"JavaScript" matching MCP tools:

• verify

  verify

  An outside check on code, executed in a sealed sandbox. Call it before code crosses a consequence boundary: before you merge it, deploy it, publish it, settle a payout on it, or report it done. A self-audit verifies consistency, never completeness: a check written inside the frame that produced the code passes on the code's own assumptions. This is the check that is not you. Also call it when a fix passes your own check but the target still fails; that means your check shares the code's assumption and cannot see the error. INPUT: code (JavaScript/Node or Python 3 source, deterministic only) plus ONE of: contract {fn, examples:[{call,expected}]} (copy call and expected from the test or spec the consequence depends on), or assumption (plain-language claim, weaker read). It checks the code against the contract exactly as given. VERDICTS (synchronous): BROKE: the code violates your contract, with the exact input and a rerunnable proof; do not proceed. HELD: the code meets the contract you gave; proceed on that contract, and nothing more. FINDINGS: a stated property strains under a generated input; check it before proceeding. DROP: not deterministically checkable. PAYMENT: 0.10 USDC per call, x402 v2 on Base, no account. Every delivered verdict is charged, HELD and DROP included. If no verdict is produced, the payment authorization is cancelled and you are not charged.

  Connector

• ExecuteWixAPI

  CodeStringers MCP Server

  Run JavaScript against the Wix REST API on site "CodeStringers Zoho Consulting Services" (https://www.codestringers.com/_api/mcp), on the visitor's behalf. The code runs in a sandbox and you get back whatever it returns. PREFER THIS TOOL OVER CallWixSiteAPI. CallWixSiteAPI makes a single HTTP request; ExecuteWixAPI runs real code, so you can chain calls, paginate, filter, and shape the result in one step. Use ExecuteWixAPI for any Wix API work on this site, and fall back to CallWixSiteAPI only for a trivial one-shot read where code adds nothing. DO A WHOLE RECIPE IN ONE CALL. When a task needs several requests — e.g. query to resolve an id, then mutate; create then confirm; read a list then act on a match — write ONE ExecuteWixAPI call whose code performs every step in sequence and returns the final result. Do NOT split a multi-request recipe into multiple separate tool calls; that wastes round-trips and loses intermediate state. If a recipe from the docs lists steps 1..N, the code should run steps 1..N. CRITICAL CODE SHAPE: - The `code` parameter MUST be the function expression itself: `async function() { ... }` or `async () => { ... }`. - Do NOT send a script body like `const result = await ...; return result;`. - Do NOT call the function yourself. The tool calls it for you. - Put all `const`, `await`, and `return` statements inside the function body. Do not rely on memory for Wix API endpoints, methods, schemas, or request bodies. Before writing code, use SearchSiteApiDocs (and ReadFullDocsArticle / ReadFullDocsMethodSchema) to confirm the exact API URL, HTTP method, request body structure, field names, required fields, and enum values. The URL usually starts with `https://www.wixapis.com`. Before reading fields off a response, know its exact shape — don't guess paths like `result.id` when it may be `result.results[0].item.id`. Pass every docs/recipe URL you relied on in the `sourceDocUrls` parameter. Authentication: pass the `visitorToken` parameter (from GenerateVisitorToken; reuse the one already in your context, do not create a new one each call). Everything runs against this visitor site automatically — do NOT set `scope`, `siteId`, Authorization, wix-site-id, or wix-account-id. Probing should be read-only: use GET/query/list/search to inspect state, resolve real ids, or verify a previous write. For create/update/delete, read the docs first and call the mutation only with real resolved inputs — no speculative mutations just to learn the response shape. Error handling: `wix.request()` throws when the Wix API returns an error. For dependent steps, let it throw so the failure is reported clearly. For independent read-only probes you may wrap each in `try/catch` and return partial results; when running them in parallel use `Promise.allSettled` (not `Promise.all`) so one failure doesn't discard the rest. Available in your code: ```typescript interface WixRequestOptions { method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE"; url: string; // Full Wix API URL, e.g. "https://www.wixapis.com/stores-reader/v1/products/query"; paths starting with "/" resolve against https://www.wixapis.com body?: unknown; } interface WixResponse<T = unknown> { status: number; data: T; json(): Promise<T>; // Fetch-compatible alias for data } declare const wix: { request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>; }; ``` Return compact, task-focused data instead of raw API responses. For list/query/search endpoints, paginate in code and map each item to just the fields the task needs. Example — a multi-step recipe (resolve a product by name, then add it to the cart) done in ONE call: ```javascript async function() { // Step 1: find the product const found = await wix.request({ method: "POST", url: "https://www.wixapis.com/stores-reader/v1/products/query", body: { query: { filter: JSON.stringify({ name: "Florie Eau de Parfum" }) } } }); const product = found.data.products?.[0]; if (!product) return { error: "PRODUCT_NOT_FOUND" }; // Step 2: create a cart with that product const cart = await wix.request({ method: "POST", url: "https://www.wixapis.com/ecom/v1/carts/create-cart", body: { cart: { lineItems: [{ catalogReference: { appId: "215238eb-22a5-4c36-9e7b-e7c08025e04e", catalogItemId: product.id }, quantity: 1 }] } } }); return { cartId: cart.data.cart?.id, productId: product.id, name: product.name }; } ```

