Returns the implemented edit profile, frozen direct-filesystem threat model and operational requirements, and locally available Tiled command-line adapters.

Lists map, tileset, template, world and project assets under the configured project root.

Reads one project-local JSON .world file and returns its explicit map members with world coordinates, declared sizes, per-member existence and pinned revisions, plus world custom properties. Pattern-based members are counted only by default; pass expandPatterns to match them with World::allMaps semantics — every pattern partially matches project-asset file names in exactly the world's own directory, two capture groups become x/y through the multipliers and offsets, sizes default to the absolute multipliers, and expanded members append after explicit ones without deduplication, marked fromPattern with their patternIndex.

Reads one project-local .tiled-project file and returns its propertyTypes definitions verbatim — the authoritative source of class member and enum type annotations that TMJ documents themselves never carry. Read-only; malformed entries fail closed.

Lists bounded checkpoint manifests and separately reports corrupt entries. This tool never restores or deletes files.

Creates committed recovery checkpoints of the exact current bytes of 1 to 32 project files, without modifying any project asset — an explicit save point before risky work, on top of the automatic checkpoints every net-changing apply already takes. Restoring one of these checkpoints reproduces the snapshotted state byte for byte.

Pins one prepared checkpoint manifest and proves that the current target still equals its pre-write state: an existing target must match the exact before revision and size, while a create target must still be missing. It returns a destructive discard proposal without deleting the manifest or changing the project asset. Conflicting, exact-after, ambiguous, committed, unsafe, or unrelated states are rejected.

For an ambiguous create checkpoint only, pins the full prepared manifest and current target evidence and requires the target to exactly match the after revision. It returns an explicit operator-decision proposal without changing either the manifest or project asset. Applying the proposal commits only the internal audit checkpoint record; because its before state is target absence, it still cannot be restored as deletion. It does not run garbage collection, and there is no generic force flag.

Pins the full manifest, target observation, and one of four machine-classified ambiguous prepared-checkpoint conflicts. It returns an explicit destructive operator-decision proposal without changing the project asset. Applying it permanently deletes only the recovery manifest and then runs fail-closed garbage collection; safe-discard states and machine-reconcilable existing-file exact-after states are rejected. A create exact-after conflict remains eligible because its provenance is ambiguous. There is no generic force flag.

Pins the raw manifest revision of one committed recovery checkpoint and returns a destructive prune proposal without deleting it. Prepared checkpoints are rejected; reconcile them or use the dedicated safe-discard preview when its exact-before eligibility is proven. Applying the proposal removes only the manifest, then runs fail-closed garbage collection for unreferenced checkpoint objects and private crash temporary files.

Pins 2 to 32 explicit committed recovery checkpoint manifests, canonicalizes their UUIDs to lowercase, and orders them by checkpoint ID. The destructive proposal is non-atomic: apply preflights every pin, removes manifests sequentially with per-item directory durability, stops on the first failure, caches any partial result without resume, and runs fail-closed garbage collection once only after all selected manifests are removed. Prepared checkpoints and duplicate normalized IDs are rejected.

Validates one checkpoint and its exact pre-write JSON bytes, pins the current target revision, and returns a destructive restore proposal without writing. When the target file is missing (deleted through tiled_delete_file or externally), expectedRevision must equal the checkpoint's restorable content revision and the approved restore recreates the file with no-replace semantics. Only that document is restored; referenced tilesets, images and other files are not.

Reads dimensions, normalized root render/background/class metadata, revision, layer tree and external tileset identities before editing. Embedded (inline) atlas tilesets are listed separately with their tilesets[] index and GID range; they are pinned by the map revision and stay read-only. Infinite maps are readable too: the summary reports infinite:true, chunked tile-layer content bounds with startX/startY, and a read-only profile marker; isometric maps likewise return a read-only profile (tile data and GIDs are storage-identical to orthogonal), while staggered and hexagonal maps stay rejected. XML maps (.tmx) return a bounded read-only summary through a fail-closed XML subset reader — layer tree with data encodings, external tileset references resolved with per-file existence and revision pins, and an editable:false marker; TMX never reaches any edit planner.

