agent setup

Points Claude Code or Cursor at Mercemur’s MCP server, so an agent can read your catalogue and edit your storefront. Detects what is installed; pass --client claude-code or --client cursor to pick one, --global for your home directory, --status to see what is configured.
No credential is written. The endpoint advertises its authorization server, so your agent opens a consent screen where you choose the store and the scopes. That is why the file this writes is safe to commit. Existing servers in your configuration are preserved.
Restart your agent afterwards. An MCP client reads its tool list once, when it connects.

config

Only store and api are settable. An unknown key is refused rather than stored, because a setting that is silently ignored looks like a feature that does not work.
There is no setting for an API key, deliberately. Keys live in your OS keychain; a config file is a thing people commit.

Profiles

One config file, many accounts. Useful when you work across several stores.
--profile works on every command. A profile sits between the environment and the project file in precedence, per field: an explicit --store still wins, and a profile that names only a store still inherits the project’s api. An unknown profile name is an error that lists the ones you have, rather than quietly falling back to your default store. Each profile resolves its own key from the keychain, so mercemur login --store acme.mercemur.com once per account is all the setup there is.

sandbox create

Registers an account, creates a store, mints a secret key and puts it in your keychain, so a new machine or an automated workflow can start immediately.
This is a real account and it does not expire. There is no seven-day clock and nothing cleans it up. The password is shown once and generated with a cryptographic source; write it down.

fixtures

Runs a series of API calls in order, each able to read what an earlier one returned.
seed.json
A reference that is the whole value keeps its type, so "${shirt:price_minor}" sends the number 1999 rather than the string "1999". Money on this API is integer minor units, so that distinction is the difference between a working seed and a rejected one. Requests stop at the first failure, because a later one usually depends on an earlier one having worked, and continuing produces a wall of errors whose first line is the only real one.

logs

The record of writes to your store: who changed what, newest first.
This is an audit log, not a webhook feed. Its action names are dotted (promotion.created) and webhook topics are slashed (products/created). The two sets are disjoint and neither accepts the other’s values. To receive events as they happen, use webhooks.
tail polls and prints each entry once. --json is refused there, as it is on theme dev; for scripted output run logs list --json in your own loop.

open and docs

open takes a shortcut name and launches your browser; --url prints the address instead, which is what you want over ssh. docs search matches page paths and works offline.