upshift-mcp

Upshift's reference MCP server. Three tools, deployed remote, on MCP spec revision 2026-07-28.

It exists to do two jobs at once: be genuinely useful to an agent, and be the worked example a buyer looks at before paying us to build theirs. Every price it quotes is generated from the live store, so it cannot invent one.

https://mcp.upshiftsites.com/mcp

{
  "mcpServers": {
    "upshift": { "type": "http", "url": "https://mcp.upshiftsites.com/mcp" }
  }
}

Or run the same server locally, for clients that spawn a command rather than call a URL. Nothing to clone or build — it is published on npm:

{
  "mcpServers": {
    "upshift": { "command": "npx", "args": ["-y", "upshift-mcp"] }
  }
}

The same binary from a shell. stdio is the default; --http serves the full Worker on localhost instead:

npx upshift-mcp

Tools

Free and rate limited to 20 calls/minute per IP.

Layout

src/
  worker.ts      Cloudflare entrypoint: routing, origin policy, rate limit
  server.ts      The three tools; the one place production layers are applied
  audit.ts       Audit rules — pure, so every rule is testable without a network
  safe-fetch.ts  The SSRF guard for the one tool that takes a caller's URL
  match.ts       Template matching
  services.ts    What we charge for MCP work
  catalog.generated.ts   Template lines + prices, generated from the store
  landing.ts     The page a human gets at /
evals/           12 qa_pairs, run over the real protocol
test/            32 tests: protocol conformance + the pure logic

Working on it

npm install
npm run dev          # http://127.0.0.1:8788/mcp
npm run ci:verify    # typecheck + tests + evals

wrangler dev needs macOS 13.5+ and will not boot on the build machine, so npm run dev serves the production src/worker.ts on Node against an in-memory KV. Same handler, same routes, same tools — not a second implementation. Deployment is still wrangler deploy.

Prices come from ../upshift-agency-site/src/data/store.ts. After changing them there:

npm run gen:catalog

Deploying

Live since 2026-08-16 at https://mcp.upshiftsites.com/mcp. KV namespace and custom domain are provisioned; npm run deploy ships a new version.

Listed

• Official MCP registry: com.upshiftsites/mcp, published active against the DNS-verified namespace.
• Glama — installable, with a released container built from this repo.
• npm: upshift-mcp — npx upshift-mcp runs this same server locally.

Honest gaps

In docs/VALIDATION.md — what is verified, what is not, the four real bugs the eval suite caught during the build (one of them a security bypass), and the fifth it missed. That document is the argument for shipping evals alongside a server, which is the part of this we sell; the miss is part of the argument, not an exception to it.

Licence

MIT. Lift anything usef

... View full README on GitHub