Does Punch List have an MCP server?

Yes. Every share link answers MCP over Streamable HTTP at its own address plus /mcp, with 17 tools. A client that supports remote servers connects with one command and nothing installed.

Do I need an API key or an account to connect an agent?

No. A Punch List share link is its own access token: whoever holds the link can open it, and the MCP endpoint follows the same rule. There is no OAuth step and no key to paste. If the link is locked with a password, send it as a header (Authorization: Bearer ; in Claude Code, --header).

Which coding agents work with Punch List?

Any MCP client that can reach a remote server. This page has setup for Claude Code, Claude, Codex, Cursor and VS Code. Windsurf, Zed, Cline, Gemini CLI and anything else that takes a remote MCP URL work the same way.

Can the agent change the website that was reviewed?

Not through Punch List. Punch List never touches the page’s source. The agent reads the comments, edits your code with its own tools, and reports back on the link. What it can change in Punch List is the review itself: statuses, replies, its own comments, suggested edits, a checklist and polls.

Why does each link need its own connection?

The endpoint is bound to one share link, so there is nothing to install or update, and an agent can only see the review it was given. A new link means a new connection.

How do I know the connection worked?

Seeing the server listed is not proof. Ask the agent to call marklayer_room_info: it should answer with the URL the link reviews. A 401 means the link is locked, and it wants the password. If the agent says it has no Punch List tools, the session predates the config; start a new one.

Give the review to your agent.

Every Punch List link is an MCP server. Your coding agent reads what reviewers marked on the page, fixes it, and ticks each comment off while they watch.

Terminal

claude mcp add --transport http \
  marklayer https://feedback.smbteam.com/s/<id>/mcp

Run /mcp and check marklayer is listed. A session opened before this will not see the tools; start a new one.

Settings → Connectors → Add custom connector

https://feedback.smbteam.com/s/<id>/mcp

Name it Punch List and paste the address. There is no sign-in to approve: the link is the credential. Start a new chat.

Terminal

codex mcp add marklayer \
  --url https://feedback.smbteam.com/s/<id>/mcp?agent=codex

If the current session does not list the tools, start a new one.

~/.cursor/mcp.json

{
  "mcpServers": {
    "marklayer": {
      "url": "https://feedback.smbteam.com/s/<id>/mcp?agent=cursor"
    }
  }
}

Keep any servers already in the file. Open a new chat so Cursor reloads its tool list.

.vscode/mcp.json

{
  "servers": {
    "marklayer": {
      "type": "http",
      "url": "https://feedback.smbteam.com/s/<id>/mcp?agent=copilot"
    }
  }
}

The top-level key is servers, not mcpServers, and the transport is named.

The address is any share link plus /mcp; the Details panel on the link shows it filled in. Add?agent=cursor, or any name, so reviewers see who picked their comment up.

One comment, start to finish. The reviewer never leaves the page. The agent never asks what was clicked.

Priya · hero button

This still says “Submit”. It should say “Start trial” like the pricing page.

buttonmain > section.hero button.cta

Open
In progress · claude
Resolved

claude · reply

Renamed the CTA in Hero.tsx:42 and the matching test. Deployed to the preview.

watch_annotationsnew comment 3, with target selector and markup
acknowledgepin flips to in progress on Priya’s screen
edits src/Hero.tsx, runs the tests
resolvesummary posted as the reply above
watch_annotationswaiting for the next one

A worked example. The reviewer, the page and the file are made up; the calls are the real ones.

It knows what you clicked. Each comment arrives with the element it was left on: a selector, a text fingerprint, a snapshot, and on a React, Vue or Svelte page the component chain.
You watch it work. Seen, replied, done. Every status change lands on the pin while the thread is still open.
Wording fixes come back exact. A typo or a better sentence comes back as a diff to accept, never prose describing one.

Any MCP client.

Claude Code
Cursor
Codex
Copilot
Windsurf
Cline
Zed
Gemini

17 tools. Everything the room can tell an agent, and everything an agent can do back.

