationObject; put?: OperationObject; patch?: OperationObject; delete?: OperationObject; head?: OperationObject; options?: OperationObject; trace?: OperationObject; par…
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | JavaScript async arrow function to execute |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | The sandboxed code result as text: the returned value, JSON-stringified when not a string, possibly truncated. |
No examples provided.
get_chatbot_analytics Chatbot Analytics ~158
Get chatbot analytics for the inline analytics card: message counts and feedback split, training/knowledge state (from the chatbot dashboard endpoint), account-wide quota usage with a 12-month message-volume history (from the usage endpoint), and trailing-30-day engagement totals — widget opens, conversations started, unique visitors, escalations, leads (from the analytics endpoint; null when the account does not have analytics enabled). Uses GET /api/v2/chatbots/{chatbotId}/dashboard, GET /api/v2/usage, and GET /api/v2/chatbots/{chatbotId}/analytics.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| conversations | object | yes | – |
| engagement | – | yes | – |
| history | array | yes | – |
| knowledge | object | yes | – |
| quota | object | yes | – |
| training | object | yes | – |
No examples provided.
get_chatbot_appearance Get Widget Appearance ~104
Read the chatbot widget appearance (colors, launcher position and shape, title, welcome message, placeholder, tooltip) plus its starter questions, for the inline appearance card. Uses GET /api/v2/chatbots/{chatbotId}/settings/appearance and GET /api/v2/chatbots/{chatbotId}/starters.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| Name | Type | Req | Description |
|---|---|---|---|
| appearance | object | yes | – |
| chatbotId | string | yes | – |
| starters | array | yes | – |
No examples provided.
get_conversation Get Conversation Transcript ~107
Read one conversation with its transcript (visitor questions and chatbot/system answers, capped at 2000 characters per message). Renders as the transcript panel of the inline conversations inbox. Uses GET /api/v2/chatbots/{chatbotId}/conversations/{threadId}.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| threadId | string | yes | Conversation thread id, from list_conversations. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| escalated | boolean | yes | – |
| important | boolean | yes | – |
| messages | array | yes | – |
| mode | string|null | yes | – |
| resolved | boolean | yes | – |
| threadId | string | yes | – |
| title | string|null | yes | – |
No examples provided.
get_onboarding_status Onboarding Status ~130
Get the live status of an agent-first onboarding workspace: workspace and claim state, the setup checklist (knowledge crawl/training, persona, starters, …), the browser onboarding page URL, and the POST-only claim API endpoint (claimUrl is for agents/CLI clients — never a page to open in a browser). The onboarding-progress view polls this while pages crawl and train. Requires the temporary onboarding token issued by the onboarding start endpoint. Uses GET /api/v2/onboarding/workspaces/{workspaceId}.
| Name | Type | Req | Description |
|---|---|---|---|
| workspaceId | string | yes | Onboarding workspace id (an RFC-4122 UUID). |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string|null | yes | – |
| checklist | array | yes | – |
| claimStatus | string|null | yes | – |
| claimUrl | string|null | yes | POST-only API endpoint for agents/CLI clients starting a claim. NOT a browser page — never present it to a human as a link to open (a browser GET returns 405). |
| isExpired | boolean | yes | – |
| onboardingUrl | string|null | yes | The browser onboarding page — the one link humans open. |
| status | string|null | yes | Workspace status: CREATED, BUILDING, CLAIMED, EXPIRED, … |
| workspaceId | string | yes | – |
No examples provided.
list_conversations List Conversations ~158
List a chatbot conversation inbox with filters (open/resolved status, escalated-only) and cursor pagination, projected to compact rows with a last-message snippet. Renders as the inline conversations inbox. Uses GET /api/v2/chatbots/{chatbotId}/conversations.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| cursor | string | – | Opaque pagination cursor from the previous page. |
| escalated | boolean | – | true → only conversations escalated to a human. |
| limit | integer | – | Maximum conversations to return (default 50, max 100). |
| status | string | – | Filter by resolution status; defaults to all. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| conversations | array | yes | – |
| nextCursor | string|null | yes | – |
No examples provided.
