post_v1_sites_deploy

DeploySite deploys a caller-supplied file manifest — the deploy_site capability an agent calls — and answers with where it went live.

files is a list of {path, content} pairs, the same shape the brief build emits, and it runs through the SAME guards: index.html required at the root, absolute and traversal paths rejected, per-file and total size capped, and a mobile viewport meta tag injected into every HTML document that lacks one — so a hand-built site is exactly as safe and as responsive as a generated one. slug and name are optional; a slug is derived from the name or minted.

It writes into the SAME org-scoped store as /v1/projects, ensuring a project (framework static) for the resolved slug and recording a deployment. The hosting gate runs before the upload and the debit lands once, after the site is live — a failed upload is never billed. Answers 503 when object storage is unconfigured.

Scope: a validated principal is required (403 without one) and the site is published into THAT principal's org.

Arguments

tools/list declares a type for each field and nothing further. A — means neither the door nor that operation constrains the field.

Object types

projectsFile is an object this tool's fields are made of, declared inside the tool's own schema and enumerated in full below.

projectsFile

Call it

A tools/call carries every argument in one flat object — nothing binds to a path or a query string. Nothing above is required, so every declared argument is shown rather than a guess at which matter.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "post_v1_sites_deploy",
         "arguments": {
           "files": [
             {
               "content": "<content>",
               "path": "<path>"
             }
           ],
           "name": "<name>",
           "slug": "<slug>"
         }
       }
     }'

Values are the operation's own defaults and enumerated values where it declares them, and a <placeholder> where neither source declares one. tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

The same capability over plain HTTP is in the sites API reference, on https://api.hanzo.ai.

All 755 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 833 tools captured 2026-08-01, of which 755 are documented here (the operator surface is not published) (this build read the vendored copy; the door was unreachable).