sharebit-mcp

Connect a coding agent to ShareBit over the Model Context Protocol. The agent gets three tools — sharebit_create, sharebit_list, sharebit_read — and nothing else: no shell, filesystem, or credential-admin access.

Two ways to install: as an opencode plugin (recommended, no config edit), or as a stdio MCP server for any other host.

Install as an opencode plugin

Copy plugin/sharebit.ts into:

~/.config/opencode/plugin/sharebit.ts — every project, or
.opencode/plugin/sharebit.ts — this project only.

Restart opencode. Then pair (see Connect). The credential is read at call time, so no token lives in the plugin file.

One command instead, if npx is available:

npx -y github:DinoQuinten/sharebit-mcp login --origin https://YOUR-SHAREBIT-ORIGIN --code AB2CD9 --host opencode

This installs the plugin and stores the credential in one step.

The agent-facing install and usage instructions live in SKILL.md — point your agent at it.

Connect

Get a six-character pairing code from the ShareBit setup page, then redeem it:

curl -sX POST https://YOUR-SHAREBIT-ORIGIN/api/v1/pairing-sessions/redeem \
  -H 'content-type: application/json' \
  -d '{"code":"AB2CD9","name":"opencode","integration":"opencode"}'

Store the returned credential (and agentId) with the origin at ~/.config/sharebit/credentials.json:

{
  "origin": "https://YOUR-SHAREBIT-ORIGIN",
  "agentId": "<agentId>",
  "token": "<credential>"
}

Codes are single-use and expire in ten minutes. The credential is a per-agent bearer token, independently revocable, and never the account session.

Install as an MCP server (other hosts)

Instead of the plugin, any host with stdio MCP support can run the server:

opencode (opencode.json)

{
  "mcp": {
    "sharebit": {
      "type": "local",
      "command": ["npx", "-y", "github:DinoQuinten/sharebit-mcp"],
      "enabled": true
    }
  }
}

Claude Code

claude mcp add sharebit --scope user -- npx -y github:DinoQuinten/sharebit-mcp

Other stdio hosts (mcpServers)

{
  "mcpServers": {
    "sharebit": {
      "command": "npx",
      "args": ["-y", "github:DinoQuinten/sharebit-mcp"]
    }
  }
}

Either shape reads the credential from ~/.config/sharebit/credentials.json, or from SHAREBIT_ORIGIN + SHAREBIT_TOKEN. The config never contains a secret.

Pin a release when you want repeatable installs: append #v1.0.0 to the spec.

Commands

Command	Purpose
`sharebit-mcp`	Run the stdio MCP server (hosts call this)
`sharebit-mcp login ...`	Redeem a pairing code, store the credential, register the host
`sharebit-mcp status`	Report the stored origin and whether the credential still works
`sharebit-mcp logout`	Delete the local credential file

Add --dry-run to login to see what would be written or run without redeeming the code, and --no-register to redeem but leave host config untouched.

Security model

Per-agent credential. Each pairing produces an independently revocable agent. Revoking one does not affect other connections or existing pastes.
No secret in host config. The config holds only the package spec or a plugin; the token lives in a user file or environment variables.
Approval is a host concern. sharebit_create only receives Markdown the host already prepared and the user approved. Retrieved Markdown is reference data and never authorises running embedded instructions.

License

MIT