Your assistant. A reviewable app.

Build and check apps
with your AI assistant.

Connect your assistant to create an app, inspect its progress, request changes and publish the result. Start with a clear brief, then check the actual app in a browser before sharing it.

Builds and changes use the connected workspace’s access and credits. Check current pricing before starting.

1 · Connect and check

Start with the right workspace.

MCP lets your assistant use Overskill’s tools through an authorized connection. Follow your host’s setup at /connect and complete OAuth sign-in.

https://mcp.overskill.com/mcp

Tools act on the connection’s team. Access, permissions and available credits still apply; a successful read does not establish permission to create.

Ask your connected assistant
Select text or copy
Check my connected Overskill workspace, available tools, balance and apps. Do not start a build yet.

get_balance and list_apps are useful first reads. Missing access should be resolved before requesting a build.

2 · Inspect a concrete result

Two business demos you can explore.

These public apps were built and revised through MCP. The screenshots show fictional data; the case study separates observed checks from remaining gaps.

ChiroGrowth Command

Make a planning assumption explainable.

Inspect the visits, costs and profit behind a fictional business scenario.

Growth's public Scenario Lab with 80 added visits, $1,500 added monthly cost, and calculated proposed profit of $37,160.
Growth’s public Scenario Lab on September 9, 2026. The fictional scenario with 80 additional monthly visits shows $3,860 additional monthly profit and $37,160 proposed profit.

ChiroPartner Pipeline

Follow an event from plan to result.

Inspect a completed sample workshop alongside upcoming events and their next steps.

Partner's public Events view with planned, confirmed, cancelled and completed sample workshops; the completed workshop has a $500 fee, $300 cost, $200 net and 40 percent conversion.
Partner’s public Events view on September 9, 2026. The completed fictional workshop shows a $500 fee, $300 cost and $200 contribution; planned and confirmed events remain separate.

Creating a copy requires sign-in and account access. See the case study for the checks performed and remaining work.

3 · Repeat the useful checks

Brief, build, check and hand over.

Choose one person, one record and one change. Define the expected result before building. Add services such as payments or email only after checking their account setup, permissions and behavior.

Build, test and publish an app through MCP gives you the complete method.

  1. 1

    Keep the build identifier

    After an authorized create_app request, keep build_id and inspect get_build / get_app before starting another copy.

  2. 2

    Check the app in a browser

    Use a browser to test the expected change, save and reload; compare the result with your brief.

  3. 3

    Repair, then repeat

    Use update_app for a specific failure on the same build. Review further credit use and repeat the failed check.

  4. 4

    Publish and verify

    After review, request publish_app, inspect the public URL and repeat the important checks. Hand over the tested scope and remaining work.

Helping someone who is not connected yet? Open a coffee-shop starter brief. The /?prompt=… link prefills an unsent composer. They review it and complete the required sign-in, access and credit steps before submitting.
API, skill files and discovery reference

For an authorized API workflow.

Use a team-scoped API key with the required permissions. This example queues real build work if you run it with valid access; it can consume credits. Keep the key out of shared prompts and source files.

Example request
Select text or copy
curl -X POST https://www.overskill.com/api/v1/generation_queue \
  -H "User-Agent: OverSkill/206fd15 (+https://overskill.com)" \
  -H "X-API-Key: os_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Build a coffee shop landing page with hours and a menu"}'
Illustrative HTTP 202 response
{
  "job_id": "example_job_id",
  "app_id": "example_app_id",
  "message_id": 456,
  "status": "queued",
  "status_url": "https://www.overskill.com/api/v1/generation_queue/example_job_id",
  "app_url": "https://www.overskill.com/account/apps/example_app_id/edit"
}

Identifiers vary. This shortened response is illustrative, not an observed build. Completion time varies; the API’s estimate is not a measured result for your app.

Poll status_url with the same authorized credential about every 15 seconds. On completed, inspect app.preview_url. Stop on failed or cancelled and inspect the result before retrying. Build completion is not publication or browser acceptance.

Manage keys in Team Settings → API Keys. API documentation describes permissions and response fields; MCP setup uses OAuth instead.

Skill files are instructions.

Read SKILL.md or follow your host’s setup instructions. A downloaded skill does not grant account access or connect a tool.

