Your AI agent can now build an album with you

A browser agent driving a normal website is doing computer vision on a user interface designed for humans. It reads a screenshot, guesses which pixels are the Create album button, clicks, waits, screenshots again, and tries to work out whether it worked.

Every one of those steps can fail in a way the agent cannot see. It clicks a disabled button and reads the unchanged page as success. It misses a validation error rendered in a colour it cannot interpret. A dropdown renders differently on a narrow window and the whole plan derails. Worse, it has no idea what an action costs — nothing on screen tells it that this particular button spends your credits.

None of that is the agent being bad at its job. It is being asked to reverse-engineer intent from a picture, when the site could simply have told it.

Sustain publishes a set of tools: named, typed actions with descriptions written for a machine that has never seen our interface. An agent calls them instead of hunting for buttons.

They are reachable two ways. mcp.sustain-app.com is a hosted MCP server — Claude on your desktop, ChatGPT, Cursor, anything that speaks MCP connects to it over the network and works on your account through a grant you approve. And when an agent is running inside your browser, the same tools are published into the page through WebMCP, an emerging web standard. Most of this post is about the first; the browser half is at the end.

Ten tools ship today, and they map to the actual journey of making an album rather than to our REST endpoints:

• ask_site — answers questions from our own published content (pricing, printing, privacy, the guides you are reading now) and returns the source pages, so the agent can cite rather than invent.

• create_album and album_status — start an album and check how it is going.

• request_photos and import_google_photos — two ways to get photos in, neither of which sends a single image through the conversation. More on that below.

• quick_place and build_album — lay the photos out for free, or run the full AI build.

• list_albums, get_credits, start_checkout — find your albums, read your balance, buy more credits.

This is the route that needs no flags and no extensions, and it works on any plan — free included.

In Claude, open Settings → Connectors → Add custom connector and paste https://mcp.sustain-app.com/mcp. Claude will find the rest on its own — it reads what the server publishes and sets up the sign-in for you.

You will land on a Sustain page asking what this app may do, on your account. Four boxes: see your albums, create and edit albums, spend your credits on AI runs, and see your credit balance and plans. Tick fewer than it asked for if you want to — the agent gets what you grant, not what it requested. An agent without spend your credits cannot even see the tool that starts a paid run; it is not offered and refused, it is simply not there.

Then ask for what you want. “Make me an album from my Italy trip” is enough. If the agent can read your files — Claude on your desktop can — it creates the album and uploads the photos itself; just tell it which folder. If it cannot, it hands you a link to open on the device the photos are on. Either way it then offers to run the AI build, and tells you it costs credits before it does.

You can take it back at any time from Settings → Connected apps. Disconnecting takes effect on the agent’s very next call, not whenever its access happens to expire, because we issue those tokens ourselves rather than handing out something we cannot revoke.

The connector hands an agent the tools. It does not tell it how to use them well, and uploading is where that gap shows. An upload ticket takes a whole batch of files per request and allows twenty requests an hour — plenty when the agent sends sixty photos at a time, useless when it sends one at a time, which is the shape an agent tends to improvise first. It works for nineteen photos and then stalls for an hour.

So we publish the arithmetic as a skill: a short recipe your agent installs once, which knows the batch sizes, the file types we accept, and what to do when something is refused. Install it whichever way matches the Claude you use.

• Claude Code, in a terminal. Paste the command below to add our catalogue, then run /plugin install sustain-skills@sustain.

• The Claude desktop app. Open Settings → Skills (under Customize), press Add, and upload the skill file. Skills there read SKILL.md from the top of the archive, which is exactly what that download is — the plugin archive the terminal uses is a different shape and will not work here.

Both need the same thing underneath: an agent that can actually reach your disk and run a command. A Claude that only runs in the cloud cannot open ~/Pictures/Italy no matter which skill it has, and for that one the upload page is the right route.

One failure is worth naming, because it looks like our fault and it is not. An agent that runs commands on your machine usually does so inside a sandbox with its own network allowlist, and until sustain-app.com is on that list the upload is refused before it ever leaves your laptop — a 403, with blocked-by-allowlist in the response if you look closely.

The tell is an odd asymmetry: the agent creates the album perfectly well and then cannot upload a single photo. That is the two paths differing. The tool calls travel from Claude to us and are never affected; the files leave from your own machine, through the sandbox. Only the second one is blocked. An agent describing this as a permissions problem with your folder has misread its own error.

Allow the domain wherever your agent runs:

• The Claude desktop app. Go to Settings → Capabilities → Domain allowlist. Under Additional allowed domains type sustain-app.com and press Add, then do the same for *.sustain-app.com. The allowlist ships set to Package managers only, which is exactly why we are blocked until you add us.

• Claude Code, in a terminal. It asks the first time a command wants a new host — choose “Yes, and don’t ask again” and it is remembered for good. To pre-allow it instead, add "allowedDomains": ["sustain-app.com", "*.sustain-app.com"] under sandbox.network in ~/.claude/settings.json, then start a fresh session; the sandbox reads its policy at startup.

If you edit settings rather than using the app’s screen, use your user settings, not a repository’s — a project-level .claude/settings.json is ignored for this particular setting, so a rule that works in the terminal can quietly do nothing in the app.

A granted permission is not a blank cheque, and the failure we actually expect is not an attacker — it is an agent looping on a call it misread as failed.

