Publish a website to a live HTTPS URL in seconds, no account needed. Keep it free on GearHost.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Requires signing in to GearHost. Attach a custom domain (e.g. mycoffeeshop.com or www.mycoffeeshop.com) to one of the user's CloudSites, the same as "Attach Custom Domain" in the GearHost panel. Works on every plan, including free. Afterwards the domain's DNS must point at the site: the result lists the exact records to add at the domain's DNS host. HTTPS is issued automatically once DNS resolves; get_domain_status reports progress. Returns structuredContent { status, domain, site, attached, records:[{ type, host, value }], next }.
The CloudSite to attach to, by its current address (e.g. "glowing-raven.gearhost.io"; list_my_sites shows them).
The custom domain to attach, e.g. "mycoffeeshop.com".
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http mcp https://mcp.gearhost.com/
Requires signing in to GearHost. Attach a custom domain (e.g. mycoffeeshop.com or www.mycoffeeshop.com) to one of the user's CloudSites, the same as "Attach Custom Domain" in the GearHost panel. Works on every plan, including free. Afterwards the domain's DNS must point at the site: the result lists the exact records to add at the domain's DNS host. HTTPS is issued automatically once DNS resolves; get_domain_status reports progress. Returns structuredContent { status, domain, site, attached, records:[{ type, host, value }], next }.
| Argument | Type | Description |
|---|---|---|
| site* | string | The CloudSite to attach to, by its current address (e.g. "glowing-raven.gearhost.io"; list_my_sites shows them). |
| domain* | string | The custom domain to attach, e.g. "mycoffeeshop.com". |
{
"type": "object",
"required": [
"site",
"domain"
],
"properties": {
"site": {
"type": "string",
"description": "The CloudSite to attach to, by its current address (e.g. \"glowing-raven.gearhost.io\"; list_my_sites shows them)."
},
"domain": {
"type": "string",
"description": "The custom domain to attach, e.g. \"mycoffeeshop.com\"."
}
}
}Loads a published GearHost site from GearHost's servers and reports problems to fix: missing files and broken links on the site, external scripts/stylesheets that fail to load (e.g. a wrong CDN version), no mobile viewport tag, no <title>, images without alt text, http:// resources on an https page, images over 1 MB, contact forms that send nowhere, and leftover placeholder text (Lorem ipsum, example.com). Pass the site url (or token / name + project_key) and optionally a path. Works for GearHost-hosted sites only. JavaScript is not executed, so runtime script errors are not detected. Each issue has a severity (error, warning, info) and a suggested fix.
| Argument | Type | Description |
|---|---|---|
| url | string | The site or page address, e.g. https://my-site.gearhost.io/ or https://my-site.gearhost.io/about.html. |
| name | string | Alternative to url: site name (pair with project_key). |
| path | string | Optional page path to check on the site, e.g. "/contact.html". Default: the home page. |
| token | string | Alternative to url: the manage token returned by publish_website. |
| project_key | string | The project_key the named site was published with. |
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The site or page address, e.g. https://my-site.gearhost.io/ or https://my-site.gearhost.io/about.html."
},
"name": {
"type": "string",
"description": "Alternative to url: site name (pair with project_key)."
},
"path": {
"type": "string",
"description": "Optional page path to check on the site, e.g. \"/contact.html\". Default: the home page."
},
"token": {
"type": "string",
"description": "Alternative to url: the manage token returned by publish_website."
},
"project_key": {
"type": "string",
"description": "The project_key the named site was published with."
}
}
}Keep a preview permanently: claims a site made with publish_website into the user's GearHost account, so it becomes a free, permanent CloudSite at the same URL (no 72h expiry). Use when the user wants to keep their site. Requires signing in to GearHost: if they aren't signed in, they are asked to sign in or create a free account. Needs the preview's manage token (from publish_website). Returns structuredContent { status, url, claimed, expires_at, dashboard_url }.
| Argument | Type | Description |
|---|---|---|
| token* | string | The manage token of the preview to claim (keep it forever). |
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "The manage token of the preview to claim (keep it forever)."