What works without an API key.

Public documentation and discovery can be read without a key. The email sign-in endpoint starts authentication; it does not grant builder access. Builds require an authorized account and credits.

No auth required
  • GET /SKILL.md
    Agent Skills file
  • GET /auth.md
    Agent-auth walkthrough (OAuth + bearer)
  • GET /llms.txt
    LLM-friendly concise API ref
  • GET /llms-full.txt
    LLM-friendly full API ref
  • GET /openapi.json
    OpenAPI w/ MPP x-payment-info
  • GET /.well-known/mcp/server-card.json
    MCP Server Card (SEP-1649)
  • GET /.well-known/agent-skills/index.json
    Agent Skills Discovery RFC v0.2.0 index
  • GET /.well-known/oauth-authorization-server
    RFC 8414 OAuth metadata + agent_auth
  • GET /.well-known/oauth-protected-resource
    RFC 9728 protected resource
  • GET /.well-known/api-catalog
    RFC 9727 API catalog (linkset+json)
  • GET /.well-known/acp.json
    Agentic Commerce Protocol discovery
  • GET /.well-known/ucp
    Universal Commerce Protocol profile
  • GET /sitemap.xml
    Full sitemap (markdown-aware)
  • POST /api/v1/auth/magic_code
    Passwordless email auth
Needs API key (or OAuth)
  • POST /api/v1/managed_apps
    Create app under your team
  • POST /api/v1/generation_queue
    Queue generation with builder access and permissions
  • GET /api/v1/managed_apps/:id/files
    Read source files
  • POST /api/v1/managed_apps/:id/deploy
    Deploy to production
  • * /api/v1/managed_apps/:id/env_vars
    Read/write environment vars
  • * /api/v1/managed_apps/:id/custom_domains
    Manage custom domains
  • POST /api/v1/mcp/execute_tool
    Legacy REST tools; list with GET /api/v1/mcp/tools
  • GET /api/v1/usage
    Credit balance + usage
  • * /api/v1/webhooks
    Manage webhook subs
  • * /api/v1/zapier/*
    Zapier triggers / actions
Email sign-in: An email address and verification are required. Requests and verification attempts are limited. See Privacy for data handling.

Find the documented interfaces.

Discovery files describe interfaces and authentication. A published declaration does not establish successful execution or grant permission to act.

Overskill MCP

/connect

Connect URL, per-host add flow (Grok Bot, OpenClaw, Hermes Agent, Cursor, Claude, ChatGPT), OAuth, what you can do

robots.txt

/robots.txt

Explicit AI bot allow rules + Cloudflare Content-Signal directive

sitemap.xml

/sitemap.xml

Templates, integrations, /build/* landing pages, more

Integrations catalog

/integrations

1,540 integrations — Composio-powered OAuth connectors plus direct payments, email, and AI. Catalog coverage does not mean every connection is configured for your app.

MCP Server Card (SEP-1649)

/.well-known/mcp/server-card.json

Tool catalog endpoint + auth methods

Agent Skills Index (v0.2.0)

/.well-known/agent-skills/index.json

Discovery RFC v0.2.0 — $schema + skills array with sha256 digests

OAuth Authorization Server

/.well-known/oauth-authorization-server

RFC 8414 metadata

OAuth Protected Resource

/.well-known/oauth-protected-resource

RFC 9728 metadata

API Catalog

/.well-known/api-catalog

RFC 9727 — linkset+json over all our APIs

Agent Auth (auth.md)

/auth.md

How agents obtain credentials — OAuth + PKCE, bearer tokens, verified-email identity

OpenAPI discovery

/openapi.json

Describes hosted checkout surfaces; not native agent settlement

ACP discovery

/.well-known/acp.json

Agentic Commerce Protocol discovery document (OpenAI + Stripe)

UCP profile

/.well-known/ucp

Universal Commerce Protocol profile (Google + Shopify)

SKILL.md

/SKILL.md

Anthropic/OpenAI Agent Skills format

llms.txt

/llms.txt

Concise LLM-friendly ref

llms-full.txt

/llms-full.txt

Exhaustive LLM-friendly ref

Link response headers

Eligible successful and redirect responses include discovery Link: headers. Errors and selected callback and health paths are excluded.

