Connect the remote endpoint.
Use a client that supports MCP Streamable HTTP and custom authorization headers. Put the API key in the client's secret or credential manager; do not commit it with the configuration.
{
"mcpServers": {
"latchshot": {
"type": "http",
"url": "https://latchshot.fly.dev/mcp",
"headers": {
"Authorization": "Bearer ls_live_replace_me"
}
}
}
}Configuration keys differ between clients, but the transport contract does not: send authenticated MCP requests to https://latchshot.fly.dev/mcp. The server is stateless and responds with JSON over Streamable HTTP.
The Free plan issues one key per email with 100 successful renders each UTC calendar month. No card or approval queue is required.
Use the install path your client supports.
Every path reaches the same hosted tools. What changes is where the client keeps the key and how much of that path has been checked in the client itself.
VS Code + GitHub Copilot
Password-masked input variable; no key in the install link.
- Install
- One-click definition or
code --add-mcp - Checked
- Definition and secret prompt reviewed; live tool call not claimed.
Cursor
LATCHSHOT_API_KEY from the environment that launches Cursor.
- Install
- One-click deep link or
cursor --add-mcp - Checked
- Configuration accepted by Cursor 3.12.17; live capture not claimed.
Claude Code
LATCHSHOT_API_KEY from the process environment.
- Install
- Public plugin repository and fixed remote endpoint
- Checked
- Remote server connected; an in-client tool invocation is not claimed.
Gemini CLI
Sensitive extension setting; no local executable or always-on prompt.
- Install
- Directly from the public extension repository
- Checked
- Live PNG capture verified through the installed extension.
goose
Custom Streamable HTTP extension with an explicit Authorization header.
- Install
- Manual authenticated remote-extension setup
- Checked
- Live PNG capture verified in goose.
Registry, marketplace, and gallery discovery are separate downstream processes. The recipes state the current acceptance boundary for each client and do not imply placement that has not happened.
Expose two tools, not a remote browser.
The narrow tool surface keeps capture work inspectable. There is no tool for arbitrary JavaScript, cookies, sessions, payment, or plan changes.
| Tool | What it does | Important inputs |
|---|---|---|
capture_page | Returns one public page as an inline image or PDF resource plus render diagnostics. | url, format, viewport, full page, dark mode, delay, paper, landscape |
get_usage | Returns the current plan, successful renders, remaining quota, reset time, and existing upgrade-request state. | None |
A representative capture_page call asks for only the artifact controls the job needs:
{
"url": "https://example.com",
"format": "png",
"width": 1440,
"height": 900,
"darkMode": false,
"delayMs": 250
}Keep the artifact inside the tool result.
The client does not need a second download URL. Successful captures return a compact JSON diagnostic summary followed by the artifact in the same MCP result.
| Requested format | MCP content | Diagnostic evidence |
|---|---|---|
png or jpeg | Inline image content with its MIME type and base64 data | Bytes, render time, navigation, fonts, scripts, quota remaining and reset |
pdf | Embedded resource at latchshot://capture/document.pdf | The same render and quota fields |
| Failed capture | Structured tool error with the HTTP status and public error code | No successful-render quota consumed |
The public production verification used the official MCP TypeScript SDK to initialize the server, list both tools, read usage, and receive a 16,001-byte inline PNG from example.com. That is a checked integration path, not a customer claim or SLA.
Give the agent a bounded capability.
capture_page reaches the open web, so the server treats the URL as untrusted input and applies the same guardrails as the REST API.
- Targets must be public HTTP or HTTPS pages on ports 80 or 443.
- Private, loopback, link-local, special-use, metadata-network, and mixed public/private DNS destinations are rejected.
- Viewport, full-page height, extra delay, browser deadline, request rate, concurrency, and queue depth are bounded.
- Cookies, login sessions, arbitrary scripts, CAPTCHA solving, proxy rotation, and anti-bot bypass are not supported.
- The transport requires Bearer authentication, limits JSON-RPC bodies to 64 KB, validates the production host, and stores no MCP session state.
The server annotation marks capture as an open-world, non-destructive operation. Your application should still require user intent before an agent captures an unfamiliar public URL.
Choose hosted MCP for artifact jobs.
A hosted capture tool and a local browser server solve different problems. Pick the smaller operating model that satisfies the workflow.
| Decision | Hosted Latchshot MCP | Browser running near the client |
|---|---|---|
| Desired result | One screenshot or PDF artifact | Interactive browsing or a multi-step session |
| Browser operations | Hosted and quota-metered | Installed, updated, and isolated by you |
| Reachable pages | Public HTTP/HTTPS only | Can reach environments you explicitly expose to it |
| Control surface | Bounded capture options | Potentially arbitrary navigation and page actions |
| Artifact delivery | Inline in the MCP result | Depends on the server and client |
Keep the browser local for authenticated apps, private previews, clicks, form workflows, cookies, or custom scripts. Use Latchshot when the agent starts with a public URL and must finish with a screenshot or PDF.
Meter successful artifacts, not attempts.
The Free plan renews to 100 successful renders each UTC calendar month. Launch is $19 for 2,500, Build is $49 for 12,000, and Scale is $149 for 50,000. Automatic overages are disabled, and failed direct renders do not consume quota.
The server contract is published as io.github.BaiqingL/latchshot 1.0.2 in the official MCP Registry. Read the public metadata repository for client-specific setup notes and the benchmark method before using capture in a production decision.
Connect the first capture.
Create a Free-plan key, store it with the client, then ask for a fixed-size PNG of one public page.