list_escalations List Waiting Escalations ~159
List the open conversations that are escalated to a human and waiting — the queue behind the inline escalations view — with cursor pagination for queues longer than one page. Read-only: replying to escalated visitors happens in the SiteGPT dashboard inbox (API v2 has no agent-reply endpoint yet). Uses GET /api/v2/chatbots/{chatbotId}/conversations with escalated=true and status=open.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| cursor | string | – | Pass the previous page nextCursor to fetch the next page. |
| limit | integer | – | Maximum escalations to return (default 50, max 100). |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| escalations | array | yes | – |
| nextCursor | string|null | yes | – |
No examples provided.
list_knowledge_sources List Knowledge Sources ~109
List a chatbot connector data sources (Notion, Google Drive, Confluence, …) with their sync state, plus document counts by ingestion status. Renders as the inline knowledge view. Uses GET /api/v2/chatbots/{chatbotId}/knowledge/sources and GET /api/v2/chatbots/{chatbotId}/documents/stats.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| documents | object | yes | – |
| sources | array | yes | – |
No examples provided.
list_leads List Leads ~157
List the leads a chatbot collected (name, email, phone, received time, starred/archived flags) with search, status filter, and cursor pagination. Renders as the inline leads browser. Uses GET /api/v2/chatbots/{chatbotId}/leads.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| cursor | string | – | Opaque pagination cursor from the previous page. |
| limit | integer | – | Maximum leads to return (default 50, max 100). |
| query | string | – | Search across lead name, email, and phone. |
| status | string | – | Filter leads by state (default all). |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| leads | array | yes | – |
| nextCursor | string|null | yes | – |
No examples provided.
preview_chatbot SiteGPT Chatbot Preview ~225
Render a live, interactive preview of a SiteGPT chatbot directly in the conversation (MCP Apps extension). Call it after creating or inspecting a chatbot, passing the chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id — and optionally the chatbot title for the preview header. Returns { chatbotId, widgetUrl }; hosts that support MCP Apps render the actual chat widget from the ui://sitegpt/chatbot-preview resource, and any client can open widgetUrl in a browser instead. Performs no API calls and does not verify that the chatbot exists — use execute_read for lookups. Note: chatbots that restrict embedding via Allowed Domains (Settings > General) block the inline frame; the preview then switches to a built-in chat driven by the send_chat_message tool, and shows a fallback with the direct link when that fails too.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| title | string | – | Optional chatbot title shown in the preview header. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| title | string | – | – |
| widgetUrl | string | yes | Public chat widget URL for this chatbot — the page the preview embeds. |
No examples provided.
search SiteGPT API Spec Search ~577
Search the SiteGPT API v2 OpenAPI spec. Targets the SiteGPT API v2 (spec: https://sitegpt.ai/api/v2/openapi.json, docs: https://sitegpt.ai/docs/api-reference/v2/getting-started). codemode.spec() returns $refs resolved inline. This tool only reads the local spec catalog; it performs no API calls. Types: // OpenAPI 3.x spec with $refs resolved inline. // The spec object follows the standard OpenAPI 3.x structure. interface OperationObject { summary?: string; description?: string; operationId?: string; tags?: string[]; parameters?: Array<{ name: string; in: "query" | "header" | "path" | "cookie"; required?: boolean; schema?: unknown; description?: string; }>; requestBody?: { required?: boolean; description?: string; content?: Record<string, { schema?: unknown }>; }; responses?: Record<string, { description?: string; content?: Record<string, { schema?: unknown }>; }>; security?: Array<Record<string, string[]>>; deprecated?: boolean; } interface PathItem { summary?: string; description?: string; get?: OperationObject; post?: OperationObject; put?: OperationObject; patch?: OperationObject; delete?: OperationObject; head?: OperationObject; options?: OperationObject; trace?: OperationObject; parameters?: OperationObject["parameters"]; } interface OpenApiSpec { openapi: string; info: { title: string; version: string; description?: string }; paths: Record<string, PathItem>; servers?: Array<{ url: string; description?: string }>; components?: Record<string, unknown>; tags?: Array<{ name: string; description?: string }>; } declare const codemode: { spec(): Promise<OpenApiSpec>; }; Your code must be an async arrow function that returns the result. Examples: // List all paths async () => { const spec = await codemode.spec(); return Object.keys(spec.paths); } // Find endpoints by tag async () => { const spec = await codemode.spec(); const results = []; for (cons…
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | JavaScript async arrow function to search the spec |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | The sandboxed code result as text: the returned value, JSON-stringified when not a string, possibly truncated. |
No examples provided.
send_chat_message Send Chat Message ~206
Send a visitor message to a SiteGPT chatbot and get its answer — the data lane behind the inline chatbot preview's built-in chat. The first call (no threadId) creates a conversation and returns its threadId; pass that threadId on follow-ups to continue the same conversation. Messages are capped at 20000 characters (the endpoint's limit). On chatbots in human-support mode the message is delivered but answer is null — a human replies in the site widget. Uses POST /api/v2/chatbots/{chatbotId}/messages and POST /api/v2/chatbots/{chatbotId}/conversations/{threadId}/messages.
