Publish HTML reports to a share link, collect anchored comments, revise at the same URL.
Scored across 45 tools
Most tools map cleanly to a distinct resource+action (reports, comments, signoffs, reviewers, routines, skills, websites, connectors, integrations, notifications, assets), and the descriptions give strong contextual cues. The one real collision is get_report vs read_report, which both 'fetch a report by id' and return HTML — an agent must read carefully to know which to pick. Minor secondary overlap between create_report's visibility args and set_report_sharing, but that is survivable.
Nearly everything follows snake_case verb_noun (create_report, list_reports, delete_routine, set_comment_status, deploy_website), which is highly predictable. The exceptions are the get_/read_ duality for the same retrieval semantics (get_report vs read_report), which is an inconsistency in exactly the place it hurts most. Reply_to_comment also slightly breaks the verb_noun pattern but is readable.
45 tools is far beyond the comfortable range and forces an agent to scan a large surface before acting. The breadth is partly legitimate (reports, comments, signoffs, reviewers, routines, skills, websites, website comments, notifications, integrations, connectors, assets are genuinely different sub-domains). Still, several tools could be folded (read_report into get_report, list_website_comments into a status filter) to bring this into a workable size.
Core report lifecycle is largely covered (create, get/read, update, assets, sharing, signoffs, comments), but there is no delete_report, which is a striking gap for a report-hosting product. Other lifecycle holes: no update_skill or get_skill, no update_connector, no delete_website/update_website, and no delete_comment. Agents can work around most of these, but the surface is uneven across sub-domains.
Create a top-level comment on a report. Optionally anchor it to a text excerpt or block id.
Inputs: body (required), report_id (required), block_id, anchor_text, +2 more.
Connect a GitHub PAT or Linear API key so Comma can post report links onto PRs/issues. The token is verified against the provider, then stored encrypted; the token itself is never returned. Re-connecting the same provider rotates the stored token.
Inputs: provider (required), access_token (required), account_label.
Create a connector: an encrypted credential a skill can use. kind must be one of the catalog kinds from list_connectors; config and secret are validated against that kind's schema. The secret is encrypted at rest and never returned. (kind, label) must be unique per account.
Inputs: kind (required), label (required), secret (required), config.
Subscribe a webhook to report events. Omit report_id to subscribe to every report you own, were invited to, or share with your team (public link access doesn't count). events defaults to all three; format is 'slack' (default), 'discord', or 'plain'.
Inputs: webhook_url (required), name, events, format, +2 more.
Upload a new HTML report to Comma and get back an absolute share_url to give the user. By default anyone with the link can open the report (visibility='public'; share links are not indexed by search engines) and comment on it after a free sign-in (public_permission='comment'). Pass visibility='private' to keep it owner-only, or public_permission='view' for a read-only link. To include images or other files the HTML references by relative path (e.g. <img src="images/chart.png">), pass them in assets — they're uploaded and the HTML's relative refs are rewritten to public URLs automatically, all in this one call. Returns the report id, visibility, public_permission, and absolute edit_url (/r/:id) and share_url (/p/:id). Pass producer_name (e.g. 'Claude Code', 'Cursor') so the public share view can attribute the report to the agent that produced it. Only pass source_recipe.prompt when the user asks; it is shown to every viewer.
Inputs: html (required), title, assets, visibility, +6 more.
Import a public web page into Comma as a report. Fetches the URL and inlines its images, styles and fonts into a single self-contained HTML document — JavaScript-rendered pages (SPAs, app-builder pages like base44, dashboards) are rendered in a headless browser first so their real content is captured. Creates a shareable report and returns its id, edit URL (/r/:id) and share URL (/p/:id). Use for requests like 'import this page/site/dashboard/app into Comma' or 'turn this URL into a Comma doc'. The page must be publicly reachable (no login); pages behind bot-protection (e.g. Cloudflare challenges) can't be captured.
Inputs: url (required), title, visibility, public_permission.
Register an agent-reviewer. Comma POSTs the report's content to reviewer_url; the reviewer replies with comments. Set report_id to scope it to one report, or omit it for an org-wide reviewer across all your reports. With auto_on_revision=true (default) it runs automatically whenever a new revision is pushed.
Inputs: reviewer_url (required), name, prompt, enabled, +3 more.
