Loading…
Manage Dock workspaces, rows, and activity logs through a standardized MCP interface.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The dock MCP server exposes 68 tools, focused primarily on communication, filesystem, and web capabilities. Its published description reads: "Manage Dock workspaces, rows, and activity logs through a standardized MCP interface". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates dock F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check dock's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add dock to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://trydock.ai/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List all workspaces the authenticated principal has access to. Returns workspace name (slug), mode (the default-view preference for the first tab), and creation date. A workspace is a container of one
Get details about a specific workspace by its slug, including columns of its primary table surface, member count, and row count. A workspace contains one or more surfaces (tabs): any combination of `t
List rows in a workspace's table surface. Returns rows with their data (a JSON object of column-name to value), creation time, the principal who created/updated each row, AND the row's `surface_slug`
Append a new row to a workspace's table surface. The data field is a JSON object with column-name keys. Status column accepts: drafted, queued, sealed, active, blocked. Works on any workspace; columns
Fetch a single row by id without listing the full table. Useful when a cue payload carries a row id and the agent only needs that one record. Returns the same row shape as list_rows.
Update specific fields of an existing row. Only the fields provided in `data` are updated; others are preserved. Setting `surface_slug` to a different sheet than the row currently lives on MOVES the r
Permanently delete a row from a workspace. This action cannot be undone.
Atomically move N rows from their current sheet(s) to a target sheet inside the same workspace. Use for programmatic data migration: dropping a batch of agent-produced drafts onto the right sheet, reo
Read a workspace's doc (TipTap rich-text) body. Format is negotiable via `format`: `markdown` (default — CommonMark + GFM, ready to feed to an LLM or render in a non-ProseMirror surface), `content` (T
Return a table surface's column definitions so an agent knows what keys create_row/update_row will accept. Each column has `key` (the field name in row.data), `label` (human-readable), `type` (text |
Append a single column to a workspace's table schema. Position is auto-computed as next-after-max so the contiguity invariant holds. Key collision (409) if a column with the same key already exists. E
List principals with explicit access to a workspace. Returns users (id, name, email; email visible only when the caller is in the same org) and agents (id, name, brandKey) along with their role (owner
Archive a workspace. Soft-delete: rows, doc body, and activity history are preserved, and the workspace can be restored from Settings · Archived. Every member loses access immediately. Idempotent: cal
Rename a workspace, change its slug, switch its default-view mode, or flip its visibility (private | org | unlisted | public). Pass any subset of `name`, `new_slug`, `mode`, `visibility`; fields you o
Invite a human (by email) to a workspace at a specified role. If the email already belongs to a Dock user they're added immediately and a notification email is sent; if not, a 7-day invite token is mi
Change an existing workspace member's role. Editor role required to caller. Owner-tier transitions (promoting to or demoting from owner) require an owner caller. Demoting the sole owner is blocked; pr
Remove a workspace member. Editor role required; owner-tier removals require an owner caller. Sole-owner removal is blocked; promote someone else first. Note: if the workspace visibility is `org`, rem
Replace a workspace's doc body. Takes EITHER TipTap JSON (`content`) OR Markdown (`markdown`): pass markdown when you're producing prose from scratch (CommonMark + GFM is the format every LLM emits na
Pre-flight check on markdown BEFORE writing it via update_doc / append_doc_section. Returns { ok, errors, warnings, parsed } with parsed counts per format type (imageCount, videoCount, mermaidCount, m
Replace a single section of a workspace's doc body, identified by its heading text. The targeted edit complement to `update_doc` (full replacement) and `append_doc_section` (append-only at the end). U
Append a chunk of Markdown to the END of a workspace's doc body. Designed for crons + ingest agents that produce content in timestamped chunks (changelog updates, daily standups, batch summaries). Sam
Read an HTML surface's body. HTML surfaces (Surface.kind="html") store mockup or full-page content as three text fields (html, css, js) rendered together inside a sandboxed iframe. Use `list_surfaces`
Write an HTML surface's body. Pass any of `html` / `css` / `js`; omitted fields stay unchanged. Pass empty string to clear. The surface renders in a sandboxed iframe on a separate origin (`render.tryd
Pre-flight check on html / css / js BEFORE writing via update_html. Returns { ok, errors, warnings, parsed } where parsed has byte counts per field and `dropped` (true if the sanitizer would strip any
Create a new workspace in the caller's org. Works for both user and agent callers; agent-created workspaces attribute to the agent and enroll the agent's owning user as a co-owner so the human sees it
Get recent activity events for a workspace. Who did what, when. Useful for understanding what's happened since you last looked.
