2ools

by 2ools.app · remote · no sign-in to list tools · v0.3.1 · published by app.2ools

Build, version, review, and export websites, web apps, and games from a conversation.

Deletes · 13Final · 1Changes · 35

Compare Registry entry

81 tools: 13 can delete or cancel things, 1 do something that can't be undone, 35 change things and 32 only read.

Scanned Oct 21, 2026

Deletes or cancels13Claude Code: deny: see these tools
Can't be undone1Claude Code: ask: see these tools
Changes things35Claude Code: ask: see these tools
Only reads32Claude Code: allow: see these tools

7 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http 2ools https://2ools.app/mcp

Findings

Matches of fixed checks, with the text they matched.

4 warn3 info

Warnlist_projects
The server marks "list_projects" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_projects" says "list": a word for reading.
What this check looks for
Warnresolve_project_feedback
The server marks "resolve_project_feedback" destructive (destructiveHint: true), and its name says "resolve", a word for reading.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":false}; The name "resolve_project_feedback" says "resolve": a word for reading.
What this check looks for
Warnprepare_version_export
The server marks "prepare_version_export" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "create": a word for a change.
What this check looks for
Warnprepare_artifact_download
The server marks "prepare_artifact_download" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "create": a word for a change.
What this check looks for
Infoget_account_profile
The description mentions "credentials".
Matched text
description: "...ffective MCP scopes. Passwords, private credentials, billing instruments, and provider secr..."
What this check looks for
Infoget_agent
The description mentions "credentials".
Matched text
description: "...un traces. Raw prompts, tool arguments, credentials, and source bytes are not returned."
What this check looks for

Show 1 more finding

Infoget_project_work_dispatch
The description mentions "credentials".
Matched text
description: "...ess and lease evidence without prompts, credentials, source, paths, or private model transc..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

81 tools

Deletes or cancels 13Removes, cancels or revokes something.Claude Code: deny

act_on_project_os_taskApp-only route for an authenticated person's explicit click in the native Project OS panel.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
App-only route for an authenticated person's explicit click in the native Project OS panel. Hidden from the model; every action is revision checked and idempotent, and cancellation requires an explicit confirmation.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
answer_project_engineering_decisionAccept or reject one exact native-safe engineering decision at one exact project revision.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Accept or reject one exact native-safe engineering decision at one exact project revision. Requires an explicit confirmation and durable note, enforces project role and high-risk owner policy, rejects revision conflicts, preserves immutable history, and returns an idempotent receipt plus canonical reread. Unknown future response kinds remain in Project OS.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
approve_versionUse separately delegated review authority to approve one saved version and make it the project's active version.No findings
Why it is in this group
- The name "approve_version" says "approve": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Use separately delegated review authority to approve one saved version and make it the project's active version. Does not publish, export, or change project permissions.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
attach_project_engine_workspaceOwner-authorized attachment of one saved project to one exact opaque workspace on one exact online 2ools Engine.No findings
Why it is in this group
- The name "attach_project_engine_workspace" says "attach": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Owner-authorized attachment of one saved project to one exact opaque workspace on one exact online 2ools Engine. This grants future project work access to real source on that computer, so show the selected computer/workspace and obtain explicit confirmation. It changes no source file and never falls back to another Engine.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
cancel_agent_runStop one queued or running Agent execution and close its durable run history.No findings
Why it is in this group
- The name "cancel_agent_run" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Stop one queued or running Agent execution and close its durable run history. Completed, failed, stalled, and already-canceled runs keep their terminal truth.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
cancel_buildCancel one exact queued or running non-Agent 2ools build after named explicit confirmation.No findings
Why it is in this group
- The name "cancel_build" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Cancel one exact queued or running non-Agent 2ools build after named explicit confirmation. Repeating the same cancellation is safe, late Engine results are rejected, completed versions are never deleted, and immutable history remains. Governed Agent execution uses cancel_agent_run.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
reject_versionUse separately delegated review authority to reject one saved version.No findings
Why it is in this group
- The name "reject_version" says "reject": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Use separately delegated review authority to reject one saved version. If it is active, restores its saved parent as active; the rejected version remains in immutable history.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_project_memberRemove one exact member's project access after explicit confirmation.No findings
Why it is in this group
- The name "remove_project_member" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove one exact member's project access after explicit confirmation. Their account and authored history stay; active project builds are canceled and armed project agents are paused.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
remove_project_pinRemove one shared workspace pin.No findings
Why it is in this group
- The name "remove_project_pin" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove one shared workspace pin. The operation is idempotent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
resolve_project_feedbackOwner-only review decision that resolves or reopens one saved feedback item.1 finding
Why it is in this group
- The name "resolve_project_feedback" says "resolve": a word for reading.
- The server marks it destructive (destructiveHint: true).
Findings
- Warn
  The server marks "resolve_project_feedback" destructive (destructiveHint: true), and its name says "resolve", a word for reading.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":false}; The name "resolve_project_feedback" says "resolve": a word for reading.
  What this check looks for
Description, as the server wrote it
Owner-only review decision that resolves or reopens one saved feedback item.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
revoke_project_inviteRevoke one exact pending project invitation after explicit confirmation.No findings
Why it is in this group
- The name "revoke_project_invite" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Revoke one exact pending project invitation after explicit confirmation. The person can no longer accept that invitation; project history remains auditable.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
revoke_version_share_linkDisable every existing public or code-protected URL for one exact saved version.No findings
Why it is in this group
- The name "revoke_version_share_link" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Disable every existing public or code-protected URL for one exact saved version. Re-publishing a protected link rotates its code.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_project_member_roleChange one exact member to collaborator or viewer, or transfer ownership.No findings
Why it is in this group
- The name "update_project_member_role" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Change one exact member to collaborator or viewer, or transfer ownership. Requires explicit confirmation because demotion cancels that member's active builds and pauses armed project agents, while ownership transfer changes the current owner's authority.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

