Skip to content

Writ Cloud

by usewrit.app · remote · local (npm) · no sign-in to list tools · v1.0.0 · published by app.usewrit

Read, crawl and act on websites, signed in as the user, and turn any site into an API.

Deletes · 14Final · 3Changes · 13

41 tools: 14 can delete or cancel things, 3 do something that can't be undone, 13 change things and 11 only read.

Scanned Oct 21, 2026

4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http writ-cloud https://api.usewrit.app/mcp

Findings

Matches of fixed checks, with the text they matched.

3 warn1 info
  • The server marks "writ_workflow_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "writ_workflow_runs" says "run": a word for a change.

    What this check looks for
  • The server marks "writ_scrape" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "read": a word for reading.

    What this check looks for
  • The server marks "writ_browser_live_view" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "writ_browser_live_view" says "view": a word for reading.

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ion, and its answers never ask for one: credentials are typed only into a Writ window. acti..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

41 tools

Deletes or cancels 14Claude Code: deny
  • writ_browser_actRuns one batch of actions on an open session and returns the fresh page.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Runs one batch of actions on an open session and returns the fresh page. Each action is an object, e.g. {"action":"click","selector":"#go"}. DRIVE: navigate, click, fill, type_text, select, check, hover, submit, press_key, scroll, back, wait, wait_for. SEE: query_dom, find_text, read_text, count, get_attributes, inspect, list_candidates, get_dom, get_screenshot. NETWORK: capture_network, get_request, rotate_exit. CODE: evaluate_js, search_scripts, read_script. RECORD: extract {variable,script}, api_call, login_post, probe_write, confirm_write. 2FA: twofa {challenge_method}. A value written {{name}} with its real value in `inputs` becomes a workflow input. Each action's arguments: the session's start answer, or writ_help('writ_browser_act').

    Annotations the server declares

    • title: Act in a browser session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_browser_cancelCloses an open browser session (an open cloud browser bills until it is closed).No findings

    Why it is in this group

    • The name "writ_browser_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Closes an open browser session (an open cloud browser bills until it is closed). Unsaved work that did more than visit pages is auto-saved first and the reply names it; discard=true keeps nothing.

    Annotations the server declares

    • title: Close a browser session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • writ_browser_composeAuthors the workflow in an open session beyond a recording: named API functions (define_function with a `flow` (preferred in an API build), from a captured call's index, or a lists…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Authors the workflow in an open session beyond a recording: named API functions (define_function with a `flow` (preferred in an API build), from a captured call's index, or a lists payload; live-tested as defined; compile_function for an authenticated request), set_inputs, add_steps, test_function, remove_function, remove_step, list. Payload shapes: writ_help('writ_browser_compose').

    Annotations the server declares

    • title: Compose a workflow in a session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_browser_saveSaves the open session as a replayable workflow and closes the browser, in the place its browser ran: the user's desktop library or Writ Cloud.No findings

    Why it is in this group

    • The name "writ_browser_save" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Saves the open session as a replayable workflow and closes the browser, in the place its browser ran: the user's desktop library or Writ Cloud. Composed functions become callable API functions, declared inputs become its parameters. The answer carries the steps, the inputs and a run_example; the workflow runs at zero AI cost through writ_run_workflow. A save that references something no run could resolve is refused with the reasons, and the browser stays open.

    Annotations the server declares

    • title: Save a session as a workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_browser_useA REAL CLOUD BROWSER FOR A TASK ON A SITE: the user's signed-in account (a persona_id from writ_personas: the password stays sealed in Writ, and sessions never ask for a password),…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    A REAL CLOUD BROWSER FOR A TASK ON A SITE: the user's signed-in account (a persona_id from writ_personas: the password stays sealed in Writ, and sessions never ask for a password), a click, form, submit or search inside an app, or a page a plain fetch cannot open (login wall, 403, CAPTCHA). Opens the browser and returns the first page; writ_browser_act drives it (Writ runs no model here). Recording is always on: writ_browser_save turns the session into a workflow that replays without a browser, writ_browser_cancel closes it (an open browser bills). The start answer carries the action vocabulary, the recording rules and, with a persona, the 2FA rules. NOT FOR: reading pages (writ_scrape). An API: writ_website_to_api opens this same browser, bound to a build.

