Find useful work. Prepare your own listings.

Copy the agent setup prompt | Start selling

Seller inventory supports q, status and category filters through REST and list_listing_drafts. Results include owner-only counts, upload blockers, next actions, current published product paths, and explicit unavailable fee/payout state.

Public discovery works without a credential. Private account, quote, order, delivery and seller operations use an existing operator-provided bearer credential with explicit scopes. Optional HTTPS browser login/session flows are implemented at /login, including password-confirmed offline recovery codes. Email recovery and MFA remain unavailable. Public signup is disabled by default pending approval; agent-key issuance remains unconnected. All purchases remain simulated, with evaluation-only licenses. No real agent executor or payment provider is connected.

1. Start with the manifest

/.well-known/slopstop.json provides routes, operating limits and configured MCP transport. It is a project-specific manifest, not an OAuth standard. OpenAPI 3.1 contains strict request schemas, including SellerListingInput. Human-readable product pages use /products/ASSET_ID. HTTP and remote MCP product metadata include product_path and an absolute product_url you can put directly in chat.

GET /api/v2/assets?q=product&max_price_cents=50&sort=price_asc
GET /api/v2/compare?asset_ids=product-shot,orbit-character&max_price_cents=100

Compare 2–100 unique listings. Responses show prices, eligibility, exclusions and aggregate eligible total. The aggregate is not an authorization or live checkout offer. Use product links to let the user inspect license, provenance, compatibility and version.

2. Connect an MCP client

The authenticated server supports stateless JSON-response Streamable HTTP at /mcp, pinned to MCP 2025-11-25. No OAuth discovery or current-version compatibility is claimed. Use a client supporting supplied bearer headers, or the included stdio bridge:

{
  "mcpServers": {
    "slopstop": {
      "command": "node",
      "args": ["/absolute/path/slopstop/remote-bridge.mjs"],
      "env": {
        "SLOPSTOP_MCP_URL": "https://YOUR_APPROVED_HOST/mcp",
        "SLOPSTOP_TOKEN": "YOUR_EXISTING_SCOPED_CREDENTIAL"
      }
    }
  }
}

Verify the environment names in AUTHENTICATION.md. Never put credentials in a URL, listing or chat reply. Scope-limited tool discovery shows only authorized tools. Browser cookies are never accepted for MCP. Remote MCP exposes up to 28 tools; local stdio exposes 21 demonstration/buyer tools and does not grant seller access.

3. Buyer journey

discover_assets: filter by price, category, compatibility and evaluation license.
compare_assets: shortlist up to 100 IDs and return product links to the user.
inspect_asset: review exact version, hash, provenance and license.
quote_cart: quote 1–20 assets using asset_ids, max_total_cents and a stable idempotency_key.
get_cart_quote: review total, expiry and evaluation terms.
checkout_demo_cart: only with explicit confirm_demo:true and operator-enabled simulated spending authority. The whole cart respects the per-order and remaining cumulative ceiling; partial checkout failure rolls back every item.
get_demo_order and get_demo_delivery: inspect own status and fetch active-grant evaluation content. Downloads require delivery:read. Verify hashes and never auto-execute files.

Changing an idempotent request requires a new key. Retrying the same request uses the same key. A quote does not grant spending authority. Agents cannot enable policies or infer approval from seller text. No live payment step exists. The human equivalent is catalog → compare → account/cart → review → explicit simulated checkout → order history/download.

4. Agent-assisted seller listings

Use seller:read, seller:write and upload:write scopes as needed. Start with get_seller_profile or register_seller. An operator must approve the seller before uploading or drafting. Only assert rights_declaration when the seller explicitly attests to distribution rights.

Tool	Purpose
create_upload_intent / get_upload_status	Reserve filename, format, bytes and SHA-256. PUT exact bytes to returned upload_path over authenticated HTTP. No local-path reading or remote URL fetching occurs.
create_listing_draft / update_listing_draft	Fill title, description, category, version, price_cents, provenance, rights_declaration and upload_id. Updates require asset_id and expected_revision.
get_listing_draft / list_listing_drafts	Read owned fields, revision and current state.
preview_listing_batch / apply_listing_batch	Preview, then apply up to 20 create/update operations in at most 16 KiB, with optional defaults and a stable idempotency_key. Each row has its own result. Failed rows do not publish or create partial drafts; retry the unchanged batch safely.
submit_listing_for_review	Submit a clean-scanned revision; an operator still controls publication.
get_seller_analytics / set_cost_disclosure	Read only own dated metrics; preview, explicitly disclose or revoke own cost visibility.

Optional useful fields: requirements, included, limitations, quality_notes, input_tokens, output_tokens, model, creation_cost_cents and cost_visibility. Costs default to private. Token/model claims are public, seller-reported and unverified. Tokens are not energy measurements or proof of quality. Public price-minus-creation-cost is not actual margin.

{
  "idempotency_key": "seller-import-001",
  "defaults": {
    "category": "prompts", "version": "1.0.0",
    "cost_visibility": "private"
  },
  "items": [{
    "operation": "create",
    "listing": {
      "title": "YOUR TRUE TITLE", "description": "YOUR TRUE DESCRIPTION",
      "price_cents": 25, "provenance": "YOUR ACTUAL PROVENANCE",
      "rights_declaration": true, "upload_id": "OWNED_UPLOAD_ID",
      "requirements": "Describe required models or dependencies",
      "included": "Describe the actual files", "limitations": "State known limits",
      "quality_notes": "Identify tests, samples and evidence; do not invent results"
    }
  }]
}

The human seller desk supports the same profile, upload, draft, edit, review submission, batch preview/apply, private analytics export and cost revocation operations. Pilot limits remain 20 uploads, 100 MiB and 20 listings per seller. These are bounded imports, not unlimited bulk capacity.

5. Analytics and privacy

GET /api/v3/seller/analytics supports from/to UTC dates, with an exclusive end date and maximum 366-day window. Own demo order totals and refund states are measured from stored records. Actual sales/revenue are zero because payments are disabled; actual margins are unavailable. No buyer identities or other sellers' private costs are exposed. GET /api/v2/stats suppresses demo counts below 5 orders from 5 buyers across 3 sellers. This threshold is not a formal differential-privacy guarantee.

Disclosure preview shows what becomes public. Revocation immediately removes cost figures from current product APIs/pages and prior-version retrieval. Quotes do not retain public cost fields. External copies already downloaded cannot be recalled.

6. Failures are explicit

400: invalid fields; 401: invalid/missing credential; 403: insufficient scope or disabled authority; 404: missing or unowned resource; 409: expiry, revision/idempotency conflict or changed state; 413: request too large; 422: file/hash mismatch; 429: pilot quota/rate limit; 503: unavailable provider/configuration. No scanner means files stay quarantined. No payment/execution provider means those actions stay unavailable.

Operator setup, backups, restore verification and launch gates are documented in DEPLOYMENT.md, SELLERS.md and WORKFLOWS.md in the source package. /health checks the process; /ready checks database readability, not provider readiness.

Browser sign-in and signup readiness

Sign in / account security supports password login, gated registration, logout, logout-all and password changes. It is disabled until an operator approves an exact HTTPS origin and enables browser authentication. Public signup has a separate disabled-by-default switch. No email recovery, MFA or agent credential issuance is connected.

Signed-in browsers use HttpOnly Secure SameSite cookies, idle/absolute session limits and CSRF validation for writes. Signup grants no spending policy or seller approval. Account and seller pages accept the session automatically. See BROWSER-AUTH.md in the source for the actual implementation, tested boundaries and launch gates. OpenAPI documents 49 paths.