# Punch List by SMB Team · Full Reference

> Website feedback for SMB Team's clients. Open a review link, click anything on your new website, and leave a note. No account, nothing to install.

## What is Punch List?

Punch List (https://feedback.smbteam.com) is the feedback tool SMB Team (https://smbteam.com), a web agency, uses while it builds websites for its clients. Instead of collecting feedback by email, screenshots and phone calls, SMB Team sends the client a review link. The client's new website opens in the browser with a comment layer on top. Clicking anything pins a note to that exact spot, and every note lands on the team's punch list, the list of fixes to make before launch.

Each note carries a status the client can watch change: open, in progress, resolved. Replies keep the conversation on the note it is about.

## Who uses it

- **Clients** open the link they were sent. There is no account to create, no password, and nothing to install, on a computer or a phone. A display name is all they give, and it stays in their browser.
- **SMB Team staff** sign in with an emailed link (no password) to create review links, keep the ones they want in a dashboard, choose who can edit or only view, lock a link with a password, and set an expiry.
- **AI coding agents** working for SMB Team connect to a review link over MCP and work its comments as a queue, with every status change visible to the client.

## Features

### Comments
Pin a comment to any spot on the page, with threaded replies. Each comment carries one of five statuses (open, in_progress, resolved, approved, dismissed) and one of four priorities (low, medium, high, urgent). It can be assigned to a person or an AI agent, can @mention anyone already working on that page, and can hold image attachments. Every comment also records the browser, operating system and viewport width it was written on, so a problem that only shows at one width says so.

### Suggested edits
Select real text on the page and write the exact replacement rather than describing it. It is shown as a diff, and the same diff travels into the Markdown export and into an agent's view of the thread.

### Drawing and capture
Pen, highlight, line, arrow, rectangle, circle, text label, area capture, eraser, element inspector and measure, each on a single-key shortcut. Ruler guides are shared with everyone on the link.

### Responsive review
Preview a page at desktop, tablet or mobile width. Marks bind to the element they were left on, by CSS selector with a text fingerprint as a fallback, so a comment stays on the right element when the layout reflows or a single-page app re-renders.

### PDFs and images
A PDF or an image can be reviewed like a page, by link or by upload (up to 25MB: PDF, PNG, JPEG, GIF, WebP or AVIF). Text inside a PDF stays selectable.

### Working together
Live cursors for everyone on a link, and peer-to-peer voice and video with nothing to install.

### Multi-page projects
One link can hold up to 50 pages, switched through a tab strip.

### Export and integrations
Copy or download every comment, reply and suggested edit as Markdown, or export the annotated page as a PNG. Comments can also be sent one way to Slack, Microsoft Teams, Discord, a JSON webhook, Linear, GitHub, Jira or Trello.

### Retention
A review link is deleted 90 days after it was last opened, and any view or comment resets that clock, so a review in use never expires. Links a team member has saved to their dashboard are kept until they delete them or set an expiry. Uploaded files follow the same 90-day clock.

## AI Coding Agent Integration (MCP)

Every share link is a remote MCP server (Streamable HTTP) at the link plus /mcp. Nothing is installed and there is no API key: the link is the credential.

    claude mcp add --transport http marklayer https://feedback.smbteam.com/s/abc123/mcp

Add ?agent=<name> to set the name reviewers see on the agent's work (default: agent). A password-protected link takes the password as a header: Authorization: Bearer <password>. The endpoint is bound to its link, so it serves every tool below except marklayer_connect_room.

Read:
- marklayer_read_page: the page's headings, text, links and controls, each with its selector
- marklayer_room_info: the URL under review, its viewport and timestamps
- marklayer_list_annotations: everything left on the page, filtered by status
- marklayer_get_annotation: one annotation in full, with its reply thread and attached images
- marklayer_get_feedback: counts by status, open items, checklist progress, poll tallies

Work:
- marklayer_watch_annotations: wait for new comments, and for anything assigned to the agent by name
- marklayer_acknowledge: mark in_progress, so the reviewer sees it was picked up
- marklayer_resolve: close it and post what changed as a reply
- marklayer_dismiss: decline it, with a required reason
- marklayer_reply: ask a question without moving the status

Review:
- marklayer_create_annotation: leave its own comment, pinned to an element
- marklayer_suggest_edit: propose exact replacement text, shown as a diff

Hand off:
- marklayer_share_preview: open a review link on a preview URL and return it
- marklayer_set_next_steps: publish a checklist of planned changes
- marklayer_complete_next_step: tick a step off
- marklayer_ask: put a multiple-choice question to the reviewers

approved is the one status an agent never sets. It is the person who asked for the change confirming the fix, so a resolved thread going back to open means they disagreed.

In a browser whose agent supports WebMCP, the same actions are exposed on a share link through document.modelContext.

Per-client setup (Claude Code, Claude, Codex, Cursor, VS Code): https://feedback.smbteam.com/mcp.md

## Share API

A public HTTP API creates and reads share links. The id is caller-supplied and is the access token for the link, so generate it with a crypto-strength RNG (nanoid, crypto.randomUUID()) and give it only to the people meant to see the page.

    POST https://feedback.smbteam.com/api/{id}
    Content-Type: application/json

    { "ops": [], "url": "https://example.com/page-1", "width": 1440, "expires_in": 2592000 }

- ops (required): annotation operations. Pass [] for a blank page the reviewer will mark up.
- url: the webpage the link opens and overlays.
- width: reference viewport width in CSS pixels. 1440 is a safe default.
- expires_in: seconds until cleanup, at most 2592000 (30 days). Omit it and the link is deleted 90 days after its last access instead.

Share links:

    https://feedback.smbteam.com/s/{id}            # editable
    https://feedback.smbteam.com/s/{id}?readonly=1 # view-only

For one link holding several pages as tabs, POST /api/p/{id} with { "pageIds": [...] } (max 50). A password-protected link answers 401 unless the request sends Authorization: Bearer <password>.

Spec: https://feedback.smbteam.com/api/openapi.json (also listed in https://feedback.smbteam.com/.well-known/api-catalog).

## What Punch List does not do

It captures no console or network logs, and integrations are one way out: a ticket's later state does not come back. It never edits the website's source; changes are made by SMB Team, or by an agent with its own tools, and reported back on the link.

## Links

- Website: https://feedback.smbteam.com
- Help for reviewers: https://feedback.smbteam.com/help
- MCP setup for coding agents: https://feedback.smbteam.com/mcp
- Privacy Policy: https://feedback.smbteam.com/privacy
- SMB Team: https://smbteam.com

## Attribution

Punch List is built on MarkLayer by Dean Rusin (https://github.com/thevrus/MarkLayer), open source under the Apache-2.0 licence. SMB Team is not affiliated with, endorsed by, or sponsored by the MarkLayer project.

## Contact

Email: support@smbteam.com