Returns a bounded semantic summary of one tileset referenced by a map — an external TSJ selected by tilesetAssetId, or an embedded (inline) atlas tileset selected by its original tilesets[] index via embeddedIndex (exactly one selector is required; embedded content is pinned by the map revision itself). Includes sparse tile metadata with per-tile custom-property values (scalars, enums, object references, and bounded raw nested class/list values; only oversized entries carry an explicit valueOmitted marker), animation, exact collision shape geometry (gid/template objects and oversized paths carry omission markers), and expanded Wang sets (full color projections plus a bounded wangtile sample; wangid slots run clockwise from the top edge). Image-collection tilesets project a collection block instead of atlas geometry, with each returned page tile's image verified and revision-pinned; collection Wang sets, per-tile sub-rectangles, and embedded image-collection tilesets fail closed.

Searches one referenced external TSJ (atlas or image-collection) for exact tile classes or explicitly serialized scalar properties and returns bounded TileRefs ordered by local ID.

Returns a bounded rectangular tile region using tileset asset IDs and local tile IDs. Cells referencing an embedded (inline) tileset return a read-only {kind:"embedded", sourceIndex} reference instead of an asset ID. On infinite maps the rectangle uses absolute tile coordinates (negatives allowed) and cells outside every chunk are empty. XML maps (.tmx) return raw encoded GIDs (flip bits included) plus the map's tileset ranges so callers attribute cells by firstgid themselves; finite csv and base64 layers only — plain tile elements and chunks fail closed.

Renders one bounded page of a referenced tileset (atlas or image-collection), with every tile labeled by its local ID. Collection pages walk sparse local ids ascending, read each tile's own verified, revision-pinned image, and are limited to 64 tiles per page.

Renders an explicit bounded, input-ordered selection of local tile IDs from one referenced external tileset (atlas or image-collection). Every selected tile is labeled with its local ID; the selection is never sorted, reduced or paginated. Collection selections read each tile's own image verified and revision-pinned; missing sparse ids fail closed.

Renders a bounded orthogonal TMJ region without invoking TmxRasterizer; infinite chunked maps require an explicit absolute-coordinate region (negatives allowed, cells outside chunks are empty). The native v1 profile supports static external and embedded (inline) atlas tile layers — embedded images resolve relative to the map file and their source entry carries {embedded: {sourceIndex}} pinned by the map revision; tile objects backed by embedded tilesets fail closed — plus fixed-style absolute tile-rectangle highlights and explicit basic-object geometry debugging. The v2 object debug profile supports rectangles, points, ellipses, Tiled 1.12 capsules, polygons, polylines, and text boxes; it ignores object and layer visibility/opacity and does not render text glyphs. Every highlight must intersect the effective tileRegion; partial overlap is clipped and reported.

Renders the same bounded region of two maps through the native preview and compares them pixel by pixel: differing pixels paint solid red over a faded copy of the first render, matching pixels keep the first render at reduced opacity, and differences also aggregate to tile-cell granularity (bounded sample). Both renders must agree on pixel size; layer selections may differ per side, so the same map can be diffed against itself with different layers visible. Read-only.

Renders a bounded region of one finite isometric TMJ map using the exact Tiled 1.12.2 IsometricRenderer placement math — the region paints as its own diamond, cells composite in the editor's diagonal scanline order, and tile images anchor bottom-left like the official CellRenderer. The strict profile covers external atlas tilesets whose tile size matches the grid; image-collection tilesets, transparent-color keying, anti-diagonal flips, and image or group layers fail closed, and object layers are skipped with their ids disclosed. Orthogonal maps belong to tiled_render_preview. Read-only.

Renders a bounded region of one finite staggered or hexagonal TMJ map using the exact Tiled 1.12.2 HexagonalRenderer transform — staggered maps are the hexSideLength=0 degenerate case, matching the official class hierarchy — with cells compositing in the editor's row order on both stagger axes. Same strict profile as tiled_render_isometric: external atlas tilesets whose tile size matches the grid; image-collection tilesets, transparent-color keying, hexagonal rotation flags, and image or group layers fail closed, and object layers are skipped with their ids disclosed. Read-only.

Returns a bounded list of objects from all object layers or one selected object layer.

Returns one supported object with complete shape-specific geometry, effective text styling, and its custom properties in document order: scalar, enum, and object-reference values verbatim, nested class and list values as bounded raw JSON (class member types live in the project's class definitions, not in the TMJ), and only oversized entries carry an explicit valueOmitted marker. A JSON (.tj) template instance expands with Tiled 1.12.2 syncWithTemplate merge rules and reports its revision-pinned template source; tile templates, XML templates, and template property merging fail closed.

