SDK and MCP server

• @exysh/sdk: a typed client for the API v1, plus a verifier for webhook signatures.
• @exysh/mcp: an MCP server that gives AI agents (Claude Code, Claude Desktop, Cursor and any other MCP client) tools to manage your servers, orders, invoices and support tickets.

​

TypeScript SDK

npm install @exysh/sdk

import { createClient, retryAfterSeconds } from "@exysh/sdk"

const exy = createClient(process.env.EXY_API_TOKEN!)

const { data, error, response } = await exy.GET("/v1/servers", {
  params: { query: { limit: 20 } },
})
if (error) {
  if (response.status === 429) console.log(`Rate limited, retry in ${retryAfterSeconds(response)}s`)
  throw new Error(`exy.sh API ${response.status}: ${JSON.stringify(error)}`)
}
for (const server of data.data) console.log(server.id, server.name, server.status)

• Typed: every path, parameter, request body and response is typed. The paths, operations and webhooks types are exported too.
• No exceptions on HTTP errors: a call resolves to { data, error, response } and never throws on an error status.
• Options: the client is built on openapi-fetch. The second argument of createClient accepts its options, for example baseUrl or a custom fetch.
• Paid calls: POST /v1/orders, POST /v1/servers/{id}/renew and POST /v1/servers/{id}/upgrades take an Idempotency-Key header. Generate one key per purchase and reuse it when you retry; see Order and renew servers.
• Webhooks: verifyWebhook checks the signature and the timestamp of a delivery. Pass the raw body before parsing it; see Webhooks.

​

MCP server

claude mcp add exy --env EXY_API_TOKEN=exy_… -- npx -y @exysh/mcp

{
  "mcpServers": {
    "exy": {
      "command": "npx",
      "args": ["-y", "@exysh/mcp"],
      "env": { "EXY_API_TOKEN": "exy_…" }
    }
  }
}

​

Scopes and tools

​

What the server guarantees

• Confirmation: delete_server and reinstall_server require confirmName, like the API. The server never fills in the name itself. Whether your client asks you before running a destructive tool is up to the client.
• Paid calls: order_server and renew_server require an idempotencyKey from the caller. The server never retries a call and never makes up a key. After a timeout, call again with the same key: the API returns the first result and charges once.
• Errors: an error comes back with the HTTP status and the API’s code and message; a 429 also carries retryAfterSeconds.
• Token: the server logs nothing and never returns the token in a result.