Developers & AI agents

Website Feedback Tool has one machine-facing interface: an MCP server. A coding agent connects to it and reads the design reviews you captured in the browser extension — the comments, the selectors, the computed styles, the console errors and the screenshots — then fixes them in your codebase.

How the pieces fit

You capture a review in the extension and click Send to AI agent. That publishes it to the backend under a key that belongs to your browser profile. Your agent, holding the same key, can then list and read those reviews. Nobody else's key can see them.

Connect an agent

Open the extension → Connect AI agent. It generates your key and resolves the endpoint for your region, then shows a ready-to-run command of this shape:

claude mcp add --scope user --transport http website-feedback-tool \
  <endpoint> --header "Authorization: Bearer <your-key>"

Cursor takes the same endpoint and header in ~/.cursor/mcp.json, Codex in ~/.codex/config.toml; the extension shows both snippets filled in. The address is not printed here on purpose — it differs by region, and a copied-out URL would be the wrong one for some users.

Treat the key like an API key: it belongs in your agent's config file, not in a chat message. If an agent stops seeing your reviews, the key changed (reinstall, cleared data, new device) — re-run the command, it overwrites the old one. You can also regenerate it in the extension, which invalidates the previous key immediately.

What an agent can call

Tool	Arguments	What it returns
`list_reviews`	—	Lists your recent reviews, newest first: site, title, time, comment count and the reviewId to pass on. Use it to pick which review to apply.
`get_latest_review`	—	Returns the most recent review as Markdown: comments, CSS selectors, computed styles, console and network errors, screenshot URLs.
`get_review`	`reviewId`	Returns one review by id, same Markdown shape. Ids come from list_reviews and look like rvw_abc123.
`get_screenshot`	`reviewId, commentId`	Returns a comment's screenshot inline as an image, because MCP clients do not fetch image URLs on their own. The comment id is shown beside the screenshot in get_review.

Every tool is scoped to the key that called it, and each carries a JSON Schema for its arguments, so an agent discovers them through tools/list without anything hard-coded on its side.

Transport, auth and limits

Streamable HTTP, stateless. POST only — GET answers 405, since the server→client stream is unused.
Auth is Authorization: Bearer <key>. The server stores only a hash of the key, never the key itself.
600 requests per IP per hour. Over that, requests are refused rather than queued.
Reviews expire 4 days after they are published. An agent asked to work from a week-old link will find nothing — capture it again.

Errors

All errors come back as JSON, never as an HTML page:

Status	Body	When
`401`	`{ "error": "unauthorized" }`	No Authorization header, or it is not a Bearer token.
`429`	`{ "error": "rate-limited" }`	More than 600 requests from one IP in the current hour.
`500`	`{ "error": "mcp-failed" }`	The server failed to handle the message. Safe to retry once.
`202`	`(no body)`	A JSON-RPC notification was accepted. Notifications carry no id and get no result.

What does not exist

So nobody builds against something that was never promised: there is no public REST API, no webhooks, and no CLI. The edge functions the extension talks to are an internal contract — unversioned, and free to change with any release. The MCP server is the supported surface, and it is the one this page documents.

Missing something you would build on? Tell us — that is how this list gets shorter.