Performs structural and MVP-profile validation without modifying the map, tilesets, or images.

Returns bounded whole-map tile frequency, layer density, transform, used-tileset, and unused-local-ID summaries. Hidden layers and tile objects are included.

Bounded four-way connectivity analysis over one finite tile layer with explicit passability: either empty cells walk (mode empty-cells) or a listed tile set walks (mode listed-tiles, with includeEmpty opting empty cells in); flip bits never affect matching. Returns passable/blocked counts, connected components ranked by size with one representative cell each, and — when from/to are both given — whether they share a component. Read-only; endpoints on blocked cells fail closed.

Directly creates a new empty TMJ as the sole additive no-preview mutation exception. The caller must confirm the target path; parent directories must exist, and any existing destination—including identical bytes—is never overwritten or treated as success.

Plans one new external atlas TSJ from an existing project image, computing columns and tilecount with the Tiled 1.12.2 margin/spacing grid formula, and returns an expiring change set without modifying project assets. The approved expectedRevision is the SHA-256 of the exact prospective TSJ bytes; apply refuses to overwrite any existing destination. tiled_create_map remains the sole direct creation exception.

Plans the permanent deletion of one project-local TMJ map or TSJ tileset. The bounded fail-closed reference scan (TMJ maps, JSON worlds, JSON templates, plus TMX maps and XML templates through the bounded fail-closed XML reader; pattern-based worlds still reject the scan) must prove the target unreferenced, and it re-runs on apply. Apply commits a checkpoint of the exact current bytes before unlinking, so restoring that checkpoint recreates the file; the tool itself modifies nothing.

Validates one project-local external atlas TSJ, assigns its GID range after all current ranges, and returns an expiring map change set without modifying project assets. With createChangeSetId, a pending tileset-create change set's replayed prospective content stands in for a TSJ that does not exist yet; the attachment pins that prospective revision, so it applies after the create commits or atomically with it in one transaction.

Validates bounded probability, class, animation, scalar custom-property, and collision-shape updates for tiles of one currently referenced external TSJ (atlas or image-collection), then returns an expiring tileset change set without modifying project assets. Collision replaces the whole objectgroup objects array with basic shapes (null removes it); tile geometry, atlas images, and referencing maps are never touched. Image-collection tilesets additionally accept structural updates, each exclusive to its change set: createCollectionTile adds a new sparse tile entry from a verified project image (the planner reads the image and pins its actual pixel size; tilecount and the maximum tile size follow), and removeCollectionTile (destructive) deletes an existing entry after proving the current map holds no reference to it and no other project asset references the tileset — a shrinking GID span must not strand references. Removing the last entry fails closed. An embedded (inline) map tileset is addressed by its original tilesets[] index via embeddedIndex instead (exactly one selector; expectedTilesetRevision must then be omitted — the map revision is the only pin) and returns an embeddedTilesetEdit change set that patches the map itself; structural collection updates are impossible there because embedded tilesets are atlas-only.

Validates sequential Wang edits on one currently referenced external atlas TSJ — addWangSet appends a new set (name, corner/edge/mixed type, optional colors up to Tiled's 254-color limit), addWangColor appends one 1-based color to an existing set, and setWangTiles applies Tiled setWangId semantics per assignment (an all-zero 8-slot wangId removes the tile's entry, an identical one is a no-op, anything else upserts; slots run clockwise from the top edge and reference 1-based color indexes valid at that point in the sequence). The touched wangtiles member is rewritten in Tiled's canonical ascending-tileId save order. Returns an expiring wangEdit change set without modifying project assets; image-collection tilesets and pre-1.5 edgecolors/cornercolors sets fail closed.

Plans one empty tile, object, image or group layer at a root/group insertion index, pins map/dependency revisions, and returns an expiring change set without modifying project assets. Image layers require imagePath and may pin expectedImageRevision; other layer types reject both image fields.

Validates root map-property updates, exclusive bounded map resizing, exclusive unused-tileset-reference removal, direct tile writes, dense rectangular pattern stamps, bounded four-way flood fills, snapshot-based tile-region copies, exact tile replacements, common layer-property updates, exclusive safe layer deletion, movement or duplication, and object operations including bounded scalar custom-property patches and tile objects (a shape:"tile" draft encodes its external TileRef into gid exactly like a tile-layer cell and requires explicit width/height; updateObject can replace an existing tile object's reference, and shape objects never become tile objects) without modifying project assets, then returns an expiring changeSetId bound to the exact map and current dependency revisions.