invite_project_memberInvite an existing 2ools username or an email address to one owned project as a collaborator or viewer.No findings
Why it is in this group
- The name "invite_project_member" says "invite": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Invite an existing 2ools username or an email address to one owned project as a collaborator or viewer. New-account claim tokens are emailed by 2ools and are never returned through MCP.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 35Creates or changes something that can be changed back.Claude Code: ask

activate_projectRecord the person's one-time choice to use this already-connected 2ools client with one exact saved project.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Record the person's one-time choice to use this already-connected 2ools client with one exact saved project. Call only after the person approves in the inline card or explicitly in chat. This does not read or import local files and does not start work or a build.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
add_project_feedbackAdd an attributable review comment to a saved project version.No findings
Why it is in this group
- The name "add_project_feedback" says "add": a word for a change.
Description, as the server wrote it
Add an attributable review comment to a saved project version. This does not modify source or approve the version.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
add_project_pinAdd an attributable note or safe http(s) link to the shared project workspace.No findings
Why it is in this group
- The name "add_project_pin" says "add": a word for a change.
Description, as the server wrote it
Add an attributable note or safe http(s) link to the shared project workspace.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
advance_project_agent_modeIdempotently re-evaluate and, when safe, queue the next dependency-ready safe-auto plan step on the project's already approved Agent, Engine, and provider.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Idempotently re-evaluate and, when safe, queue the next dependency-ready safe-auto plan step on the project's already approved Agent, Engine, and provider. Running, review, blocked, and approval states never double-dispatch.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
approve_artifact_versionApprove one pending immutable artifact version and make it current.No findings
Why it is in this group
- The name "approve_artifact_version" says "approve": a word for a change.
Description, as the server wrote it
Approve one pending immutable artifact version and make it current. Repeating the same decision is idempotent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
build_from_conversationCreate a new 2ools project from a structured conversation brief and queue one durable build.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it
Create a new 2ools project from a structured conversation brief and queue one durable build. Returns project_id and job_id; use get_build to retrieve completion status and the protected preview.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
checkpoint_work_sessionEnd the current lease with a compact continuation checkpoint, or place work in an explicit waiting or blocked state.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
End the current lease with a compact continuation checkpoint, or place work in an explicit waiting or blocked state. Ambiguous external effects always wait for reconciliation and are never auto-retried.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
claim_work_assignmentAtomically claim one open assignment and receive a five-minute renewable lease plus an immutable budget snapshot.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Atomically claim one open assignment and receive a five-minute renewable lease plus an immutable budget snapshot.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
configure_project_agent_modeTurn the selected project's governed Agent Mode on or off.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Turn the selected project's governed Agent Mode on or off. When enabled, the person chooses one armed project Agent, one exact Engine, and one provider; only reviewed safe-auto steps in the exact approved plan may advance in dependency order. Limits and approval boundaries are never widened.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_public_previewTurn a complete standalone HTML document already created in this chat into a temporary, read-only 2ools preview.No findings
Why it is in this group
- The name "create_public_preview" says "create": a word for a change.
Description, as the server wrote it
Turn a complete standalone HTML document already created in this chat into a temporary, read-only 2ools preview. Free and authless; expires after 24 hours. This tool does not generate the page—write the HTML first, then call it.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_version_share_linkCreate or recover a durable public or code-protected link for one exact saved version.No findings
Why it is in this group
- The name "create_version_share_link" says "create": a word for a change.
Description, as the server wrote it
Create or recover a durable public or code-protected link for one exact saved version. Reusing the idempotency key returns the original result.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_work_assignmentCreate a durable assignment with acceptance criteria and hard step, time, and spend ceilings.No findings
Why it is in this group
- The name "create_work_assignment" says "create": a word for a change.
Description, as the server wrote it
Create a durable assignment with acceptance criteria and hard step, time, and spend ceilings.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