}
}
}Requires signing in to GearHost. Delete one of the user's GearHost CloudSites (by domain): its hosting, files, certificates, DNS, HA replicas and Git Push repo, exactly like deleting it in the GearHost panel. Destructive - set confirm:true. Databases linked to the site are KEPT (unlinked, still in the account) unless delete_databases:true. Returns structuredContent { status, domain, deleted, databases }.
| Argument | Type | Description |
|---|---|---|
| domain* | string | |
| confirm* | boolean | Must be true to actually delete. |
| delete_databases | boolean | Also permanently delete the databases linked to this site. Default false: they are kept. |
{
"type": "object",
"required": [
"domain",
"confirm"
],
"properties": {
"domain": {
"type": "string"
},
"confirm": {
"type": "boolean",
"description": "Must be true to actually delete."
},
"delete_databases": {
"type": "boolean",
"description": "Also permanently delete the databases linked to this site. Default false: they are kept."
}
}
}Check whether a preview has been claimed into a GearHost account, and how long is left to claim it (the site is auto-removed at expiry unless claimed). Pass token, or name+project_key. Read-only. Returns structuredContent { status, url, claimed, claimable, expiring_soon, seconds_left, time_left, claim_url, owner }. claim_url is the page where the user can keep the site.
| Argument | Type | Description |
|---|---|---|
| name | string | The site name (with project_key) instead of a token. |
| token | string | The manage token (or use name+project_key). |
| project_key | string | The project_key (with name) instead of a token. |
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The site name (with project_key) instead of a token."
},
"token": {
"type": "string",
"description": "The manage token (or use name+project_key)."
},
"project_key": {
"type": "string",
"description": "The project_key (with name) instead of a token."
}
}
}Get everything needed to put a custom domain (e.g. yourshop.com) on a GearHost site: the exact DNS records, plus how to attach it. Identify the site by token, or by name+project_key. A custom domain can only be attached to a site in a GearHost account (it binds the domain to a real owner). The steps are: (1) the preview is claimed into a free account (claim_website or claim_url), (2) the domain is attached (attach_custom_domain when signed in, or "Attach Custom Domain" in the GearHost panel), (3) the DNS records are added at the domain's DNS host, (4) get_domain_status reports when it is live. Returns structuredContent { status, domain, claim_first, requires_account, attach_in_dashboard, claim_url, how_to_attach, records:[{ type, host, value, priority, note }], steps }.
| Argument | Type | Description |
|---|---|---|
| name | string | The site name (with project_key) instead of a token. |
| token | string | The site manage token (or use name+project_key). |
| domain* | string | The custom domain to point here, e.g. "yourshop.com". |
| project_key | string | The project_key (with name) instead of a token. |
{
"type": "object",
"required": [
"domain"
],
"properties": {
"name": {
"type": "string",
"description": "The site name (with project_key) instead of a token."
},
"token": {
"type": "string",
"description": "The site manage token (or use name+project_key)."
},
"domain": {
"type": "string",
"description": "The custom domain to point here, e.g. \"yourshop.com\"."
},
"project_key": {
"type": "string",
"description": "The project_key (with name) instead of a token."
}
}
}Check whether a custom domain is wired up and serving yet — the verify/poll half of the custom-domain flow. After you give the user the DNS records (get_domain_setup) and they attach the domain + add the records, call this to see live progress: is it attached to the CloudSite, does DNS resolve to the GearHost node, and is HTTPS active. Identify the site by token or name+project_key. Poll this every ~30-60s after the user adds DNS until https:"active" — like get_site_status for a publish. Returns structuredContent { status, domain, attached, dns_ok, apex_ok, www_ok, https, live, live_url, next }.
| Argument | Type | Description |
|---|---|---|
| name | string | The site name (with project_key) instead of a token. |
| token | string | The site manage token (or use name+project_key). |
| domain* | string | The custom domain to check, e.g. "yourshop.com". |
| project_key | string | The project_key (with name) instead of a token. |
{
"type": "object",
"required": [
"domain"
],
"properties": {
"name": {
"type": "string",
"description": "The site name (with project_key) instead of a token."
},
"token": {
"type": "string",
"description": "The site manage token (or use name+project_key)."
},
"domain": {
"type": "string",
"description": "The custom domain to check, e.g. \"yourshop.com\"."
},
"project_key": {
"type": "string",
"description": "The project_key (with name) instead of a token."
