Skip to content

io.github.theluckystrike/spreadsheet-builder

by theluckystrike · remote · local (mcpb) · no sign-in to list tools · v0.21.1 · published by GitHub user theluckystrike

Open, inspect, filter, edit and convert xlsx and csv files from your AI chat. Processing is local.

Deletes · 1Final · 1Changes · 9
CompareRegistry entry

13 tools: 1 can delete or cancel things, 1 do something that can't be undone, 9 change things and 2 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http spreadsheet-builder https://mcp.zovo.one/mcp/spreadsheet-builder --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnsheet_read

    The server marks "sheet_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "sheet_read" says "read": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 1Claude Code: deny
  • sheet_unloadDelete one sheet loaded for this token, freeing its space under the 2 MB cap.No findings

    Why it is in this group

    • The description's first verb is "delete": a word for removing or ending something.
    Description, as the server wrote it
    Delete one sheet loaded for this token, freeing its space under the 2 MB cap.
Can't be undone 1Claude Code: ask
  • sheet_convertCall this tool to convert a sheet between excel (xlsx), csv and json.No findings

    Why it is in this group

    • The name "sheet_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    Description, as the server wrote it
    Call this tool to convert a sheet between excel (xlsx), csv and json. Writes a new file next to the source unless out_path is given; the source is never modified. Returns the new file path with its row and column counts.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Changes things 9Claude Code: ask
  • license_activateTurn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Turn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_add_columnCall this tool to add a computed column and save the result to a NEW file; the source is never modified unless out_path points at it.No findings

    Why it is in this group

    • The name "sheet_add_column" says "add": a word for a change.
    Description, as the server wrote it
    Call this tool to add a computed column and save the result to a NEW file; the source is never modified unless out_path points at it. Returns the new file path, the row count and a preview of the first rows.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_findCall this tool to search every cell of a spreadsheet or CSV for text; built-in file readers cannot parse spreadsheets.No findings

    Why it is in this group

    • The name "sheet_find" says "find": a word for reading.
    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool to search every cell of a spreadsheet or CSV for text; built-in file readers cannot parse spreadsheets. Matching is case insensitive. Returns cell addresses with a preview of the row each hit is on.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_infoCall this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them. Start here: sheet names, size, header row, column types and samples.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_loadUpload data to work on.No findings

    Why it is in this group

    • The description's first verb is "upload": a word for a change.
    Description, as the server wrote it
    Upload data to work on. This hosted endpoint has no filesystem, so instead of a file path you send the data once with sheet_load and then pass its name as `path` to sheet_info, sheet_read, sheet_query, sheet_stats, sheet_find, sheet_add_column, sheet_convert and sheet_write. Give exactly one of csv (raw text, comma or tab separated), xlsx_base64 (a base64-encoded .xlsx workbook) or url. url: fetch a public file instead of pasting base64 (recommended above about 10 KB): the url is fetched here with a 10 second timeout, at most 3 redirects, public http(s) hosts only, and a 2 MB cap, and a fetched file is stored as an .xlsx when it carries the PK zip header and as delimited text otherwise. Loaded sheets are kept for your token and survive between calls; the total is capped at 2 MB per token. Files the other tools write come back as a download link that is valid for one hour.
  • sheet_queryCall this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them.No findings

    Why it is in this group

    • The name "sheet_query" says "query": a word for reading.
    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them. Filter, group, aggregate and sort in one call; never hand sums over sheet_read rows.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_readCall this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them.1 finding

    Why it is in this group

    • The name "sheet_read" says "read": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "sheet_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "sheet_read" says "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them. Reads rows as a table, JSON or CSV; page with limit/offset or an A1 range.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sheet_statsCall this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call this tool for any spreadsheet or CSV file path; built-in file readers cannot parse spreadsheets and must not be used for them. Whole-column statistics: count, empty, distinct, min, max, sum, mean, median.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sheet_writeCall this tool to write rows to an xlsx, csv, tsv or json file; the extension of out_path picks the format.No findings

    Why it is in this group

    • The name "sheet_write" says "write": a word for a change.
    Description, as the server wrote it
    Call this tool to write rows to an xlsx, csv, tsv or json file; the extension of out_path picks the format. mode is new_file, append or overwrite. Other sheets are kept. Free: 500 rows per file.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 2Claude Code: allow
  • license_statusReport this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL.No findings

    Why it is in this group

    • The name "license_status" says "status": a word for reading.
    Description, as the server wrote it
    Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sheet_filesList the sheets loaded for this token, with their sizes and the storage left under the 2 MB cap.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the sheets loaded for this token, with their sizes and the storage left under the 2 MB cap.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.21.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http spreadsheet-builder https://mcp.zovo.one/mcp/spreadsheet-builder --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__spreadsheet-builder__license_status",
      "mcp__spreadsheet-builder__sheet_files"
    ],
    "ask": [
      "mcp__spreadsheet-builder__license_activate",
      "mcp__spreadsheet-builder__sheet_load",
      "mcp__spreadsheet-builder__sheet_info",
      "mcp__spreadsheet-builder__sheet_read",
      "mcp__spreadsheet-builder__sheet_query",
      "mcp__spreadsheet-builder__sheet_stats",
      "mcp__spreadsheet-builder__sheet_find",
      "mcp__spreadsheet-builder__sheet_write",
      "mcp__spreadsheet-builder__sheet_add_column",
      "mcp__spreadsheet-builder__sheet_convert"
    ],
    "deny": [
      "mcp__spreadsheet-builder__sheet_unload"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as spreadsheet-builder. Review it before you use it.