Skip to content

ZeroWidth Workbench

by zerowidth.ai · remote · no sign-in to list tools · v1.0.0 · published by ai.zerowidth

Build, run and publish Workbench flows, tasks, shims and knowledge bases.

Deletes · 16Changes · 21

60 tools: 16 can delete or cancel things, 21 change things and 23 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http workbench https://api.zerowidth.ai/mcp/x/workbench

Findings

Matches of fixed checks, with the text they matched.

3 warn
  • The server marks "workbench_flows_schedules_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "workbench_flows_schedules_list" says "schedule": a word for a change.

    What this check looks for
  • The server marks "comments_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "comments_list" says "comment": a word for a change.

    What this check looks for
  • The server marks "workbench_tasks_run_view" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "workbench_tasks_run_view" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

60 tools

Deletes or cancels 16Claude Code: deny
  • comments_resolveSets a comment thread's resolved state (rootId = the thread's root comment id).No findings

    Why it is in this group

    • The name "comments_resolve" says "comment": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Sets a comment thread's resolved state (rootId = the thread's root comment id). Resolve ONLY when the human asked or the thread's question is demonstrably settled — and say what settled it in a reply first. Reopening is for new evidence.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Resolve or reopen a thread
  • entity_tags_setReplaces the FULL tag set on one entity (an empty list clears it).No findings

    Why it is in this group

    • The name "entity_tags_set" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replaces the FULL tag set on one entity (an empty list clears it). Read the current tags with entity_tags_get first and pass the merged list — this is not additive. Tags are lowercase letters, numbers, spaces, and hyphens; prefer labels already in use (entity_tags_browse) so the workspace's vocabulary stays small. The id comes from the kind's list/get tool or search_workspace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Set an entity's tags
  • workbench_flows_deleteDeletes a flow.No findings

    Why it is in this group

    • The name "workbench_flows_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a flow. Its schedules stop, guest share links die, and evals targeting it can no longer run (their binding shows flowOk: false) — check caliper_flow_performance for evals and workbench_flows_schedules_list before proposing, and prefer workbench_flows_update with archived: true when the user just wants it out of the way. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Delete a Workbench flow
  • workbench_flows_edit_textApplies ONE precise text replacement to a flow's DRAFT orchestration — Edit-tool semantics: `find` must be the EXACT current text, copied character-for-character from workbench_flo…No findings

    Why it is in this group

    • The name "workbench_flows_edit_text" says "edit": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Applies ONE precise text replacement to a flow's DRAFT orchestration — Edit-tool semantics: `find` must be the EXACT current text, copied character-for-character from workbench_flows_get, and must occur exactly once anywhere in the flow (system prompts, node settings, metadata, a node's type). `find` is text inside ONE value, not JSON: to change a model, find the model slug alone (`anthropic-claude-haiku-4-5`) and replace it with another `llm` slug from workbench_node_catalog_get. It can't add or remove nodes or links. Zero or multiple matches return an error instead of guessing. This is the improvement primitive: check receipts first with caliper_flow_performance, cite the run id in `note`, apply the edit after approval, then re-run the eval with caliper_evals_run and report the score delta — never claim improvement without the before/after. Edits land on the draft only; the published version changes when someone publishes (workbench_flows_publish, after the user has seen the result). May return `needs_confirmation` — show the user the exact find/replace diff and wait.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Surgically edit text inside a flow
  • workbench_flows_publishSnapshots the flow's current DRAFT as a named published version — the version schedules (workbench_flows_schedule), guest share links (workbench_flows_share_create), public-API run…No findings

    Why it is in this group

    • The name "workbench_flows_publish" says "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Snapshots the flow's current DRAFT as a named published version — the version schedules (workbench_flows_schedule), guest share links (workbench_flows_share_create), public-API runs, and 'published'-stage evals execute. The draft keeps evolving after this; runs on the published side don't change until the next publish. Publishing does NOT run the flow, but any eval set to runOnPublish starts a run (that spends credit — mention it when one exists). Publish only after the user has tested the draft (workbench_flows_run) or asked for it. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • title: Publish a Workbench flow version
  • workbench_flows_scenarios_deleteDeletes one scenario.No findings

    Why it is in this group

    • The name "workbench_flows_scenarios_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes one scenario. A design session running as it goes back to no scenario. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Delete a flow's scenario
  • workbench_flows_scenarios_updateRenames a scenario or changes its values.No findings

    Why it is in this group

    • The name "workbench_flows_scenarios_update" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Renames a scenario or changes its values. `values` MERGES into what's saved: pass only the variables that change, and null to clear one. Get the scenarioId from workbench_flows_scenarios_list. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Change a flow's scenario
  • workbench_flows_schedules_deleteRemoves a schedule for good.No findings