}
}
}GearHost CloudSite plans and monthly prices in USD, read live from GearHost (the free plan included). Each plan: name, monthly_price_usd, disk_mb, monthly_requests (null = no fixed limit). Every plan, including free, can use custom domains with automatic HTTPS. Add-on prices (email, high availability, databases) are per plan. Plans are changed in the GearHost panel (the CloudSite's "Change plan" link); this tool only reads prices. Returns structuredContent { status, currency, plans:[...], change_plan }.
No arguments.
{
"type": "object",
"properties": {}
}Optional: read the GearHost publishing docs (methods, limits ~25 MB and an hourly cap on new sites, 72h lifecycle). The docs describe a raw HTTP API (octane.gearhost.com/preview/) for non-MCP clients - when using MCP you do NOT need it; just call publish_website.
No arguments.
{
"type": "object",
"properties": {}
}Requires signing in to GearHost. Traffic for the user's CloudSites: requests per day for the last 7 or 30 days (successful and not-found), bandwidth, and this billing cycle's requests against the plan's limit. Requests count every page and file served, not unique visitors; the numbers are refreshed about hourly. Use when the user asks how many visits or how much traffic a site gets. Omit domain for all sites. Read-only. Returns structuredContent { status, days, sites:[{domain, requests, ok, not_found, bandwidth_mb, cycle_requests, cycle_limit, daily:[{date, requests}]}] }.
| Argument | Type | Description |
|---|---|---|
| days | integer | Period in days: 7 or 30 (default 7). |
| domain | string | One CloudSite (its main address). Omit for all sites in the account. |
{
"type": "object",
"properties": {
"days": {
"type": "integer",
"description": "Period in days: 7 or 30 (default 7)."
},
"domain": {
"type": "string",
"description": "One CloudSite (its main address). Omit for all sites in the account."
}
}
}Full status of a published site — the one call to confirm a publish landed and inspect it. Identify the site by token, OR by name + project_key. Runs a real server-side HTTP probe (live_http) so you get a definitive "is it serving?" answer even while the fresh DNS has not propagated to you yet — prefer this over fetching the URL directly right after publishing. Also returns the current version, content_hash (to detect drift from what you published), size, file_count, source, and the claim/expiry state.
| Argument | Type | Description |
|---|---|---|
| name | string | Site name (alternative to token; pair with project_key). |
| token | string | The manage token returned when the site was published. |
| project_key | string | The project_key you published the named site with (>=16 chars). |
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Site name (alternative to token; pair with project_key)."
},
"token": {
"type": "string",
"description": "The manage token returned when the site was published."
},
"project_key": {
"type": "string",
"description": "The project_key you published the named site with (>=16 chars)."
}
}
}Requires signing in to GearHost. Lists messages visitors sent through contact forms on the user's CloudSites (GearHost Forms), newest first. Use when the user asks whether anyone contacted them through their site or wants to read form submissions. Optionally limit to one site (domain), to messages since a date, and the number returned (default 20, max 50). Read-only; visitor IP addresses are not included. Returns structuredContent { status, total, messages:[{site, received_at, subject, reply_to, fields}] }.
| Argument | Type | Description |
|---|---|---|
| limit | integer | How many messages to return, newest first (1-50, default 20). |
| since | string | Only messages received on or after this date (YYYY-MM-DD, UTC). |
| domain | string | Only messages from this site (e.g. mysite.gearhost.io or a custom domain on the site). Omit for all sites. |
{
"type": "object",
"properties": {
"limit": {
"type": "integer",
"description": "How many messages to return, newest first (1-50, default 20)."
},
"since": {
"type": "string",
"description": "Only messages received on or after this date (YYYY-MM-DD, UTC)."
},
"domain": {
"type": "string",
"description": "Only messages from this site (e.g. mysite.gearhost.io or a custom domain on the site). Omit for all sites."
}
}
}List the live preview sites you created with a given project_key (your cross-session identity). Reuse one project_key across several named publishes, then call this to enumerate + manage them all. Returns structuredContent { status, count, sites:[{ name, url, expires_at, last_published, claimed }] }.
| Argument | Type | Description |
|---|---|---|
| project_key* | string | The secret project_key you published with (>=16 chars). Lists every live preview that shares it. |
{
"type": "object",
"required": [
"project_key"
],
"properties": {
"project_key": {
"type": "string",
"description": "The secret project_key you published with (>=16 chars). Lists every live preview that shares it."
