io.github.Reachpad/reachpad-mcp

Est-ce que io.github.Reachpad/reachpad-mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.Reachpad/reachpad-mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 25 outils

• create_app≈ 955 tokens

  Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.

  Paramètres, retour & exemple (8)

  Paramètres

  • name · string · requis
    What the app is called. Shown in listings.
  • slug · string · optionnel
    The readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is never taken and two apps may share one.
  • type · string · optionnel · app | page | doc | file
    The badge on the row. Defaults to app.
  • files · array · requis
    Files to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/NNNN_name.sql, run in order when the version goes live.
  • access · object · optionnel
    Who may open the link. Defaults to org_link.
  • message · string · optionnel
    What version 1 contains.
  • manifest · object · optionnel
    Omit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and env apply only to functions. Runtime details and limits: https://reachpad.dev/SKILL.md
  • validate · boolean · optionnel
    Check without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characters assigned on publish. Does not check the org app limit; publishing can still fail for that.

  Exemple d'appel

  {"name": "create_app", "arguments": {"name": "texte", "files": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_app_logs≈ 217 tokens

  Read recent log lines from the live version of a function app. An app that serves files has no process and answers that it has no logs. Function logs are not captured yet either, and the answer says so: until they are, have the function catch its own errors and return them in the response.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    How many rows to return. Defaults to 50.
  • since · string · optionnel
    RFC 3339 timestamp to read from.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "get_app_logs", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_app_shares≈ 131 tokens

  List the people an app is shared with, their roles, and whether the grant has attached to an account yet. The owner and editors can read this list.

  Paramètres, retour & exemple (1)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "list_app_shares", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_app_versions≈ 206 tokens

  List an app's versions, newest first. Versions are immutable and numbered from 1. Earlier versions open for the app's editors; the live link follows the app's access setting. Pass the next_cursor from a previous call to get the next page.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    How many rows to return. Defaults to 50.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • cursor · string · optionnel
    next_cursor from a previous call.

  Exemple d'appel

  {"name": "list_app_versions", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_secrets≈ 100 tokens

  List the organization's secrets: each name, who set it, when, and the apps whose versions bind it. Names only. No tool anywhere returns a secret value.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_secrets", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• ls≈ 157 tokens

  List what is directly inside one folder: its subfolders and the apps filed in it. Omit folder_id for the top level. Each folder carries the updated_at that mv needs.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · integer · optionnel
    How many rows to return. Defaults to 50.
  • folder_id · string · optionnel
    The folder to look inside. Omit for the top level.

  Exemple d'appel

  {"name": "ls", "arguments": {"limit": 1, "folder_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• mkdir≈ 120 tokens

  Create a folder, at the top level or inside another one.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    The folder name.
  • parent_id · string · optionnel
    The folder to create it inside. Omit for the top level.

  Exemple d'appel

  {"name": "mkdir", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• mv≈ 288 tokens

  Move an app into a folder, or move a folder under another folder. Name exactly one of app_id or folder_id as the thing being moved, and to_folder_id as the destination, or null for the top level. Moving a folder also needs base_updated_at, the value read from ls or tree, so a move made against a stale reading is refused instead of undoing someone else's.

  Paramètres, retour & exemple (4)

  Paramètres

  • app_id · string · optionnel
    The app to move. Name this or folder_id, not both.
  • folder_id · string · optionnel
    The folder to move. Name this or app_id, not both.
  • to_folder_id · string|null · requis
    The destination folder id, or null to move to the top level.
  • base_updated_at · string · optionnel
    The moved folder's updated_at, from ls or tree. Required when folder_id is given.

  Exemple d'appel

  {"name": "mv", "arguments": {"to_folder_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• publish_app_version≈ 189 tokens

  Make one version of an app live by its number. This is how a version staged with publish false goes on the link, and how an app is rolled back: name an older number and that version is what the link serves again. Nothing is rebuilt, the pointer moves.

  Paramètres, retour & exemple (2)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • number · integer · requis
    The version number to make live.

  Exemple d'appel

  {"name": "publish_app_version", "arguments": {"app_id": "texte", "number": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• query_app_db≈ 278 tokens

  Run one SQL statement against a function app's own database, to read rows and to fix data. Not for schema: a table or a column belongs in the version's migrations/NNNN_name.sql, and a statement that changes the schema is refused. Owners and editors only. Answers rows and rowCount for a select, and changes with lastInsertRowid for a write.

