Skip to content

Dreamlit

by dreamlit.ai · remote · no sign-in to list tools · v0.1.0 · published by ai.dreamlit

Create, test, publish, and manage Dreamlit notification workflows from AI clients.

Deletes · 2Final · 2Changes · 3
CompareRegistry entry

13 tools: 2 can delete or cancel things, 2 do something that can't be undone, 3 change things and 6 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http dreamlit https://mcp.dreamlit.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnprepare_publish

    The server marks "prepare_publish" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "prepare_publish" says "publish": a word for a change that another call does not undo.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 2Claude Code: deny
  • confirm_publishUse only after explicit user confirmation and a prior prepare_publish result to publish or schedule a Dreamlit workflow.Can send data outNo findings

    Why it is in this group

    • The name "confirm_publish" says "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "confirm_publish" says "publish": it sends or publishes something to other people.
    Description, as the server wrote it
    Use only after explicit user confirmation and a prior prepare_publish result to publish or schedule a Dreamlit workflow. Side effect: installs live database/repeating/auth triggers, schedules or sends broadcasts, and may enable notification delivery; sandbox mode can hold notifications for inspection. Returns the published workflow status and app URLs. Do not call speculatively or without carrying forward the prepare_publish safety fields.

    Annotations the server declares

    • title: Confirm publish
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • unpublish_workflowUse after explicit user intent to unpublish a Dreamlit workflow.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Use after explicit user intent to unpublish a Dreamlit workflow. Side effect: disables live triggers or schedules for that workflow and stops future automated sends. Returns updated workflow status and app URLs. Do not use for deleting drafts, canceling one broadcast run, or editing workflow content.

    Annotations the server declares

    • title: Unpublish workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • prepare_publishRead-only validation step before publishing.Can send data out1 finding

    Why it is in this group

    • The name "prepare_publish" says "publish": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "prepare_publish" says "publish": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "prepare_publish" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "prepare_publish" says "publish": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    Read-only validation step before publishing. Use after the user asks to publish and after inspecting the workflow if needed. Returns validation status, publish mode, preview URL, and a confirmation payload with version/timestamp safety checks for confirm_publish. Does not publish or schedule anything by itself.

    Annotations the server declares

    • title: Prepare publish
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • send_workflow_testSide effect when confirmSend is true: sends one current draft email or Slack message for review, but does not publish, schedule, or edit the workflow.Can send data outNo findings

    Why it is in this group

    • The name "send_workflow_test" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "send_workflow_test" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Side effect when confirmSend is true: sends one current draft email or Slack message for review, but does not publish, schedule, or edit the workflow. Use after authoring or inspection when the user wants to verify an important message before publishing. Returns sent-test details, app URLs, a confirmation request, or a clarification request with user-facing message choices. Do not expose test target ids as copy; ask users to choose by message label and confirm before sending.

    Annotations the server declares

    • title: Send workflow test
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Changes things 3Claude Code: ask
  • create_or_update_workflowCreates a new Dreamlit workflow draft or updates an existing draft from an outcome-oriented natural-language prompt.Reads text others writeNo findings

    Why it is in this group

    • The name "create_or_update_workflow" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a new Dreamlit workflow draft or updates an existing draft from an outcome-oriented natural-language prompt. Use after get_status; use get_workflow_and_preview_url first when editing an existing workflow, then describe the steps to change by what they do, not by step id. Each call continues the workflow's current chat; pass startNewChat to start fresh. Existing Supabase Auth workflows can be edited except for the immutable trigger step; creating Supabase Auth workflows must happen through Supabase Auth email setup in the Dreamlit web app. Side effect: may create or modify a draft, but does not publish or install live triggers. Returns the workflow/draft result, action-required or handoff details when more input is needed, and relevant app URLs. Do not use for publishing, direct database changes, or low-level graph edits.

    Annotations the server declares

    • title: Create or update workflow
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • move_workflow_to_folderUse when the user asks to put a workflow or broadcast in a folder, move it to another folder, or take it out of a folder.No findings

    Why it is in this group

    • The name "move_workflow_to_folder" says "move": a word for a change.
    Description, as the server wrote it
    Use when the user asks to put a workflow or broadcast in a folder, move it to another folder, or take it out of a folder. Folders are per list: the Published and Drafts lists on the Workflows page and the Sent and Drafts lists on the Broadcasts page each have their own folders, and this moves the workflow within the list it shows in now. Folders are flat; a "/" is just part of the name. A draft's folder does not carry over when it is published. Side effect: may create the folder; never deletes folders and does not change the draft, published version, or live triggers. Returns the folder, the list, and app URLs. Do not use to rename or delete folders.

