Read a UTF-8 text file from within the server's sandboxed directory (/app). Path is relative to that directory. Refuses files above the configured size limit or outside the sandbox.

Write UTF-8 text to a file within the server's sandboxed directory (/app). Path is relative to that directory. Creates parent directories as needed; refuses to write outside the sandbox or above the configured size limit.

List files and subdirectories within the server's sandboxed directory (/app). Path is relative to that directory ('' or '.' for the root).

Fetch a public web page and extract its content. Without selector, returns the page title, visible text (script/style stripped), and outgoing links. With selector, returns the text of every element matching that CSS selector instead. Blocks requests to private, loopback, link-local, and other non-public addresses.

Transform or aggregate tabular/record data. operation='convert' converts between JSON (array of objects) and CSV (requires output_format). operation in {sum, average, min, max, count, unique} aggregates a single field across the records (omit field if data is a flat JSON array of numbers).

Make an authenticated HTTP request to a public API. The server attaches its own configured credential (bearer token or API key) — do not attempt to pass Authorization headers yourself, they will be ignored. GET/POST/PUT/PATCH/DELETE/HEAD supported. Blocks requests to private, loopback, link-local, and other non-public addresses, and re-validates every redirect hop.