Read

marklayer_read_page: The page's headings, text, links and controls, each with the selector that finds it.
marklayer_room_info: The URL under review, the viewport it was annotated at, and timestamps.
marklayer_list_annotations: Everything left on the page, filtered by status.
marklayer_get_annotation: One annotation in full, with its reply thread and any attached images.
marklayer_get_feedback: One read of the room: counts by status, open items, checklist progress, poll tallies.

Work

marklayer_watch_annotations: Wait for new comments, and for anything assigned to the agent by name.
marklayer_acknowledge: Flip a comment to in progress so the reviewer sees it was picked up.
marklayer_resolve: Close a comment and post what changed as a reply.
marklayer_dismiss: Decline a comment. The reason is required, and the reviewer reads it.
marklayer_reply: Ask a question on the thread without moving its status.

Review

marklayer_create_annotation: Leave its own comment, pinned to an element, one per finding.
marklayer_suggest_edit: Propose exact replacement text, shown to the reviewer as a diff to accept.

Hand off

marklayer_share_preview: Open a review room on a preview URL and return the link to send a human.
marklayer_set_next_steps: Publish a checklist of planned changes, each tied to the comments it answers.
marklayer_complete_next_step: Tick a step off while the reviewers watch.
marklayer_ask: Put a multiple-choice question to the room and read the votes back.

Not on a link’s endpoint

marklayer_connect_room: Switch to another share link by URL or id. A link’s own endpoint is bound to that link, so it leaves this one out.

Inside a board, the agent does more than fix. It reports back where the reviewers already are.

The agent can post its plan as a checklist that ticks off as the work lands, and when it needs a decision rather than an opinion, it can ask the board to vote. Starting a new board stays with the SMB Team: an agent carries no sign-in, so share_preview answers with a refusal. Start the board yourself and give the agent its link.

Agents forget a tool exists unless something reminds them. Paste this into CLAUDE.md orAGENTS.md and yours will reach for Punch List on its own:

CLAUDE.md / AGENTS.md

## Visual review

When I share a feedback.smbteam.com/s/... link, connect to it over MCP and work the
annotations: acknowledge each one before you start, resolve it with a one-line
summary of what changed, and dismiss it with a reason if you cannot act on it.

Or just say it:

Watch my Punch List comments. For each one, acknowledge it, make the fix, then resolve it with a one-line summary of what changed.

Read the page on my Punch List link and review it for broken copy, accessibility gaps and layout bugs. Leave one comment per finding, and use a suggested edit for any exact text fix.

Pointing an agent at the setup itself? Plain-text instructions for agents.

Frequently asked questions

Does Punch List have an MCP server?: Yes. Every share link answers MCP over Streamable HTTP at its own address plus /mcp, with 17 tools. A client that supports remote servers connects with one command and nothing installed.
Do I need an API key or an account to connect an agent?: No. A Punch List share link is its own access token: whoever holds the link can open it, and the MCP endpoint follows the same rule. There is no OAuth step and no key to paste. If the link is locked with a password, send it as a header (Authorization: Bearer <password>; in Claude Code, --header).
Which coding agents work with Punch List?: Any MCP client that can reach a remote server. This page has setup for Claude Code, Claude, Codex, Cursor and VS Code. Windsurf, Zed, Cline, Gemini CLI and anything else that takes a remote MCP URL work the same way.
Can the agent change the website that was reviewed?: Not through Punch List. Punch List never touches the page’s source. The agent reads the comments, edits your code with its own tools, and reports back on the link. What it can change in Punch List is the review itself: statuses, replies, its own comments, suggested edits, a checklist and polls.
Why does each link need its own connection?: The endpoint is bound to one share link, so there is nothing to install or update, and an agent can only see the review it was given. A new link means a new connection.
How do I know the connection worked?: Seeing the server listed is not proof. Ask the agent to call marklayer_room_info: it should answer with the URL the link reviews. A 401 means the link is locked, and it wants the password. If the agent says it has no Punch List tools, the session predates the config; start a new one.

No account needed for anyone on the link.

Annotate a page · How reviewers leave feedback