decide_work_assignmentComplete submitted work or reopen it with useful feedback.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Complete submitted work or reopen it with useful feedback. Requires separately delegated work-review authority.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
dispatch_project_workReserve one exact revision-checked Project OS task for one armed project Agent, then queue it on one exact online Engine and authenticated provider selected by the person.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Reserve one exact revision-checked Project OS task for one armed project Agent, then queue it on one exact online Engine and authenticated provider selected by the person. Queued is not working; the task becomes active only after that Engine atomically claims it. Never falls back to another computer, provider, hosted compute, or a parallel task.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
heartbeat_work_sessionRenew the authenticated worker's active lease without widening its immutable step, time, or spend ceilings.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Renew the authenticated worker's active lease without widening its immutable step, time, or spend ceilings.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
list_projectsOpen the native Project OS entry point and list recent 2ools projects the authenticated account can access.1 finding
Why it is in this group
- The name "list_projects" says "list": a word for reading.
- The description's first verb is "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "list_projects" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_projects" says "list": a word for reading.
  What this check looks for
Description, as the server wrote it
Open the native Project OS entry point and list recent 2ools projects the authenticated account can access. The app automatically continues the only saved project or shows an inline chooser when several projects are available. Returns compact metadata without generated source.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
manage_project_disciplinePropose a project trade-off, version an eval case or verifier definition, or attach an eval/verifier receipt to exact work.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Propose a project trade-off, version an eval case or verifier definition, or attach an eval/verifier receipt to exact work. Agents may propose decisions but cannot accept their own proposals; verifier definitions describe external evidence and never execute arbitrary code on 2ools.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
manage_work_watchdogPause, park, resume, or reprioritize one durable task, or deliberately configure the project Watchdog.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Pause, park, resume, or reprioritize one durable task, or deliberately configure the project Watchdog. This never answers for the user, approves a risky action, deploys, spends, sends externally, deletes data, or widens authority.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
prepare_artifact_downloadCreate a five-minute download URL for one immutable artifact version.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "prepare_artifact_download" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Create a five-minute download URL for one immutable artifact version. Stored bytes never enter MCP model output.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
prepare_artifact_uploadCreate a five-minute PUT URL for exact bytes.No findings
Why it is in this group
- The name "prepare_artifact_upload" says "upload": a word for a change.
Description, as the server wrote it
Create a five-minute PUT URL for exact bytes. External-agent output always enters pending review and never replaces the current artifact version before approval.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
prepare_version_exportCreate a five-minute download URL for an exact saved version.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "prepare_version_export" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Create a five-minute download URL for an exact saved version. Source is delivered by the download route, never embedded in MCP model output.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
prepare_work_handoffCheckpoint one owned session into an immutable, exactly-once successor envelope.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Checkpoint one owned session into an immutable, exactly-once successor envelope. Estimated signals are labeled as estimates; questions and possibly committed effects stay paused for a person.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
refine_projectCreate one protected child version from a saved base version and concrete review feedback.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it
Create one protected child version from a saved base version and concrete review feedback. Preserves the base source as currentCode, consumes one persisted project iteration, and returns an asynchronous job_id.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
refresh_project_cockpitRefresh the bounded project state shown inside an already-open 2ools MCP App.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Refresh the bounded project state shown inside an already-open 2ools MCP App. This app-only read does not start work, import files, or change the project.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
register_existing_projectCreate one durable Project OS record for a local or external project that list_projects did not match.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it