Rasterizes one deterministic geometric shape — a Bresenham line, a rectangle outline or fill, or a midpoint ellipse inscribed in its bounding rectangle — into exact tile cells and returns an ordinary mapEdit change set carrying the setTiles writes. Pure bounded computation: no randomness, no clipping (a shape that leaves the map fails closed), at most 10,000 cells, and a null tile erases along the shape. Every preview, revision-pin, and transaction rule applies unchanged.

Computes a deterministic seeded value field over one bounded region — smooth value noise (stateless coordinate hash, so the same seed always reproduces the same output and results are translation-stable), a cellular cave automaton yielding exactly 0 (open) and 1 (wall), or a rooms-and-corridors dungeon yielding exactly 0 (floor) and 1 (wall) with every floor cell connected (sequential seeded stream drawn region-relative, so a shifted region reproduces the same layout) — then maps values to tiles through explicit [min, max) intervals (max 1 inclusive; unmatched cells are skipped for sparse generation) and returns an ordinary mapEdit change set carrying the setTiles writes. Math.random is never involved; a mapping that matches no cells fails closed, as does a dungeon region too small for one minimum room plus its wall ring.

Scatters decoration tiles over one bounded region with a deterministic density roll per cell: a stateless coordinate hash gates each cell against the density and a second salted hash picks one weighted tile from the choice list, so the same seed always reproduces the same picks and results are translation-stable. Math.random is never involved. With skipOccupied, cells already holding a tile are left untouched; a null choice erases where it lands. Returns an ordinary mapEdit change set carrying the setTiles writes; a scatter that matches no cells fails closed.

Resamples one project reference image onto a bounded cell grid — each cell averages its alpha-weighted pixel block — maps every cell to the nearest palette color by squared RGB distance (ties resolve to palette order), and returns an ordinary mapEdit change set carrying the setTiles writes. Fully transparent blocks are skipped, a null palette tile erases where its color wins, and palette tiles accept semantic {name} references. Pure integer arithmetic: the same image and palette always produce the same plan; a fully transparent region fails closed.

Stamps one source-map region as a prefab: tiles from one source tile layer — carried as tileset+localId references, so a target map missing the tileset fails closed — and optionally objects anchored inside the region's pixel bounds from one source object layer, materialized at planning time into ordinary setTiles and createObject operations against the target map (the plan itself is the frozen prefab; nothing re-reads the source at apply, and an optional expectedSourceRevision asserts the source up front). Empty source cells are skipped unless copyEmpty stamps the rectangle verbatim as erasure; extraTileLayers stamps additional source-to-target tile-layer pairs over the same region in one plan, and flipHorizontal mirrors the tile stamp with official TileLayer::flip bit semantics (tile layers only — combining it with objects fails closed). Objects outside the supported draft profile — custom properties, template instances, unknown members — fail closed rather than being silently dropped, as do cross-map object stamps between maps with differing tile sizes.

Places one JSON object template instance in Tiled's minimal serialized form — {id, template, x, y}, with every other member inherited from the template at load time. The template is read and validated through the same fail-closed profile as template expansion (tile and nested templates reject), its revision is pinned into the plan, and apply re-verifies both the pin and that the map-relative reference still resolves to the pinned path. Returns an ordinary mapEdit change set.

Serializes one restricted-profile project .tmj map to TMX bytes matching Tiled 1.12.2's own writer byte for byte — finite orthogonal maps, external tileset references, CSV tile layers, and top-level tile/object layers the serializer fully understands; embedded tilesets, image and group layers, custom properties, template instances, unknown members, and floats whose six-significant-digit rendering would lose precision all fail closed. Tileset references and GIDs carry verbatim, so the .tmx target must live in the source map's directory and must be a new file. Returns an expiring fileExport change set whose producer is the native serializer; apply re-serializes under the pinned source revision and fails closed unless the bytes exactly match the approved content hash. No Tiled CLI is involved.

