Skip to content

demo.st

by demo.st · remote · no sign-in to list tools · v1.1.0 · published by st.demo

Reserve a subdomain, upload .zip via MCP, get a link. Optional document API at api.demo.st.

Deletes · 3Changes · 7
CompareRegistry entry

13 tools: 3 can delete or cancel things, 7 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http demost https://demo.st/mcp --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 3Claude Code: deny
  • clear_siteRemove deployed site content from your subdomain.No findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    Description, as the server wrote it
    Remove deployed site content from your subdomain. Subdomain remains reserved.
  • delete_collectionDelete a document collection and all of its records.No findings

    Why it is in this group

    • The name "delete_collection" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    Delete a document collection and all of its records.
  • delete_recordDelete a record from a document collection.No findings

    Why it is in this group

    • The name "delete_record" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    Delete a record from a document collection.
Changes things 7Claude Code: ask
  • check_subdomain_availabilityCheck if a subdomain name is available on demo.st (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check if a subdomain name is available on demo.st (e.g. "my-site" → my-site.demo.st).
  • create_collectionCreate a document collection (lowercase letter start; letters, numbers, underscores; max 63 chars).No findings

    Why it is in this group

    • The name "create_collection" says "create": a word for a change.
    Description, as the server wrote it
    Create a document collection (lowercase letter start; letters, numbers, underscores; max 63 chars). Max 20 collections per site.
  • release_subdomainRelease your reserved subdomain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Release your reserved subdomain. Deletes the reservation, any deployed site, and all document DB data for that site.
  • reserve_subdomainReserve a subdomain for the logged-in account.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reserve a subdomain for the logged-in account. One subdomain per account.
  • rotate_site_api_keyRotate the public site API key.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rotate the public site API key. The old key stops working immediately; update your site with the new key.
  • upload_siteUpload a .zip as site content for your reserved subdomain.No findings

    Why it is in this group

    • The name "upload_site" says "upload": a word for a change.
    Description, as the server wrote it
    Upload a .zip as site content for your reserved subdomain. Easiest for agents: zip_base64 (base64-encoded zip). Or file_url (public URL to zip). Or file_path (local path, when MCP runs locally).
  • upsert_recordCreate or update a JSON record in a collection.No findings

    Why it is in this group

    • The name "upsert_record" says "upsert": a word for a change.
    Description, as the server wrote it
    Create or update a JSON record in a collection. Pass data as an object. Optional id to upsert a specific record.
Only reads 3Claude Code: allow
  • get_site_api_keyGet (or create) the public site API key for your reserved subdomain.No findings

    Why it is in this group

    • The name "get_site_api_key" says "get": a word for reading.
    Description, as the server wrote it
    Get (or create) the public site API key for your reserved subdomain. Embed this key in your static site and call https://api.demo.st/v1 with Authorization: Bearer <key>. Tenant is scoped by the key — never share another site's key.
  • list_collectionsList document collections for your site (api.demo.st document store).No findings

    Why it is in this group

    • The name "list_collections" says "list": a word for reading.
    Description, as the server wrote it
    List document collections for your site (api.demo.st document store).
  • list_recordsList records in a document collection.No findings

    Why it is in this group

    • The name "list_records" says "list": a word for reading.
    Description, as the server wrote it
    List records in a document collection.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http demost https://demo.st/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__demost__get_site_api_key",
      "mcp__demost__list_collections",
      "mcp__demost__list_records"
    ],
    "ask": [
      "mcp__demost__check_subdomain_availability",
      "mcp__demost__reserve_subdomain",
      "mcp__demost__upload_site",
      "mcp__demost__release_subdomain",
      "mcp__demost__rotate_site_api_key",
      "mcp__demost__create_collection",
      "mcp__demost__upsert_record"
    ],
    "deny": [
      "mcp__demost__clear_site",
      "mcp__demost__delete_collection",
      "mcp__demost__delete_record"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as demost. Review it before you use it.