Use CTRify from AI agents or your own software.

The two canonical entry points

These are service endpoints, not web pages. Configure or call the specific interface as documented below.

Choose the interface

Both interfaces act on CTRify's hosted infrastructure. Customers do not install CTRify, PHP, Python or a database on their computer or server.

Connect through MCP

Use the exact server URL below in a client that supports remote MCP over Streamable HTTP and OAuth:

https://www.ctrify.com/mcp

CTRify publishes OAuth discovery, supports dynamic public-client registration and requires authorization code with PKCE S256. A compatible client should open the CTRify login and consent flow automatically. Do not paste a CTRify password or bearer token into the client configuration.

Cursor

Add CTRify to the project in .cursor/mcp.json, or use the same entry in Cursor's global MCP configuration:

{
  "mcpServers": {
    "ctrify": {
      "url": "https://www.ctrify.com/mcp"
    }
  }
}

1. Save the file and open Cursor's MCP settings.
2. Select Connect for CTRify. Cursor should open the CTRify OAuth flow.
3. Sign in to CTRify, review the exact permissions and approve only the access you intend to grant.
4. Use Cursor Agent normally. The available CTRify tools appear in its tools list.

Cursor Agent CLI users can inspect the connection with cursor-agent mcp list, authenticate with cursor-agent mcp login ctrify, and inspect exposed tools with cursor-agent mcp list-tools ctrify. Cursor's UI and commands may change; see the current Cursor MCP documentation.

ChatGPT

1. In ChatGPT on the web, open Settings → Security and login and enable Developer mode.
2. Open ChatGPT Plugins, select the plus button and create a developer-mode app.
3. Choose a remote MCP connection, enter https://www.ctrify.com/mcp, and use OAuth authentication.
4. Complete CTRify login and consent, review the discovered tools, then add CTRify from the conversation's Developer mode tools.

Developer mode availability depends on the ChatGPT account and workspace policy. OpenAI's interface and eligibility can change; verify the current official OpenAI developer-mode documentation.

Other MCP clients

A compatible client needs Streamable HTTP, OAuth protected-resource discovery, authorization code with PKCE S256, and either dynamic client registration or a previously registered public client. Start with:

How an agent should use CTRify

CTRify exposes a bounded catalog of 504 reviewed operations across 25 product modules without exposing arbitrary PHP methods, SQL, cron controls, filesystem paths or internal credentials.

1. Call ctrify_capabilities_search with a specific goal or product module.
2. Call ctrify_capability_get for one exact operation_id and inspect its arguments, permissions, cost behavior and side effects.
3. Call ctrify_action_execute with contract-valid arguments. Every mutation also needs a new, stable idempotency_key.
4. Read the returned state. Queued CTRify workflows remain asynchronous; a successful queue response does not mean the native job has already finished.

Example requests for an agent

CTRify REST API

The REST API is for applications that want predictable HTTPS/JSON routes instead of an MCP conversation.

Open the complete OpenAPI 3.0 contract →

Authenticated examples

List websites:

curl -sS \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  'https://www.ctrify.com/api/ctrify/v1/websites?limit=25'

Search the catalog and read the exact contract before executing anything:

curl -sS \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  'https://www.ctrify.com/api/ctrify/v1/capabilities?query=author&kind=read&limit=10'

curl -sS \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  'https://www.ctrify.com/api/ctrify/v1/capabilities/authors.list'

Execute a read operation:

curl -sS -X POST \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  --data '{"limit":20,"status":"active"}' \
  'https://www.ctrify.com/api/ctrify/v1/operations/authors.list'

Execute a mutation with retry protection:

curl -sS -X POST \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: author-create-20260815-0001' \
  --data '{"firstname":"Ada","lastname":"Example"}' \
  'https://www.ctrify.com/api/ctrify/v1/operations/authors.create'

The JSON body of /operations/{operation_id} contains only that operation's arguments. The caller never sends customer_id; CTRify derives account ownership from the bearer token.

OAuth for REST clients

CTRify uses authorization code OAuth with PKCE S256. It supports public desktop, CLI and web clients without a reusable client secret. Access tokens last one hour; rotating refresh tokens last up to 30 days.