    Annotations the server declares

    • title: Move workflow to folder
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rename_workflowUse when the user asks to rename an existing Dreamlit workflow.No findings

    Why it is in this group

    • The name "rename_workflow" says "rename": a word for a change.
    Description, as the server wrote it
    Use when the user asks to rename an existing Dreamlit workflow. Side effect: changes only the workflow name; the draft, published version, and live triggers are unchanged. Returns the updated name and app URLs. Do not use to edit workflow content or to name a new workflow; pass name to create_or_update_workflow instead.

    Annotations the server declares

    • title: Rename workflow
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 6Claude Code: allow
  • get_analyticsRead-only.No findings

    Why it is in this group

    • The name "get_analytics" says "get": a word for reading.
    Description, as the server wrote it
    Read-only. Use to query Dreamlit analytics for overview metrics, notification rows, recipient engagement, or workflow run rows with filters, sorting, and cursor pagination. Returns bounded structured analytics data, effective query metadata, pagination details when rows are included, and relevant app URLs. Do not use for CSV exports, bulk dumps, workflow edits, publishing, or low-level database access.

    Annotations the server declares

    • title: Get analytics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_statusRead-only.No findings

    Why it is in this group

    • The name "get_status" says "get": a word for reading.
    Description, as the server wrote it
    Read-only. Use first when the agent needs Dreamlit product guidance, prompting guidance, approved workspace context, project setup, schema hints, workflow state, or relevant app URLs. Returns a compact context pack with concepts, recommended tool flow, actor/workspace/project data, optional authoring context, optional workflow context, and appUrls. Do not use this to create, update, publish, or unpublish workflows.

    Annotations the server declares

    • title: Get status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_workflow_and_preview_urlRead-only.Reads text others writeNo findings

    Why it is in this group

    • The name "get_workflow_and_preview_url" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe name "get_workflow_and_preview_url" says "get" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Read-only. Use before editing, verifying, or preparing publish for an existing workflow. Returns normalized draft and published workflow structure plus the Dreamlit preview/builder URL and status URLs. Step ids are for reading only; when asking create_or_update_workflow for changes, describe steps by what they do. Do not use to create, update, publish, or unpublish workflows.

    Annotations the server declares

    • title: Get workflow and preview URL
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_brand_stylesRead-only.No findings

    Why it is in this group

    • The name "list_brand_styles" says "list": a word for reading.
    Description, as the server wrote it
    Read-only. Use when the user wants to inspect saved project brand styles for generated email drafts. Returns paginated project brand style summaries, ids, default status, style metadata, and app URLs. Do not use to create, update, delete, or expose raw style provenance.

    Annotations the server declares

    • title: List brand styles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_projectsRead-only.No findings

    Why it is in this group

    • The name "list_projects" says "list": a word for reading.
    Description, as the server wrote it
    Read-only. Use when the target project is unknown or the user names a project instead of providing an id. Returns accessible Dreamlit projects in the approved workspace with project and workflow-list URLs. Do not use to inspect workflow structure or author changes.

    Annotations the server declares

    • title: List projects
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_workflowsRead-only.No findings

    Why it is in this group

    • The name "list_workflows" says "list": a word for reading.
    Description, as the server wrote it
    Read-only. Use to find workflows in a project by name, description, or trigger type before inspection or editing. Trigger filters include database, auth email, repeating, broadcast, and no-trigger workflows. Returns paginated workflow summaries, published/sandbox state, trigger type, folder (the folder name in the list the workflow shows in, or null), workflow URLs, totalCount, hasMore, and nextOffset. Do not use as the final source of truth before editing; call get_workflow_and_preview_url for full structure.

    Annotations the server declares

    • title: List workflows
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http dreamlit https://mcp.dreamlit.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__dreamlit__get_status",
      "mcp__dreamlit__list_projects",
      "mcp__dreamlit__list_workflows",
      "mcp__dreamlit__list_brand_styles",
      "mcp__dreamlit__get_workflow_and_preview_url",
      "mcp__dreamlit__get_analytics"
    ],
    "ask": [
      "mcp__dreamlit__create_or_update_workflow",
      "mcp__dreamlit__rename_workflow",
      "mcp__dreamlit__move_workflow_to_folder",
      "mcp__dreamlit__send_workflow_test",
      "mcp__dreamlit__prepare_publish"
    ],
    "deny": [
      "mcp__dreamlit__confirm_publish",
      "mcp__dreamlit__unpublish_workflow"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as dreamlit. Review it before you use it.

Capability tags behind 5 rules
  • mcp__dreamlit__create_or_update_workflow untrusted-input
  • mcp__dreamlit__get_workflow_and_preview_url untrusted-input
  • mcp__dreamlit__send_workflow_test outbound
  • mcp__dreamlit__prepare_publish outbound
  • mcp__dreamlit__confirm_publish outbound