Create a routine that re-runs on a cron schedule against a report you can edit. Provide either trigger_url (Comma POSTs to your webhook each tick) or skill_id (Comma runs one of your skills). schedule_cron is a standard 5-field cron expression; routines run at any cadence on every plan, with no per-plan routine cap. Hosted runs draw down your prepaid credit balance (or run free on your own AWS Bedrock key).
Inputs: report_id (required), schedule_cron (required), name, enabled, +5 more.
Create a skill, either by authoring a new one (pass name + prompt) or by uploading a SKILL.md you already have (pass its full text as skill_md — its YAML frontmatter is parsed for name/description/prompt/required tools/model). The skill can then be attached to a routine (via create_routine's skill_id) so Comma runs it on a schedule. For .zip-bundle or GitHub-sourced skills, use the REST endpoint POST /api/v1/skills.
Inputs: name, model, prompt, skill_md, +2 more.
Create a new website. Either a deploy target (then call deploy_website to push source), or pass external_url to link an EXISTING live site (embed + page-level comments, no deploy). framework is react|nextjs|vite|static (defaults to react).
Inputs: name, framework, description, external_url.
Delete a connector you own. Routines referencing it keep their other connectors.
Inputs: connector_id (required).
Remove a notification subscription by id.
Inputs: subscription_id (required).
Delete a previously-uploaded asset by its id. Removes both the storage object and the database row. The report's HTML is not modified — any <img src> etc. referencing the deleted asset will 404.
Inputs: asset_id (required), report_id (required).
Delete an agent-reviewer you own. Comments it already produced stay; their reviewer_id becomes null.
Inputs: reviewer_id (required).
Delete a routine you own and its run history.
Inputs: routine_id (required).
Delete a skill you own. Routines that reference it keep working but their skill_id becomes null.
Inputs: skill_id (required).
Deploy source files to a website. Provide the full source bundle as files:[{path, content}] (UTF-8 text; max 2000 files / 25 MB). The provider builds + hosts it; poll read_website for the live URL. Sites are taken down after their TTL — redeploy to bring one back.
Inputs: files (required), website_id (required).
Remove a connected integration by id.
Inputs: integration_id (required).
Fetch a report by id. Returns metadata + the stored HTML. Requires view permission.
Inputs: id (required).
List review verdicts (approved / changes_requested) on a report. Each entry carries the reviewer, optional note, and is_stale — true when the report's content has changed since the verdict was given. Check this before promoting or distributing a report: an approval with is_stale=true does not vouch for the current content.
Inputs: report_id (required).
List comments + replies on a report. Cursor-paginated; pass the returned nextCursor to fetch the next page. Each comment embeds up to 50 replies; replies_truncated=true means the thread has more (REST: GET /api/v1/comments/:id/replies).
Inputs: report_id (required), limit, cursor.
List your connectors (encrypted credentials for tools like PostHog, Databricks, Supabase, Slack, Stripe, Google Drive) plus the catalog of connector kinds and their config/secret schemas. Secrets are never returned.
Inputs: no named parameters.
List your connected GitHub / Linear integrations. Access tokens are never returned — only provider, account label, and status.
Inputs: no named parameters.
List your notification subscriptions. Each one POSTs report events (revision.created, comment.created, comment.mentioned, signoff.submitted) to a webhook formatted for Slack, Discord, or plain JSON.
Inputs: no named parameters.
List all assets attached to a report, with their access-controlled URLs. Useful for discovering what's already uploaded before deciding whether to add more or reference existing files.
Inputs: report_id (required).
List reports the authenticated user owns, most-recently-updated first. Returns id, title, description, timestamps, and share/edit URLs — not the HTML. Use get_report to fetch a report's body.
Inputs: limit, cursor.
List the agent-reviewers you own. A reviewer is a webhook (reviewer_url) Comma calls with a report's content; the reviewer posts back comments. Reviewers with report_id=null apply to every report you own.
Inputs: no named parameters.
List the routines you own. A routine re-runs on a cron schedule, either by calling a webhook (trigger_url) or by running a skill inside Comma (skill_id), and can republish a report.
Inputs: no named parameters.
List the skills you own. A skill is a reusable prompt/recipe a routine can run inside Comma. Returns the prompt, required tools, source, and model for each.
Inputs: no named parameters.
List comments left on a website, with the full hidden enrichment a coding agent needs to fix each issue: page_path (the route), target_selector (the element), deployment_id (the build), and a metadata blob (element purpose, a DOM slice, viewport, recent console messages). Defaults to open comments; pass status:'all' to include resolved.
