MCP Servers

1. What it is

MCP is the open standard AI clients use to call external tools. Each Share a Wish server runs locally as a stdio process, receives tool calls from your assistant and forwards them to the same Share a Wish endpoints the Partner Portal uses — with your credentials, on your machine.

Both servers are available to every Partner Portal account, the free plan included. There is no separate MCP plan or fee. Plan limits — wishlist actions per month, number of shops, ready product videos per shop — apply exactly as they do in the portal, because the servers call the same endpoints.

The servers are single-file bundles without runtime dependencies and need Node.js 18 or newer. Tool names use snake_case (shops_create, keys_domains_set) for maximum client compatibility.

2. Install

The package is published on npm as @shareawish/mcp and exposes two binaries, shareawish-creator-mcp and shareawish-wishlist-mcp. You do not need a global install — every client below starts the server through npx:

npx -y -p @shareawish/mcp shareawish-creator-mcp
npx -y -p @shareawish/mcp shareawish-wishlist-mcp

Replace saw_pat_… in the examples with your personal access token (see Authentication).

Claude Code

claude mcp add shareawish-creator  -e SHAREAWISH_TOKEN=saw_pat_… -- npx -y -p @shareawish/mcp shareawish-creator-mcp
claude mcp add shareawish-wishlist -e SHAREAWISH_TOKEN=saw_pat_… -- npx -y -p @shareawish/mcp shareawish-wishlist-mcp

Cursor, Claude Desktop, Windsurf

Add the servers to the mcpServers object of the client configuration (Cursor: .cursor/mcp.json or Settings → MCP; Claude Desktop: claude_desktop_config.json; Windsurf: ~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "shareawish-creator": {
      "command": "npx",
      "args": ["-y", "-p", "@shareawish/mcp", "shareawish-creator-mcp"],
      "env": { "SHAREAWISH_TOKEN": "saw_pat_…" }
    },
    "shareawish-wishlist": {
      "command": "npx",
      "args": ["-y", "-p", "@shareawish/mcp", "shareawish-wishlist-mcp"],
      "env": { "SHAREAWISH_TOKEN": "saw_pat_…" }
    }
  }
}

VS Code with GitHub Copilot

Create .vscode/mcp.json in your project. The inputs entry makes VS Code prompt for the token once and store it in its secret storage instead of the file:

{
  "inputs": [
    { "type": "promptString", "id": "shareawish-token", "description": "Share a Wish personal access token", "password": true }
  ],
  "servers": {
    "shareawish-creator": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "-p", "@shareawish/mcp", "shareawish-creator-mcp"],
      "env": { "SHAREAWISH_TOKEN": "${input:shareawish-token}" }
    },
    "shareawish-wishlist": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "-p", "@shareawish/mcp", "shareawish-wishlist-mcp"],
      "env": { "SHAREAWISH_TOKEN": "${input:shareawish-token}" }
    }
  }
}

Only add the server you need: creators usually want just shareawish-creator, integrators just shareawish-wishlist. Start with whoami in your client to confirm the connection.

3. Authentication

Recommended: personal access token. Set SHAREAWISH_TOKEN to a token that starts with saw_pat_. Create it in the Partner Portal under Account Settings → Access tokens & AI agents. The token is shown once when you create it, can be revoked at any time and expires after 365 days by default. It grants the same rights as your portal login, scoped to the partner account it was created in.

The docs, snippet and plan tools of the Wishlist Integration server (docs_search, openapi_get, plans_list, snippet_*, baskets_public_config) work without credentials. Everything else calls whoami-level authentication first and returns unauthorized if the token is missing, expired or revoked.

Tokens and passwords are read from the environment only. The server never writes them — or any session it derives from them — to disk.

4. Creator Shop server tools

Started with shareawish-creator-mcp. Ids are the numeric ids returned by the list/get tools; the public shop URL is https://shareawish.shop/<handle>.

5. Wishlist Integration server tools

Started with shareawish-wishlist-mcp. Key ids are the ids shown in the portal; basket configuration ids look like bkt_….

6. Example sessions

Creator: from idea to live shop

A prompt such as "Create a shop called Lena's Picks with an autumn favourites list, add these three products with my affiliate links, upload the clip and publish it" typically results in this tool sequence:

1. whoami — confirm the account, then shops_check_handle(handle="lenas-picks") — is the URL free?

2. shops_create(name, handle, template) — the shop is created as a draft.

3. shops_upload_image(shop_id, type="logo", source="./logo.png") — logo from a local file or URL.

4. lists_create(shop_id, name="Autumn favourites")

5. products_add_by_url(shop_id, list_id, source_url, affiliate_url) — the product page is scraped for title, image and price; visitors click affiliate_url.

6. media_upload_video(product_id, source="./clip.mp4") — MP4/MOV up to 200 MB.

7. shops_publish(shop_id, status="live") — the shop is public at https://shareawish.shop/lenas-picks.

Integrator: from test key to production

1. whoami, then keys_create(environment="test") — you get a pk_test_… key.

2. widget_init_check(public_key, origin="http://localhost:3000") — confirms the handshake works before touching your code.

3. baskets_create(name, cart_url or webhook_url) — the basket configuration (bkt_…); optionally baskets_test_webhook.

4. snippet_save_button(framework="react", public_key) and snippet_basket(config_id, framework) — paste the generated code into the shop.

5. keys_create(environment="prod", allowed_domains=["shop.example.com"]) or keys_domains_set — allow-list the production domain.

6. Swap in the pk_live_… key and watch usage_get against the plan limit.

Test keys hit the same live API as production keys; there is no sandbox, so the data you save is real. Details: Wishlist API, Save Button.

7. Security notes

• Least privilege. Create a separate personal access token per machine and per agent, name it after where it lives, and revoke it in the Partner Portal as soon as you are done. A token grants the same rights as your login; treat it like a password.
• Only Share a Wish endpoints. The server talks exclusively to Share a Wish hosts (the public API, the partner API and, for product scraping and image or video fetches, the URLs you pass in). It does not phone home, collect telemetry or contact any third party.
• Nothing on disk. Credentials, sessions and uploaded files are held in memory only; the server writes nothing to disk. Removing the server from your client configuration leaves no residue.
• Approve destructive calls. Keep your client's per-call approval on for shops_publish, keys_create (prod), keys_revoke, keys_delete, lists_delete, baskets_delete and media_delete.
• Keep secrets out of files you commit. Prefer the VS Code inputs prompt or your client's secret storage over a plain-text token in mcp.json; if you must use a file, add it to .gitignore.

Source

The servers are open source (MIT). Source on GitHub: github.com/shareawish/mcp — issues and pull requests welcome. npm: @shareawish/mcp.