    Why it is in this group

    • The name "workbench_flows_schedules_delete" says "schedule": a word for a change.
    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes a schedule for good. Prefer workbench_flows_schedules_update with enabled: false when the user might want it back. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Delete a flow schedule
  • workbench_flows_schedules_updateChanges one schedule: `enabled: false` pauses it (configuration kept), `enabled: true` resumes and recomputes the next fire time from now; `interval` / `scheduleTime` / `scheduleTi…No findings

    Why it is in this group

    • The name "workbench_flows_schedules_update" says "schedule": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes one schedule: `enabled: false` pauses it (configuration kept), `enabled: true` resumes and recomputes the next fire time from now; `interval` / `scheduleTime` / `scheduleTimezone` / `scheduleDayOfWeek` change the cadence; `label`, `delivery`, and `input` can change too. Pass only what changes. Get the scheduleId from workbench_flows_schedules_list. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Pause / resume / re-time a flow schedule
  • workbench_flows_shares_revokeKills one guest link immediately — anyone holding it gets a closed page from then on.No findings

    Why it is in this group

    • The name "workbench_flows_shares_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Kills one guest link immediately — anyone holding it gets a closed page from then on. Conversations already had stay in the flow's history. Get the shareId from workbench_flows_shares_list. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Revoke a flow's guest share link
  • workbench_flows_updateChanges a flow's name, description, visibility, tags, or archived state — the metadata around the flow, NOT its orchestration (prompts and nodes change through workbench_flows_edit…No findings

    Why it is in this group

    • The name "workbench_flows_update" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes a flow's name, description, visibility, tags, or archived state — the metadata around the flow, NOT its orchestration (prompts and nodes change through workbench_flows_edit_text). Pass only what changes. Archiving hides the flow from the default gallery but leaves it runnable, scheduled, and shared; pass archived: false to restore. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Rename / describe / archive / re-scope a Workbench flow
  • workbench_kb_deleteDeletes a knowledge base and everything in it.No findings

    Why it is in this group

    • The name "workbench_kb_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a knowledge base and everything in it. Flows that search it will find nothing — check which agents use it (the user knows; the KB page in Workbench lists them) and say so before proposing. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Delete a knowledge base
  • workbench_kb_document_deleteRemoves one ingested document and all its chunks; searches stop returning it at once.No findings

    Why it is in this group

    • The name "workbench_kb_document_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes one ingested document and all its chunks; searches stop returning it at once. Get the documentId from workbench_kb_documents_list. To replace a document, remove it then workbench_kb_add_documents the new version. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Remove a document from a knowledge base
  • workbench_tasks_deleteDeletes a task.No findings

    Why it is in this group

    • The name "workbench_tasks_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a task. Runs still in flight are stopped (a gate waiting on someone is closed), and its schedule trigger stops firing; past runs stay in history. Check workbench_tasks_get for live runs and say so before proposing. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Delete a Workbench Task
  • workbench_tasks_freezeFreezes a reviewed plan as the Task's next version and activates it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Freezes a reviewed plan as the Task's next version and activates it. Pass the EXACT plan object a compile returned — never hand-edit it (change the sentence and recompile instead). Freeze ONLY after the user has seen the proposal and said go; echo what you're freezing in one line first. In-flight runs keep their pinned versions. After freezing, offer to start a first run.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Freeze a compiled plan (activate the Task)
  • workbench_tasks_updateChanges a task's name — the gallery label only.No findings

    Why it is in this group

    • The name "workbench_tasks_update" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes a task's name — the gallery label only. The sentence and plan are versioned and change through workbench_tasks_compile + workbench_tasks_freeze, never here. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • title: Rename a Workbench Task
Changes things 21Claude Code: ask
  • comments_createPosts a comment on a workspace entity — a new thread, or a reply when rootId is given.No findings

    Why it is in this group

    • The name "comments_create" says "comment": a word for a change.
    Description, as the server wrote it
    Posts a comment on a workspace entity — a new thread, or a reply when rootId is given. Use it to leave findings where the discussion already lives (an eval result on the flow being debated, a summary on a long thread). Mention people via mentionedUserIds (from workspace member ids) to ring their notification bell; never mention someone who didn't ask to be pulled in.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Comment on an entity
  • comments_listLists the comment threads on one workspace entity (open first, then resolved) with authors and timestamps.1 finding