Serializes one restricted-profile project .tsj atlas tileset to TSX bytes matching Tiled 1.12.2's own writer byte for byte. The declared grid must be derivable from the declared image size, margin, and spacing (the official exporter recomputes it, so a disagreeing declaration fails closed rather than drifting); per-tile metadata, wang sets, custom properties, and unknown members also fail closed. The image reference carries verbatim, so the .tsx target must be a new file in the source tileset's directory. Returns an expiring fileExport change set whose producer is the native serializer; apply re-serializes under the pinned source revision and fails closed unless the bytes exactly match the approved content hash. No Tiled CLI is involved.

Serializes one restricted-profile project .tj object template to TX bytes following Tiled 1.12.2's writeObjectTemplate exactly: a bare root with the base object serialized without id, x, or y, through the same object writer verified byte-exactly against official TMX exports. Tile templates (which carry a tileset) and nested templates fail closed, matching the template reading profile. The .tx target must be a new file in the source template's directory. Returns an expiring fileExport change set whose producer is the native serializer; apply re-serializes under the pinned source revision and fails closed unless the bytes exactly match the approved content hash. No Tiled CLI is involved.

Evaluates one stateless selection predicate over a bounded tile-layer region — a tile set matched by tileset+localId (flip bits ignored), empty cells, or non-empty cells — and returns the selection as plain data: exact cell count, tight bounding box, and a bounded coordinate sample (at most 2,048 cells, with truncation disclosed). No selection id or server-side selection state exists; feed the result into region- or cell-based tools explicitly. Works on orthogonal, isometric, staggered, and hexagonal maps. Read-only.

Reads the server-owned .tiledmcp/tile-names.json registry — a validated name-to-{tileset, localId} map that lets later requests reference tiles by semantic name instead of bare ids. Names are restricted lowercase identifiers (at most 4,096 entries); every referenced tileset must exist and gets its revision pinned into the result. The registry is weak metadata: localId is disclosed verbatim without re-checking tileset contents, and a missing registry file reads as empty rather than failing. Read-only.

Validates upsert/delete edits to the server-owned .tiledmcp/tile-names.json semantic registry and returns an expiring tileNameEdit change set — no Tiled asset is touched. Upserted names are restricted lowercase identifiers whose tilesets must exist as project .tsj files (re-verified at apply); deleting an unregistered name fails closed, the registry is bounded at 4,096 names, and the registry file's revision — or its absence — is pinned so a concurrent registry write fails closed. Apply replays the operations, verifies the result against the approved content hash, and rewrites the registry canonically.

Scans every tile layer of one map for cells whose base GID falls outside all bound tileset ranges and returns an ordinary mapEdit change set erasing exactly those dangling cells — nothing applies without the usual preview and approval, and a map with nothing mechanically fixable fails closed instead of returning an empty plan. Dangling tile-object GIDs are reported by tiled_validate but deliberately not auto-fixed: deleting objects is a human decision. More than 10,000 dangling cells also fails closed — that scale points at a broken tileset reference, not at data worth erasing.

Validates sequential upsert/delete edits to one .tiled-project file's propertyTypes definitions and returns an expiring propertyTypeEdit change set. upsertClass and upsertEnum replace a same-name definition in place (keeping its id) or append with id = max + 1, exactly like Tiled's own allocation; deleteType (destructive) refuses to remove a type still referenced by another definition's member, but references from maps and tilesets are not scanned — serialized values there keep working and simply lose their annotations. Apply patches only the propertyTypes member under the pinned project-file revision.

Validates bounded add, move, and remove operations on one JSON world's explicit map members - members addressed by their current array index under the world's revision pin, additions requiring existing project-local .tmj maps - and returns an expiring change set without modifying project assets. Referenced map files are never touched.

Composes between 2 and 16 already previewed, unapplied map edit, tileset edit, tileset creation, or file deletion change sets with pairwise-distinct target paths into one expiring transaction change set, locking each member against individual apply. Applying the transaction commits every member through a crash-recoverable redo journal: all targets land or none do.

Applies one previously previewed map edit, tileset edit, tileset creation, file deletion, atomic multi-file transaction, checkpoint restore, current-before-verified prepared-checkpoint discard, explicit prepared-checkpoint commit or abandon adjudication, single committed-checkpoint prune, or explicit committed-checkpoint prune batch after checking its approved SHA-256 revision and all plan-specific evidence and dependency pins. Applying a document edit also persists project-internal asset-identity safety metadata.