Add an app
create_appAdd an app. Pass its URL; scenarios, limits, notes and test logins are optional and can be changed later with update_app. Give scenarios as a list with expects — what must be seen, one sentence each — and every check answers each of them (seen, shows otherwise, not seen); the answer returns them as they were understood. test_email/test_password is the default test user — pass the password you already hold (the project's .env or seeds); test_accounts adds named ones ("admin", "free user"), and a scenario that names one ("As admin: refunds work") is checked signed in as it. Passwords are write-only: stored encrypted, never returned (list_apps says has_password). An app that runs inside another product's page (a Shopify embedded app) needs allowed_origins: the host page's origin and the app's own. For a password-protected store (Shopify's "Enter store password" page), pass store_password and every check enters it. A website gets a recurring check (daily by default) within the team's plan; each check spends the team's balance, so the first one runs automatically when the balance covers it and otherwise waits for a top-up (or, on a paid plan, the next monthly credit) (the result's hint says which, with buy_url and upgrade_url). isError with code plan_limit when the plan does not allow it.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"url": "<url>"
},
"name": "create_app"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The deployed app's address, e.g. https://your-app.com (or a Chrome Web Store link) | |
| team | No | Act in another of your teams, by its name or id (whoami lists them). Omitted: the key's own team | |
| notes | No | Context for every check, e.g. 'Do not delete the test account.' | |
| limits | No | What a check may never do, one rule per line, e.g. 'Do not touch /admin.' | |
| frequency | No | How often it is checked; default daily | |
| scenarios | No | What must keep working — each becomes a scenario of the app, watched from the first check. Best as a list that says what must be seen: [{ "title": "Pay with a card", "description": "Add the test product and pay with the test card.", "expects": ["The page reads «Order confirmed»."] }]. Or plain words, one scenario per line (or per sentence), e.g. 'Checkout: pay with the test card; the page reads «Order confirmed».' | |
| test_email | No | Sign-in email of a test user of the app (the "default" account) | |
| test_accounts | No | More test users, each a different kind of user, e.g. [{label:'admin', …}, {label:'free user', …}]. A scenario that names one ('As admin: refunds work') is checked signed in as it | |
| test_password | No | That test user's password, e.g. from the project's .env or seeds. Write-only: stored encrypted, never returned (list_apps says has_password) | |
| store_password | No | For a password-protected store (Shopify's 'Enter store password' page): the store password. Stored encrypted and never returned | |
| allowed_origins | No | Other https origins the check may open and act on besides the app's own — for an app that runs inside another product's page, e.g. ['https://admin.shopify.com', 'https://your-app.example.com'] for a Shopify embedded app | |
| test_totp_secret | No | For a login whose app asks for a code from an authenticator app: the secret shown under the QR code when 2FA was set up, or the otpauth:// address in it. The check types {{TEST_TOTP}} codes from it. Write-only (list_apps says has_authenticator); "" removes it |