    Why it is in this group

    • The name "comments_list" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "comments_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "comments_list" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Lists the comment threads on one workspace entity (open first, then resolved) with authors and timestamps. Read this before weighing in on contested work — the threads are where disagreement lives before it becomes a decision.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read an entity's comment threads
  • workbench_flows_attach_knowledge_baseAttaches a knowledge base to an AGENT flow's draft, the same way picking it in the agent editor does: a docs knowledge base becomes a search tool the model calls when a question ne…No findings

    Why it is in this group

    • The name "workbench_flows_attach_knowledge_base" says "attach": a word for a change.
    Description, as the server wrote it
    Attaches a knowledge base to an AGENT flow's draft, the same way picking it in the agent editor does: a docs knowledge base becomes a search tool the model calls when a question needs it; a tabular one also puts its tables in the prompt and adds a query tool. The flow needs a system prompt (scaffold it with one). Attaching one that's already there changes nothing. Do it BEFORE workbench_flows_publish: a published version is what interfaces and schedules run, so attach, try it with workbench_flows_run, then publish — and if something already pins an older version (an interface grant), re-grant the new version. Tell the model in its system prompt what the knowledge base holds and when to search it. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Give an agent flow a knowledge base to search
  • workbench_flows_forkCopies a PUBLIC flow from another workspace (a template) into this one as a new draft the user owns.No findings

    Why it is in this group

    • The name "workbench_flows_fork" says "fork": a word for a change.
    Description, as the server wrote it
    Copies a PUBLIC flow from another workspace (a template) into this one as a new draft the user owns. Identify it by its flowUuid (the id on Workbench's public template pages and in `workbench_flows_get` output); optionally pin which published version to copy. Flows already in this workspace can't be forked — open them instead. Counts toward the plan's flow cap. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Fork a public flow into the workspace
  • workbench_flows_runExecute a flow and return its outputs synchronously.No findings

    Why it is in this group

    • The name "workbench_flows_run" says "run": a word for a change.
    Description, as the server wrote it
    Execute a flow and return its outputs synchronously. Runs the draft by default; pass source:"published" (optionally a version) to run the live published version. Spends workspace LLM budget, bounded by the token's cost cap. `input` is the flow's input envelope, e.g. {"kind":"chat","messages":[…]} or {"kind":"form","values":{…}}.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • title: Run a Workbench flow
  • workbench_flows_scaffoldCreates a runnable first-draft flow from a spec you author: pick the simplest pattern that fits (classifier for read-and-bucket, structurer for transform/extract/draft-for-review, …No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Creates a runnable first-draft flow from a spec you author: pick the simplest pattern that fits (classifier for read-and-bucket, structurer for transform/extract/draft-for-review, agent for genuinely conversational), write a production-quality system prompt grounded in what the user told you, and mark anything stubbed with [STUB: ...] markers plus stubNotes. The draft opens in Workbench's simple editor at /w/<workspace>/flows/<id> — give the user that path. May return `needs_confirmation`; show the user what you're proposing and wait for their approval, then re-call with the approvalId. When the draft comes from a Compass change, pass its opportunityId so the flow and the change point at each other (Compass shows 'Open in Workbench'; the flow shows where it came from). Then: workbench_flows_run to try it, workbench_flows_publish when it's ready for schedules and share links.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Scaffold a first-draft Workbench flow
  • workbench_flows_scenarios_createSaves a named scenario: values for the flow's variables, e.g.No findings

    Why it is in this group

    • The name "workbench_flows_scenarios_create" says "create": a word for a change.
    Description, as the server wrote it
    Saves a named scenario: values for the flow's variables, e.g. one demo customer. It shows in the test pane's Scenarios menu, and Caliper evals can run as it. Use the person's details from what the user shared (a CRM screenshot, a profile) and say which ones you made up. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Save a scenario for a flow
  • workbench_flows_scheduleSet a specific built flow to run automatically on a cadence — the deterministic counterpart to a zv1 routine.No findings

    Why it is in this group

    • The name "workbench_flows_schedule" says "schedule": a word for a change.
    Description, as the server wrote it
    Set a specific built flow to run automatically on a cadence — the deterministic counterpart to a zv1 routine. Each run executes the flow's latest PUBLISHED revision with the fixed `input` envelope and routes the output per `delivery`. USE THIS when the user wants a flow they've built to run on a schedule ("run my digest flow every morning"). Do NOT create a routine for this — a routine runs a free-form instruction, not a built flow. The schedule runs the PUBLISHED flow, so the flow must be published (check workbench_flows_revisions_list; publish with workbench_flows_publish if it isn't). `input` is fixed for every run, so the flow itself should fetch anything time-varying at run time. Manage existing schedules with workbench_flows_schedules_list / workbench_flows_schedules_update.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Schedule a Workbench flow
  • workbench_flows_schedules_listEvery schedule on one flow: cadence, whether it's paused (`enabled: false`), the next fire time, delivery, and the last run's status.1 finding

