@fifth-door/mcp

The public Fifth Door MCP server: sign in to Fifth Door and publish games from Cursor, Claude Code, Codex, or any MCP client. Runs locally over stdio so it can read the game directory being published; talks to Fifth Door exclusively over REST with a per-user session token.

Install

Published package (@latest keeps users on the newest version — npx caches otherwise). @latest resolves when the client launches the server, so a running client keeps the version it started with; after a release, restart the MCP server (or the editor) to pick up the new one.

Cursor — one-click: see fifthdoor.com/docs/mcp, or add to .cursor/mcp.json:

{
  "mcpServers": {
    "fifth-door": {
      "command": "npx",
      "args": ["-y", "@fifth-door/mcp@latest"]
    }
  }
}

Claude Code:

claude mcp add fifth-door -- npx -y @fifth-door/mcp@latest

Codex:

codex mcp add fifth-door -- npx -y @fifth-door/mcp@latest

From this monorepo (already registered in .mcp.json, pointed at the local dev stack):

bun packages/mcp/src/index.ts

Tools

The tables below, tools.json, and the ## Tools section of docs/publish-from-your-editor.md are written by bun run generate-tools from the registered tools (src/tooling/catalog.ts); catalog.test.ts fails when they are stale. Edit descriptions in src/tools/, not here.

Account

Publish

Game art and audio

Your games

Gameplay previews

Game jams

Platform SDK docs

publish_game always uploads authored source alongside the playable bundle (required for content rating and later rehydrate). When directory is a build output such as dist/, pass sourceDirectory as the project root. Each publish also creates or updates an idle Studio session so Insights and listing metadata are available in the app; it does not start an agent turn.

The server never writes SDK files into a project. Adding the SDK is the setup guide (get_sdk_docs({ version, topic: "setup" })): pin one release in a script tag or install @fifth-door/platform-sdk, then read the topics from that same release. Releases before 0.4.0 shipped an add_sdk tool that copied the checkout's docs and helpers from /api/prism/devkit.zip and read docs from /api/platform/sdk/index.json; in production those routes answer 410 with a message to upgrade.

The two SDK tools are thin callers of /api/platform/sdk/latest.json, /api/platform/sdk/<version>/index.json, and /api/platform/sdk/<version>/docs/<topic>. The API builds the index from the release's own index.json; this server holds no docs, no frontmatter parsing, and no knowledge base of its own, so the same index and docs are reachable without the MCP (the web docs page reads the same routes). Learning and changing the project are separate: both tools are read-only and need no login, so an agent can assess a capability before touching anything. An exact version is read from that release or fails; it never falls forward to a newer one, because docs for a release the project does not pin describe an API the project does not have. The setup guide ends with a project note the agent leaves (AGENTS.md, CLAUDE.md, or the README) naming the pinned release and these two tools, so a later session reads the release the game was written against rather than the newest.

Cover art

Covers render inside a 4:3 landscape box on every browse surface (GameCard.tsx), with object-contain — so a 16:9 screenshot or a square image shows with bars around it rather than being cropped. Other surfaces reuse the same image at 3:2 (share cards) and 5:1 (banners), and those crop.

• Letter the game's title into the artwork. A card is the cover plus a creator row — the title is drawn nowhere on it, so a cover without the name ships as an untitled picture. Fifth Door's own cover generator bakes the title in for the same reason (packages/assets/src/generation/cover-art.ts).
• Export at 4:3: 1200x900, or 1600x1200 for a sharper card.
• Keep the title and hero subject inside the middle ~70%, out of the corners.
• publish_game reads the cover's header and warns in its output when the aspect is off or the image is under 800px wide. It cannot see whether the title is on the image, so that part is on the caller.

Gameplay previews

Discover loops a short muted clip on a game's card instead of the still cover, when the artifact has one (platform_artifacts.preview_video_url).

Going public queues a recording automatically for any game that has no preview yet (applyArtifactVisibility), so an MCP-published game normally gets one without asking. generate_game_preview exists to record one for a game that is still unlisted, or to replace a bad clip (regenerate: true). It runs an agent over the published source to write a controller, then records that controller under Playwright on a GPU worker — several minutes, so poll get_game_preview_status.

set_game_preview is the manual path: hand it a local video and the server transcodes the first 8 seconds into a card-sized h.264 loop. Trim before uploading.

Configuration

Everything arrives via env vars in the MCP client config — this package never reads monorepo state.

Credentials are cached in ~/.config/fifth-door/credentials.json (0600), keyed by API origin.

Server-side counterpart

• Device flow: better-auth deviceAuthorization plugin (packages/api/src/auth.ts), approval page at /device (packages/web/src/routes/device.tsx), device_code table.
• API keys: api_tokens table + ApiTokenRepository; minted on the account page (apiTokens RPC router), accepted as bearer tokens by the platform REST routes.
• Publish + management: POST /api/platform/publish (session or API-key bearer ⇒ owned, slug-guarded publish; session publishes require sourceFiles), GET /api/platform/me, GET /api/platform/me/artifacts, PATCH /api/platform/me/artifacts/:slug/visibility (packages/api/src/routes/platform.ts).
• Previews: POST/DELETE /api/platform/me/artifacts/:slug/preview (raw video body ⇒ writePlatformPreview transcode), POST/GET /api/platform/me/artifacts/:slug/preview/generation (same queue Studio and the go-public path use). Shared save/clear lives in packages/api/src/lib/artifactPreview.ts.
• Game jams: GET /api/platform/jams, POST/DELETE /api/platform/me/artifacts/:slug/jam-entries[/:jam] (shared entry rules in packages/api/src/lib/gameJamEntries.ts).
• User-facing setup guide: docs/publish-from-your-editor.md here, rendered at /docs/mcp (packages/web/src/components/docs/McpDocsPage.tsx).

Release

Publishing is automated by .github/workflows/publish-mcp.yml: bump version in this package.json, merge to main, and CI publishes to npm via trusted publishing (GitHub OIDC) — it no-ops when the version is already on npm.

Every PR that changes the published server (tools, tool descriptions, behavior, defaults) bumps version in this package.json and both version fields in server.json, in the same PR. Without the bump the merge publishes nothing, and creators on @latest never get the change. Minor for new tools or changed behavior, patch for fixes and description edits.

The MCP Registry listing io.github.fifthdoor/mcp is described by server.json and published by hand once the version is on npm: bump both version fields in server.json to match, then from this directory run mcp-publisher login github (any member of the fifthdoor GitHub org) and mcp-publisher publish. The registry verifies npm ownership through mcpName in package.json, which must equal the server name.

Publishes carry no provenance attestation. npm only verifies a sigstore bundle whose source repository is public, and fifthdoor/conduit is private; trusted publishing enables provenance by default, so the workflow sets NPM_CONFIG_PROVENANCE=false to turn it back off. Making the repo public is the only way to get provenance back.

One-time bootstrap (npm requires the package to exist before a trusted publisher can be configured):

1. Create the fifth-door org on npmjs.com (owns the @fifth-door scope).
2. First publish manually: cd packages/mcp && npm publish (runs prepublishOnly build; needs npm login).
3. On npmjs.com → package Settings → Trusted Publisher → GitHub Actions → repository fifthdoor/conduit, workflow publish-mcp.yml. From then on, no tokens anywhere.

bun run build produces dist/index.js (Node-runnable; esbuild stays external because it ships a platform-native binary).