Biver Builder
Use the remote MCP server when the client supports authenticated Streamable HTTP. Otherwise call the REST API directly.
- MCP:
https://mcp.biver.id/mcp - REST:
https://api.biver.id - Live REST contract:
https://api.biver.id/SKILL.md - Authentication:
Authorization: Bearer $BIVER_API_KEYorX-API-Key: $BIVER_API_KEY
All Biver API keys can affect the workspace attached to the key. A key prefix does not create a sandbox. Start with read-only scopes and add write scopes only when the task requires them.
Safety policy
Read-only calls do not need confirmation. Before a high-impact call, state the exact target and impact and obtain explicit user confirmation. An explicit request that already names the action and target counts; a vague request to “manage” or “clean up” does not.
Confirmation is required for:
- every
DELETErequest; - page deploy or publish;
- custom-domain creation, update, primary selection, or deletion;
- subdomain creation, update, publication, or deletion;
- gallery deletion;
- workspace settings, branding, or SEO mutation.
For MCP, pass confirm: true only after that confirmation. Never reuse confirmation for another resource. Never log, print, or place the API key in a URL, file, prompt, or response.
Scope contract
Scopes are enforced by the API. all bypasses individual scope checks and should be reserved for tightly controlled administration.
| Resource | Read | Write |
|---|---|---|
| Pages | pages:read | pages:write |
| Sections | sections:read | sections:write |
| Products | products:read | products:write |
| Forms and submissions | forms:read | forms:write |
| Gallery | gallery:read | gallery:write |
| Custom domains | domains:read | domains:write |
| Subdomains | subdomains:read | subdomains:write |
| Workspace | workspace:read | workspace:write |
| AI | ai:generate | ai:generate |
| Tracking | — | tracking:write |
| Wallet | wallet:read | — |
| Analytics | analytics:read | — |
| Checkout orders | checkout:read | — |
GET and HEAD use the read scope. Other methods use the write scope. AI routes always use ai:generate. Unknown /v1/<resource> routes fail closed unless the key has all.
MCP
Connect to https://mcp.biver.id/mcp with the API key in an authorization header. The server exposes one tool:
biver_request
Arguments:
| Field | Type | Required | Description |
|---|---|---|---|
path | string | yes | A /v1/... API path without a query string. |
method | string | no | GET, POST, PATCH, PUT, or DELETE; defaults to GET. |
query | object | no | String, number, or boolean query values. |
body | object | no | JSON request body. |
confirm | boolean | for high-impact calls | Set only after explicit confirmation. |
The MCP server validates browser origins, API keys, scopes, path shape, methods, and confirmation. It returns the REST status and body as structured content. Multipart gallery upload remains a REST-only operation.
REST endpoint map
Use the live contract for request fields and response details. Do not guess fields that are not listed there.
| Resource | Endpoints |
|---|---|
| Pages | GET/POST /v1/pages, GET/PATCH/DELETE /v1/pages/:id, POST /v1/pages/:id/deploy, publish status and deployment history |
| Sections | GET/POST /v1/sections, PATCH/DELETE /v1/sections/:id, bulk create and reorder |
| Products | GET/POST /v1/products, GET/PATCH/DELETE /v1/products/:id |
| Forms | GET/POST /v1/forms, GET/PATCH /v1/forms/:id, submissions endpoints |
| Gallery | GET/POST /v1/gallery, GET/DELETE /v1/gallery/:id |
| Subdomains | GET/POST /v1/subdomains, GET/PATCH/DELETE /v1/subdomains/:id |
| Domains | GET/POST /v1/domains, GET/PATCH/DELETE /v1/domains/:id, POST /v1/domains/:id/primary |
| Workspace | GET /v1/workspace/settings, PATCH/PUT settings, branding, and SEO, GET /v1/workspace/public |
| AI | context, page, section, and image generation routes under /v1/ai |
| Wallet | GET /v1/wallet, GET /v1/wallet/transactions |
| Analytics | GET /v1/analytics/revenue, GET /v1/analytics/traffic |
| Checkout | GET /v1/checkout/orders, GET /v1/checkout/orders/:idOrOrderId |
The API Worker requires authentication for every /v1/* route, including form-submit and workspace-public routes. Visitor-facing forms use Biver’s published-page flow, not an unauthenticated agent call.
Minimal REST call
curl --fail-with-body \
-H "Authorization: Bearer $BIVER_API_KEY" \
"${BIVER_API_BASE_URL:-https://api.biver.id}/v1/pages?limit=20"
Send JSON mutations with Content-Type: application/json. Send gallery uploads as multipart/form-data with a file field. Use only one authentication header.
Response handling
Successful responses use { "success": true, "data": ... }. Errors use { "success": false, "error": { "code", "message" } }.
401: missing, invalid, expired, or revoked key.403: required scope is missing.404: resource not found in the key’s workspace.409: conflicting slug, subdomain, or domain.422: invalid input.429: rate limit reached; respectRetry-After.
Treat mutation retries conservatively. Re-read the resource after an ambiguous timeout before retrying a create, deploy, or delete operation.
Install
clawhub install @ramaaditya49/biver-builder
Configure BIVER_API_KEY in the client’s secret store, not in the skill directory. Review the installed SKILL.md before granting write scopes.