  Paramètres, retour & exemple (3)

  Paramètres

  • sql · string · requis
    One statement, with ? placeholders for every value that comes from somewhere else. A second statement in the same string is refused.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • params · array · optionnel
    The values for the ? placeholders, in order. Strings, numbers, booleans and null.

  Exemple d'appel

  {"name": "query_app_db", "arguments": {"sql": "texte", "app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_app≈ 287 tokens

  Read one app before update_app: its name, type, access level and publishing mode, plus base_version_id and its files, which both describe the version the next edit builds on. Each text file carries its content, so this is how you see what an app already contains before changing it. A file marked content_omitted answer budget did not fit in this answer and read_app_file fetches it; one marked too large is past what any tool answer carries. Pass that base_version_id to update_app. version is what the link serves now, and head_version is the version base_version_id names on the apps where that is not the live one, which is every app with a version staged by publish false. pending_version is the number of that staged version, and publish_app_version is what makes it live.

  Paramètres, retour & exemple (1)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "read_app", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_app_file≈ 254 tokens

  Read one file out of an app as text, at most 256 KB. Use it for a file that read_app left out with content_omitted: "answer budget", or to fetch a single file without the rest of the app. A file that is not text, and a text file over that size, are refused rather than truncated. Reads the newest version unless you name one, which is the same version read_app lists.

  Paramètres, retour & exemple (3)

  Paramètres

  • path · string · requis
    The path inside the app, as it appears in read_app's files, for example index.html.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • number · integer · optionnel
    The version number to read from. Defaults to the newest version.

  Exemple d'appel

  {"name": "read_app_file", "arguments": {"path": "texte", "app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_app_preview≈ 196 tokens

  Look at the picture of what an app's link serves right now, as an image. Use it for an app whose files you cannot read: a function app's module stays with the people who develop it, so this is how you see what the app actually shows. It is the live version only, and an app published before its picture was taken, or one whose capture has not run yet, answers that there is no picture rather than an error.

  Paramètres, retour & exemple (1)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "read_app_preview", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• read_app_version≈ 190 tokens

  Read one version by its number, with its files and each text file's content. Use it to see what an earlier publish contained, and to copy a file back out of a version you want to return to. Earlier versions open for the app's editors; the live link follows the app's access setting.

  Paramètres, retour & exemple (2)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • number · integer · requis
    The version number.

  Exemple d'appel

  {"name": "read_app_version", "arguments": {"app_id": "texte", "number": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• remove_secret≈ 143 tokens

  Remove one organization secret and delete it from every published version that binds it. A version the deletion did not reach keeps the name in the list with that version in failed, and running this again retries exactly those.

  Paramètres, retour & exemple (1)

  Paramètres

  • name · string · requis
    The secret name, from list_secrets.

  Exemple d'appel

  {"name": "remove_secret", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• revoke_app_share≈ 158 tokens

  Remove one share by its id, from list_app_shares. The app itself is untouched. The owner or an editor may use this when editor-managed sharing is enabled.

  Paramètres, retour & exemple (2)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • share_id · string · requis
    The share id. Starts with shr_.

  Exemple d'appel

  {"name": "revoke_app_share", "arguments": {"app_id": "texte", "share_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• rmdir≈ 122 tokens

  Delete an empty folder. This refuses while the folder still holds apps or subfolders, and it never deletes an app. Move the contents out first.

  Paramètres, retour & exemple (1)

  Paramètres

  • folder_id · string · requis
    The folder to delete.

  Exemple d'appel

  {"name": "rmdir", "arguments": {"folder_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_apps≈ 290 tokens

  Find apps in the caller's organization by text. This matches substrings of the name and the slug, and whole words on the live version's page, not meaning: search for a word that appears in the title or on the page rather than describing the app. Returns ids and live URLs.

  Paramètres, retour & exemple (5)

  Paramètres

  • q · string · optionnel
    Text to match against the name, the slug and the words on the live page.
  • type · string · optionnel · app | page | doc | file
    Keep only apps carrying this badge.
  • limit · integer · optionnel
    How many rows to return. Defaults to 50.
  • created_by · string · optionnel
    Keep only apps owned by this user id or email address.
  • updated_by · string · optionnel
    Keep only apps owned by this user id or email address. Version authors are not indexed in v1, so this filters on the owner.

  Exemple d'appel

  {"name": "search_apps", "arguments": {"q": "texte", "type": "app", "limit": 1, "created_by": "texte", "updated_by": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_app_access≈ 266 tokens

  Change who can open an app: restricted (only the owner and named people), org_link (anyone signed in to the organization), or public_link (anyone with the URL). A password and an expiry apply to a public link only. Owner only.