}
}
}Requires signing in to GearHost. List the CloudSites in the user's GearHost account. Returns structuredContent { status, sites:[{domain,url,status,plan,node}] }.
No arguments.
{
"type": "object",
"properties": {}
}List the recent publish history for a site (newest first), so you can undo a change. Pass token, or name+project_key. Each publish is a version; use a version number with rollback_website to restore it. Returns structuredContent { status, url, current_version, count, versions:[{ version, published_at, sha, is_current }] }.
| Argument | Type | Description |
|---|---|---|
| name | string | |
| token | string | |
| project_key | string |
{
"type": "object",
"properties": {
"name": {
"type": "string"
},
"token": {
"type": "string"
},
"project_key": {
"type": "string"
}
}
}Requires signing in to GearHost. Publish/update content to a CloudSite ALREADY in the user's GearHost account (by domain). To put a NEW site online, use publish_website instead: it needs no account. Provide ONE of: html, files map (must include index.html at the root), or zip_base64. Returns structuredContent { status, url, domain, files, updated }.
| Argument | Type | Description |
|---|---|---|
| html | string | HTML for a one-page site (served as index.html at the root). |
| files | object | Map of relative path => contents. MUST include "index.html" at the root. |
| domain* | string | The CloudSite domain to publish to (must be in your account). |
| zip_base64 | string | Base64 .zip with index.html at the archive root. |
{
"type": "object",
"required": [
"domain"
],
"properties": {
"html": {
"type": "string",
"description": "HTML for a one-page site (served as index.html at the root)."
},
"files": {
"type": "object",
"description": "Map of relative path => contents. MUST include \"index.html\" at the root.",
"additionalProperties": {
"type": "string"
}
},
"domain": {
"type": "string",
"description": "The CloudSite domain to publish to (must be in your account)."
},
"zip_base64": {
"type": "string",
"description": "Base64 .zip with index.html at the archive root."
}
}
}Publish a website to a live public URL on GearHost in seconds (no account). For when the user has you build a website, landing page, portfolio, or HTML/CSS/JS app and wants to see it live or share a link. Provide ONE of: html (a one-page site), files (a map of relative path => text contents), or zip_base64. Pass token to update a site you published before (same URL). Optionally pass name to request a specific subdomain (e.g. name:"daily-grind" → daily-grind.gearhost.io); omit it for an auto-generated fun-name. Pair name with project_key (a secret you generate and STORE) for a PERSISTENT handle: re-publishing the same name + project_key in any future session updates that same URL, even after the token is gone. config applies serving behavior. Supported today: spa (serve index.html for any unmatched route — REQUIRED for client-side-routed apps like React/Vue so deep links + refresh work) and not_found. Unsupported config keys (e.g. redirects, headers) are rejected with bad_request. The response echoes config_applied with EXACTLY what took effect — read it to confirm what was honored instead of assuming. To verify SPA end-to-end, fetch any non-existent deep path and confirm it returns 200 with your index page, not 404. The published site is served at https://<name>.gearhost.io. This tool does the whole publish; static sites can have a working contact form by posting it to https://octane.gearhost.com/forms/ (get_publish_info has the exact markup; messages are emailed to the owner once the site is kept). octane.gearhost.com/preview/ in the docs is the equivalent raw HTTP API for non-MCP clients. Returns structuredContent { status, url, name, token, token_is_secret, updated, url_ready_in_seconds, verify_with, expires_at, claim }. live_now:true means the URL works right away (most publishes, and every update). If live_now is false the address is brand new and its DNS can take ~10s, so do NOT GET it immediately and assume failure; confirm with get_site_status (the verify_with tool) instead. On FAILURE: isError=true + structuredContent { status:"error", error, kind }. kind drives recovery: invalid_token (your update token is stale - retry WITHOUT token to publish a fresh site) | expired (preview hit max lifetime - claim it to keep editing) | rate_limited (back off - there is an hourly limit on NEW sites; the quota field in every publish response shows what is left) | too_large (>25 MB - shrink) | name_taken (the requested name is in use - pick another or omit name) | name_invalid (bad name - 3-40 chars, lowercase letters/numbers/hyphens) | forbidden (that name is managed with a different project_key - you cannot update it) | unavailable (publishing off / service down - retry later) | bad_request (fix the input) | publish_failed (transient - retryable). Content is PUBLIC - never include secrets or private files. The returned token is a WRITE CREDENTIAL - keep it private.