    Annotations the server declares

    • title: Open a browser
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_crawl_siteCOLLECTS a site or a section into a queryable, change-tracked dataset (one row per page).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    COLLECTS a site or a section into a queryable, change-tracked dataset (one row per page). Scope: intent (a section, in plain words), rank_cap=N (the top N items of a listing), seed_urls (known pages), or the whole site capped by page_budget. Modes: markdown (default, no AI), extract_mode='schema' (uniform records), executor='ai' + extract_prompt (per-page understanding, 5x the page rate). A bounded crawl answers with its rows; an open one returns a crawl_id for writ_crawl_status wait=true. NOT FOR: reading a few pages now (writ_scrape). Every option: writ_help('writ_crawl_site').

    Annotations the server declares

    • title: Crawl a site into a dataset
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_create_http_extractionDrafts or revises a multi-request browserless HTTP extraction (loops, GraphQL, cursor pagination) from captured requests and a plain-language goal.No findings

    Why it is in this group

    • The name "writ_create_http_extraction" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Drafts or revises a multi-request browserless HTTP extraction (loops, GraphQL, cursor pagination) from captured requests and a plain-language goal. Every option: writ_help('writ_create_http_extraction').

    Annotations the server declares

    • title: Build an HTTP extraction
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_paymentPays on a site with one of the user's cards; card numbers never reach this conversation.No findings

    Why it is in this group

    • The name "writ_payment" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pays on a site with one of the user's cards; card numbers never reach this conversation. request (site, max_amount, purpose) returns a tell_user and an open_url where the user approves; wait (grant_id or confirmation_id); checkout pauses at the order button for the user's confirmation, then Writ places the order; fill; list (card handles only). Details: writ_help('writ_payment').

    Annotations the server declares

    • title: Pay with a card the user approves
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_record_websiteRecords a repeatable task on a site as a workflow (goal + start url): the same session as writ_browser_use, labelled with its goal, driven with writ_browser_act and saved with writ…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Records a repeatable task on a site as a workflow (goal + start url): the same session as writ_browser_use, labelled with its goal, driven with writ_browser_act and saved with writ_browser_save. A goal that asks for an API opens as a writ_website_to_api build instead: the same browser, bound to the build.

    Annotations the server declares

    • title: Record a website task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_run_workflowRuns a saved workflow by workflow_id or name and returns its extracted data (it waits by default).No findings

    Why it is in this group

    • The name "writ_run_workflow" says "run": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Runs a saved workflow by workflow_id or name and returns its extracted data (it waits by default). Inputs go as top-level fields or under `inputs`; function_name runs one function of a multi-function API (with the sign-in it needs). max_age reuses a recent result at no cost. A write function previews with mutation_mode='dry_run'. Runs sign in as the workflow's persona or persona_id; no password is ever passed. Venue, network, files and output shape: writ_help('writ_run_workflow').

    Annotations the server declares

    • title: Run a saved workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • writ_set_scheduleSchedules a saved workflow: every_minutes, or kind='daily'/'weekly' with time (HH:MM) and days.No findings

    Why it is in this group

    • The name "writ_set_schedule" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Schedules a saved workflow: every_minutes, or kind='daily'/'weekly' with time (HH:MM) and days. functions + inputs schedule chosen functions of a multi-function API.

    Annotations the server declares

    • title: Schedule a workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • writ_update_saved_crawlInspects or changes a saved crawl's settings in place.No findings

    Why it is in this group

    • The name "writ_update_saved_crawl" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Inspects or changes a saved crawl's settings in place.

    Annotations the server declares

    • title: Edit a saved crawl
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • writ_update_workflowInspects or edits a saved workflow: an outline, one function's source, targeted function or step edits, a settings patch.No findings

    Why it is in this group

    • The name "writ_update_workflow" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Inspects or edits a saved workflow: an outline, one function's source, targeted function or step edits, a settings patch. copy_to keeps a linked copy on Writ Cloud or the user's desktop. Every option: writ_help('writ_update_workflow').