Create one durable Project OS record for a local or external project that list_projects did not match. When the canonical project ID is already known, pass existing_project_id and that exact record is reused. Otherwise an exact normalized name match is reused instead of duplicated, even with a new idempotency key. Call only after the person approves the proposed name, goal, current state, decisions, and next step. This never reads or uploads local files and never starts a build.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
reject_artifact_versionReject one pending immutable artifact version with useful feedback.No findings
Why it is in this group
- The name "reject_artifact_version" says "reject": a word for a change.
Description, as the server wrote it
Reject one pending immutable artifact version with useful feedback. Repeating the same decision is idempotent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
review_project_missionRestore an immutable Mission or Goal revision, decide a proposed scope change, or submit proof-based goal completion review.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Restore an immutable Mission or Goal revision, decide a proposed scope change, or submit proof-based goal completion review. Completion and high-risk authority remain server-gated.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
run_project_agentQueue real execution for a project-linked Agent the person already test-ran and armed.No findings
Why it is in this group
- The name "run_project_agent" says "run": a word for a change.
Description, as the server wrote it
Queue real execution for a project-linked Agent the person already test-ran and armed. The immutable saved Limits, project access, account fuse, and online Engine requirement are enforced server-side before a job exists.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
run_task_quality_gateStart checks against exact task/artifact/environment fingerprints, or submit every configured check with same-project evidence and explicit findings.No findings
Why it is in this group
- The name "run_task_quality_gate" says "run": a word for a change.
Description, as the server wrote it
Start checks against exact task/artifact/environment fingerprints, or submit every configured check with same-project evidence and explicit findings. Missing routes, stale proof, failed checks, and open findings cannot become a false pass.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
start_project_on_engineCreate one new 2ools project and queue its first build on one exact connected Engine and provider selected by the person.No findings
Why it is in this group
- The name "start_project_on_engine" says "start": a word for a change.
Description, as the server wrote it
Create one new 2ools project and queue its first build on one exact connected Engine and provider selected by the person. Fails before project creation or queueing when that Engine is offline, busy, missing the provider, or lacks the protocol. Never falls back to hosted, server, Studio, or another computer.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
submit_work_sessionEnd the authenticated worker's lease and submit typed result references for a separate review decision.No findings
Why it is in this group
- The name "submit_work_session" says "submit": a word for a change.
Description, as the server wrote it
End the authenticated worker's lease and submit typed result references for a separate review decision.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
update_account_profileUpdate only the explicitly supplied profile fields for the authenticated person.No findings
Why it is in this group
- The name "update_account_profile" says "update": a word for a change.
Description, as the server wrote it
Update only the explicitly supplied profile fields for the authenticated person. This cannot change email, password, MFA, billing, entitlements, roles, or account-deletion state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
update_living_planAdd, edit, move, or reorder open Living Plan items from the current conversation, then return the refreshed inline plan and timeline panel.No findings
Why it is in this group
- The name "update_living_plan" says "update": a word for a change.
Description, as the server wrote it
Add, edit, move, or reorder open Living Plan items from the current conversation, then return the refreshed inline plan and timeline panel. This cannot mark returned work complete; completion remains a separate evidence-backed review decision.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_project_intelligenceInitialize or append one immutable, validated dossier revision.No findings
Why it is in this group
- The name "update_project_intelligence" says "update": a word for a change.
Description, as the server wrote it
Initialize or append one immutable, validated dossier revision. The complete snapshot must cite material claims, preserve unknowns, finish or explicitly block all six lanes before synthesis, include a reproducible saturation audit, and pass falsification/output gates. Revision conflicts require a reread; no source retrieval is fabricated by this tool.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
update_project_missionCreate or revise Mission and Goal contracts, explicitly transition or reorder goals, or propose a scope change.No findings
Why it is in this group
- The name "update_project_mission" says "update": a word for a change.
Description, as the server wrote it
Create or revise Mission and Goal contracts, explicitly transition or reorder goals, or propose a scope change. Server role, revision, conflict, and safety policy remain authoritative.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 32Looks things up and changes nothing.Claude Code: allow

