Skip to content

JSONPad documentation

by jsonpad.io · remote · local (npm) · no sign-in to list tools · v0.1.0 · published by io.jsonpad

JSONPad docs, API, SDK and CLI references, and offline checkers for write rules and flows.

Changes · 3

14 tools: 3 change things and 11 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http docs https://mcp.jsonpad.io/docs

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "check_write_rules" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_write_rules" says "write": a word for a change.

    What this check looks for
  • The server marks "eval_write_rule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "eval_write_rule" says "write": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Changes things 3Claude Code: ask
  • check_flowCompile a flow document (flows-v1) with the same engine the API uses, and run its tests (flow-tests-v1) against in-memory data.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compile a flow document (flows-v1) with the same engine the API uses, and run its tests (flow-tests-v1) against in-memory data. Returns diagnostics (with JSON pointers into the document), what the flow reads and writes, and why each failing test failed. Costs nothing and sees no data.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • check_write_rulesCompile a list's write rules with the same engine the API uses, and run their tests (a rules-tests-v1 document).1 finding

    Why it is in this group

    • The name "check_write_rules" says "write": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_write_rules" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_write_rules" says "write": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Compile a list's write rules with the same engine the API uses, and run their tests (a rules-tests-v1 document). Returns every diagnostic with its line and column, and for each failing test what it expected, what happened, and how each rule came out. Costs nothing and sees no data: lookups find the test document's items. Use it before saving rules.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • eval_write_ruleCheck one write against a rule set, as the API would, and say whether it would be allowed, denied (403) or failed (400), which statement decided it, and (with trace) what every exp…1 finding

    Why it is in this group

    • The name "eval_write_rule" says "write": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "eval_write_rule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "eval_write_rule" says "write": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Check one write against a rule set, as the API would, and say whether it would be allowed, denied (403) or failed (400), which statement decided it, and (with trace) what every expression evaluated to. The write is shaped like a rule test case: action, identity, token, old, new, patch, merge, now. Costs nothing and sees no data.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
Only reads 11Claude Code: allow
  • get_api_endpointThe full contract of one REST API endpoint: parameters, headers, request body, responses and examples, and the JavaScript SDK method that calls it.No findings

    Why it is in this group

    • The name "get_api_endpoint" says "get": a word for reading.
    Description, as the server wrote it
    The full contract of one REST API endpoint: parameters, headers, request body, responses and examples, and the JavaScript SDK method that calls it. Find it by id (the docs page slug, e.g. "item-restore"), by method and path (templates or concrete paths both work: "/lists/my-list/items/abc"), or by a description.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_cli_commandThe usage, arguments and options of a jsonpad command line tool (@basementuniverse/jsonpad-cli) command, and whether it works offline.No findings

    Why it is in this group

    • The name "get_cli_command" says "get": a word for reading.
    Description, as the server wrote it
    The usage, arguments and options of a jsonpad command line tool (@basementuniverse/jsonpad-cli) command, and whether it works offline. Find it by name ("rules test", "jsonpad sync-schema --dry-run") or by what it does.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_plan_limitsThe limits of each public plan (Free, Indie, Pro, Scale): requests per month and minute, the minimum gap between requests, storage, item size, versions kept, tokens, identities, re…No findings

    Why it is in this group

    • The name "get_plan_limits" says "get": a word for reading.
    Description, as the server wrote it
    The limits of each public plan (Free, Indie, Pro, Scale): requests per month and minute, the minimum gap between requests, storage, item size, versions kept, tokens, identities, realtime connections, webhooks and flows. null means unlimited. Sizes are in bytes, rateLimit in milliseconds, prices in GBP.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_sdk_methodThe signature, description and example of a method in the JavaScript SDK (@basementuniverse/jsonpad-sdk) or the realtime SDK, and the REST endpoint it calls.No findings