    Annotations the server declares

    • title: Edit a saved workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • writ_website_to_apiTURNS A WEBSITE INTO A CALLABLE API (named functions with inputs, returning JSON), built by the caller in a real browser.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    TURNS A WEBSITE INTO A CALLABLE API (named functions with inputs, returning JSON), built by the caller in a real browser. url = the page that already shows the rows (search results or a listing, not the home page); goal = the inputs and fields wanted. The call first proposes the user's matching saved workflows and marketplace APIs (skip_existing / skip_marketplace build fresh), then opens a cloud browser bound to the build: capture_network records the site's own calls, writ_browser_network reads them, api_call probes them; a failed probe is evidence, not the end. Functions: HTTP flows first (writ_browser_compose define_function `flow`; writ_help('http_flows')), single requests (from_index) mixed in, DOM extraction last. writ_browser_save, then run_example on two inputs. mode=intelligent: Writ builds it alone (+ writ_discovery_status wait=true), on request.

    Annotations the server declares

    • title: Turn a website into an API
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Can't be undone 3Claude Code: ask
  • writ_create_automationCreates an automation: on an event (a workflow or crawl completed, a monitor change, a webhook, a schedule) it runs a workflow, sends a notification templated over the event's data…No findings

    Why it is in this group

    • The name "writ_create_automation" says "create": a word for a change.
    • The input addresses people (input.recipients): what it sends cannot be taken back.
    Description, as the server wrote it
    Creates an automation: on an event (a workflow or crawl completed, a monitor change, a webhook, a schedule) it runs a workflow, sends a notification templated over the event's data, and/or wakes an AI agent. Event, template and webhook options: writ_help('writ_create_automation').

    Annotations the server declares

    • title: Create an automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_expose_workflow_apiPublishes a saved workflow as a REST endpoint (a POST URL that waits and returns its JSON).No findings

    Why it is in this group

    • The description's first verb is "publish": a word for a change that another call does not undo.
    Description, as the server wrote it
    Publishes a saved workflow as a REST endpoint (a POST URL that waits and returns its JSON). Repeated calls reuse it.

    Annotations the server declares

    • title: Publish a workflow as a REST API
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • writ_wire_monitorConnects a monitor's change_detected event to an action: action='notify' (channels and recipients the account has configured), 'workflow' (runs a saved workflow), or 'ai_task' (an …No findings

    Why it is in this group

    • The input addresses people (input.recipients): what it sends cannot be taken back.
    Description, as the server wrote it
    Connects a monitor's change_detected event to an action: action='notify' (channels and recipients the account has configured), 'workflow' (runs a saved workflow), or 'ai_task' (an AI agent opens the page and works `prompt`). A price watch takes `threshold` (+ threshold_op): the action then runs once, when a check reads a price at or below it. Buying at a price (`buy`): writ_help('writ_wire_monitor').

    Annotations the server declares

    • title: Connect a monitor to an action
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 13Claude Code: ask
  • writ_browser_ask_userHands an open session to the Writ user: kind='captcha' (they complete a security check in the live browser), 'twofa' (they supply the one-time code and Writ types it; the code neve…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Hands an open session to the Writ user: kind='captcha' (they complete a security check in the live browser), 'twofa' (they supply the one-time code and Writ types it; the code never reaches this conversation), 'sign_in' (they sign in on the live page; no persona applies) or 'question' (their text answer). The call that opens the ask returns at once with user_link + tell_user to relay; later calls hold up to 60 s and answer answered, waiting_for_user (the same call again) or expired. Their answer is kept if your turn ends first.

    Annotations the server declares

    • title: Ask the user to step in
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_browser_contextRe-reads an open session: section=page (url, fields, buttons, cleaned DOM), lists (the page's repeating rows with a live-tested define_function payload for writ_browser_compose), m…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Re-reads an open session: section=page (url, fields, buttons, cleaned DOM), lists (the page's repeating rows with a live-tested define_function payload for writ_browser_compose), map (the evidence of the build the session is bound to).

