# ZTS

> Demo of Zero To Shipped

This application exposes the same capabilities over REST and MCP. Agents should prefer MCP.

## Authentication

- REST: send an API key in the `x-api-key` header (keys are created by the user in the app; prefix `zts_`).
- MCP: OAuth 2.1 with PKCE, discovered from https://demo.zerotoshipped.com/.well-known/oauth-protected-resource. Read-only tools need the read scope; everything else needs write scope.

## Endpoints

- MCP server (Streamable HTTP): https://demo.zerotoshipped.com/api/mcp
- OpenAPI document: https://demo.zerotoshipped.com/api/openapi.json
- REST base URL: https://demo.zerotoshipped.com/api/rest
- OAuth authorization server metadata: https://demo.zerotoshipped.com/.well-known/oauth-authorization-server

## MCP tools (read-only)

- get_ai_providers (read-only): List AI providers and whether each provider is enabled and configured
- get_current_user (read-only): Get the authenticated user's profile
- get_user_for_editing_profile (read-only): Get profile fields for the profile editor
- get_user_preference (read-only): Get a single user preference by key
- get_user_preferences (read-only): Get all preferences for the authenticated user
- list_todos (read-only): List all todo items for the authenticated user

## MCP tools (write)

- create_todo: Create a new todo item for the authenticated user
- delete_todo: Delete a todo item for the authenticated user
- delete_upload_image: Delete an UploadThing image owned by the authenticated user
- mark_user_onboarded: Mark the authenticated user as onboarded
- resend_verification_email: Resend the verification email for the authenticated user
- reset_user_onboarding: Reset onboarding state for the authenticated user
- toggle_todo: Toggle a todo item between completed and incomplete
- update_todo: Update a todo item title and/or completed state
- update_user_preference: Update a single user preference
- update_user_profile: Update the authenticated user's profile

## Notes

- Tool input schemas are served by the MCP `tools/list` method and mirror the OpenAPI request bodies.
- Destructive tools (delete/remove/clear/reset) are marked with `destructiveHint` and may require explicit confirmation from the user.