| Argument | Type | Description |
|---|---|---|
| html | string | HTML for a one-page site (served as index.html at the root). |
| name | string | Optional subdomain for a NEW site: name:"daily-grind" → daily-grind.gearhost.io. 3-40 chars, lowercase letters/numbers/hyphens, no leading/trailing hyphen. Taken → kind:name_taken; bad format/reserved → kind:name_invalid. Ignored when updating with a token. Omit for an auto-generated fun-name. |
| note | string | Optional short label for this version, shown in list_versions (e.g. "added pricing section"). Max 200 chars. |
| files | object | Map of relative path => contents. MUST include "index.html" at the root (served at /). Paths are relative (no leading slash, no ".."). Each value is EITHER a string (text file) OR, for a binary asset like an image/font/favicon, an object {"encoding":"base64","data":"<base64>"}. So you can publish HTML + CSS + a logo in one call without zipping. |
| token | string | Manage token from a previous publish - updates the SAME url. Treat as a secret credential. |
| config | object | Optional serving config. Supported today: { "spa": true } — serve index.html for any path that is not a real file (so client-routed React/Vue/SvelteKit apps work on deep links + refresh), and optional "not_found":"404.html" for the fallback file. Other keys (redirects/headers) are rejected for now (not silently ignored). |
| source | string | Optional attribution tag for the builder/app/integration publishing on the user's behalf (e.g. "lovable", "v0", "my-gpt-name"). Shown on the claim page ("published with …"). Free-form, short. |
| notify_url | string | Optional HTTPS webhook. GearHost POSTs lifecycle events to it as JSON { event, name, url, ... } where event is "expiring_soon" (~6h before auto-removal), "expired" (removed), or "claimed" (the user kept it). Signed with X-GearHost-Signature (HMAC-SHA256 over the body, key = sha256("octane-preview-hook:v1:" + token)). |
| zip_base64 | string | Base64 of a .zip of the built site. MUST contain index.html at the archive root. Max ~25 MB. |
| project_key | string | Optional PERSISTENT HANDLE for cross-session editing without an account. A random secret of AT LEAST 16 characters (shorter is rejected with kind:bad_request) that you generate once and STORE. Best paired with name: publishing name + project_key creates the site and remembers the key; re-publishing the SAME name + project_key in any future session UPDATES that same URL (even after the per-publish token is gone). Wrong key for an existing name → kind:forbidden. If you pass project_key WITHOUT name, it updates your single site with that key (or, if the key has several sites, asks you to also pass name). Keep it secret — it is the write password. |
{
"type": "object",
"properties": {
"html": {
"type": "string",
"description": "HTML for a one-page site (served as index.html at the root)."
},
"name": {
"type": "string",
"description": "Optional subdomain for a NEW site: name:\"daily-grind\" → daily-grind.gearhost.io. 3-40 chars, lowercase letters/numbers/hyphens, no leading/trailing hyphen. Taken → kind:name_taken; bad format/reserved → kind:name_invalid. Ignored when updating with a token. Omit for an auto-generated fun-name."
},
"note": {
"type": "string",
"description": "Optional short label for this version, shown in list_versions (e.g. \"added pricing section\"). Max 200 chars."
},
"files": {
"type": "object",
"description": "Map of relative path => contents. MUST include \"index.html\" at the root (served at /). Paths are relative (no leading slash, no \"..\"). Each value is EITHER a string (text file) OR, for a binary asset like an image/font/favicon, an object {\"encoding\":\"base64\",\"data\":\"<base64>\"}. So you can publish HTML + CSS + a logo in one call without zipping.",
"additionalProperties": {
"oneOf": [
{
"type": "string"
},
{
"type": "object",
"required": [
"encoding",
"data"
],
"properties": {
"data": {
"type": "string"
},
"encoding": {
"enum": [
"base64"
],
"type": "string"
}
}
}
]
}
},
"token": {
"type": "string",
"description": "Manage token from a previous publish - updates the SAME url. Treat as a secret credential."