    Annotations the server declares

    • title: Read a browser session
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_browser_live_viewThe live browser card's own access: the card ChatGPT and Claude show under writ_browser_use and writ_record_website calls it to read the session's state and get one-time passes for…1 finding

    Why it is in this group

    • The name "writ_browser_live_view" says "view": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "writ_browser_live_view" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "writ_browser_live_view" says "view": a word for reading.

      What this check looks for
    Description, as the server wrote it
    The live browser card's own access: the card ChatGPT and Claude show under writ_browser_use and writ_record_website calls it to read the session's state and get one-time passes for the session's screencast and its take-over channel. The user watches the page in the card and can take it over there. It is not part of a conversation's work.

    Annotations the server declares

    • title: Live browser view
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_crawl_filesThe original files (PDFs, office documents, images, CSVs) a crawl captured, with short-lived download URLs.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The original files (PDFs, office documents, images, CSVs) a crawl captured, with short-lived download URLs.

    Annotations the server declares

    • title: List a crawl's captured files
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_create_monitorWATCHES a page for changes: Writ checks it on a schedule and fires change_detected when the page, a CSS selector's text, a value read by `extract`, or a visual zone changes.No findings

    Why it is in this group

    • The name "writ_create_monitor" says "create": a word for a change.
    Description, as the server wrote it
    WATCHES a page for changes: Writ checks it on a schedule and fires change_detected when the page, a CSS selector's text, a value read by `extract`, or a visual zone changes. Returns the monitor_id that writ_wire_monitor connects to an alert, a workflow or an AI task (a price watch takes a threshold there). Without `interval` the answer is needs_input: this plan's options and a tell_user for the user, nothing created. The page is read first: a sign-in answers needs_persona, a bot check offers use_residential.

    Annotations the server declares

    • title: Watch a page for changes
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_devicesThe user's linked Writ desktops: list, use (scope this connection to one: runs, browsers, personas and monitors then target it), clear, monitors, datasets.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The user's linked Writ desktops: list, use (scope this connection to one: runs, browsers, personas and monitors then target it), clear, monitors, datasets.

    Annotations the server declares

    • title: Choose a linked desktop
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_export_dataExports a workflow's full data table as CSV or JSON.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Exports a workflow's full data table as CSV or JSON.

    Annotations the server declares

    • title: Export collected data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_helpThe full reference of any Writ tool (every parameter and its rules) and the complete guide.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The full reference of any Writ tool (every parameter and its rules) and the complete guide. topic = a tool name (e.g. 'writ_browser_compose', a 'run_<workflow>' tool), 'guide' for the manual (recurring digests, HTTP flow building, buying on a price, crawl and build modes), 'actions' / 'recording' / '2fa' for the browser rules, 'http_flows' / 'flow_operators' for writing an HTTP flow, or empty for the list of topics.

    Annotations the server declares

    • title: Writ tool reference
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_personasThe user's own accounts on websites (personas): how Writ signs in as them.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ion, and its answers never ask for one: credentials are typed only into a Writ window. acti..."

      What this check looks for
    Description, as the server wrote it
    The user's own accounts on websites (personas): how Writ signs in as them. No password passes through this tool or the conversation, and its answers never ask for one: credentials are typed only into a Writ window. action='list' domain=<site> shows the personas usable there; with none it answers persona_needed: a tell_user for the user, a create_url (a small Writ window with only the sign-in form, pre-filled for the site) and a link_id. action='wait' link_id=<id> is one held call that answers when the user saves it, with its persona_id. Also get, request (a link for another account), sign_in (refresh the session) and record_login. A persona_id works on writ_scrape, writ_crawl_site, writ_browser_use and writ_run_workflow; a desktop persona ('device:...') signs in on that desktop, from its own vault.

    Annotations the server declares

    • title: Use the user's saved sign-ins
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_pin_workflow_toolPins (or unpins) a saved workflow as its own run_<name> tool on this server.No findings

    Why it is in this group

    • The name "writ_pin_workflow_tool" says "pin": a word for a change.
    Description, as the server wrote it
    Pins (or unpins) a saved workflow as its own run_<name> tool on this server.