Search across everything the caller can already touch: workspace names, row cell values, and doc sections/paragraphs. Returns ranked hits (score 0-1) with a navigable URL per hit so the agent can open
Get the caller's org billing summary: current plan (free, pro, or scale), active counts and caps for every gated resource (agents, members, workspaces, rows per workspace, API calls per month, webhook
Move the caller's org to Pro ($19/mo flat, 10 agents, 20 members, 200 workspaces, 5k rows per workspace) or Scale ($49/mo flat, 30 agents, 60 members, 1,000 workspaces, 50k rows per workspace). The bi
Schedule a downgrade to Free at the end of the current billing period. The org keeps its current plan (Pro or Scale) and paid limits until the period ends. No-op when already on Free. Consent-gated. T
Ask Dock to raise a plan limit (agents, workspaces, rows, or other). We record the signal on the admin side; there's no reply loop. Use this when you hit a cap you can't resolve with upgrade_plan (e.g
List the surfaces (tabs) inside a workspace. A workspace can hold any combination of `table` (rows + columns) and `doc` (TipTap body) surfaces, one or many of either kind; this tool tells you exactly
Create a new surface (tab) inside a workspace. `kind` picks `table`, `doc`, `html`, or `files`. Optional `slug` (lowercase kebab-case, 3-64 chars); when omitted the server slugifies `name` and appends
Rename, reslug, reorder, OR replace the column schema of a surface. Pass any subset of `name`, `new_surface_slug`, `position`, `columns`. Position is 0-based and is normalised across siblings so posit
Archive a surface (soft-delete). Rows + doc body are preserved for restore. Idempotent: calling on an already-archived surface returns its current archivedAt unchanged. Cannot archive the only live su
List API keys. Agent callers see only the key they're authenticated with (a one-row response: id, prefix, lastUsedAt, the workspace it's bound to). User callers (cookie session) see every key for ever
Atomically mint a new API key with the same agent / workspace / scopes / name and revoke the old one. Returns the new plaintext (`key`) once; store it before discarding the response. Subsequent reques
Revoke an API key (soft-delete via `revokedAt`). Subsequent requests with the key return 401. Agents may revoke ONLY their own key; calling this is effectively a self-destruct, the response itself com
Ask the human owner to revoke ANOTHER agent's active API key (sibling agent). The MCP `revoke_api_key` tool is self-only by design; this is the cross-agent escalation path. Returns { status: 'approval
Ask the human owner to rotate ANOTHER agent's active API key (mint a new one + revoke the old). Same shape as request_revoke_agent_key: returns an approval_url, requires the target agent's owner to cl
List webhook endpoints registered on an org. Returns each webhook's id, url, subscribed events, active flag, and an 8-char `secretPreview` of the signing secret (full secret is only returned at create
Register a new webhook endpoint on an org. The URL must be public (loopback / private ranges / cloud metadata are blocked at create-time AND re-validated by DNS at delivery-time). Events array filters
Toggle a webhook's `active` flag on or off. Inactive webhooks are skipped at delivery time (no retry queue, no log row) but the endpoint config is preserved so flipping back is one call. Use to silenc
Mint a fresh signing secret for a webhook. The new `secret` is returned exactly once; copy it to the receiver before the next event lands. After this call, deliveries are signed with the new secret on
Permanently delete a webhook endpoint. The URL stops receiving events immediately and the secret is destroyed; recreate from scratch if you need to re-add it. To pause without losing config, use updat
Send a direct message to another agent or human in the messaging substrate. Wires through cue.dock.svc, the same path the /live UI uses, so the recipient sees this message in their drawer (and, once t
File a support ticket. Mirrors to a GitHub issue in Dock's support repo and shows up in the user's dashboard at /settings/support. Use this for bugs (you hit an error), feature requests (Dock is missi
List support tickets (READ-ONLY) from Dock's support repo. These are the SAME tickets create_support_ticket files, so the list reflects ALL tickets — whether routed through chat or filed directly via
Read ONE support ticket by its number (as shown in list_support_tickets), including the full body/description. Read-only, scoped to Dock's support repo. Returns not-found for a number that isn't a sup
List the Dock Sheets formula functions an agent can use in a cell carrier. Returns the canonical name, signature, one-sentence description, category (Math/Logic/Text/Date/Lookup/Predicates), rollout s
Parse-check a formula expression server-side without writing anything. Returns { ok, error?, rewrittenFormula?, referencedFunctions, unknownFunctions }. Use BEFORE update_row / create_row when the for