    Why it is in this group

    • The name "workbench_flows_schedules_list" says "schedule": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "workbench_flows_schedules_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "workbench_flows_schedules_list" says "schedule": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Every schedule on one flow: cadence, whether it's paused (`enabled: false`), the next fire time, delivery, and the last run's status. Read this before workbench_flows_schedule (don't create a duplicate) and to get the scheduleId for workbench_flows_schedules_update / workbench_flows_schedules_delete / workbench_flows_schedules_run_now.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List a flow's schedules
  • workbench_flows_schedules_run_nowRuns one iteration of a schedule immediately through the real scheduled pipeline (same input, same delivery — the email or channel it normally posts to) without moving its cadence.No findings

    Why it is in this group

    • The name "workbench_flows_schedules_run_now" says "schedule": a word for a change.
    Description, as the server wrote it
    Runs one iteration of a schedule immediately through the real scheduled pipeline (same input, same delivery — the email or channel it normally posts to) without moving its cadence. Works on paused schedules. Use it to test a schedule the user just set up. Spends workspace credit and delivers for real, so it sits behind the approval gate — may return `needs_confirmation`. The run is fire-and-forget: check workbench_flows_schedules_list for lastStatus, or workbench_executions_get for the trace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • title: Fire a flow schedule once, now
  • workbench_flows_share_createCreates a no-account guest link where anyone can chat with the flow's latest PUBLISHED revision at workbench's /s/<token> page — the fastest way to put a working flow in a stakehol…No findings

    Why it is in this group

    • The name "workbench_flows_share_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates a no-account guest link where anyone can chat with the flow's latest PUBLISHED revision at workbench's /s/<token> page — the fastest way to put a working flow in a stakeholder's hands ('here, try it'). The flow must have a published version (workbench_flows_revisions_list shows it; publish with workbench_flows_publish if not). Conversations are capped per guest; the link can expire, and you can list links with workbench_flows_shares_list and kill one with workbench_flows_shares_revoke. May return `needs_confirmation` — say who the link is for and wait.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • title: Mint a guest share link for a flow
  • workbench_kb_add_documentsAdds documents to a knowledge base and starts ingestion (chunk + embed; graph KBs also extract entities; tabular KBs load CSV as tables).No findings

    Why it is in this group

    • The name "workbench_kb_add_documents" says "add": a word for a change.
    Description, as the server wrote it
    Adds documents to a knowledge base and starts ingestion (chunk + embed; graph KBs also extract entities; tabular KBs load CSV as tables). Text goes inline (Markdown, plain text, CSV — encoding utf8); binary files (PDF, .docx) go base64-encoded with their mimeType. Up to 50 sources per call, ~10 MB each. Ingestion runs in the BACKGROUND — the result carries a runId; check it with workbench_kb_ingestion_status when the user asks, don't poll. workbench_kb_search works once it finishes. Content from <attached-file> blocks is ideal source material. Check workbench_kb_documents_list first so you don't add a document twice. Embedding spends workspace inference credit, so this sits behind the approval gate: may return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Add documents to a knowledge base
  • workbench_kb_createCreates an empty knowledge base.No findings

    Why it is in this group

    • The name "workbench_kb_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates an empty knowledge base. Recipe 'docs' (default) for reference material an agent searches at runtime; 'tabular' for spreadsheet-style data queried with SQL; 'graph' for entity/relationship extraction. After creating, add content with workbench_kb_add_documents, then give an agent flow a search tool over it with workbench_flows_attach_knowledge_base (before publishing the flow). May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Create a knowledge base
  • workbench_shim_add_answerAdds one answer (a label and, optionally, when it applies).No findings

    Why it is in this group

    • The name "workbench_shim_add_answer" says "add": a word for a change.
    Description, as the server wrote it
    Adds one answer (a label and, optionally, when it applies). The shim needs three examples of it before it builds again with the new answer. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Add an answer to a shim
  • workbench_shim_add_examplesAdds example inputs to one answer.No findings

    Why it is in this group

    • The name "workbench_shim_add_examples" says "add": a word for a change.
    Description, as the server wrote it
    Adds example inputs to one answer. Write inputs a real person would actually type in the shim's setting — varied in length, register and specifics, each one clearly this answer and not another — never paraphrases of the answer's name. Read the shim first so new examples fit alongside the existing ones and land where recall is low. Exact duplicates are skipped. The shim rebuilds on its own afterwards; read it again for the new report. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Add examples to an answer
  • workbench_shim_createCreates a shim from a name, the question it answers, and its answers.No findings