Inputs: website_id (required), limit, cursor, status.
List the authenticated user's websites, most-recently-updated first. Returns id, name, framework, visibility, and the app URL (/websites/:id) — use read_website for the live URL and production deployment.
Inputs: limit, cursor.
Fetch a report by id, optionally as plain text. Returns id, title, description, URL, html and text. Use to read another agent's prior report as context.
Inputs: id (required), format.
Fetch a website by id: metadata plus its production deployment and live URL. Requires view permission.
Inputs: website_id (required).
Reply to an existing comment thread.
Inputs: body (required), comment_id (required).
Run every enabled agent-reviewer for a report against its current head revision. Returns the per-reviewer outcome (ok, comments_created, error?). Use when you've shipped a new revision and want a second agent to leave anchored critique before a human looks at it.
Inputs: report_id (required), reviewer_id.
Execute a routine immediately, without waiting for its next scheduled tick. Returns the run outcome plus the refreshed routine row (last_run_status, next_run_at, …). Skill-driven routines may run asynchronously (deferred); poll list_routines for the final status.
Inputs: routine_id (required).
Trigram text search over reports the caller owns, was invited to, or shares with their team (not other people's public share links). Returns id, title, snippet, share URL and similarity. Use before drafting a new report to find prior work.
Inputs: query (required), limit, include_html.
Resolve or reopen a comment thread.
Inputs: status (required), comment_id (required).
Publish or unpublish a report and control who can reach its share link (/p/:id). visibility: 'public' (anyone with the link), 'registered' (any signed-in user), 'domain' (anyone signed in with a verified email on one of allowed_email_domains — required with 'domain', e.g. ['acme.com']), 'team' (the report's team; the report must already be filed under one), or 'private' (owner + invited people only). To change the domain list, send visibility='domain' again with the full new list. public_permission is what link/anonymous visitors may do: 'none', 'view', 'comment', or 'edit'. To publish a report so anyone can open and comment on it, set visibility='public' and public_permission='comment'. show_approved_only enables staged publishing: view-only audiences see the last revision a reviewer approved (see set_report_signoff) while reviewers keep seeing head. allowed_embed_origins opts the report into embedding on other sites: pass the bare origins allowed to iframe it (e.g. ['https://acme.com']), or [] / null to turn embedding off. The response then carries embed_snippet, the exact markup to paste into the host page; the embed only renders while the report is public, its link permission isn't 'none', and it has no share password. Requires manage permission on the report (owner or admin).
Inputs: report_id (required), visibility, public_permission, show_approved_only, +2 more.
Submit or replace your review verdict on a report: 'approved' or 'changes_requested', with an optional one-line note. One current verdict per reviewer per report (PR-review semantics); it is pinned to a revision snapshotting the report's content at submission and goes stale when that content changes.
Inputs: verdict (required), report_id (required), note.
Resolve or reopen a website comment. Use this to close out issues as you ship fixes.
Inputs: status (required), comment_id (required).
Edit a report's title, description, HTML, and/or producer attribution in place. At least one mutable field must be provided.
Inputs: id (required), html, title, description, +4 more.
Update an agent-reviewer you own. Pass any subset of name, reviewer_url, reviewer_auth_header (null clears), prompt (null clears), enabled, auto_on_revision.
Inputs: reviewer_id (required), name, prompt, enabled, +3 more.
Update a routine you own. Pass any subset of name, schedule_cron, trigger_url (null clears), trigger_auth_header (null clears), skill_id (null clears), connector_ids, payload, enabled. Changing schedule_cron recomputes the next run time and is re-checked against your plan floor.
Inputs: routine_id (required), name, enabled, payload, +5 more.
Attach a binary asset (image, video, font, CSS, JS, etc.) to a report. The returned url is a stable public link suitable for <img src>, <video src>, CSS url(...), or any other reference inside the report's HTML. Pass content_base64 as raw base64 (or a data:<mime>;base64,... URL — both work). Re-uploading the same relative_path replaces the previous asset.
Inputs: report_id (required), relative_path (required), content_base64 (required), content_type.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Publish HTML pages, collect review comments, and revise at the same link.
Publish HTML to a shareable link and collect feedback anchored to the passage it refers to.
Publish HTML files as shareable pages, update them at the same link, and read guest comments.
Publish HTML or Markdown to a stable link; pull readers' edits and comments back to revise.
Add one secure layer between your agents and this server.