Evaluate a formula expression against an actual Dock workspace's columns + rows, server-side, returning the same display value the UI's HyperFormula engine would render. Two modes: STANDALONE (omit `w
Post a new comment on any target in a workspace: a row, a cell, a doc text range, an html element, an entire surface, or the workspace itself. Polymorphic target shape mirrors the REST POST /api/works
List comments in a workspace. Filter by `target_type` (row, cell, doc_range, html_element, surface, workspace), `target_id`, `surface` (returns every comment anchored to any element of one surface, us
Fetch a single comment with its replies + reactions in one round trip. Pass any comment id in the thread (root or reply). Returns `{ comment, replies }` where each entry includes aggregated reactions
Convenience wrapper around `add_comment` for the common reply case. Pass the parent comment id and the body; the handler reconstructs the target from the parent (no need for the agent to remember whet
Mark a comment thread resolved. Idempotent: calling on an already-resolved thread returns the existing `resolvedAt` unchanged. Fires `comment.resolved`. Pair with `unresolve_comment` for the reverse.
Re-open a previously-resolved comment thread. Idempotent on already-unresolved comments. Fires `comment.unresolved` with `reason: 'manual'`. (Auto-unresolve on reply fires the same event with `reason:
Add or remove an emoji reaction to a comment. Reactions are per-principal: each (commentId, principalId, emoji) combination is unique. `action: 'add'` is idempotent (re-adding the same emoji is a no-o
List the folder + file children of a Files surface (kind='files'). Folders sorted first by position then name; files sorted by name. Returns folders[], files[] with cuids agents can pass to `get_file`
Fetch metadata + a download URL for a single file by id. The `download_url` field is a direct Vercel Blob URL valid until the file is hard-deleted (Phase 5; Phase 6 wires a files.trydock.ai signed-URL
Soft-delete a file by id. Moves to a 30-day trash window before the cleanup cron hard-deletes + refunds the storage quota. Restorable via the REST PATCH endpoint (`PATCH /api/workspaces/{slug}/files/{
Mint a public share token for a file. Returns a `url` of the form `https://trydock.ai/share/files/<token>` that anyone (no auth) can open to view + download the file. The token is 32 random bytes (~25
Soft-revoke a share token minted via `share_file`. The public `/share/files/<token>` URL stops resolving immediately. Idempotent: revoking an already-revoked token returns `alreadyRevoked: true` witho
List the 50 most recently updated files in a Files surface, sorted by `updatedAt` descending. Flat surface-wide list; ignores folder structure. Useful for an agent answering 'what changed lately' or '
Lists the agents you can reach — your own agents AND agents shared to you from other owners. To MESSAGE any of them, use the `message_teammate` tool (it delivers AND wakes the recipient). Do NOT use s
List the provider API keys your owner has stored in their Vault (e.g. Gemini, ElevenLabs, OpenAI) so you can use them in a task. Returns `capabilities`: the exact NAMES of the keys your owner has vaul
Pull one provider API key your owner has vaulted, so you can use it for the task at hand (e.g. call the Gemini or ElevenLabs API). Pass `name` = the EXACT capability name from `list_capabilities` (a m
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: send_message
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
}` on success. IMPORTANT: this tool QUEUES a message to the recipient's iRecommendationRemove model-directed instructions from tool descriptions.
tool: list_capabilities
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
to call freely. IMPORTANT: this lists what EXISTS in the Vault — it is disRecommendationRemove model-directed instructions from tool descriptions.
tool: pull_capability
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
RIZATION — read before calling: only pull a key when your OWNER directs you to in THIS thread, in their own voice, for …RecommendationRemove model-directed instructions from tool descriptions.
tool: list_workspaces
A tool description tries to alter the model’s use of another tool.
ther kind. Use `list_surfaces` to see what a given workspace actually containRecommendationDescriptions must describe only their own tool.
tool: get_workspace
A tool description tries to alter the model’s use of another tool.
of either. Use `list_surfaces` to enumerate every tab; fetch /rows or /doc toRecommendationDescriptions must describe only their own tool.
tool: create_row
A tool description tries to alter the model’s use of another tool.
ace them, call `add_column`, or retry with `auto_create_columns: true`. *RecommendationDescriptions must describe only their own tool.
tool: get_row
A tool description tries to alter the model’s use of another tool.
me row shape as list_rows.RecommendationDescriptions must describe only their own tool.
tool: update_row
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_doc
A tool description tries to alter the model’s use of another tool.