    Why it is in this group

    • The name "workbench_shim_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates a shim from a name, the question it answers, and its answers. Add examples afterwards with workbench_shim_add_examples — three or more per answer and it builds on its own. May return `needs_confirmation`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Create a shim
  • workbench_tasks_actRecords THIS user's verdict on a run that is waiting on them — the labels come from the gate (workbench_tasks_run_view shows them via the plan; a wrong label errors listing the rea…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Records THIS user's verdict on a run that is waiting on them — the labels come from the gate (workbench_tasks_run_view shows them via the plan; a wrong label errors listing the real options). Echo the verdict + note back to the user in one line BEFORE calling; that echo is the confirmation. Refuses when the gate is assigned to someone else.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • title: Act on a Task gate (record a verdict)
  • workbench_tasks_compileRuns the compiler over a sentence and returns the PROPOSED plan (or repair-grade problems — fix by refining the sentence with the user, not by guessing).No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Runs the compiler over a sentence and returns the PROPOSED plan (or repair-grade problems — fix by refining the sentence with the user, not by guessing). Nothing persists. Present the proposal in plain terms: which clauses run flows, which you (zv1) will handle, who decides, what the compiler noted. Then iterate or freeze. Compile may take ~15s.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Compile a sentence into a Task plan
  • workbench_tasks_createCreates a DRAFT Task from a name + sentence.No findings

    Why it is in this group

    • The name "workbench_tasks_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates a DRAFT Task from a name + sentence. Use this once the user's sentence feels settled after you've refined it together — then compile it. The sentence should be THEIR words: trigger first ('When a claim arrives…'), then steps, branches, and who decides what.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • title: Create a draft Task
  • workbench_tasks_run_viewThe run's current state rendered as its sentence: what ran (with timings), which path each gate took, what's waiting on whom and for how long, what's coming up.1 finding

    Why it is in this group

    • The name "workbench_tasks_run_view" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "workbench_tasks_run_view" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "workbench_tasks_run_view" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The run's current state rendered as its sentence: what ran (with timings), which path each gate took, what's waiting on whom and for how long, what's coming up. Use whenever the user asks where something stands, and after acting on a gate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: View a Task run (the lit sentence)
  • workbench_tasks_startKicks off a run of a Task.No findings

    Why it is in this group

    • The name "workbench_tasks_start" says "start": a word for a change.
    Description, as the server wrote it
    Kicks off a run of a Task. When the task expects an input document (its trigger has an input), pass the user's material as `input` — pasted text, extracted attachment text, or JSON. Cite the run id back and tell the user what happens next (the run may immediately be waiting on someone).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • title: Start a Task run
Only reads 23Claude Code: allow
  • entity_tags_browseWithout a tag: every tag in use across the workspace with how many entities carry it, most-used first — the vocabulary the team already organizes by.No findings

    Why it is in this group

    • The name "entity_tags_browse" says "browse": a word for reading.
    Description, as the server wrote it
    Without a tag: every tag in use across the workspace with how many entities carry it, most-used first — the vocabulary the team already organizes by. With a tag: everything filed under it across every tool, each with its kind, id, title, and path. Use it to reuse existing labels instead of inventing near-duplicates, and to answer 'show me everything about X' when X is a label.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Browse the workspace's tags
  • entity_tags_getReturns the tags on a batch of entities of one kind — the labels galleries organize by.No findings

    Why it is in this group

    • The name "entity_tags_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns the tags on a batch of entities of one kind — the labels galleries organize by. Ids come from the kind's list/get tool or from search_workspace. Use it before entity_tags_set so you replace the full set knowingly, and to answer 'what is this filed under'. Entities the user can't see are omitted.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read the tags on entities
  • get_docFetch the full Markdown body of a specific docs page by its slug.No findings

    Why it is in this group

    • The name "get_doc" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the full Markdown body of a specific docs page by its slug. Use this after `search_docs` when the user needs the complete content of a page. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Fetch ZeroWidth doc by slug
  • list_docsEnumerate all available docs pages, optionally filtered by product (e.g.No findings

    Why it is in this group

    • The name "list_docs" says "list": a word for reading.
    Description, as the server wrote it
    Enumerate all available docs pages, optionally filtered by product (e.g. 'compass', 'legal', 'overview'). Use this to discover what slugs exist before calling `get_doc`. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List ZeroWidth docs pages
  • search_docsSearch ZeroWidth product documentation.No findings

