Skip to content

DayPilot

by daypilot.org · remote · no sign-in to list tools · v0.1.0 · published by org.daypilot

Official DayPilot references, release packages, CSS themes and verified starter projects.

Changes · 4
CompareRegistry entry

8 tools: 4 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http daypilot https://mcp.daypilot.org/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warngenerate_project

    The server marks "generate_project" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":true}; The name "generate_project" says "generate": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 4Claude Code: ask
  • builder_catalogDiscover Builder components, targets, settings, option IDs and defaults for deliberately creating a new project.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Discover Builder components, targets, settings, option IDs and defaults for deliberately creating a new project. Omit all filters for components; supply component for targets/settings; add edition and target for explicit option support. Target requires edition. Use catalogRevision in validate_project. Builder covers a configurable subset; absent settings do not establish unsupported product features.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • generate_projectGenerate and verify a new Builder project ZIP using the same validated specification plus expectedProjectDigest.1 finding

    Why it is in this group

    • The name "generate_project" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_project" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":true}; The name "generate_project" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate and verify a new Builder project ZIP using the same validated specification plus expectedProjectDigest. Returns a verified receipt and exact canonical POST download request, not ZIP bytes or a saved file. Download using that request, verify archive SHA-256 before extracting into a new directory, then follow generated README/AGENTS and check installation/build/runtime. Pro projects contain an evaluation trial. Never overwrite an existing app.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • render_themeRender complete CSS from a current theme_manifest revision, a unique CSS prefix and optional property overrides.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Render complete CSS from a current theme_manifest revision, a unique CSS prefix and optional property overrides. Uses canonical defaults and validates settings. Returns CSS, SHA-256 and application guidance without saving a theme. Load CSS globally and use the prefix in the component's theme property; verify installed typings.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • theme_manifestDiscover supported theme settings, defaults and value domains for a DayPilot component.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Discover supported theme settings, defaults and value domains for a DayPilot component. Returns a revision required by render_theme. Inspect the manifest before choosing overrides.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
Only reads 4Claude Code: allow, ask for 1 outbound
  • fetchRead the published DayPilot API/documentation/CODE article or JavaScript demo Markdown at a canonical source URL.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "read" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Read the published DayPilot API/documentation/CODE article or JavaScript demo Markdown at a canonical source URL. Preserves examples and edition qualifications. Results include source, revision, content and continuation; pass nextOffset with the same revision to continue. References describe the current documentation, not every installed version.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • resolve_packageResolve the latest official DayPilot Lite or Pro release for JavaScript, React, Angular or Vue.No findings

    Why it is in this group

    • The name "resolve_package" says "resolve": a word for reading.
    Description, as the server wrote it
    Resolve the latest official DayPilot Lite or Pro release for JavaScript, React, Angular or Vue. Returns package identity, license and installation guidance; Pro installation is a trial. Preserve an existing application's installed version and licensed dependency unless an upgrade is requested. Does not install packages or verify historical compatibility.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • validate_projectPreflight a new Builder project using a discovered catalogRevision, component, edition, target, projectName and setting-ID to option-ID map ({} uses defaults).No findings

    Why it is in this group

    • The name "validate_project" says "validate": a word for reading.
    Description, as the server wrote it
    Preflight a new Builder project using a discovered catalogRevision, component, edition, target, projectName and setting-ID to option-ID map ({} uses defaults). Returns effective settings, qualified release identity, warnings and projectDigest for generate_project. Validates generation only; does not install, build or run the application. Preserve an existing application instead of regenerating it.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http daypilot https://mcp.daypilot.org/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__daypilot__resolve_package",
      "mcp__daypilot__search",
      "mcp__daypilot__validate_project"
    ],
    "ask": [
      "mcp__daypilot__builder_catalog",
      "mcp__daypilot__fetch",
      "mcp__daypilot__generate_project",
      "mcp__daypilot__render_theme",
      "mcp__daypilot__theme_manifest"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as daypilot. Review it before you use it.

Capability tags behind 1 rule
  • mcp__daypilot__fetch untrusted-input, outbound