POST /mcp listens on the request host.
Wary Press is LLM friendly.
-mcp is stdio and does not listen.
Read tools: list_posts, get_post, search_posts, get_site.
Read tools need no key. Write tools require a non-empty gc_ key.
create_page
update_page
publish_page
list_pages
get_page
create_post
update_post
publish_post
list_posts
get_post
search_posts
get_site
upload_media
Custom domains are not sold. POST /api/domain-requests records a request and does not attach a domain.
Safety caps return 403 limit, 413 body too large, or 429 rate_limited.
Free trial: account cap of 1 site. Per site: 1 page, 1 post, 5 MiB storage, 50 MiB monthly bandwidth, 2000 monthly requests. Upload is 64 KiB. 10 API calls per minute for the account.
Regular is $4.99 per month: account cap of 1 site. Per site: 200 pages, 200 posts, 500 MiB storage, 20 GiB monthly bandwidth, 200000 monthly requests. Upload is 64 KiB. 120 API calls per minute for the account.
Heavier is $9.99 per month: account cap of 4 sites. Per site: 200 pages, 200 posts, 500 MiB storage, 20 GiB monthly bandwidth, 200000 monthly requests. Upload is 64 KiB. 120 API calls per minute for the account.
Global caps: 5 GiB storage, 600 requests per minute, 64 KiB JSON body.
GOCMS_KILL_SWITCH=1 leaves GET /pricing and GET /healthz.
The public origin is https:// plus GOCMS_PUBLIC_HOST. No hostname is compiled into this server.
GET /account shows each site's current-month requests and bytes, the site cap, and the per-site caps.
GET /account shows Test mode (sk_test / rk_test). only when STRIPE_SECRET_KEY has an sk_test or rk_test prefix.
POST /api/stripe/webhook grants a plan only for a signed sandbox checkout.session.completed whose price id matches the configured test price. A bad signature does not grant. A signed sandbox customer.subscription.deleted returns the owner to the free trial when the site count fits. A bad signature does not clear.
Create a site with POST /api/signup. The JSON fields are email, password, display_name, and host. A single label is stored as that label, a dot, and GOCMS_PUBLIC_HOST when that host is set. The response sets cookie gocms_session. GET /account with Accept text/html is the same form. The suite sign-in cookie is not a press session.
POST /api/keys with that cookie returns a gc_ key once. GET /api/keys does not return the key. The account page button does the same. Pass that key to write tools.
A customer host completes TLS only after that site exists. A missing site does not get a certificate. There is no wildcard certificate.