  Paramètres, retour & exemple (6)

  Paramètres

  • level · string · requis · restricted | org_link | public_link
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • password · string · optionnel
    Set a password on a public link.
  • expires_at · string · optionnel
    RFC 3339 timestamp after which a public link stops working.
  • clear_expiry · boolean · optionnel
    Remove the expiry.
  • clear_password · boolean · optionnel
    Remove the password.

  Exemple d'appel

  {"name": "set_app_access", "arguments": {"level": "restricted", "app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_secret≈ 257 tokens

  Set one organization secret, so a function can bind it by name in its manifest secrets list. Any member of the organization. Setting a name that already exists replaces the value and rotates it onto every published version that binds it. Answers the name, how many versions took the new value, and the ids of any that did not.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    The environment variable name the function reads, for example STRIPE_SECRET_KEY. Letters, digits and underscores.
  • value · string · requis
    The value. It is sealed on write: no tool returns it, this one included, and it is never written to a log or to this app's database. Ask the person to paste it themselves rather than repeating a key from earlier in the conversation.

  Exemple d'appel

  {"name": "set_secret", "arguments": {"name": "texte", "value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• share_app≈ 210 tokens

  Give one email address access to an app as a viewer or an editor. An address without an account gets a grant that starts working the first time they sign in. The owner or an editor may use this when the owner has enabled editor-managed sharing.

  Paramètres, retour & exemple (3)

  Paramètres

  • role · string · requis · viewer | editor
    viewer can open it, editor can also publish versions.
  • email · string · requis
    The address to share with.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "share_app", "arguments": {"role": "viewer", "email": "texte", "app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• trash_app≈ 154 tokens

  Move an app to the trash. Its link stops opening at once. Owner only. The app and its versions are kept and can be restored from Trash at reachpad.dev/apps/trash, which is also the only place an app is deleted for good.

  Paramètres, retour & exemple (1)

  Paramètres

  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.

  Exemple d'appel

  {"name": "trash_app", "arguments": {"app_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• tree≈ 111 tokens

  The whole folder tree for the organization, nested, with the number of apps filed in each folder and the count sitting at the top level. Each node carries the updated_at that mv needs.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "tree", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_app≈ 1159 tokens

  Publish a new version of an existing app. Read the app first and pass the base_version_id read_app returns: it names the version this edit builds on, and a base that has moved is refused rather than overwritten. By default the new version replaces the whole file set and goes live immediately unless the app is set to review before publishing. Send mode merge to publish only the files that changed and keep the rest of that version's files, with remove for paths to drop. Two merges in a row build on each other, staged versions included. Send validate true to check the call without publishing, or publish false to stage the version and make it live later with publish_app_version.

  Paramètres, retour & exemple (9)

  Paramètres

  • mode · string · optionnel · replace | merge
    replace, the default, publishes files as the whole file set: anything left out is gone. merge sends only the files that changed and carries every other file of the base version into the new version.
  • files · array · requis
    Files to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/NNNN_name.sql, run in order when the version goes live.
  • app_id · string · requis
    The app id, as returned by search_apps or create_app. Starts with app_.
  • remove · array · optionnel
    Paths from the base version to leave out of the new one. Merge only, and a path that is not in the base version is refused rather than ignored. A call that only removes files sends an empty files array.
  • message · string · optionnel
    What changed in this version.
  • publish · boolean · optionnel
    false stages the version instead of putting it on the link. It is built and readable at its own version URL, and publish_app_version makes it live. Defaults to true.
  • manifest · object · optionnel
    Omit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and env apply only to functions. Runtime details and limits: https://reachpad.dev/SKILL.md
  • validate · boolean · optionnel
    Check without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characters assigned on publish. Does not check the org app limit; publishing can still fail for that.
  • base_version_id · string · requis
    The base_version_id read_app returned, which is the version this edit was made against. Starts with ver_.

  Exemple d'appel

  {"name": "update_app", "arguments": {"files": [], "app_id": "texte", "base_version_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• whoami≈ 196 tokens

  Report the account and the organization this connection is signed in as: user id, email and name, plus org id and name, and `orgs`, every organization the account is in with the current one marked. Takes no arguments. Every app is created in the current organization and nowhere else, so call this before publishing when the person named an organization to publish into, and stop if the org id is not the one they named: switching is done at reachpad.dev/apps, from the organization name at the top of the sidebar, and this connection follows it.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "whoami", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://reachpad.dev/mcp