    Why it is in this group

    • The name "search_docs" says "search": a word for reading.
    Description, as the server wrote it
    Search ZeroWidth product documentation. Returns matching pages with title, slug, public URL, and a query-relevant snippet. Use this when the user asks about a ZeroWidth product (Compass, Workbench, Caliper, Prism, Ledger, Napkin, zv1), an API behavior, or a policy. No authentication required — the docs corpus is public.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Search ZeroWidth docs
  • search_workspaceFinds anything in the workspace in one call — uploaded files (searching the text inside them), folders, Workbench flows, shims, knowledge bases and tasks, Compass pages and changes…No findings

    Why it is in this group

    • The name "search_workspace" says "search": a word for reading.
    Description, as the server wrote it
    Finds anything in the workspace in one call — uploaded files (searching the text inside them), folders, Workbench flows, shims, knowledge bases and tasks, Compass pages and changes, Caliper datasets, evals, rubrics, reviews, specs and sources, Ledger entries, Napkin sketches, decks, docs, sheets, diagrams and interfaces. The same search the person uses in Home. Use it FIRST whenever the user mentions something without saying where it lives ('the SOW', 'the dispatch interviews', 'that invoice'). The query is words in any order: each word must appear in the thing's name, its tags, the names of the folders it's filed under, or the text inside it — so 'northwind sow' finds the SOW filed in the Northwind folder, and 'dispatch interview' finds 'Dispatcher interview 1.md'. Results are ranked best first. Each hit carries its id, kind, path (for a link), folderPath (where it's filed, top-down), tags, and a snippet when the words were found inside it rather than in its name — say where a thing lives using folderPath. A file's id feeds workspace_files_read; other ids feed the kind's *_get tool. Pass folderId to search only inside one folder and everything under it. If nothing comes back, try fewer or different words before telling the user it doesn't exist. Results only include what the user can see, and only kinds this token may read.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Search the whole workspace
  • workbench_executions_getThe flow's stack traces: recent executions with per-node timelines — what each node received, produced, how long it took, and the exact error when one failed.No findings

    Why it is in this group

    • The name "workbench_executions_get" says "get": a word for reading.
    Description, as the server wrote it
    The flow's stack traces: recent executions with per-node timelines — what each node received, produced, how long it took, and the exact error when one failed. USE THIS when a run misbehaves instead of guessing: read the failing node's inputs/error, then propose a fix (workbench_flows_edit_text) grounded in what actually happened. Pass executionId to inspect one run, or just flowId for the most recent runs. Node inputs/outputs are truncated for transport — the full record is in the flow's dev drawer.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Inspect a flow's executions (debug traces)
  • workbench_flow_authoring_guideREAD THIS FIRST before writing or editing any raw flow orchestration JSON.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    READ THIS FIRST before writing or editing any raw flow orchestration JSON. Covers the document shape, the settings-vs-input-ports rule (temperature, max_tokens, tools, response_format are PORTS, not settings — constants reach ports via value nodes), exact link format, plugin links, and three complete worked examples.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Workbench flow-authoring guide
  • workbench_flows_getOne flow.No findings

    Why it is in this group

    • The name "workbench_flows_get" says "get": a word for reading.
    Description, as the server wrote it
    One flow. Default `view: summary` lists its nodes and links so you can pick one; `view: node` with a nodeId returns that node's full settings and prompt — read THAT before workbench_flows_edit_text, and copy `find` text from it character-for-character, never from memory. `view: full` returns the whole orchestration body.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read one Workbench flow
  • workbench_flows_listLists every flow in the active workspace the caller can see.No findings

    Why it is in this group

    • The name "workbench_flows_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists every flow in the active workspace the caller can see. Returns summaries (id, name, visibility, updatedAt) — fetch one with `workbench_flows_get` for the full orchestration body.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List Workbench flows
  • workbench_flows_revisions_listThe flow's revision history, newest first: published versions carry a `version` label and note; entries with version null are draft autosaves.No findings

    Why it is in this group

    • The name "workbench_flows_revisions_list" says "list": a word for reading.
    Description, as the server wrote it
    The flow's revision history, newest first: published versions carry a `version` label and note; entries with version null are draft autosaves. Use it to answer 'is this published?' (any entry with a version), to find a revision id for caliper_evals_create's flowRevisionId, or to see when the draft last changed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List a flow's versions (publish history)
  • workbench_flows_scenarios_listA flow's variables (each {{token}} in an agent's prompt, with its type) and every saved scenario with its values.No findings