-trippable into update_doc for structural edits), `text` (plain text, bestRecommendationDescriptions must describe only their own tool.
tool: get_workspace_schema
A tool description tries to alter the model’s use of another tool.
knows what keys create_row/update_row will accept. Each column has `key` (RecommendationDescriptions must describe only their own tool.
tool: add_column
A tool description tries to alter the model’s use of another tool.
additions; use get_workspace_schema + update_workspace_columns (PUT on /columns) foRecommendationDescriptions must describe only their own tool.
tool: share_workspace
A tool description tries to alter the model’s use of another tool.
(new user). Use update_workspace_member to change a role afterwards, remove_workspace_mRecommendationDescriptions must describe only their own tool.
tool: remove_workspace_member
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
set to the same token. User callers (cookie session) skip the consentRecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_doc
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: validate_doc_markdown
A tool description tries to alter the model’s use of another tool.
writing it via update_doc / append_doc_section. Returns { ok, errors, warRecommendationDescriptions must describe only their own tool.
tool: update_doc_section
A tool description tries to alter the model’s use of another tool.
complement to `update_doc` (full replacement) and `append_doc_section` (aRecommendationDescriptions must describe only their own tool.
tool: append_doc_section
A tool description tries to alter the model’s use of another tool.
down surface as update_doc: supports CommonMark, GFM, **`` inliRecommendationDescriptions must describe only their own tool.
tool: get_html
A tool description tries to alter the model’s use of another tool.
ed iframe. Use `list_surfaces` to enumerate html surfaces in a workspace. OmiRecommendationDescriptions must describe only their own tool.
tool: update_html
A tool description tries to alter the model’s use of another tool.
to override any of it; nothing in the baseline is !important, so a surfRecommendationDescriptions must describe only their own tool.
tool: validate_html
A tool description tries to alter the model’s use of another tool.
ORE writing via update_html. Returns { ok, errors, warnings, parsed } whereRecommendationDescriptions must describe only their own tool.
tool: create_workspace
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_billing
A tool description tries to alter the model’s use of another tool.
his. Use before upgrade_plan to check whether you're actually capped, and afRecommendationDescriptions must describe only their own tool.
tool: upgrade_plan
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
-mode only. The token returned by the first call as `confirm_token`.RecommendationRemove side-channel parameters; constrain tool inputs.
tool: downgrade_plan
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
-mode only. The token returned by the first call as `confirm_token`.RecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_limit_increase
A tool description tries to alter the model’s use of another tool.
't resolve with upgrade_plan (e.g. you're already Pro but need a custom limiRecommendationDescriptions must describe only their own tool.
tool: create_surface
A tool description tries to alter the model’s use of another tool.
te content via `update_html`. `files` surfaces start empty; browse them witRecommendationDescriptions must describe only their own tool.
tool: update_surface
A tool description tries to alter the model’s use of another tool.
html kind. Use `get_workspace_schema` first to fetch the current shape, mutate it, sRecommendationDescriptions must describe only their own tool.
tool: rotate_api_key
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
rotate_api_key Atomically mint a new API key with the same ageRecommendationRemove side-channel parameters; constrain tool inputs.
tool: revoke_api_key
A tool description tries to alter the model’s use of another tool.
n the gap, use `rotate_api_key` instead.RecommendationDescriptions must describe only their own tool.
tool: request_revoke_agent_key
A tool description tries to alter the model’s use of another tool.
gent). The MCP `revoke_api_key` tool is self-only by design; this is the crossRecommendationDescriptions must describe only their own tool.
tool: request_rotate_agent_key
A tool description tries to alter the model’s use of another tool.
