# Build ATXP Agent Web Apps

Agent-facing web apps need reliable authentication between MCP tools and browsers. This skill provides templates for ATXP auth, cookie setup, Express APIs, and directory publishing.

## Install

```bash
npx skillstore add napoleond/clawdirect-dev
```

## Metadata

- Status: approved
- Slug: napoleond-clawdirect-dev
- Skillstore revision: r1
- Version status: missing
- Tree hash: 16a6093e529869d9784b1437702856b7e22a91237a974a1d8fed0e9d573a7596
- Author: napoleond
- GitHub username: napoleond
- License: MIT
- Repository: https://github.com/napoleond/clawdirect/tree/main/skills/clawdirect-dev/
- Ref: 62e2a730c5cd74eab4c7164309d810de660fcea3
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: scripts, external\_commands, network, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/napoleond-clawdirect-dev
- Manifest: https://skillstore.pages.dev/api/skills/napoleond-clawdirect-dev/manifest

## Capabilities

- Scaffold Node.js and TypeScript projects for ATXP web apps.
- Show Express cookie authentication linked to MCP tools.
- Define @longrun/turtle MCP tools with optional ATXP payments.
- Provide SQLite patterns for storing agent account cookies.
- Create an agent skill template for browser and MCP workflows.
- Document ClawDirect directory add, edit, and delete commands.

## Use Cases

- Build an Agent Login Flow: Create a browser authentication bridge for agents that already use MCP tools.
- Add Paid MCP Actions: Design MCP tools that require ATXP authentication and optional payment before execution.
- Publish an Agent Directory Entry: Prepare a ClawDirect listing so agents can discover and call a web service.

## Prompt Templates

### Plan My ATXP App

```
Use clawdirect-dev to outline an ATXP-enabled web app for my service. Include the MCP tools, browser flow, and storage choices.
```

### Create Auth Middleware

```
Use clawdirect-dev to design cookie authentication for my Express API. Explain the files, routes, and validation steps I need.
```

### Add a Paid Agent Action

```
Use clawdirect-dev to add a paid MCP action to my app. Include authentication, payment handling, and clear user-facing behavior.
```

### Review Production Readiness

```
Use clawdirect-dev to review my planned ATXP browser authentication flow. Identify deployment, logging, cookie, and payment risks.
```

## Limitations

- The examples need security hardening before production use.
- The guidance assumes Node.js, Express, SQLite, and ATXP.
- The skill does not generate a complete hosted application by itself.
- Some example commands contact external services and may require payment.

## Best Practices

- Treat generated cookies as bearer credentials and protect them like secrets.
- Require explicit approval before running commands that install packages or spend money.
- Replace placeholders with project-specific names, domains, costs, and retention rules.

## Anti Patterns

- Do not use query strings for long-lived authentication tokens in production.
- Do not store raw bearer cookies without expiration, hashing, or revocation.
- Do not publish paid MCP tools without clear cost and confirmation behavior.

## Security Audit

- Audited at: 2026-07-05T20:45:42.846\+00:00
- Summary: Most static hits are Markdown fences, TypeScript template literals, configuration examples, or reference links rather than hidden execution. The review confirms some explicit setup and npx network commands, plus a high-risk auth design that passes bearer cookies through URLs. The skill should not be treated as production-ready until cookie transport and token storage are hardened.

## Stats

- Views: 178
- Downloads: 8
- Favorites: 0
- Popularity score: 0