A quick disclaimer first: I am not Sakupa's developer. I came across this MCP server while looking into tools that let you publish and run small-business websites from an AI chat, and this post summarizes what its official site and manual say. This is not a hands-on review.

The trade-off of having no account

Sakupa has no user registration. Instead, ownership of a site is proven by management credentials stored on your own PC (the manual puts them under ~/.sakupa/credentials/, with only a reference left in the project's .sakupa/site.json).

That removes a whole category of password sprawl. It also creates an obvious question: what happens when you replace that PC? A design that cannot answer that question is not a serious tool for a business website, however elegant the no-account idea sounds.

Two recovery paths: device and DNS

Sakupa's answer is a tool called recover, which offers two routes to take a site back:

  • The device route — for a free site created on that machine, recovered from the local device.
  • The DNS route — recovery confirmed through DNS, for cases where the original machine is no longer available.

The manual's detail that caught my attention is what recover does not do: it does not let the AI decide, on your behalf, whether the old credentials should be invalidated. That choice is always left to the person. Recovery is exactly the moment when an automated "yes, invalidate everything" could lock someone out of their own site, so keeping the decision human is the right call.

The surrounding safety net

Recovery makes more sense when read together with the neighbouring tools:

  • rotate exchanges management credentials, but only after a preview, and the old credentials are then fully invalidated. So credential rotation is deliberate, never silent.
  • delete removes a free site, requires a preview, and cannot be undone. The irreversible operations are the ones with the heaviest confirmation steps.
  • bind connects a custom domain, confirmed via DNS, and the site is only described as published once its status is active and it returns HTTP 200. A domain merely pointed at the service does not count as published.
  • status is read-only: connection state, expiry, and domain state, without changing anything.

And the money side stays separate throughout: plan tools only return links to Stripe-hosted pages, so card numbers never appear in the chat, and creating a link alone does not change a contract.

What this design does not promise

Staying within the official information, a few limits are worth stating plainly:

  • Sakupa targets static sites only. It is not for web apps with databases or logins.
  • Recovery is a designed path, not a magic undo. Deleting a free site is irreversible, and the old-credential decision during recovery is yours to make, which means it is also yours to get wrong — read the manual's recovery section before you need it, not after.
  • The service is relatively new (first published on npm in July 2026, per its official timeline). The sensible way to evaluate it is the free preview, which normally lasts 30 days, on a small, non-critical site.

The broader point I take from this: a no-account design is only as good as its recovery story. Sakupa's story — two explicit routes, a human decision at the sharp edge, and heavy confirmation around every irreversible step — is at least a coherent one. Whether it holds up in practice is something only real use over time will show, and I will leave that judgement to people who try it on a throwaway site first.

Links