. Same shape as request_revoke_agent_key: returns an approval_url, requires the target aRecommendationDescriptions must describe only their own tool.
tool: create_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ns the signing `secret` exactly once (whsec_… prefixed); store it on tRecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: rotate_webhook_secret
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
rotate_webhook_secret Mint a fresh signing secret for a webhook. TheRecommendationRemove side-channel parameters; constrain tool inputs.
tool: delete_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: delete_webhook
A tool description tries to alter the model’s use of another tool.
ing config, use update_webhook with active:false instead.RecommendationDescriptions must describe only their own tool.
tool: create_support_ticket
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_support_ticket
A tool description tries to alter the model’s use of another tool.
ng else. Prefer request_limit_increase when the user is simply hitting a plan cap.RecommendationDescriptions must describe only their own tool.
tool: list_support_tickets
A tool description tries to alter the model’s use of another tool.
he SAME tickets create_support_ticket files, so the list reflects ALL tickets — whethRecommendationDescriptions must describe only their own tool.
tool: get_support_ticket
A tool description tries to alter the model’s use of another tool.
er (as shown in list_support_tickets), including the full body/description. Read-onlRecommendationDescriptions must describe only their own tool.
tool: list_sheet_functions
A tool description tries to alter the model’s use of another tool.
ia update_row / create_row so you only reference functions that actually eRecommendationDescriptions must describe only their own tool.
tool: validate_formula
A tool description tries to alter the model’s use of another tool.
RE update_row / create_row when the formula references functions or syntaxRecommendationDescriptions must describe only their own tool.
tool: evaluate_formula
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
valuate_formula Evaluate a formula expression against an actual Dock workspace's columns + roRecommendationAnnotate destructive tools and require human approval.
tool: add_comment
A tool description tries to alter the model’s use of another tool.
target, prefer `reply_to_comment` which derives the target from the parent. EditRecommendationDescriptions must describe only their own tool.
tool: list_comments
A tool description tries to alter the model’s use of another tool.
oundaries. Use `get_comment_thread` to pull a single comment plus its replies + reRecommendationDescriptions must describe only their own tool.
tool: reply_to_comment
A tool description tries to alter the model’s use of another tool.
wrapper around `add_comment` for the common reply case. Pass the parent comRecommendationDescriptions must describe only their own tool.
tool: resolve_comment
A tool description tries to alter the model’s use of another tool.
ed`. Pair with `unresolve_comment` for the reverse. Used by agents to close a feeRecommendationDescriptions must describe only their own tool.
tool: unresolve_comment
A tool description tries to alter the model’s use of another tool.
is handled by `add_comment` / `reply_to_comment`.)RecommendationDescriptions must describe only their own tool.
tool: list_files
A tool description tries to alter the model’s use of another tool.
ts can pass to `get_file` / `delete_file`. `parent_folder_id` defaults tRecommendationDescriptions must describe only their own tool.
tool: delete_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
elete_file Soft-delete a file by id. Moves to a 30-day trash window before thRecommendationAnnotate destructive tools and require human approval.
tool: share_file
A tool description tries to alter the model’s use of another tool.
oke later with `revoke_file_share`. Editor role required. Gated behind FILES_SURFRecommendationDescriptions must describe only their own tool.
tool: revoke_file_share
A tool description tries to alter the model’s use of another tool.
ken minted via `share_file`. The public `/share/files/<token>` URL stops rRecommendationDescriptions must describe only their own tool.
tool: address_book
A tool description tries to alter the model’s use of another tool.
nt). Do NOT use send_message for an agent — that path does not wake them andRecommendationDescriptions must describe only their own tool.
tool: list_capabilities
A tool description tries to alter the model’s use of another tool.
es verbatim to `pull_capability` — do NOT guess or normalize it (a key may be vRecommendationDescriptions must describe only their own tool.
tool: pull_capability
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ll one provider API key your owner has vaulted, so you can use it for tRecommendationRemove side-channel parameters; constrain tool inputs.
tool: pull_capability
A tool description tries to alter the model’s use of another tool.
lity name from `list_capabilities` (a mismatched name fails the same way a missinRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
`rotate_webhook_secret` / `delete_webhook`. # Self-manage org settingRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
d of typesetting math in code blocks or as plain text. - **Callouts** → `>RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_workspace
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_workspace"RecommendationScope tools to the minimum needed.
tool: create_row
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_row"RecommendationScope tools to the minimum needed.
tool: update_row
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_row"RecommendationScope tools to the minimum needed.
tool: delete_row
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_row"RecommendationScope tools to the minimum needed.
tool: move_rows
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "move_rows"RecommendationScope tools to the minimum needed.
tool: get_workspace_schema
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_workspace_schema"RecommendationScope tools to the minimum needed.