},
"config": {
"type": "object",
"properties": {
"spa": {
"type": "boolean",
"description": "Enable SPA fallback (rewrite unknown paths to index.html)."
},
"not_found": {
"type": "string",
"description": "Fallback file for unknown paths (default \"index.html\"). Must exist in your upload."
}
},
"description": "Optional serving config. Supported today: { \"spa\": true } — serve index.html for any path that is not a real file (so client-routed React/Vue/SvelteKit apps work on deep links + refresh), and optional \"not_found\":\"404.html\" for the fallback file. Other keys (redirects/headers) are rejected for now (not silently ignored)."
},
"source": {
"type": "string",
"description": "Optional attribution tag for the builder/app/integration publishing on the user's behalf (e.g. \"lovable\", \"v0\", \"my-gpt-name\"). Shown on the claim page (\"published with …\"). Free-form, short."
},
"notify_url": {
"type": "string",
"description": "Optional HTTPS webhook. GearHost POSTs lifecycle events to it as JSON { event, name, url, ... } where event is \"expiring_soon\" (~6h before auto-removal), \"expired\" (removed), or \"claimed\" (the user kept it). Signed with X-GearHost-Signature (HMAC-SHA256 over the body, key = sha256(\"octane-preview-hook:v1:\" + token))."
},
"zip_base64": {
"type": "string",
"description": "Base64 of a .zip of the built site. MUST contain index.html at the archive root. Max ~25 MB."
},
"project_key": {
"type": "string",
"description": "Optional PERSISTENT HANDLE for cross-session editing without an account. A random secret of AT LEAST 16 characters (shorter is rejected with kind:bad_request) that you generate once and STORE. Best paired with name: publishing name + project_key creates the site and remembers the key; re-publishing the SAME name + project_key in any future session UPDATES that same URL (even after the per-publish token is gone). Wrong key for an existing name → kind:forbidden. If you pass project_key WITHOUT name, it updates your single site with that key (or, if the key has several sites, asks you to also pass name). Keep it secret — it is the write password."
}
},
"additionalProperties": false
}Report a GearHost preview site being used for phishing/malware/abuse.
| Argument | Type | Description |
|---|---|---|
| name* | string | The preview fun-name, e.g. 'azure-lynx'. |
| reason* | string | What's wrong with it (phishing, malware, etc.). |
{
"type": "object",
"required": [
"name",
"reason"
],
"properties": {
"name": {
"type": "string",
"description": "The preview fun-name, e.g. 'azure-lynx'."
},
"reason": {
"type": "string",
"description": "What's wrong with it (phishing, malware, etc.)."
}
}
}Restore a site to a previous version (undo). Pass the manage token and the version number from list_versions. Restores that version's content to the live URL and resets the expiry timer. Returns structuredContent { status, url, restored_from, updated, url_ready_in_seconds }. Errors: version_not_found (no such version) | no_versions (nothing to roll back to) | invalid_token.
| Argument | Type | Description |
|---|---|---|
| token* | string | Manage token (write credential). |
| version* | integer | The version to restore, from list_versions. |
{
"type": "object",
"required": [
"token",
"version"
],
"properties": {
"token": {
"type": "string",
"description": "Manage token (write credential)."
},
"version": {
"type": "integer",
"description": "The version to restore, from list_versions."
}
}
}Take a published site DOWN immediately (delete it). Pass the manage token you got when you published. Use this to remove a site the moment it is no longer needed - or RIGHT AWAY if you accidentally published a secret (sites are public). Without this, a site only auto-expires ~72h after its last publish. Returns structuredContent { status:"deleted", url, deleted:true }. (A site that was CLAIMED into an account is a real CloudSite - delete it from the GearHost dashboard, not here.)
| Argument | Type | Description |
|---|---|---|
| token* | string | The manage token returned when the site was published. |
{
"type": "object",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "The manage token returned when the site was published."
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 10, 2026.
Takes a password, API key or token as an argument, so the secret passes through the model's context and chat logs.
Fix: Read credentials from the server's own configuration (environment, OAuth) instead of a tool argument.