Any MCP client
Claude (desktop, web, Code), ChatGPT, Cursor, Zed, Continue — anything that speaks the Model Context Protocol. Streamable HTTP, one endpoint, stateless. No SDK to install, no plugin to maintain.
The product
BYO-AI
An MCP server that gives your assistant a live, scoped connection to your domain. It can read the site, edit it transactionally, build it, verify it in a real browser, publish it atomically, and hand the whole thing back to you on request. You supply the intelligence. We supply everything it needs to act.
Bring your own AI
You already pay for the model. Why buy it twice?
Every AI website builder resells you inference. You pay them a monthly fee, they pay a model provider, and you get a credit allowance that runs out in the middle of the job. Meanwhile you are already paying for Claude or ChatGPT, sitting in another tab, idle.
BYO-AI inverts it. We sell infrastructure — the domain, the server, the build pipeline, the publishing machinery — and your existing subscription supplies the model. There are no credits here to run out, no per-generation metering, and no incentive for us to make the model cheaper than the one you chose.
It also means the quality of your site tracks the frontier. When your assistant gets better, your builder gets better, on the same day, at no extra cost to you.
Tokens that only reach your sites
Access is a scoped token, and the site root is derived from it rather than passed as an argument. A request for someone else's site does not fail with a permission error — it fails as though the site does not exist.
The surface
What your AI can actually call.
The tools are grouped by what they touch. The third column is the one that matters: almost nothing your assistant does can change what a visitor sees.
| Tool | What it does | Visible to the public? |
|---|---|---|
| site_list | Every site this token can reach, with its live URL | no |
| site_status | One answer: live URL, current release, one plain sentence | no |
| site_tree | File listing with sizes and hashes — never content | no |
| site_read | Line-ranged read, or a structural outline of a page | no |
| site_grep | Search with context — how the model finds its anchor | no |
| site_edit | The write path. Typed operations, applied as one atomic commit | draft only |
| site_asset_upload | Images and fonts — type checked, EXIF stripped, optimised | draft only |
| site_media_search | Licence-cleared stock, so pages don't ship broken images | no |
| site_brand_set | Persisted brand tokens injected into every future build | draft only |
| site_build | Sandboxed build, with parsed diagnostics on failure | draft only |
| site_render_check | The verifier. DOM facts, console errors, broken assets, layout — and a screenshot | no |
| site_link_check | Whole-site crawl for dead links and orphaned pages | no |
| site_preview_url | Signed, short-lived preview link for you to look at | no |
| site_pin | Structurally protect a pasted snippet from any rewrite | draft only |
| site_publish | Preflight, then new immutable release and atomic swap | yes |
| site_rollback | Repoint the live site at an earlier release, instantly | yes |
| site_restore_to | Return the site to a point in time and carry on | yes |
| site_timeline | Edits, builds, checks and publishes as one ordered list | no |
| site_domain_attach | Bind a domain; returns the exact records to add | yes |
| site_domain_status | Per-resolver DNS table, certificate state, typed next action | no |
| site_seo_set | Page metadata; regenerates the sitemap and robots file | draft only |
| site_export | The exit. Plain HTML plus full history, one command | no |
Abbreviated. The full v1 surface is 39 tools, filtered by scope into read, builder and admin profiles — a token that cannot publish will not even be shown the publish tool.
Architecture
One constraint that decides everything else.
The organising principle
Node is the build-time renderer, never the request-time runtime. Code written for your site is never executed on a request. Ever.
Astro runs once, at build time, in a locked-down sandbox with no network and no ability to reach anything but its own directory. What comes out the other side is HTML, CSS, images and JavaScript that runs in the visitor's browser. That is all the web server ever serves.
The consequence is that a site is a directory, not a container. There is no per-customer process to supervise, restart, patch or have compromised. One machine holds a thousand sites because a site costs a folder and a symlink.
It also means our problems are not your problems. If we ship a bad update to the control plane, the web server keeps serving the last release off disk and your site does not notice.
The path jail
Every write is resolved against your site root and refused unless it lands inside it. Traversal, absolute paths, encoded separators, symlinks and unexpected characters are rejected by an allow-list, not a blocklist. It is property-tested against generated adversarial input on every commit.
Releases live outside the writable area
Published releases are stored where nothing with write access can reach them. Without that split, anything that got into the draft could overwrite an already-verified release and promote it through rollback — skipping the build and every check.
The node holds nothing irreplaceable
Source of truth is the control plane, with full git history. Disaster recovery is a re-push, not a restore — and your export is the same content, so you are never dependent on our backups being good.
The design system
Why pages built weeks apart still match.
Hand a model an empty file and it will write competent, generic CSS — different competent, generic CSS every time. Monday's home page uses one red and one font; Thursday's about page uses a slightly different red and a different button radius. Both pass every automated check. The site still looks wrong.
Brand is stored, not remembered
Palette, type scale, spacing, radius and shadow live with the site and are injected into every build — not carried in a conversation that will eventually be compacted.
Composed, not authored
Around twenty named sections — hero, feature grid, menu, gallery, testimonial, hours and map, footer — that the model assembles by name instead of inventing from scratch.
Starting points that already work
Layouts for local services, professional services, portfolio, restaurant, events and SaaS. The first draft is a real design, not a blank page with your words on it.
Off-brand fails the publish
A colour that isn't on the palette or a font that isn't registered blocks the release. Drift gets caught before it ships, not three pages later.
Safety model
We annotate honestly, so the confirmation still means something.
Building one five-section page takes a dozen or more tool calls. If every one of them asks “are you sure?”, your first experience is clicking Allow fifteen times in four minutes — after which you will sensibly click always allow, often including publish. The defence against “the AI broke my live site” is a confirmation you have just switched off.
So we only flag what actually has public consequences. Editing a draft, uploading an image and running a build are marked non-destructive, because they are: nothing a visitor can see changes. That collapses a page build from roughly fifteen approvals to one, and makes “always allow” a safe thing to click.
- Publish is diff-aware. If the new version drops a script, iframe, stylesheet or form that is live and you didn't ask to remove, it stops and names what would disappear.
- Third-party noise can't force deletion. A map or social embed that logs console errors is reported, never blocking — otherwise the fastest way for a model to turn the check green is to delete the thing you asked for.
- Errors carry reality. A failed call returns counts, line numbers and the actual hash, plus the exact argument to change — which is what stops a retry loop.
- Every result is budgeted. Tool output is capped and told how to narrow itself, so a large site never floods your assistant's context.
Composition
The advantage a walled builder can't have.
A builder in a browser tab is a closed application. It can only see the site it owns. Your assistant, meanwhile, is already connected to the rest of your business — your storefront, your CRM, your calendar, your inbox, your DNS.
Because our tools are just more tools in that same session, work that would be an integration project elsewhere is a sentence here. Nothing needs to be built; the pieces are already in the room.
- Generate a page per product from the store you already run
- Publish next month's events straight off your calendar
- Turn the case study in your CRM into a written-up story
- Point the domain and create the DNS records in the same breath
Ownership
Leaving is one command.
We would rather earn the renewal than trap you. site_export hands back plain HTML, CSS and images with the full git history — not a proprietary bundle that only imports back into us.
Host it on anything: a bucket, a static host, a colleague's laptop. The domain is registered in your name and transfers out on request. There is no export fee and no notice period on the data.
✓ risecrumb.zip 4.1 MB
↳ 34 pages, 62 assets
↳ .git with 411 commits
↳ no TDC-specific files
Early access
Point your assistant at a real domain.
We're onboarding a limited number of sites while the platform is in early access. If you already run an AI you like, you have everything you need except the infrastructure.