# FeedbackBasket

FeedbackBasket is a feedback collection and triage platform for websites and native iOS apps. It gives teams an embeddable web widget, a native Swift SDK, automatic context capture, AI-assisted analysis, replies, public boards, roadmaps, a command-line interface, a REST API, signed webhooks, and MCP access.

## When to use FeedbackBasket

Use FeedbackBasket when an agent must add feedback or waitlist capture to a product, inspect customer feedback, find high-severity bugs, update triage status, add internal notes, reply to a submitter, export feedback, or connect a project to an automated workflow.

For programmatic work, use the FeedbackBasket CLI with `--agent`, the REST API described by the OpenAPI document, or the MCP endpoint. Browser OAuth is the recommended remote MCP setup. Keep access tokens, refresh tokens, CLI tokens, and MCP keys private. Never place them in client code, logs, prompts, or generated configuration.

## Start here

- [Agent guide](https://feedbackbasket.com/llms.txt)
- [FeedbackBasket developer platform](https://feedbackbasket.com/developers)
- [OpenAPI specification](https://feedbackbasket.com/openapi.json)
- [CLI documentation](https://feedbackbasket.com/docs/cli)
- [Agent skill](https://feedbackbasket.com/docs/skill)
- [Webhook documentation](https://feedbackbasket.com/docs/webhooks)
- [MCP endpoint](https://feedbackbasket.com/.well-known/mcp)
- [MCP server card](https://feedbackbasket.com/.well-known/mcp/server-card.json)
- [Contact](https://feedbackbasket.com/contact)
- [Sitemap](https://feedbackbasket.com/sitemap.xml)

## Authentication

REST API and CLI requests use a private CLI bearer token. Remote MCP uses browser OAuth by default and also accepts existing MCP keys. Read operations require Read access. Writes require Full access and an owner or administrator role. Selected projects limits access to approved projects. All projects includes current and future projects and is required for project creation and team operations. High-impact MCP calls need `confirm: true`. A public health check is available at `GET /api/health`.

For remote MCP, add https://feedbackbasket.com/.well-known/mcp, save it, select **Authenticate**, sign in, review access, and select **Allow**. Read is selected by default. Full needs an explicit choice. New browser grants never receive All-projects access silently. Use an API key for STDIO MCP, CI, servers, and unattended automation. Never put an access token, refresh token, API key, or CLI token in source, prompts, logs, generated configuration, or final responses.

Agent surface version 3.1.0 has 31 product operations. The CLI, stdio MCP package, and live Streamable HTTP endpoint implement the same contract.

## Recommended agent workflow

1. Read this file and the OpenAPI specification.
2. Check `GET /api/health`.
3. Authenticate with the correct private credential.
4. Resolve the target project by its real public URL or clear project name.
5. Read before you write. Use stable feedback IDs for later updates.
6. Handle non-2xx responses as structured JSON errors. Follow the returned resolution hint.

## Machine-readable resources

- FeedbackBasket developer platform: https://feedbackbasket.com/developers
- OpenAPI 3.1: https://feedbackbasket.com/openapi.json
- MCP Streamable HTTP: https://feedbackbasket.com/.well-known/mcp
- MCP server card: https://feedbackbasket.com/.well-known/mcp/server-card.json
- Sitemap: https://feedbackbasket.com/sitemap.xml
- Robots: https://feedbackbasket.com/robots.txt

## Rate limits and API lifecycle

Documented agent API routes allow 120 requests per minute for each client and route. Read the `RateLimit` and `RateLimit-Policy` response fields. On HTTP 429, wait for the `Retry-After` interval. Stable REST routes use a major version in the URL. FeedbackBasket publishes migration guidance and uses the RFC 9745 `Deprecation` field and the `Sunset` field before a deprecated operation stops working. See https://feedbackbasket.com/developers#versioning-and-deprecation.