tool: add_column
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_column"RecommendationScope tools to the minimum needed.
tool: delete_workspace
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_workspace"RecommendationScope tools to the minimum needed.
tool: update_workspace
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_workspace"RecommendationScope tools to the minimum needed.
tool: remove_workspace_member
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "remove_workspace_member"RecommendationScope tools to the minimum needed.
tool: update_doc
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_doc"RecommendationScope tools to the minimum needed.
tool: update_doc
Role tokens or delimiter abuse steer the model rather than describe the tool.
onvention). - **```mermaid** fenced code → diagram (15 sub-types: fRecommendationWrite neutral, descriptive tool metadata.
tool: update_doc
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
ontaining only `https://cdn.dock.ai/2025-launch-walkthrough.mp4`. Mid-paragraph URLs stay as plain links — surrouRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: validate_doc_markdown
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "validate_doc_markdown"RecommendationScope tools to the minimum needed.
tool: update_doc_section
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_doc_section"RecommendationScope tools to the minimum needed.
tool: append_doc_section
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "append_doc_section"RecommendationScope tools to the minimum needed.
tool: append_doc_section
Role tokens or delimiter abuse steer the model rather than describe the tool.
5 GB per file), ```mermaid diagrams, $math$/$$math$$ KaTeX, > [!NOTRecommendationWrite neutral, descriptive tool metadata.
tool: update_html
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_html"RecommendationScope tools to the minimum needed.
tool: validate_html
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "validate_html"RecommendationScope tools to the minimum needed.
tool: create_workspace
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_workspace"RecommendationScope tools to the minimum needed.
tool: upgrade_plan
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upgrade_plan"RecommendationScope tools to the minimum needed.
tool: downgrade_plan
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "downgrade_plan"RecommendationScope tools to the minimum needed.
tool: create_surface
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_surface"RecommendationScope tools to the minimum needed.
tool: update_surface
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_surface"RecommendationScope tools to the minimum needed.
tool: delete_surface
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_surface"RecommendationScope tools to the minimum needed.
tool: list_api_keys
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_api_keys"RecommendationScope tools to the minimum needed.
tool: revoke_api_key
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "revoke_api_key"RecommendationScope tools to the minimum needed.
tool: list_webhooks
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_webhooks"RecommendationScope tools to the minimum needed.
tool: create_webhook
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_webhook"RecommendationScope tools to the minimum needed.
tool: delete_webhook
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_webhook"RecommendationScope tools to the minimum needed.
tool: send_message
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "send_message"RecommendationScope tools to the minimum needed.
tool: validate_formula
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "validate_formula"RecommendationScope tools to the minimum needed.
tool: add_comment
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "add_comment"RecommendationScope tools to the minimum needed.
tool: react_to_comment
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "react_to_comment"RecommendationScope tools to the minimum needed.
tool: list_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
list_files List the folder + file children of a Files surface (kind='files'). FolRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: list_files
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "parent_folder_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: delete_file
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "delete_file"RecommendationScope tools to the minimum needed.
tool: delete_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
elete_file Soft-delete a file by id. Moves to a 30-day trash window before thRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "file_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: share_file
The description pairs a fetch imperative with a hardcoded external URL, letting the server relocate its real instructions off-metadata and mutate them after review. Fires only when a fetch verb and a URL co-occur, so benign documentation links do not.
l` of the form `https://trydock.ai/share/files/<token>` that anyone (no auth) can open to viewRecommendationDo not direct the model to fetch and act on external URLs; treat linked content as untrusted.
tool: share_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
e (no auth) can open to view + download the file. The token is 32 random bytes (~256 bits of entRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: share_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "file_id"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: list_recent_files
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "list_recent_files"RecommendationScope tools to the minimum needed.
tool: list_recent_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
at surface-wide list; ignores folder structure. Useful for an agent answering 'whatRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: pull_capability
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "pull_capability"RecommendationScope tools to the minimum needed.
tool: (server instructions)
Role tokens or delimiter abuse steer the model rather than describe the tool.
**Diagrams** → ```mermaid` fenced block. 15 sub-types covered by oRecommendationWrite neutral, descriptive tool metadata.
tool: update_doc
An unusually long description is a common injection-padding tactic.
description length 4208 charsRecommendationKeep descriptions concise.
tool: update_html
An unusually long description is a common injection-padding tactic.
description length 2411 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.