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| message | string | yes | The visitor message to send. |
| threadId | string | – | Omit on the first message; pass the threadId a previous call returned to continue that conversation. |
| Name | Type | Req | Description |
|---|---|---|---|
| answer | string|null | yes | The chatbot answer text, or null when no automatic answer was produced (human-support mode). |
| chatbotId | string | yes | – |
| messageType | string|null | yes | – |
| threadId | string | yes | Conversation thread id — pass it back for follow-ups. |
No examples provided.
update_chatbot_appearance Update Widget Appearance ~261
Update the chatbot widget appearance: title, welcome message, placeholder, tooltip, brand/launcher/link colors (#rrggbb), and launcher position. Only the provided fields change; the tool returns the full updated appearance. This changes the LIVE widget customers see. Uses PATCH /api/v2/chatbots/{chatbotId}/settings/appearance.
| Name | Type | Req | Description |
|---|---|---|---|
| brandColor | string | – | Widget header/background color as #rrggbb. |
| brandTextColor | string | – | Text color over the brand color as #rrggbb. |
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| iconBackgroundColor | string | – | Launcher bubble background color as #rrggbb. |
| iconPosition | string | – | Which side of the page the launcher bubble sits on. |
| linkColor | string | – | Hyperlink color inside chatbot replies as #rrggbb. |
| placeholderText | string | – | Placeholder text inside the message input box. |
| title | string | – | Widget header title shown to visitors. |
| tooltip | string | – | Short prompt shown next to the closed launcher bubble. |
| welcomeMessage | string | – | First message the widget shows when a visitor opens it. |
| Name | Type | Req | Description |
|---|---|---|---|
| appearance | object | yes | – |
| chatbotId | string | yes | – |
No examples provided.
upload_knowledge_file Upload Knowledge File ~147
Upload one file (base64-encoded, max 1500000 bytes decoded — about 1.5 MB; the MCP transport caps request bodies, larger files go through the dashboard) as chatbot training knowledge. Ingestion is queued asynchronously. Uses POST /api/v2/chatbots/{chatbotId}/knowledge/files.
| Name | Type | Req | Description |
|---|---|---|---|
| base64 | string | yes | Base64 file content (a data: URL prefix is tolerated). |
| chatbotId | string | yes | SiteGPT chatbot id — an RFC-4122 UUID or a 15-20 digit numeric id. |
| name | string | yes | File name. |
| type | string | – | MIME type; defaults to application/octet-stream. |
| Name | Type | Req | Description |
|---|---|---|---|
| chatbotId | string | yes | – |
| documentsCount | number | yes | – |
| fileName | string | yes | – |
| ingestJobRunIds | array | yes | – |
No examples provided.
How do I install the SiteGPT MCP server?
SiteGPT is a hosted endpoint at https://sitegpt.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · sitegpt.ai
claude mcp add --transport http sitegpt-sitegpt 'https://sitegpt.ai/mcp'
What is the SiteGPT MCP server?
SiteGPT is an MCP server listed in the public MCP registry as io.github.sitegpt/sitegpt. Manage SiteGPT chatbots and account resources through the SiteGPT API v2. This page covers its hosted endpoint (https://sitegpt.ai/mcp).
Is the SiteGPT MCP server safe to use?
SiteGPT scores 40 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SiteGPT MCP server expose?
SiteGPT exposes 17 tools: search, execute_read, execute_write, preview_chatbot, send_chat_message, and 12 more. Their descriptions and schemas cost roughly 4,065 tokens of context every time the server is loaded.
Does the SiteGPT MCP server require authentication?
Yes. SiteGPT asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the SiteGPT MCP server still maintained?
SiteGPT is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the SiteGPT MCP server?
VerifyMCP ran 5 checks on SiteGPT, covering TLS certificate, Authorization, HTTPS, HSTS header and 1 more. 6 items could not be completed, a gap on our side rather than a finding about SiteGPT: Transport, Schema quality, Stability, Tool coverage and 2 more. 6 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.