Use a maintained OAuth library where possible. The exact sequence is:

1. Read CTRify's authorization-server metadata.
2. Register the client and its exact redirect URI through dynamic client registration.
3. Create a random PKCE verifier, its SHA-256 base64url challenge and a random state value.
4. Open the authorization URL. The CTRify user signs in, reviews scopes and approves access.
5. Validate the returned state and exchange the one-time code for access and refresh tokens.
6. Send the access token as Authorization: Bearer …. Rotate the refresh token whenever it is used.

1. Register a public client

curl -sS -X POST \
  -H 'Content-Type: application/json' \
  --data '{
    "client_name":"Your CTRify integration",
    "redirect_uris":["http://127.0.0.1:8765/callback"],
    "application_type":"native",
    "grant_types":["authorization_code","refresh_token"],
    "response_types":["code"],
    "token_endpoint_auth_method":"none"
  }' \
  'https://www.ctrify.com/oauth/register'

2. Authorize with PKCE

https://www.ctrify.com/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_URL_ENCODED_REDIRECT_URI
  &scope=account%3Aread%20websites%3Aread%20assets%3Aread%20seo%3Aanalyze
  &state=YOUR_RANDOM_STATE
  &code_challenge=YOUR_BASE64URL_SHA256_CHALLENGE
  &code_challenge_method=S256
  &resource=https%3A%2F%2Fwww.ctrify.com%2Fmcp

3. Exchange the code

curl -sS -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'code=THE_RETURNED_CODE' \
  --data-urlencode 'redirect_uri=http://127.0.0.1:8765/callback' \
  --data-urlencode 'code_verifier=YOUR_ORIGINAL_PKCE_VERIFIER' \
  --data-urlencode 'resource=https://www.ctrify.com/mcp' \
  'https://www.ctrify.com/oauth/token'

4. Rotate a refresh token

curl -sS -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=refresh_token' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'refresh_token=YOUR_CURRENT_REFRESH_TOKEN' \
  --data-urlencode 'resource=https://www.ctrify.com/mcp' \
  'https://www.ctrify.com/oauth/token'

Permissions

When a client omits scope, CTRify grants only account:read websites:read assets:read seo:analyze. Any edit, execution, connection, billing, domain, outreach or destructive permission must be requested explicitly and appears on the consent screen.

Activation and usage billing

MCP and the REST API are available to active CTRify customers regardless of subscription type. Subscription plans continue to determine the normal price at which the customer buys CTRify credits.

• The first approved external connection charges 100 CTRify credits once per customer and activates both MCP and API access.
• Later connections from Cursor, ChatGPT or another client do not create another activation charge for that same CTRify account.
• Each customer receives 100 included external-access points per UTC day.
• After the included allowance, one CTRify credit purchases 1,000 reusable external-access points.
• Small indexed reads normally use very few points. Wider lists, live audits, repeated polling and bulk work scale with the actual work requested or returned.
• Operations that already have a native CTRify price keep that native price and receive only the external orchestration overhead; native work is not priced twice.

Every successful result includes enforced usage metadata. Use the MCP tool ctrify_mcp_usage_get or API route GET /usage to inspect the current allowance, reusable points and external-access credit consumption.

Security model

• CTRify derives the customer from the OAuth token. A caller cannot select or override customer_id.
• Only operations in the reviewed catalog can execute. There is no route for arbitrary api.php methods, SQL, cron callbacks or filesystem access.
• Catalog search is bounded and returns summaries. The exact schema and side effects are returned only for a selected operation.
• Every operation preserves its native ownership, availability, state, price, queue and provider checks.
• All mutations require idempotency protection. Reusing a key with changed arguments is rejected.
• Access tokens and refresh tokens are stored by CTRify only as hashes. Clients must protect the raw values and never put them in URLs, prompts, source control or logs.
• Rate limits, catalog-enumeration controls, usage metering, audit records and grant revocation apply independently of subscription plan.

Responses and errors

REST successes use data and meta. Errors keep a stable machine-readable code and a request ID:

{
  "error": {
    "code": "invalid_arguments",
    "message": "The request or operation arguments are invalid."
  },
  "request_id": "..."
}

Common incorrect tests

Machine-readable resources

Agents, code generators and integration tools should prefer these canonical resources:

Documentation version: 2026-08-15. The live OpenAPI and OAuth metadata are authoritative for route and authorization discovery.