    Annotations the server declares

    • title: Pin a workflow as a tool
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_run_saved_crawlRuns a saved crawl; max_age returns its recent data at no cost instead of re-crawling.No findings

    Why it is in this group

    • The name "writ_run_saved_crawl" says "run": a word for a change.
    Description, as the server wrote it
    Runs a saved crawl; max_age returns its recent data at no cost instead of re-crawling.

    Annotations the server declares

    • title: Run a saved crawl
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_scrapeREAD PAGES NOW, no browser session: one page (url), up to 20 pages in parallel (urls), or a listing plus its top N item pages (url + top_n).1 finding

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "writ_scrape" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    READ PAGES NOW, no browser session: one page (url), up to 20 pages in parallel (urls), or a listing plus its top N item pages (url + top_n). Returns clean markdown in 2-10 s, including pages a plain fetch cannot read: rendered by JavaScript (render_mode='browser'; a read that only got the page's shell says so and gives the retry), behind a bot wall or 403 (an automatic residential retry), or behind the user's sign-in (persona_id). Discussion threads keep their comments. format='html' returns the raw HTML for selectors. NOT FOR: a site-wide dataset (writ_crawl_site) or clicking and typing (writ_browser_use).

    Annotations the server declares

    • title: Read web pages
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • writ_workflow_runsRun history (status, timing, errors, venue) of one workflow or all of them.1 finding

    Why it is in this group

    • The name "writ_workflow_runs" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "writ_workflow_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "writ_workflow_runs" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run history (status, timing, errors, venue) of one workflow or all of them.

    Annotations the server declares

    • title: List workflow runs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 11Claude Code: allow
  • writ_browser_networkSearches (operation=search, query, method) or reads in full (operation=detail, index) the backend requests the page made after capture_network: the site's real API.No findings

    Why it is in this group

    • The description's first verb is "search": a word for reading.
    Description, as the server wrote it
    Searches (operation=search, query, method) or reads in full (operation=detail, index) the backend requests the page made after capture_network: the site's real API. writ_browser_act api_call probes one with other values (a `flow`: several requests); an index feeds writ_browser_compose define_function from_index.

    Annotations the server declares

    • title: Read a session's network calls
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_browser_sessionsLists the account's open cloud browser sessions (each resumable by its session_id).No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists the account's open cloud browser sessions (each resumable by its session_id).

    Annotations the server declares

    • title: List open browser sessions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_crawl_statusStatus of a crawl by crawl_id; wait=true holds up to 75 s and returns the collected rows when it converges.No findings

    Why it is in this group

    • The name "writ_crawl_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of a crawl by crawl_id; wait=true holds up to 75 s and returns the collected rows when it converges.

    Annotations the server declares

    • title: Check a crawl
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_diagnose_http_workflowExplains why a saved workflow's run returned nothing or failed: HTTP-lane readiness and, with task_id, the run's requests and responses.No findings

    Why it is in this group

    • The description's first verb is "explain": a word for reading.
    Description, as the server wrote it
    Explains why a saved workflow's run returned nothing or failed: HTTP-lane readiness and, with task_id, the run's requests and responses.

    Annotations the server declares

    • title: Diagnose a workflow's HTTP lane
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_discovery_statusStatus of a writ_website_to_api build.No findings

    Why it is in this group

    • The name "writ_discovery_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of a writ_website_to_api build. wait=true is one held call (up to 75 s) that follows the build to its newest rung and returns when it is done or parked. Answers: succeeded (workflow_id, functions, run_example), failed, cancelled, or needs_guidance (the build is the caller's to finish with writ_website_to_api mode=guided build_id=<id>; its map comes with it).

    Annotations the server declares

    • title: Check an API build
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_list_webhooksThe account's inbound webhook URLs and the automations they fire.No findings

    Why it is in this group

    • The name "writ_list_webhooks" says "list": a word for reading.
    Description, as the server wrote it
    The account's inbound webhook URLs and the automations they fire.