    Why it is in this group

    • The name "get_sdk_method" says "get": a word for reading.
    Description, as the server wrote it
    The signature, description and example of a method in the JavaScript SDK (@basementuniverse/jsonpad-sdk) or the realtime SDK, and the REST endpoint it calls. Find it by name ("restoreItem") or by what it does.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_api_endpointsList the REST API endpoints an API token can use, as method, path and title.No findings

    Why it is in this group

    • The name "list_api_endpoints" says "list": a word for reading.
    Description, as the server wrote it
    List the REST API endpoints an API token can use, as method, path and title. Get one in full with get_api_endpoint.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_docsList the documentation pages by section, with a description of each: the table of contents.No findings

    Why it is in this group

    • The name "list_docs" says "list": a word for reading.
    Description, as the server wrote it
    List the documentation pages by section, with a description of each: the table of contents.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • lookup_errorWhat a JSONPad API error code means, its HTTP status, and the guides that explain it.No findings

    Why it is in this group

    • The name "lookup_error" says "lookup": a word for reading.
    Description, as the server wrote it
    What a JSONPad API error code means, its HTTP status, and the guides that explain it. Give the numeric code (10013) or the name (QUOTA_EXCEEDED), as found in an error response's "code" and "name".

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • read_docRead a documentation page as markdown, or one section of it.No findings

    Why it is in this group

    • The name "read_doc" says "read": a word for reading.
    Description, as the server wrote it
    Read a documentation page as markdown, or one section of it. Give a page slug ("indexing"), a /docs path, a jsonpad.io URL (with or without .md, and with an optional #anchor), "sdk/jsonpad-sdk", "sdk/jsonpad-realtime-sdk", "cli/reference" or "cli/readme". Long pages are cut at a section boundary; read on with the returned nextSection.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • search_docsSearch the JSONPad documentation, the JavaScript SDK references and the command line tool reference.No findings

    Why it is in this group

    • The name "search_docs" says "search": a word for reading.
    Description, as the server wrote it
    Search the JSONPad documentation, the JavaScript SDK references and the command line tool reference. Returns the best-matching sections with a snippet and their jsonpad.io URL; read one with read_doc. Exact identifiers work well: error codes and names, headers, SDK methods, CLI commands, $jsonpad-var variables, "POST /lists/{listId}/items".

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • validate_sync_documentCheck a schema sync document (sync-v1) as far as possible without an account: against the JSON schema the API uses, the API's rules for keys and indexes, and every rule set and flo…No findings

    Why it is in this group

    • The name "validate_sync_document" says "validate": a word for reading.
    Description, as the server wrote it
    Check a schema sync document (sync-v1) as far as possible without an account: against the JSON schema the API uses, the API's rules for keys and indexes, and every rule set and flow in it with their tests. Documents that reference files (rulesFile, flowFile and their tests) are checked too if the files' contents are given in files. What a sync would change needs the account: the API server's plan_schema_sync, or jsonpad sync-schema --dry-run.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false
  • validate_token_permissionsCheck an API token's permission rules against the schema the API uses, say which rule shape a broken one was meant to be, and warn about valid rules that probably don't do what was…No findings

    Why it is in this group

    • The name "validate_token_permissions" says "validate": a word for reading.
    Description, as the server wrote it
    Check an API token's permission rules against the schema the API uses, say which rule shape a broken one was meant to be, and warn about valid rules that probably don't do what was meant (rule order, restore without view, sync-schema alone, allow "*").

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http docs https://mcp.jsonpad.io/docs

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__docs__search_docs",
      "mcp__docs__read_doc",
      "mcp__docs__list_docs",
      "mcp__docs__list_api_endpoints",
      "mcp__docs__get_api_endpoint",
      "mcp__docs__get_sdk_method",
      "mcp__docs__get_cli_command",
      "mcp__docs__lookup_error",
      "mcp__docs__get_plan_limits",
      "mcp__docs__validate_sync_document",
      "mcp__docs__validate_token_permissions"
    ],
    "ask": [
      "mcp__docs__check_write_rules",
      "mcp__docs__eval_write_rule",
      "mcp__docs__check_flow"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as docs. Review it before you use it.