# Tailorgame > A browser skill-game platform for players and creators. Discover games, save practice scores, develop private game briefs, and invite friends into rooms. ## When to use Tailorgame Use Tailorgame to discover playable skill games and their availability, read public practice rankings, or help a person understand game creation and credit pricing. Use the read-only public API or MCP server for these tasks. Players sign in on the website to save scores, manage their own profile, save private briefs, generate a separate playable prototype when generation is enabled, and create or join invitation-based rooms. ## Start without an account 1. GET https://tailorgame.com/api/games for the public catalog. 2. GET https://tailorgame.com/api/rankings for public rankings. 3. Read https://tailorgame.com/openapi.json for schemas and error responses. 4. Connect an MCP client to https://tailorgame.com/mcp using Streamable HTTP (protocol 2025-11-25). No API key is required for public tools. ## Product boundaries Scores are client-reported practice results. Rooms persist membership and access but do not synchronize live gameplay. Game briefs are drafts, not playable games. Generation depends on runtime configuration and a server-priced credit quote. Checkout is not connected; credits cannot currently be purchased. Public tools do not read account data, save scores, create games, reserve credits, or join rooms. Do not ask for passwords, session cookies, or Firebase tokens in chat. Ask the person to sign in on Tailorgame when an account action is needed. Updated: 2026-11-05. ## Resources - [Documentation](https://tailorgame.com/docs) - [OpenAPI 3.1](https://tailorgame.com/openapi.json) - [Documentation index](https://tailorgame.com/llms.txt) - [Authentication](https://tailorgame.com/auth.md) - [Pricing](https://tailorgame.com/pricing.md) --- # Tailorgame authentication ## Public access GET /api/games without cookies returns public games. GET /api/rankings and the MCP tools are public. No API key, account, payment method, or OAuth grant is needed for these reads. ## Interactive account access People sign in at [Sign in](https://tailorgame.com/sign-in). Firebase Authentication supplies the enabled sign-in providers, including verified email/password and configured social providers. GET /api/auth/config returns the runtime public Firebase configuration and enabled provider list. Email/password accounts must verify their email. The website uses Firebase's client SDK with in-memory persistence. A recent sign-in (within five minutes) supplies an ID token. The browser first calls GET /api/auth/csrf and retains the returned HTTP-only CSRF cookie and csrfToken value. It then POSTs {"idToken":""} to /api/auth/session, with Content-Type: application/json, the matching x-csrf-token header, and the site's Origin. The server verifies the token, provider, account, and email requirements before issuing an HTTP-only, SameSite=Lax tailorgame-session cookie for up to five days. The cookie is Secure in production. GET /api/auth/session returns {user: null} when signed out. DELETE /api/auth/session requires the same CSRF cookie/header and Origin and clears the session cookie. Sign out on the website when finished. ## Authorization and permissions Account API operations require the person's session. Mutations also enforce the configured site origin. Game briefs, credit history, profile details, rooms and private games remain protected by server-side ownership and membership checks. Signed-out account requests return JSON errors with HTTP 401. Unauthorized origins return 403. The public MCP server has public-read access only and deliberately ignores session credentials. Tailorgame does not currently offer delegated agent OAuth, API keys, service-account access, dynamic client registration, or selectable OAuth scopes. Browser social sign-in is not a delegated agent authorization endpoint. Do not copy credentials out of the browser or send them to a third party. Updated: 2026-11-05. ## Resources - [Documentation](https://tailorgame.com/docs) - [OpenAPI 3.1](https://tailorgame.com/openapi.json) - [Documentation index](https://tailorgame.com/llms.txt) - [Authentication](https://tailorgame.com/auth.md) - [Pricing](https://tailorgame.com/pricing.md) --- # Tailorgame pricing ## Free use Browsing games and rankings, playing supported games, and saving game briefs are free. A new player receives 100 welcome credits. Credits are a demo creation balance with no cash value. ## Creation credits The legacy template creation endpoint costs 20 credits per game. Saving a prompt-based brief does not spend credits. When prototype generation is available, request a server quote before confirming a generation request. Confirming generation reserves the quoted credit budget; consumed model usage, including paid unsuccessful attempts, is settled and unused credits are returned. Never start a generation automatically just to inspect pricing. ## Planned credit packs - 1,000 credits: US$10 before tax. - 3,000 credits: US$30 before tax. - 10,000 credits: US$100 before tax. These are published planned prices. Payment checkout is not connected and packs cannot currently be purchased. There are no