compare_versionsCompare two saved versions in one project without returning source.No findings
Why it is in this group
- The name "compare_versions" says "compare": a word for reading.
Description, as the server wrote it
Compare two saved versions in one project without returning source. Reports lineage, review state, page additions/removals, byte sizes, and SHA-256 identity for each page.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
continue_projectReturn one project's current Living Plan, next useful move, continuity-readiness gaps, latest evidence, and a compact 2ools-active receipt.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return one project's current Living Plan, next useful move, continuity-readiness gaps, latest evidence, and a compact 2ools-active receipt. Opens a compact status, Continue, and Open Project OS card on MCP Apps hosts; the full Project OS belongs in the host's browser side panel.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_account_profileRead the authenticated person's 2ools profile, current account labels, and server-derived effective MCP scopes.1 finding
Why it is in this group
- The name "get_account_profile" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ffective MCP scopes. Passwords, private credentials, billing instruments, and provider secr..."
  What this check looks for
Description, as the server wrote it
Read the authenticated person's 2ools profile, current account labels, and server-derived effective MCP scopes. Passwords, private credentials, billing instruments, and provider secrets are never returned.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_agentRead one Agent's saved Limits, trigger, immutable revision summaries, and redacted append-only run traces.1 finding
Why it is in this group
- The name "get_agent" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...un traces. Raw prompts, tool arguments, credentials, and source bytes are not returned."
  What this check looks for
Description, as the server wrote it
Read one Agent's saved Limits, trigger, immutable revision summaries, and redacted append-only run traces. Raw prompts, tool arguments, credentials, and source bytes are not returned.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_artifactRead one artifact's immutable version history, provenance, attribution, digests, and review states without returning stored bytes.No findings
Why it is in this group
- The name "get_artifact" says "get": a word for reading.
Description, as the server wrote it
Read one artifact's immutable version history, provenance, attribution, digests, and review states without returning stored bytes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_buildGet one build's current status, progress, errors, completed version IDs, and protected preview URLs.No findings
Why it is in this group
- The name "get_build" says "get": a word for reading.
Description, as the server wrote it
Get one build's current status, progress, errors, completed version IDs, and protected preview URLs. Does not return generated source code.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_engine_dispatchRead the authoritative state of one exact Engine dispatch.No findings
Why it is in this group
- The name "get_engine_dispatch" says "get": a word for reading.
Description, as the server wrote it
Read the authoritative state of one exact Engine dispatch. Queued means accepted but not started; running appears only after the selected Engine atomically claims the lease. Returns claim, heartbeat, failure, and terminal state without client inference.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_projectGet a 2ools project's brief, selected pages, active version, and compact version history.No findings
Why it is in this group
- The name "get_project" says "get": a word for reading.
Description, as the server wrote it
Get a 2ools project's brief, selected pages, active version, and compact version history. Does not return generated source code.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_accessRead the authenticated person's role plus the canonical project owner, members, and pending invitations.No findings
Why it is in this group
- The name "get_project_access" says "get": a word for reading.
Description, as the server wrote it
Read the authenticated person's role plus the canonical project owner, members, and pending invitations. Non-managers can read active members but never receive pending-invite metadata.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_activityRead the attributable project timeline across human work, external MCP agents, builds, versions, feedback, and workspace pins.No findings
Why it is in this group
- The name "get_project_activity" says "get": a word for reading.
Description, as the server wrote it
Read the attributable project timeline across human work, external MCP agents, builds, versions, feedback, and workspace pins. Actor kind is explicit; an external agent is never presented as the human account that authorized it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_agent_modeRead the project-level autonomous coordination state derived from the canonical Living Plan, governed Agent, and exact Engine destination.No findings