    Annotations the server declares

    • title: List inbound webhook URLs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_list_workflowsLists the workflows saved in the Writ account; each runs on demand without live browsing.No findings

    Why it is in this group

    • The name "writ_list_workflows" says "list": a word for reading.
    Description, as the server wrote it
    Lists the workflows saved in the Writ account; each runs on demand without live browsing. Returns id, name, declared inputs, schedule, and whether it is pinned as its own run_<name> tool.

    Annotations the server declares

    • title: List saved workflows
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_saved_crawl_dataReads the data a saved crawl collected on its last completed run, without crawling.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Reads the data a saved crawl collected on its last completed run, without crawling.

    Annotations the server declares

    • title: Read a saved crawl's data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_saved_crawlsLists the crawls saved for re-running, with their scope.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists the crawls saved for re-running, with their scope.

    Annotations the server declares

    • title: List saved crawls
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_search_dataSearches everything the account's workflows already collected for a term, without running anything.No findings

    Why it is in this group

    • The name "writ_search_data" says "search": a word for reading.
    Description, as the server wrote it
    Searches everything the account's workflows already collected for a term, without running anything.

    Annotations the server declares

    • title: Search collected data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • writ_workflow_dataReads a saved workflow's collected data as a table: q filters, run_id picks one run, refs returns full records.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Reads a saved workflow's collected data as a table: q filters, run_id picks one run, refs returns full records.

    Annotations the server declares

    • title: Read a workflow's collected data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http writ-cloud https://api.usewrit.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__writ-cloud__writ_discovery_status",
      "mcp__writ-cloud__writ_browser_network",
      "mcp__writ-cloud__writ_browser_sessions",
      "mcp__writ-cloud__writ_list_workflows",
      "mcp__writ-cloud__writ_diagnose_http_workflow",
      "mcp__writ-cloud__writ_workflow_data",
      "mcp__writ-cloud__writ_search_data",
      "mcp__writ-cloud__writ_saved_crawls",
      "mcp__writ-cloud__writ_saved_crawl_data",
      "mcp__writ-cloud__writ_crawl_status",
      "mcp__writ-cloud__writ_list_webhooks"
    ],
    "ask": [
      "mcp__writ-cloud__writ_browser_context",
      "mcp__writ-cloud__writ_browser_ask_user",
      "mcp__writ-cloud__writ_personas",
      "mcp__writ-cloud__writ_devices",
      "mcp__writ-cloud__writ_pin_workflow_tool",
      "mcp__writ-cloud__writ_export_data",
      "mcp__writ-cloud__writ_workflow_runs",
      "mcp__writ-cloud__writ_expose_workflow_api",
      "mcp__writ-cloud__writ_run_saved_crawl",
      "mcp__writ-cloud__writ_scrape",
      "mcp__writ-cloud__writ_crawl_files",
      "mcp__writ-cloud__writ_create_automation",
      "mcp__writ-cloud__writ_create_monitor",
      "mcp__writ-cloud__writ_wire_monitor",
      "mcp__writ-cloud__writ_help",
      "mcp__writ-cloud__writ_browser_live_view"
    ],
    "deny": [
      "mcp__writ-cloud__writ_browser_use",
      "mcp__writ-cloud__writ_record_website",
      "mcp__writ-cloud__writ_website_to_api",
      "mcp__writ-cloud__writ_browser_act",
      "mcp__writ-cloud__writ_browser_compose",
      "mcp__writ-cloud__writ_browser_save",
      "mcp__writ-cloud__writ_browser_cancel",
      "mcp__writ-cloud__writ_payment",
      "mcp__writ-cloud__writ_run_workflow",
      "mcp__writ-cloud__writ_update_workflow",
      "mcp__writ-cloud__writ_create_http_extraction",
      "mcp__writ-cloud__writ_set_schedule",
      "mcp__writ-cloud__writ_crawl_site",
      "mcp__writ-cloud__writ_update_saved_crawl"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as writ-cloud. Review it before you use it.