So there are limits that hold whatever the agent was granted: a cap on how many calls a minute a connection may make, and a cap on how many paid runs it may start in a day. Hit either and the agent is told plainly, and you can still do the same thing yourself on the website.

Every call an agent makes is recorded too — which tool, whether it worked, and what it was about. Not what you typed: the arguments are fingerprinted rather than stored, because the question that table answers is what has this agent been doing, not what did you say to it.

This is the part that is easy to get wrong, and we got it wrong first. The obvious design is a tool that takes the photos as an argument — the agent hands us the images, we store them. It works for one small picture and collapses for everything else, because a tool call is text: the image has to be encoded into the conversation, and a single full-resolution photo can exceed an entire AI context window. Splitting it into more calls makes it worse, since every call stays in the transcript and is re-sent on each later turn.

So the tools do not move photos at all. request_photos issues an upload ticket — a short-lived, single-purpose credential for one album — and whoever actually holds the pictures sends them straight to us:

• The photos are on your phone. The ticket comes with a link. You open it, pick your photos, done. Hundreds of them, none passing through the AI.

• You have given the agent access to your files. Then it uploads them itself, directly, from disk to Sustain. The agent never reads the images into the conversation — it just uses the ticket.

• Your library is in Google Photos. import_google_photos starts a picker session, you choose in Google’s own window, and Sustain downloads them server-side — up to a thousand, again with nothing going through the agent.

The ticket expires in 24 hours, is scoped to one album, and still respects your plan’s photo and storage limits. It is the same mechanism behind the QR-code upload we already ship, which is a good sign: the right design for an agent turned out to be the one we had already built for humans.

The Google Photos route is where the agent genuinely joins in the selecting: once you have picked, it can drop the videos and skip the screenshots before importing. We are careful about how far to take that claim — Google gives us a filename and a file type and nothing about what is in a picture, so an agent that told you it had removed the blurry ones would be making it up.

This is the part people ask about first, and the answer is better than it usually is for agent integrations.

A connected agent never receives a password or an API key. It gets an OAuth grant you approve on a Sustain page, listing exactly what it may do, and the token behind it is a record we hold rather than a signed key we could not take back. Disconnect it in Settings → Connected apps and its very next call fails — not whenever the token happens to expire.

An agent in your browser does not even get that. It runs in the page you already signed in to, so your browser attaches the same session cookie it always does: no token to issue, no consent screen, nothing to paste. It can act only as the person already signed in to that tab, for as long as that session lasts.

That also sets the ceiling on what a misbehaving agent could do: exactly what you could do yourself in that tab, and nothing more. The server checks every permission independently, the same as when you click.

Some things should not happen because software decided they should. We left them out on purpose:

• It cannot place a print order. That spends real money and needs a shipping address. You do that yourself.

• It cannot take a payment. start_checkout creates a checkout session and hands you the link — you pay on the provider’s own page. The tools never touch card details.

• It cannot help itself to your files. A browser agent physically cannot — a web page may not read your disk. A connected desktop agent can read whatever you granted it in your own AI client, which is a permission you give there and not one we hand out; on our side it can still only upload using a ticket you asked it to create, into the album that ticket names.

• It cannot cancel your subscription or delete an album.

One thing it can do is spend credits: build_album runs the paid AI build in a single call, and the cost depends on how many photos survive de-duplication. We treat credits the way any metered API treats tokens — the tool says plainly that it spends them, and if your balance is short it comes back with the exact shortfall so the agent can tell you and offer to top up rather than failing silently.

Everything above is the hosted server, and it works today with nothing to switch on. The rest of this post is the other half: the same tools, published into the page for an agent running inside your browser.

It is at an earlier stage, and we would rather say where it stands than imply more than is true.

WebMCP is a genuinely new standard: Chrome has shipped it from version 149 but has not switched it on by default, so this route is opt-in. In Chrome 149 or later, open chrome://flags/#enable-webmcp-testing, set the WebMCP for testing flag to Enabled, and click Relaunch. Chrome restarts with your tabs intact. Then pick an agent.

You are signed in to Sustain with an agent running in your browser. You say: “Make me an album from my Italy trip.” What happens next is not a sequence of clicks:

Throughout, you are both looking at the same page. The agent is not operating a hidden copy of the site somewhere — it is working in your tab, and every result appears in front of you.

Google publishes a Model Context Tool Inspector extension for exactly this — installed from the Chrome Web Store like any other, with public source. It is the shortest path from curiosity to a finished album, and today it is the route we would actually point you at.

Once the inspector is installed and Sustain is open in front of it, this is the prompt to start with. Paste it and watch the calls go by.

It deliberately stops before spending anything: it asks for a free layout and for a description of what a paid build would do, so your first run cannot surprise you with a credit charge.

There is a version of the next few years where people stop visiting websites and start asking an assistant to deal with them. In that world, a site that only speaks in pixels is one an agent gets wrong, gives up on, or skips in favour of one it can actually operate.

Being agent-ready is not a badge. It is the difference between an assistant that can genuinely make you a photo album and one that clicks around, spends your credits by accident, and hands back something you did not ask for. We would rather be legible to the machines that are increasingly doing the asking.

It also keeps us honest about our own product. Writing a tool description forces you to say exactly what an action does and what it costs, in a sentence, with no interface to hide behind. Several of ours got clearer in the writing.