Why it is in this group
- The name "get_project_agent_mode" says "get": a word for reading.
Description, as the server wrote it
Read the project-level autonomous coordination state derived from the canonical Living Plan, governed Agent, and exact Engine destination. Returns progress, current work, next eligible safe step, and the reason the project is running or needs the person.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_contextRead one source-free operating packet: active version metadata, the latest explicitly selected observed project input, review attention, artifact index, work queue, and current act…No findings
Why it is in this group
- The name "get_project_context" says "get": a word for reading.
Description, as the server wrote it
Read one source-free operating packet: active version metadata, the latest explicitly selected observed project input, review attention, artifact index, work queue, and current activity cursor. Imported input is immutable evidence, not an AI proposal or live filesystem sync; private 2ools skills, prompts, routing, governance text, and generated version source are not returned.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_disciplineReturn derived direction, trade-off, evidence, and continuity status with active decisions, eval evidence, verifier definitions, and explicit permission boundaries.No findings
Why it is in this group
- The name "get_project_discipline" says "get": a word for reading.
Description, as the server wrote it
Return derived direction, trade-off, evidence, and continuity status with active decisions, eval evidence, verifier definitions, and explicit permission boundaries. Status is computed from authoritative Project OS records, never editable checkboxes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_engine_workspaceRead the privacy-safe Engine workspace attached to one project.No findings
Why it is in this group
- The name "get_project_engine_workspace" says "get": a word for reading.
Description, as the server wrote it
Read the privacy-safe Engine workspace attached to one project. Returns only opaque Engine/workspace identity, safe display metadata, live readiness, and a revision. Never returns source, paths, repository URLs, SSH hosts, tokens, or secrets.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_intelligenceReturn the versioned frontier-product research dossier, six parallel lane states, evidence ledger, saturation audits, falsification, concepts, ranked outputs, integrity summary, co…No findings
Why it is in this group
- The name "get_project_intelligence" says "get": a word for reading.
Description, as the server wrote it
Return the versioned frontier-product research dossier, six parallel lane states, evidence ledger, saturation audits, falsification, concepts, ranked outputs, integrity summary, connector visibility, and a deterministic operating brief. Missing premium access is reported as a gap, never invented.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_missionReturn a bounded canonical Project Mission view, active Goal Contract, server-derived health, role capabilities, or a paginated goals, templates, scope-change, or history slice.No findings
Why it is in this group
- The name "get_project_mission" says "get": a word for reading.
Description, as the server wrote it
Return a bounded canonical Project Mission view, active Goal Contract, server-derived health, role capabilities, or a paginated goals, templates, scope-change, or history slice.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_project_work_dispatchRead the authoritative queued, claimed, running, approval-paused, or terminal state of one exact governed Project OS task dispatch.1 finding
Why it is in this group
- The name "get_project_work_dispatch" says "get": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ess and lease evidence without prompts, credentials, source, paths, or private model transc..."
  What this check looks for
Description, as the server wrote it
Read the authoritative queued, claimed, running, approval-paused, or terminal state of one exact governed Project OS task dispatch. Returns bounded progress and lease evidence without prompts, credentials, source, paths, or private model transcripts.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_task_quality_gateReturn the current task-bound Quality Gate policy, freshness, deterministic check receipt, and attached findings.No findings
Why it is in this group
- The name "get_task_quality_gate" says "get": a word for reading.
Description, as the server wrote it
Return the current task-bound Quality Gate policy, freshness, deterministic check receipt, and attached findings. A pass never replaces required human visual or approval review.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_version_share_linkRead the durable sharing state and current URL for one exact saved version.No findings
Why it is in this group
- The name "get_version_share_link" says "get": a word for reading.
Description, as the server wrote it