    Why it is in this group

    • The name "workbench_flows_scenarios_list" says "list": a word for reading.
    Description, as the server wrote it
    A flow's variables (each {{token}} in an agent's prompt, with its type) and every saved scenario with its values. Read this before creating or updating a scenario, so the values use the flow's real variable names.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List a flow's variables and scenarios
  • workbench_flows_shares_listEvery guest link on one flow, newest first: label, whether it's still live, the shareUrl (live links only — dead ones have no URL), expiry, and how many guests and messages it has …No findings

    Why it is in this group

    • The name "workbench_flows_shares_list" says "list": a word for reading.
    Description, as the server wrote it
    Every guest link on one flow, newest first: label, whether it's still live, the shareUrl (live links only — dead ones have no URL), expiry, and how many guests and messages it has seen. Use it to answer 'who has access', to recover a link the user lost, and to get the shareId for workbench_flows_shares_revoke.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List a flow's guest share links
  • workbench_kb_documents_listEvery document ingested into the KB's current content: id, name, type, size, chunk count.No findings

    Why it is in this group

    • The name "workbench_kb_documents_list" says "list": a word for reading.
    Description, as the server wrote it
    Every document ingested into the KB's current content: id, name, type, size, chunk count. Empty for a KB with nothing ingested yet (or one whose ingestion is still running — check workbench_kb_ingestion_status). Use it before workbench_kb_add_documents to avoid re-adding a document, and to get the documentId for workbench_kb_document_delete.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List the documents in a knowledge base
  • workbench_kb_getOne knowledge base: name, recipe (docs / tabular / graph), status, document and chunk counts, embedding model, and ingestion settings.No findings

    Why it is in this group

    • The name "workbench_kb_get" says "get": a word for reading.
    Description, as the server wrote it
    One knowledge base: name, recipe (docs / tabular / graph), status, document and chunk counts, embedding model, and ingestion settings. Read it to confirm a KB has content before pointing a flow at it. Get the kbId from workbench_kb_list.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read one knowledge base
  • workbench_kb_ingestion_statusThe state of one ingestion run started by workbench_kb_add_documents: PENDING / RUNNING / DONE / FAILED, chunks written, and the error when it failed.No findings

    Why it is in this group

    • The name "workbench_kb_ingestion_status" says "status": a word for reading.
    Description, as the server wrote it
    The state of one ingestion run started by workbench_kb_add_documents: PENDING / RUNNING / DONE / FAILED, chunks written, and the error when it failed. Read it when the user asks whether their documents are in yet, or before a search that needs them — don't poll in a loop; ingestion of a few documents takes under a minute. Pass the runId the add-documents call returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Check an ingestion run
  • workbench_kb_listLists every knowledge base in the active workspace the caller can see.No findings

    Why it is in this group

    • The name "workbench_kb_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists every knowledge base in the active workspace the caller can see. Returns summaries (id, name, description, status, doc/chunk counts, embedding model). Use an id with `workbench_kb_search` to retrieve content.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List knowledge bases
  • workbench_node_catalog_getThe ground truth for what nodes exist and what their ports actually are — verify against this instead of recalling.No findings

    Why it is in this group

    • The name "workbench_node_catalog_get" says "get": a word for reading.
    Description, as the server wrote it
    The ground truth for what nodes exist and what their ports actually are — verify against this instead of recalling. Search by keyword/category for summaries; pass `slug` for one node's full detail (inputs, outputs, settings). Inputs are PORTS fed by links; settings live on the node — see `workbench_flow_authoring_guide`. The catalog is the WORKSPACE'S: model nodes the workspace's inference policy forbids come back with `allowed: false` — never author with those; pick an allowed model. Pass `flowId` to include the flow's pinned imports as nodes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Search the Workbench node catalog
  • workbench_shim_getOne shim in full: the question, where its inputs come from, every answer with its description and examples, what the shim still needs before it can build, and the newest build's re…No findings

    Why it is in this group

    • The name "workbench_shim_get" says "get": a word for reading.
    Description, as the server wrote it
    One shim in full: the question, where its inputs come from, every answer with its description and examples, what the shim still needs before it can build, and the newest build's report — held-out accuracy, recall per answer, which answers get mistaken for which, and the compiler's notes. Read it before writing examples: match the setting and the existing examples' register, and put new examples where recall is low or the compiler says an answer is thin.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read one shim
  • workbench_shim_listEvery shim the user can see: id, name, the question it answers, how many answers and examples it has, and the published version's held-out accuracy (null until something is publish…No findings

    Why it is in this group

    • The name "workbench_shim_list" says "list": a word for reading.
    Description, as the server wrote it
    Every shim the user can see: id, name, the question it answers, how many answers and examples it has, and the published version's held-out accuracy (null until something is published). A shim is a small decision model that runs inside an app with no model call. Start here to get a shimId.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List shims
  • workbench_tasks_getOne Task in full: its sentence, status, the latest saved plan (the clauses — which run flows, which zv1 handles, who decides at each gate) with the flow and people names the plan r…No findings

