Let your AI agent run your sites.
This store has a built-in MCP server (Model Context Protocol). Connect your AI agent once, and it can buy subdomains, deploy sites, manage files and install WordPress for you — with your keys, under your control.
01 Quickstart
Get a key
Log in, open Dashboard → MCP Keys and generate a key. It's shown once — copy it somewhere safe.
Give it to your agent
Add the endpoint + key to your agent's MCP config (snippets below). Hermes, Muse, opencode — anything that speaks MCP over HTTPS.
Just ask
"Claim mysite.yusyus.xyz and deploy my landing page." Your agent does the rest and reports back with the live link.
https://store.yusyus.xyz/mcp.php
Transport: Streamable HTTP · POST JSON-RPC 2.0 · HTTPS only · every request needs the Authorization header below.
02 Authentication
Every MCP request carries a Bearer key. There are two ways to get one — both produce the same kind of key (format yus_mcp_…, valid 30 days, max 3 active keys per account):
- Dashboard key (recommended) — Dashboard → MCP Keys → Generate. Label it per agent ("Hermes", "laptop") so you know who used what.
- Login exchange — an agent can trade your username + password for a key itself:
curl -X POST https://store.yusyus.xyz/mcp-login.php \
-H 'Content-Type: application/json' \
-d '{"login": "your-username", "password": "your-password"}'
# → { "token": "yus_mcp_…", "expires_at": "…" }03 Client setup
Generic MCP config (Muse and most MCP clients):
{
"mcpServers": {
"yusyus-store": {
"url": "https://store.yusyus.xyz/mcp.php",
"headers": { "Authorization": "Bearer yus_mcp_YOUR_KEY" }
}
}
}Hermes (config.yaml):
mcp_servers:
yusyus-store:
url: https://store.yusyus.xyz/mcp.php
transport: http
headers:
Authorization: Bearer yus_mcp_YOUR_KEYTest it yourself — your first call:
curl -X POST https://store.yusyus.xyz/mcp.php \
-H 'Authorization: Bearer yus_mcp_YOUR_KEY' \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"get_account","arguments":{}}}'
# → your username, balance and subdomain count04 Tools (19)
Everything the dashboard can do for your own account, your agent can do too. Site-scoped tools take a subdomain_id — get it from list_subdomains.
| Tool | What it does | Main inputs |
|---|---|---|
| get_account | Your account: username, email, balance (RM), referral code. | — |
| list_plans | Plans available for purchase (price, period, disk quota). | — |
| check_availability | Is a subdomain label free on a root domain? | label, domain |
| buy_subdomain | Buy + instantly provision: starter site, HTTPS, private MySQL. Deducts the plan price from your balance. | label, plan_id, domain |
| list_subdomains | Your subdomains with plan, status, expiry, disk usage. | — |
| get_subdomain | Full details of one subdomain, including MySQL credentials. | subdomain_id |
| create_database | Create the private MySQL database for a subdomain that has none. | subdomain_id |
| migrate_subdomain | Transfer a subdomain to another user (flat RM 5.00 fee). | subdomain_id, target_username |
| redeem_credit_code | Redeem an admin-issued top-up code into your balance. | code |
| list_transactions | Your recent balance transactions. | limit |
| list_files | List files/folders inside one of your sites. | subdomain_id, path |
| read_file | Read a text file (max 512 KB). Protected system files can't be read. | subdomain_id, path |
| write_file | Create or overwrite a file (max 1 MB). Parent folders are created automatically — this is how you publish pages. | subdomain_id, path, content |
| deploy_site | Deploy a whole site in one call: up to 25 files, 3 MB total. | subdomain_id, files[] |
| delete_file | Delete a file, or a folder (recursively). Folders holding protected system files are refused. | subdomain_id, path |
| create_folder | Create a folder inside one of your sites. | subdomain_id, path |
| install_wordpress | One-click WordPress install (~1 minute). Existing files are backed up to a _backup_pre_wp_* folder, never deleted. | subdomain_id, admin_username, admin_email, admin_password |
| remove_wordpress | Remove a WordPress install from a subdomain. | subdomain_id |
| revoke_my_token | Revoke the very key making this call (panic button). | — |
yus_db.php, .user.ini, .env, wp-config.php) are protected — they can't be read, overwritten or deleted through MCP, exactly like in File Manager.05 Limits & errors
| Status | Meaning |
|---|---|
| 401 | Missing, invalid, expired or revoked key. Generate a fresh one in MCP Keys. |
| 403 | Non-HTTPS request. The endpoint is HTTPS-only. |
| 405 | GET on the endpoint — MCP is POST-only. (A 405 on GET actually means the server is up and healthy.) |
| 409 | Login exchange refused: you already have 3 active keys. Revoke one first. |
| 429 | Too many failed logins (5 per account / 20 per IP per 15 min). Wait and retry. |
- Keys expire after 30 days — minting a new one takes ten seconds.
- Every tool call is written to your account's activity log, so you can always audit what your agent did.
- Purchases through MCP follow the same rules as the website: balance is checked and locked in a transaction, taken names are rejected, nothing is charged twice.
06 FAQ
Which agents work?
Any MCP client that supports Streamable HTTP with custom headers — Hermes, Muse, opencode and most modern agent frameworks. If your agent can hold a Bearer token, it can use this store.
Does it cost extra?
No. MCP access is included with every plan. Your agent spends from the same balance you top up with credit codes — buying a subdomain through an agent costs exactly what it costs on the website.
Can my agent see other people's sites?
Never. Keys are strictly scoped to the account that created them — there is no admin bypass, and file access is jailed to your own sites.
I lost my key / it leaked. What now?
Revoke it in Dashboard → MCP Keys — it stops working instantly — then generate a new one. From inside a session, an agent can also call revoke_my_token on itself.