Read the durable sharing state and current URL for one exact saved version. Disabled shares return no URL.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_work_handoffReturn the current immutable context-handoff receipt, exact task lineage, and honestly labeled worker-reported or 2ools-forecast context signal.No findings
Why it is in this group
- The name "get_work_handoff" says "get": a word for reading.
Description, as the server wrote it
Return the current immutable context-handoff receipt, exact task lineage, and honestly labeled worker-reported or 2ools-forecast context signal.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_approval_requestsList exact saved versions waiting for a separately delegated reviewer.No findings
Why it is in this group
- The name "list_approval_requests" says "list": a word for reading.
Description, as the server wrote it
List exact saved versions waiting for a separately delegated reviewer. Returns project/version identity and attribution, never generated source.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_artifact_approval_requestsList exact artifact versions awaiting or carrying a human review decision.No findings
Why it is in this group
- The name "list_artifact_approval_requests" says "list": a word for reading.
Description, as the server wrote it
List exact artifact versions awaiting or carrying a human review decision. Requires separately delegated artifact review authority.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_artifactsList durable project artifacts and each latest immutable version without returning stored bytes.No findings
Why it is in this group
- The name "list_artifacts" says "list": a word for reading.
Description, as the server wrote it
List durable project artifacts and each latest immutable version without returning stored bytes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_build_systemsList creative systems created by the authenticated account and compatible with an optional output target.No findings
Why it is in this group
- The name "list_build_systems" says "list": a word for reading.
Description, as the server wrote it
List creative systems created by the authenticated account and compatible with an optional output target. Built-in 2ools skills, routing, prompts, and operating systems are private and are not returned.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_connected_enginesList privacy-minimized connected 2ools Engines for exact native dispatch.No findings
Why it is in this group
- The name "list_connected_engines" says "list": a word for reading.
Description, as the server wrote it
List privacy-minimized connected 2ools Engines for exact native dispatch. Returns opaque Engine identity, a redacted machine label, online state, authenticated provider CLIs, supported protocols, privacy-safe workspace handles, and the last observed timestamp. Never returns tokens, paths, repository URLs, SSH hosts, secrets, or raw device labels.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_project_agentsList the authorizing account's built-in Agents assigned to one readable project.No findings
Why it is in this group
- The name "list_project_agents" says "list": a word for reading.
Description, as the server wrote it
List the authorizing account's built-in Agents assigned to one readable project. This reveals status and summary, not full Limits or run traces.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_project_engineering_decisionsList native-safe engineering decisions for one exact project, including the canonical project revision, category, risk, question, rationale, tradeoffs, response contract, constrain…No findings
Why it is in this group
- The name "list_project_engineering_decisions" says "list": a word for reading.
Description, as the server wrote it
List native-safe engineering decisions for one exact project, including the canonical project revision, category, risk, question, rationale, tradeoffs, response contract, constraints, and current state. Never returns secrets or internal prompts; unknown future response kinds remain in Project OS.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_project_feedbackRead page-anchored review feedback for versions in a project, with explicit human or external-agent attribution.No findings
Why it is in this group
- The name "list_project_feedback" says "list": a word for reading.
Description, as the server wrote it
Read page-anchored review feedback for versions in a project, with explicit human or external-agent attribution.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_project_pinsRead shared workspace notes and http(s) links, with explicit attribution.No findings
Why it is in this group
- The name "list_project_pins" says "list": a word for reading.
Description, as the server wrote it
Read shared workspace notes and http(s) links, with explicit attribution.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_work_assignmentsList durable project work contracts, bounded attempts, leases, budgets, and result references.No findings
Why it is in this group
- The name "list_work_assignments" says "list": a word for reading.
Description, as the server wrote it