active paid subscriptions, agent payment endpoints, payment requirements for the public API, or supported x402/MPP/ACP/UCP checkout flows. See [the website's credit pricing](https://tailorgame.com/#pricing). Updated: 2026-11-05. ## Resources - [Documentation](https://tailorgame.com/docs) - [OpenAPI 3.1](https://tailorgame.com/openapi.json) - [Documentation index](https://tailorgame.com/llms.txt) - [Authentication](https://tailorgame.com/auth.md) - [Pricing](https://tailorgame.com/pricing.md) --- # Tailorgame games ## Discovery GET https://tailorgame.com/api/games without a session returns {games: Game[]}, including public playable games and clearly marked upcoming titles. Inspect each game's status rather than assuming all entries are playable. Neon Bowling, Card Clash and Color Rush are playable starter games; Pocket Pool, Speed Chess and Neon Drift are marked coming-soon. The live API is the source for current public availability. The website's lobby is at https://tailorgame.com/games. A playable game can be opened at /games?play=; the website asks the person to sign in before play. Game IDs are opaque strings. ## Rankings GET https://tailorgame.com/api/rankings returns mostPlayedGames, mostLovedGames, mostActivePlayers, and highestScoringPlayers. Distinct-player counts differ from repeated session counts. Practice points are client-reported and game scoring scales differ; rankings are not trusted competition. ## Private creation and rooms Signed-in people can save and edit private briefs at /create. A saved draft is not playable. Runtime-enabled generation creates a separate private browser prototype after a credit quote. Rooms support invitation-based membership for up to four members. Room membership can grant access to a private game, but does not synchronize gameplay. Public integrations cannot list private drafts, rooms, or generated artifacts. Updated: 2026-11-05. ## Resources - [Documentation](https://tailorgame.com/docs) - [OpenAPI 3.1](https://tailorgame.com/openapi.json) - [Documentation index](https://tailorgame.com/llms.txt) - [Authentication](https://tailorgame.com/auth.md) - [Pricing](https://tailorgame.com/pricing.md) --- # Tailorgame API and MCP ## REST Base URL: https://tailorgame.com OpenAPI: https://tailorgame.com/openapi.json API catalog: https://tailorgame.com/.well-known/api-catalog Public reads: ```sh curl --fail 'https://tailorgame.com/api/games' curl --fail 'https://tailorgame.com/api/rankings' ``` Account routes retain verified sessions and ownership checks. Consult the OpenAPI operation security requirements and [authentication documentation](https://tailorgame.com/auth.md) before use. Public reads require no key. There is no production sandbox endpoint; local development uses the demo-tailorgame Firebase Auth and Firestore emulators, never live user data. ## Errors and retries REST failures return JSON {error: string} with an HTTP status. 400 means invalid input, 401 means sign-in required, 403 means forbidden request or origin, 404 means unknown or inaccessible object, and 503 means temporarily unavailable. Retry public reads after a short delay on 503. Do not repeatedly retry authentication or validation errors, or replay a credit-spending write without checking its documented request ID semantics. No public rate-limit guarantee or uptime SLA is published. ## Read-only MCP Endpoint: https://tailorgame.com/mcp Transport: Streamable HTTP, protocol 2025-11-25, stateless JSON responses. POST requires application/json and an Accept header containing application/json and text/event-stream. GET returns 405 because the server does not offer an SSE listener. Browser Origin headers must match a configured Tailorgame origin; non-browser clients can omit Origin. No cookies or credentials are used. ```json {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"example-client","version":"1.0"}}} ``` After notifications/initialized, send MCP-Protocol-Version: 2025-11-25 on subsequent requests and call tools/list, then tools/call. Available tools: list_games (query, category, limit), get_rankings (no arguments), and get_documentation (topic: overview, authentication, pricing, games, or api). Tools validate arguments, expose only public information, and return text plus structuredContent. Documentation is also available through resources/list and resources/read. Unknown methods return JSON-RPC -32601; invalid arguments return -32602. Operational tool failures use isError: true without leaking internal exceptions. No account mutations or payments are exposed. ```json {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_games","arguments":{"query":"bowling","limit":5}}} ``` ## Browser tools Compatible browsers can discover read-only WebMCP tools for the public catalog, rankings and documentation. The website feature-detects WebMCP; normal browsing works without it. These tools omit credentials on API calls, even when the browser is signed in. Updated: 2026-11-05. ## Resources - [Documentation](https://tailorgame.com/docs) - [OpenAPI 3.1](https://tailorgame.com/openapi.json) - [Documentation index](https://tailorgame.com/llms.txt) - [Authentication](https://tailorgame.com/auth.md) - [Pricing](https://tailorgame.com/pricing.md)