For AI agents

Use Abbox from a coding agent

Abbox has a read-only MCP server at https://api.abbox.com/mcp (Streamable HTTP). Sign in with an access token someone on the team creates on Connect your coding agent; it reads that workspace’s projects and nothing else.

claude mcp add --transport http abbox https://api.abbox.com/mcp --header "Authorization: Bearer abx_…"

• get_page_context(project, path): one page’s code (buttons, forms, files and lines, analytics events, backend calls and their answers), PostHog usage, Google PageSpeed, search checks and recent changes. Call it before changing a page and after deploying.
• what_changed(project, since?): recent merges, page by page, and how views of those pages moved.
• find_pages(project, problem): pages with search issues, untracked buttons, errors, no traffic, slow, or low accessibility.
• list_projects(): the workspace’s projects and what’s connected for each.

The server is described in the MCP registry format at /.well-known/mcp.json.

Answers are short digests. Every number says where it comes from (the code at a commit, PostHog for a period, Google PageSpeed at a time), missing sources say where to connect them, and each answer links back to the page in Abbox. Abbox has no Google Analytics, Search Console or Sentry data, so don’t ask it for those.

What to tell your team

• GitHub, through the Abbox Connect app. Reads: the code of the repositories you select, at each commit Abbox analyzes. Writes: only when someone in your workspace asks: Fix it, a design change, or Add the inspector. Never: push to an existing branch, including main.
• PostHog (optional). Reads: totals for the last 60 days: event and page-view counts per page path, how they change over time, which pages visitors move between. Writes nothing. Never: session recordings.
• The Abbox inspector on your website (optional). Reads: only while your site is open inside the Abbox viewer, in that browser tab: the page address and title. Writes: highlights elements and applies temporary styles inside the viewer. Never: run for your visitors: outside the Abbox viewer it only waits for a message from the viewer and does nothing else.
• Your coding agents (optional). Reads: what Abbox already shows you: each page's code map, PostHog totals, Google PageSpeed results, search checks and recent changes, as short summaries. Writes nothing. Never: change anything in Abbox, GitHub, PostHog or your website.
• Backend and database. Abbox never calls them to change anything. In previews, the inspector mocks API answers and blocks requests that would change data.

Verify the inspector package

Download the exact version the project pins and read it. It has two dependencies (@babel/core, @babel/types) and no install scripts.

V=$(node -p "require('./package.json').devDependencies['@abbox/inspector']")
mkdir -p /tmp/abbox-inspector && cd /tmp/abbox-inspector
npm pack @abbox/inspector@$V && tar -xzf abbox-inspector-*.tgz
node -p "require('./package/package.json').scripts"          # no preinstall/install/postinstall
grep -rn "fetch(\|XMLHttpRequest\|sendBeacon\|WebSocket" package/dist | grep -v ".d.ts"
grep -rn "postMessage(" package/dist | grep -v ".d.ts"      # never with targetOrigin "*"

Expect fetch and XMLHttpRequest only where previews wrap them to mock answers and block writes, and no requests of its own to any server.

Verify what the CLI changes

npx @abbox/cli@latest init --mode production --dry-run   # lists every file it would touch
npx @abbox/cli@latest init --mode production && git diff --stat
npx @abbox/cli doctor
npx @abbox/cli@latest uninstall --dry-run   # what removing it takes out; then run without --dry-run
git status                                  # after uninstall: back to the code before init

Expected: next.config wrapped with withAbboxInspector, one component in each root layout, a pinned dev dependency, a build script, and .abbox/install.json. Nothing outside the app folder.

Verify a deployed site

curl -sI https://your-site.example | grep -i "content-security-policy\|x-frame-options"
curl -s https://your-site.example | grep -c "data-abbox-src"

With the inspector: frame-ancestors 'self' https://viewer.abbox.com https://www.abbox.com https://abbox.com and a non-zero count. Built with ABBOX_INSPECTOR=0: neither.

Verify account access

• GitHub: Settings → Applications → Abbox Connect → Configure shows the permissions and the selected repositories. Any branch Abbox created starts with abbox/: git ls-remote --heads origin 'abbox/*'.
• PostHog: the consent screen lists query:read and project:read; the authorized app shows under your PostHog account settings.
• Deletion: Delete project and Delete account remove everything listed on Security and data access.

When something goes wrong

Abbox answers errors in plain words with the next step. The common ones:

Known limits

• The page address the inspector sends to the viewer currently includes its query string.
• WebSocket messages are not blocked while a hidden state is previewed.
• Inspector builds use webpack and an extra Babel pass, so they are slower.

Report anything that doesn’t match this page through contact.