List durable project work contracts, bounded attempts, leases, budgets, and result references.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_project_previewRender an interactive, read-only card for one saved 2ools version.No findings
Why it is in this group
- The name "render_project_preview" says "preview": a word for reading.
Description, as the server wrote it
Render an interactive, read-only card for one saved 2ools version. Use after get_build or get_project when the user wants to see, open, or share the result. Returns protected preview and access-checked workspace links without source code.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
wait_for_project_activityWait up to 20 seconds for attributable project events newer than a head_cursor or prior next_cursor.No findings
Why it is in this group
- The name "wait_for_project_activity" says "wait": a word for reading.
Description, as the server wrote it
Wait up to 20 seconds for attributable project events newer than a head_cursor or prior next_cursor. Returns events oldest-first so an outside agent can process them in order. If resync_required is true, paginate get_project_activity instead of advancing the cursor.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.3.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http 2ools https://2ools.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__2ools__list_build_systems",
      "mcp__2ools__list_connected_engines",
      "mcp__2ools__get_project_engine_workspace",
      "mcp__2ools__get_build",
      "mcp__2ools__get_engine_dispatch",
      "mcp__2ools__compare_versions",
      "mcp__2ools__list_approval_requests",
      "mcp__2ools__get_account_profile",
      "mcp__2ools__get_project_access",
      "mcp__2ools__get_project",
      "mcp__2ools__get_project_context",
      "mcp__2ools__continue_project",
      "mcp__2ools__get_project_mission",
      "mcp__2ools__get_project_intelligence",
      "mcp__2ools__get_project_discipline",
      "mcp__2ools__list_project_engineering_decisions",
      "mcp__2ools__render_project_preview",
      "mcp__2ools__list_project_agents",
      "mcp__2ools__get_agent",
      "mcp__2ools__get_project_agent_mode",
      "mcp__2ools__get_project_work_dispatch",
      "mcp__2ools__get_project_activity",
      "mcp__2ools__wait_for_project_activity",
      "mcp__2ools__list_project_feedback",
      "mcp__2ools__list_project_pins",
      "mcp__2ools__get_version_share_link",
      "mcp__2ools__list_artifacts",
      "mcp__2ools__get_artifact",
      "mcp__2ools__list_artifact_approval_requests",
      "mcp__2ools__get_task_quality_gate",
      "mcp__2ools__get_work_handoff",
      "mcp__2ools__list_work_assignments"
    ],
    "ask": [
      "mcp__2ools__create_public_preview",
      "mcp__2ools__register_existing_project",
      "mcp__2ools__build_from_conversation",
      "mcp__2ools__start_project_on_engine",
      "mcp__2ools__refine_project",
      "mcp__2ools__update_account_profile",
      "mcp__2ools__invite_project_member",
      "mcp__2ools__list_projects",
      "mcp__2ools__refresh_project_cockpit",
      "mcp__2ools__activate_project",
      "mcp__2ools__update_project_intelligence",
      "mcp__2ools__manage_project_discipline",
      "mcp__2ools__update_project_mission",
      "mcp__2ools__review_project_mission",
      "mcp__2ools__manage_work_watchdog",
      "mcp__2ools__update_living_plan",
      "mcp__2ools__run_project_agent",
      "mcp__2ools__configure_project_agent_mode",
      "mcp__2ools__advance_project_agent_mode",
      "mcp__2ools__dispatch_project_work",
      "mcp__2ools__add_project_feedback",
      "mcp__2ools__add_project_pin",
      "mcp__2ools__prepare_version_export",
      "mcp__2ools__create_version_share_link",
      "mcp__2ools__prepare_artifact_upload",
      "mcp__2ools__prepare_artifact_download",
      "mcp__2ools__approve_artifact_version",
      "mcp__2ools__reject_artifact_version",
      "mcp__2ools__run_task_quality_gate",
      "mcp__2ools__prepare_work_handoff",
      "mcp__2ools__create_work_assignment",
      "mcp__2ools__claim_work_assignment",
      "mcp__2ools__heartbeat_work_session",
      "mcp__2ools__checkpoint_work_session",
      "mcp__2ools__submit_work_session",
      "mcp__2ools__decide_work_assignment"
    ],
    "deny": [
      "mcp__2ools__attach_project_engine_workspace",
      "mcp__2ools__approve_version",
      "mcp__2ools__reject_version",
      "mcp__2ools__cancel_build",
      "mcp__2ools__update_project_member_role",
      "mcp__2ools__remove_project_member",
      "mcp__2ools__revoke_project_invite",
      "mcp__2ools__answer_project_engineering_decision",
      "mcp__2ools__act_on_project_os_task",
      "mcp__2ools__cancel_agent_run",
      "mcp__2ools__resolve_project_feedback",
      "mcp__2ools__remove_project_pin",
      "mcp__2ools__revoke_version_share_link"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as 2ools. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.2ools/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

49 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:44 UTC.

For agents: Markdown · JSON · report this listing