biver-builder

Biver Builder

Use the remote MCP server when the client supports authenticated Streamable HTTP. Otherwise call the REST API directly.

• MCP: https://mcp.biver.id/mcp
• REST: https://api.biver.id
• Live REST contract: https://api.biver.id/SKILL.md
• Authentication: Authorization: Bearer $BIVER_API_KEY or X-API-Key: $BIVER_API_KEY

All Biver API keys can affect the workspace attached to the key. A key prefix does not create a sandbox. Start with read-only scopes and add write scopes only when the task requires them.

Safety policy

Read-only calls do not need confirmation. Before a high-impact call, state the exact target and impact and obtain explicit user confirmation. An explicit request that already names the action and target counts; a vague request to “manage” or “clean up” does not.

Confirmation is required for:

• every DELETE request;
• page deploy or publish;
• custom-domain creation, update, primary selection, or deletion;
• subdomain creation, update, publication, or deletion;
• gallery deletion;
• workspace settings, branding, or SEO mutation.

For MCP, pass confirm: true only after that confirmation. Never reuse confirmation for another resource. Never log, print, or place the API key in a URL, file, prompt, or response.

Scope contract

Scopes are enforced by the API. all bypasses individual scope checks and should be reserved for tightly controlled administration.

GET and HEAD use the read scope. Other methods use the write scope. AI routes always use ai:generate. Unknown /v1/ routes fail closed unless the key has all.

MCP

Connect to https://mcp.biver.id/mcp with the API key in an authorization header. The server exposes one tool:

biver_request

Arguments:

The MCP server validates browser origins, API keys, scopes, path shape, methods, and confirmation. It returns the REST status and body as structured content. Multipart gallery upload remains a REST-only operation.

REST endpoint map

Use the live contract for request fields and response details. Do not guess fields that are not listed there.

The API Worker requires authentication for every /v1/* route, including form-submit and workspace-public routes. Visitor-facing forms use Biver’s published-page flow, not an unauthenticated agent call.

Minimal REST call

curl --fail-with-body \
  -H "Authorization: Bearer $BIVER_API_KEY" \
  "${BIVER_API_BASE_URL:-https://api.biver.id}/v1/pages?limit=20"

Send JSON mutations with Content-Type: application/json. Send gallery uploads as multipart/form-data with a file field. Use only one authentication header.

Response handling

Successful responses use { "success": true, "data": ... }. Errors use { "success": false, "error": { "code", "message" } }.

• 401: missing, invalid, expired, or revoked key.
• 403: required scope is missing.
• 404: resource not found in the key’s workspace.
• 409: conflicting slug, subdomain, or domain.
• 422: invalid input.
• 429: rate limit reached; respect Retry-After.

Treat mutation retries conservatively. Re-read the resource after an ambiguous timeout before retrying a create, deploy, or delete operation.

Install

clawhub install @ramaaditya49/biver-builder

Configure BIVER_API_KEY in the client’s secret store, not in the skill directory. Review the installed SKILL.md before granting write scopes.