Squarespace MCP server for your AI

In your Squarespace site, go to Settings → Advanced → Developer API Keys and generate a key, ticking the permissions you want on Orders, Products, Inventory and Transactions. Paste that value into the API Key field — there is no OAuth app, redirect URL or client secret to set up. The key does not expire while your site is active, and it is sent server-side over HTTPS as a Bearer token. Because the key belongs to one site, the MCP server is locked to that site.

No. Squarespace puts contacts and webhooks behind its OAuth flow, so neither is part of this integration. What the key does cover is orders, products and variants, image management, inventory, transactions, profiles and analytics. With webhooks out of reach, PopMCP watches the store by polling for events like a new order, a fulfillment or a refund, and by change detection for stock levels and new customer profiles.

The agent can list and retrieve, but Squarespace itself rejects the write calls — create_product, adjust_inventory, fulfill_order and the rest. If you want the agent to change things, tick Read/Write on the specific modules you're comfortable with when you generate the key, and leave the others on Read. You can tighten it further on the PopMCP side with read-only access mode or approval-required-for-writes.

No. create_order imports an order from an external sales channel and records it in the store; it does not charge anyone. The transaction tools only read what Squarespace has already recorded — list_transactions and get_transactions return the documents for orders and donations, including refunds and gateway details, and get_transaction_summaries returns per-customer counts and totals.

Several tools batch by id, which cuts down round trips. get_product takes a comma-separated list of up to 50 product ids, get_inventory takes a list of variant ids, list_inventory returns up to 50 variants per page, and get_transaction_summaries covers up to 1,000 contact ids at once. One API quirk worth knowing: update_product goes over POST rather than PUT, which is Squarespace's own convention here.

The image tools work on images already attached to a product — there is no upload call in the set. The agent can assign an existing image to a specific variant, update alt text, reorder images and check an image's processing status. An alt-text pass across the catalog is a good fit; delete_product_image is the one to keep behind write approval.

No. PopMCP hosts it and gives you a Streamable HTTP MCP URL. There is nothing to deploy, no callback URL to register, and no infrastructure to keep running or patch.

Any client that supports a remote Streamable HTTP MCP server — Claude Desktop, Claude Web, ChatGPT custom connectors, Codex and the Codex CLI, OpenCode and Z.ai's ZCode, as well as editors such as Cursor, Windsurf and Zed. Your client signs in to PopMCP with OAuth; the provider credential never leaves the server.

Loading 23 tool definitions into every conversation burns context before the work starts. PopMCP loads a curated 18-tool set covering the everyday workflows and keeps the rest searchable, so your AI pulls a specialist tool only when a task needs it. You can switch a connection to the full catalog at any time.

A tool is something your AI calls — there are 23 here. A trigger is something PopMCP watches for you: 9 Squarespace events that can start work on the PopMCP side. Triggers never enter your AI client's context, and none of them ask you to paste a callback URL into Squarespace.