agentmods.dev

sideshift-setup

sideshift-setup is a skill for Claude Code, Codex from SideShiftApp/sideshift-mcp-server. It costs 42 tokens per session (540 once invoked), scanned A, original, Apache-2.0.

Setup instructions for connecting SideShift’s hosted MCP server to an AI host such as ChatGPT, Codex, Claude, or Cursor. OAuth is a browser-based sign-in process that grants approved access without sharing a password or token in chat.

In plain words
What is it for?
They help install or enable the connection, sign in, check the selected company and permissions with whoami, and troubleshoot missing authorization.
Why use it?
They reduce setup and authorization mistakes, especially selecting the wrong company or exposing credentials.

Skill for Claude CodeCodex

Part of the sideshift plugin — 2 skills, 1 command, 1 MCP server shipped together

not rated 0 changed today A scan 42 tokens original Apache-2.0
View the source file SideShiftApp/sideshift-mcp-server
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/sideshiftapp/sideshift-mcp-server/sideshift-setup
Any agent
npx skills add SideShiftApp/sideshift-mcp-server --skill sideshift-setup
Clone the repo
git clone --depth 1 https://github.com/SideShiftApp/sideshift-mcp-server

Made for: Claude Code, Codex.

Or install sideshift, the plugin that ships this one along with the rest of its 2 skills, 1 command, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sideshift-setup

README.md
[![agentmods](https://agentmods.dev/badge/skills/sideshiftapp/sideshift-mcp-server/sideshift-setup.svg)](https://agentmods.dev/skills/sideshiftapp/sideshift-mcp-server/sideshift-setup)
Your own site
<a href="https://agentmods.dev/skills/sideshiftapp/sideshift-mcp-server/sideshift-setup"><img src="https://agentmods.dev/badge/skills/sideshiftapp/sideshift-mcp-server/sideshift-setup.svg" alt="Measured on agentmods" height="20"></a>
Per session 42 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 540 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00042 $0.00540
Opus 5 $0.00021 $0.00270
Sonnet 5 $0.00008 $0.00108
Haiku 4.5 $0.00004 $0.00054

Measured today against content hash 51018930a0aa, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

sideshift-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/sideshift-setup/SKILL.md · 43 lines

How it starts

The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SideShift setup

SideShift uses one hosted Streamable HTTP MCP server and browser-based OAuth. The canonical endpoint is https://app.sideshift.app/api/mcp.

Connect

  1. Confirm the SideShift plugin or MCP connection is enabled in the current host.
  2. Start the host's connection or authorization flow; do not ask the user to create an API key.
  3. Complete SideShift sign-in in the browser, select the intended company, review the requested scopes, and approve only if the company and permissions are correct.
  4. Call whoami after authorization and report the connected company and granted scopes.
  5. If the company matches the user’s stated target, continue the authorized work. Ask which company they intend only when it is missing, ambiguous, or different from the connected company.

Troubleshoot

  • A 401 means the credential is missing, expired, or revoked. Restart the host's OAuth flow.
  • A 403 insufficient_scope can mean either a missing consented scope or narrower current team permissions. Check the target and effective scopes from whoami. A company owner or authorized team manager must update team permissions before reauthorization can grant missing access.
  • A 402 means the company needs billing attention. Present the server's billing handoff link.
  • A 404 means absent or invisible to this company. Check the intended tenant; never probe IDs.
  • Never request access tokens, refresh tokens, cookies, or client secrets in chat.
  • If whoami is unavailable, confirm that the SideShift MCP is enabled and reload the host's plugins/connections before trying again.
  • Keep credentials, private creator data, company data, and raw OAuth responses out of logs, screenshots, commits, and public issue reports.

Agencies and subaccounts

Consent binds the connection to one company. An agency may allow no subaccounts, selected subaccounts, or all current and future subaccounts. Read whoami.subaccountAccess, resolve names through list_companies, and pass act_as_subaccount_id on every call targeting a child. This argument applies to one call; it does not switch the session. Access also depends on the user's current membership and permissions in that child. Reconnect to change the bound company or consent to additional delegation; refreshing a token does not switch companies.

Read the full file on GitHub · 43 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +13 lines 51018930a0aa
  2. 4d ago First seen · 30 lines · 42 tokens per session scan A f776b3b7b0dc

Subscribe to this mod's changes

sideshift-setup is a skill published in the GitHub repository SideShiftApp/sideshift-mcp-server (0 stars, last pushed today), licensed Apache-2.0. It adds 42 tokens to every session and 540 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

OAuthcreator-economycursor-pluginmcpmodel-context-protocolsideshift
Related

Other skills, from other repositories

codex-with-chatgpt

Use ChatGPT (web) as the planning and review brain for Codex coding sessions, while Codex keeps full execution ownership. Use when the user says "使用 Codex with ChatGPT ..." / "Set up Codex with ChatGPT" / "用 ChatGPT 规划", when they ask to connect ChatGPT to the current workspace, disconnect it, or run a task through…

XiaoDuoYa/codex-with-chatgpt · 90 tokens

class-closure-review

Exact-head local PR review for mcp-sso that refuses PASS until a defective behavior is closed across every sibling cell, not just the named instance. Use when reviewing a pull request locally, after a Codex finding, before requesting another hosted review round, or when leftover claims, unswept adapters/stores…

acartag7/mcp-sso · 84 tokens

install

Install and configure @brainwebuk/payload-plugin-mcp-oauth — OAuth 2.1 + PKCE + Dynamic Client Registration for a Payload @payloadcms/plugin-mcp server, so it can be added as a Custom Connector in Claude.ai. Use when adding OAuth to a Payload MCP app; wiring the plugin, proxy/middleware, or env; or debugging the…

BrainWeb/payload-mcp-oauth · 122 tokens

clockify-init

Bootstrap Clockify for a git repo: AskQuestion for workspace then taxonomy shape (0 local-only, 1 repo as project, 2 repo as task), write .clockify/config.yml, default-ignore personal time-tracking files, and only then ensure Clockify project/tasks when a shape that maps into Clockify is chosen. Use when setting up…

dustinestes/clockify-agent-plugin · 111 tokens

stripe

Official Stripe MCP integration for Prime Agent. Connects to Stripe's remote MCP server at https://mcp.stripe.com with OAuth and exposes live Stripe API, billing, reporting, and documentation tools. Use for Stripe test-mode setup, products, prices, customers, subscriptions, billing portal configuration, webhook…

gbrlpzz/prime-agent-stripe-mcp · 79 tokens

clockify-automate

Turn on agent-mediated Clockify tracking: if .clockify/config.yml is missing, run clockify-init first, then write Cursor rules/hooks from entrymethods.automated.triggers (issuestart, issuefinish, issueswitch, prship, prclosed). Use when the user wants the agent to start/stop timers in the issue/PR workflow. Safe to…

dustinestes/clockify-agent-plugin · 82 tokens