Open the read-only candidate workbench. New installs return setup_required until the global Library and Local workspace are bound; otherwise ask for an uploaded reference, data profile, or plotting goal before searching.

Search the complete ranked Local Published, FigureYa, bundled Open Figure Modules, and opted-in dynamic personal Provider match set, open the candidate App, then stop and wait for the user to choose. Community is frozen and excluded from default search; Working, Capture, and flat-v1 entries remain excluded.

App-only pagination for an existing complete search result set.

Describe an exact Local Published release, bundled/personal public template, or commit-pinned FigureYa module. A bare templateId is deliberately insufficient.

Return one selected preview as standard MCP image content and optionally copy it to a trusted absolute directory. This compatibility tool does not authorize materialization.

App-only exact preview. It returns image bytes only to the component and issues a session-bound confirmation challenge.

Model-visible exact preview. Call only after the user selects a candidate, explicitly delegates visual review, or an App updateModelContext handoff selects one candidate; do not iterate all results.

App-only confirmation. The candidate workbench calls this only after the exact image load event and an explicit user click.

Model-visible confirmation after figure_library_preview_exact_headless. Use only after a user selection, explicit delegation, or an App updateModelContext handoff when serverTools is unavailable; this call cannot prove UI visibility.

Internal App-only structured diagnostics. It accepts a fixed event enum and no arbitrary log text.

Export a bounded, secret-safe diagnostic ZIP for the current server session. Defaults to sanitized_bundle, excludes user text and absolute paths, and never uploads data.

Return complete text and structured status for the global portable Library, immutable lifecycle, write lock, and every registered Local, Community, FigureYa, or personal Provider. Community is reported as frozen and excluded from default search. Capture/project-pin status is intentionally absent. New installs report setup_required until both the global Library and Local workspace are bound.

Validate the user-selected global Library directory and optionally stage a non-destructive flat-v1 copy. This read-only plan never chooses a project directory implicitly.

Apply the exact reviewed binding plan using operation-id idempotency and stale-plan checks.

Validate the user-selected Local workspace directory. First-time machine confirmation only; later starts reuse the saved locator. Never infers the current project folder.

Apply the exact reviewed workspace binding plan. After this first confirmation, later MCP starts reuse the same directory across projects.

Inspect one exact Library write lock. The user must stop every Wisp, Codex, Claude, and other writer before approving recovery; locks are never auto-stolen.

Archive the exact unchanged abandoned lock and write a recovery receipt after all writers are confirmed stopped.

Host-neutral read-only inspection of Working, Published, history, Diff, and Review findings.

Return the canonical image for an exact active pending Working plan or current Working Head. This read-only tool does not create a preview receipt or authorize materialization.

Return immutable Content Revision and Release history.

Compare complete revision fields and asset inventories without modifying either revision.

Validate user-confirmed image/code intake and return an immutable Working Revision plan. The server never calls a model or executes code.

Reverify source bytes and apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Require a one-time confirmed exact preview receipt, then resolve the provider-qualified selector and check the destination without writing files.

Apply the cached exact plan once. All failures are terminal and must not be retried with another mode, provider, downloader, or substitute template.

Inventory either the authoritative Library (excluding rebuildable indexes/runtime locks) or one exact reachable Published Release. Produces a directory-bundle plan and writes nothing.

Reverify the exact source inventory and visible expectedTarget, write a new directory bundle without overwrite, and persist an idempotent export receipt. A durable pre-write intent can recover a completed target after server restart.

Verify a full backup directory. Restore preserves libraryId and requires explicit authority transfer; Fork creates a new libraryId with fork provenance.

Restore/fork into an absent target, verify every byte, and write an immutable operation receipt. It never changes the active locator automatically.

Verify an exact Published-template bundle, copy its immutable assets into a new local candidate, and plan a Working Revision. Source approval is provenance only and is never inherited.

Reverify the exact bundle and apply only the planned Working Revision. Local review and publish remain mandatory.

Read the local user's saved style profile without modifying it. Disabled or absent profiles preserve template behavior.

Explicitly save or replace the user's long-term style preferences. Only use when the user asks to remember/change their defaults; never persist temporary instructions. Read current revision first.

Explicitly reset saved defaults while preserving the revision counter. Does not modify figures.

Read effective settings before adapting plotting code: template < enabled saved profile < current overrides. faithfulTemplate bypasses saved preferences. Semantic truth always takes priority. Host applies and verifies settings; this tool does not execute code.

Find generated or planned project figures by stable ID, name, historical alias or Figure 1B. Multiple matches need disambiguation. Does not search public templates.

Plan independent figures or panels before plotting. New entries need title and descriptive English slug for non-English titles. Label is optional (standalone figures do not occupy Figure 1). Batch updates permit panel swaps. Review before/after paths before apply. Planning A-H does not mark any panel rendered.

Apply a reviewed naming/grouping plan. Preserves stable IDs and historical revisions; moves working directories without overwriting targets. Does not render changed panel letters or rewrite external absolute references.

Snapshot only the explicitly listed figure files under its working directory. Include real plotting data and actual scripts, parameters, environment and truthful sources. Distinguish raw experiments from analysis tables. Host reports execution; SFL never runs scripts. Returns integrity issues instead of treating incomplete archives as complete.

Verify current archive hashes, required data/script/output roles, sources, execution report and artwork label state. This does not rerun code or validate scientific conclusions.

Record host-prepared language export copies after checking their code behavior and rerendered output. Both locales require English generated code; en also requires translated generated prose and plot labels. Original data/scripts remain unchanged. Records preparation only; no ZIP is generated. User reviews the file inventory before applying export.

Preview language-specific submission ZIP inventory and destination. Requires a complete archive and current host-verified language preparation; writes no ZIP. This is figure source-data packaging, not automatic journal compliance.

Generate the reviewed language ZIP without overwriting existing files. Rechecks source/translation digests and workspace. No upload, journal submission or arbitrary execution.

Read-only check of the official gh login and central repository permissions. SFL never reads or prints the token.

Return a terminal command for the user to run. This tool never launches a browser or login process.

Read-only Archive or Catalog PR Plan. Archive uses one sanitized submission; Catalog requires a manually merged Archive PR and re-verifies its fixed merge commit and ZIP.

Re-check the gh account, permissions, source, merge gate, base, and file identities; then create a branch/commit/PR through Git Data API. Never merges the PR.

Sanitize one exact Local Published Release into an Open Figure module, search FigureYa and Open Figure Modules for similar figures, and show a GitHub PR Plan without writing or merging. Path collisions fail closed. Similar hits require user review in the SFL window before Apply.

Re-check GitHub identity, module path collisions, optional similar-search confirmation, and file identities; then create a two-commit PR through the Git Data API. Never merges.

Resolve one exact reachable Local Published Release and show every included/excluded asset, rights declaration, public metadata conflict, render trace, and target without writing files.

Revalidate the exact Local Published Release and selected asset bytes, then atomically create one deterministic sanitized submission at a new target. This call never uses the network, signs content, or creates a PR.

Read the configured personal provider sources and their last-known-good snapshot identities without making any network request. The raw trusted public key is never returned.

Plan Add, Update, Configure, Remove, or explicit Trust Reset for a signed personal provider. Network access occurs only when the requested action must verify a snapshot. Planning never writes configuration or snapshots.

Apply the exact cached provider-source plan with stale-state checks and operation-id replay protection. Apply never accepts a raw public key or endpoint override.