    Why it is in this group

    • The name "workbench_tasks_get" says "get": a word for reading.
    Description, as the server wrote it
    One Task in full: its sentence, status, the latest saved plan (the clauses — which run flows, which zv1 handles, who decides at each gate) with the flow and people names the plan refers to, and its recent runs. Read this before editing a task's sentence (workbench_tasks_compile with taskId) and when the user asks what a task does. Get the taskId from workbench_tasks_list.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: Read one Workbench Task (definition + recent runs)
  • workbench_tasks_listLists the workspace's Tasks — sentence-orchestrated processes — with their sentence, status, and recent runs (id, status, who a waiting run is on).No findings

    Why it is in this group

    • The name "workbench_tasks_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists the workspace's Tasks — sentence-orchestrated processes — with their sentence, status, and recent runs (id, status, who a waiting run is on). Use this to find a task the user names ('claims intake') and to see what's in flight; workbench_tasks_get reads one in full.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • title: List Workbench Tasks

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http workbench https://api.zerowidth.ai/mcp/x/workbench

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__workbench__search_docs",
      "mcp__workbench__get_doc",
      "mcp__workbench__list_docs",
      "mcp__workbench__workbench_flows_revisions_list",
      "mcp__workbench__workbench_flows_shares_list",
      "mcp__workbench__workbench_flows_scenarios_list",
      "mcp__workbench__workbench_flows_list",
      "mcp__workbench__workbench_executions_get",
      "mcp__workbench__workbench_flows_get",
      "mcp__workbench__workbench_flow_authoring_guide",
      "mcp__workbench__workbench_node_catalog_get",
      "mcp__workbench__workbench_kb_get",
      "mcp__workbench__workbench_kb_documents_list",
      "mcp__workbench__workbench_kb_ingestion_status",
      "mcp__workbench__workbench_kb_list",
      "mcp__workbench__workbench_kb_search",
      "mcp__workbench__workbench_shim_list",
      "mcp__workbench__workbench_shim_get",
      "mcp__workbench__workbench_tasks_get",
      "mcp__workbench__workbench_tasks_list",
      "mcp__workbench__search_workspace",
      "mcp__workbench__entity_tags_get",
      "mcp__workbench__entity_tags_browse"
    ],
    "ask": [
      "mcp__workbench__workbench_flows_fork",
      "mcp__workbench__workbench_flows_schedules_list",
      "mcp__workbench__workbench_flows_schedules_run_now",
      "mcp__workbench__workbench_flows_scenarios_create",
      "mcp__workbench__workbench_flows_attach_knowledge_base",
      "mcp__workbench__workbench_flows_run",
      "mcp__workbench__workbench_flows_schedule",
      "mcp__workbench__workbench_flows_scaffold",
      "mcp__workbench__workbench_flows_share_create",
      "mcp__workbench__workbench_kb_create",
      "mcp__workbench__workbench_kb_add_documents",
      "mcp__workbench__workbench_shim_create",
      "mcp__workbench__workbench_shim_add_answer",
      "mcp__workbench__workbench_shim_add_examples",
      "mcp__workbench__comments_list",
      "mcp__workbench__comments_create",
      "mcp__workbench__workbench_tasks_create",
      "mcp__workbench__workbench_tasks_compile",
      "mcp__workbench__workbench_tasks_start",
      "mcp__workbench__workbench_tasks_run_view",
      "mcp__workbench__workbench_tasks_act"
    ],
    "deny": [
      "mcp__workbench__workbench_flows_update",
      "mcp__workbench__workbench_flows_publish",
      "mcp__workbench__workbench_flows_delete",
      "mcp__workbench__workbench_flows_schedules_update",
      "mcp__workbench__workbench_flows_schedules_delete",
      "mcp__workbench__workbench_flows_shares_revoke",
      "mcp__workbench__workbench_flows_scenarios_update",
      "mcp__workbench__workbench_flows_scenarios_delete",
      "mcp__workbench__workbench_flows_edit_text",
      "mcp__workbench__workbench_kb_delete",
      "mcp__workbench__workbench_kb_document_delete",
      "mcp__workbench__comments_resolve",
      "mcp__workbench__workbench_tasks_update",
      "mcp__workbench__workbench_tasks_delete",
      "mcp__workbench__workbench_tasks_freeze",
      "mcp__workbench__entity_tags_set"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as workbench. Review it before you use it.