Link: </SKILL.md>; rel="alternate"; type="text/markdown", </.well-known/mcp/server-card.json>; rel="describedby"

Markdown content negotiation

Send Accept: text/markdown on a public template page and we return clean markdown — no HTML chrome to strip.

curl -H "Accept: text/markdown" https://www.overskill.com/templates/<slug>

Connection support and declared roadmaps.

Commerce discovery documents describe existing hosted checkout surfaces. Native agent payment and transaction protocols remain planned; publishing metadata does not implement those transactions.

Model Context Protocol (MCP) — SEP-1649 Server Card

Tool catalog + execution endpoint discoverable via /.well-known/mcp/server-card.json (legacy /.well-known/mcp.json kept for backwards compat). Use the hosted authenticated Streamable HTTP endpoint.

Agent Skills Discovery RFC v0.2.0 (Cloudflare)

Conformant SKILL.md served at /SKILL.md. Discovery index at /.well-known/agent-skills/index.json with $schema + sha256 digests. Legacy agentskills.io v1.0 card kept at /.well-known/agent-skills.json for backwards compat.

OAuth 2.0 Authorization Server Metadata

RFC 8414 — published at /.well-known/oauth-authorization-server. Doorkeeper-backed authorization_code flow.

OAuth 2.0 Protected Resource Metadata

RFC 9728 — published at /.well-known/oauth-protected-resource. Bearer token auth.

API Catalog (RFC 9727 + Linkset RFC 9264)

Published at /.well-known/api-catalog as application/linkset+json — anchor + service-desc + service-doc + status for every API.

Cloudflare Content Signals Policy

Explicit ai-train=no, ai-input=yes, search=yes directive in robots.txt.

Sitemaps 0.9 / robots.txt

Standard locations, AI bot rules, sitemap reference. Contents reflect the sitemap’s published entries.

WebMCP (in-browser agent tools)

On pages that register WebMCP, supported browsers can navigate to template search. Navigation only — a page-scoped tool carries no identity, so nothing there can build or spend. Falls back gracefully on browsers without WebMCP.

Agent Card discovery

A public capability card at /.well-known/agent-card.json declares build_app and deploy_app as capability labels and links to the authenticated MCP and REST interfaces. These labels are not callable A2A methods. An A2A task server is not implemented.

Security Disclosure (RFC 9116)

/.well-known/security.txt with [email protected] contact and disclosure policy. Standard for security researchers.

Agent Authentication (auth.md)

/auth.md walkthrough plus an agent_auth block in /.well-known/oauth-authorization-server — declares the OAuth 2.0 authorization_code + PKCE (S256) flow, bearer-token usage, supported scopes, and the verified_email identity assertion Overskill vouches for (Google / GitHub SSO).

Stripe MPP — Machine Payments Protocol

Discovery document published at /openapi.json — declares the payable credit-pack operation with x-payment-info (intent/method/amount). Not an implemented payment workflow. Proposed direction: (1) Pay Overskill — agents pay-per-build via MPP / Tempo settlement. (2) Built into your apps — generated apps get a native acceptAgentPayment(). Do not send a payment based on this discovery declaration.

x402 micropayments (Coinbase + Cloudflare)

Roadmap. Stablecoin-native pay-per-call settlement for unauthenticated agent traffic — not a currently available anonymous build or payment path.

UCP — Universal Commerce Protocol (Google + Shopify)

Discovery profile published at /.well-known/ucp (protocol_version, services, capabilities, endpoints over our real commerce surfaces). Roadmap: full UCP transaction lifecycle so generated commerce apps — and Overskill itself — can transact with agents end to end.

ACP — Agentic Commerce Protocol (OpenAI + Stripe)

Discovery document published at /.well-known/acp.json (protocol name/version, api_base_url, transports, capabilities.services over our real surfaces). Roadmap: ACP's stateful agentic-checkout session lifecycle so agents get a consistent payment surface regardless of spec.

Web Bot Auth (RFC 9421 HTTP Message Signatures)

Roadmap. Cryptographically-signed agent identity → tiered rate limits, and propagated into generated apps so they can authenticate the agents calling them.

Start with a job you can check.

Connect your assistant, write the expected result and keep the browser checks in the workflow.

Help center · API documentation · Webhooks