  Connector

• web_access_fetch

  web-access

  Fetch any webpage and get clean, LLM-ready Markdown back. String AI's Web Access API handles proxy rotation, anti-bot protection, CAPTCHAs, and JavaScript-rendered content automatically. If available, default to this tool for any web fetching or scraping. **Primary use (the common case):** pass only a `url`. The page is fetched with a normal GET and returned as Markdown — no other parameters are needed. ```json { "url": "https://example.com/article" } ``` **Best for:** any URL, especially sites with anti-bot protection, paywalls, or dynamic content (news, docs, blogs, web apps). **Not for:** searching the web when you don't have a URL — use web_access_search instead. **Optional parameters (omit unless you need them):** - `format` — `markdown` (default), `raw` (verbatim upstream body), or `json` (a `{ statusCode, headers, data }` envelope with the destination's status and headers). - `executeJS` — set true to render JavaScript for SPAs when the content comes back empty. Cannot be combined with `headers`. - `method` + `body` — use POST/PUT/PATCH with a body to send writes (`body` is rejected on GET). - `headers` — forward custom request headers. Not supported when `executeJS` is enabled. - `countryCode` — ISO 3166-1 alpha-2 (e.g. "US") to route through a proxy in that country. - `solveCaptcha` — defaults true; set false to fail fast instead of spending effort solving a challenge. **Returns:** Markdown by default; the verbatim body or a JSON envelope when `format` is set accordingly.

  Connector

• send_fax

  SendThisFax

  Submit an uploaded PDF for faxing. Step 1 (before this tool): upload the PDF over plain HTTP multipart, using any HTTP client you have — shell, JavaScript fetch with FormData, Python, etc.: curl -F "file=@document.pdf" https://www.sendthisfax.com/api/upload fetch("https://www.sendthisfax.com/api/upload", {method: "POST", body: formDataWithFile}) The response contains fax_public_id and page_count. PDFs must be unencrypted, at most 50 MB and 1000 pages. Step 2: call this tool with the fax_public_id and the recipient fax number. Two modes: - With an API key (Authorization: Bearer stf_live_... on this MCP connection): the fax price is debited from the prepaid credit balance and sending starts immediately — no checkout, no browser. sender_email and billing_country are optional (they default to the key's records). Buy credits at https://www.sendthisfax.com/en/credits. - Without an API key: sender_email and billing_country are REQUIRED and the tool returns a checkout_url the USER must pay in a browser; the fax is sent automatically once paid. In both modes, poll get_fax_status until status reaches "delivered" or "failed" (failures after payment are auto-refunded). For integration testing, +19898989898 is the designated test recipient number.

  Connector

• validate_python

  Python Code Validator

  Check Python source without running it: parse, lint (ruff), type-check (mypy), AST security policy, credential scan. Safe on code you do not trust. Use it on every Python file you generated or edited, before writing it to disk. Alternatives: repair_python to get the corrected source instead of the diagnosis; execute_python to prove the code runs. Auth: a key is required. A free key covers this call, 100 per day, then HTTP 429; get one with POST /v1/keys. Credits are bought without an account, 1 per call: GET /v1/pricing says where to send the xDAI. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. Of options only transpile_to (e.g. 'javascript', which returns a translated copy in transpiled) acts here; timeout_s, max_iterations, optimize, examples and expected_output need a pass that rewrites or runs the code, so send code alone. Ignored options are not refused, so a call that sets them looks like it worked; and code that does not parse is answered rather than refused: valid=false with the syntax error located, which is the point. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  Connector

• repair_python

  Python Code Validator

  Everything validation does, plus deterministic fixes: the corrected source comes back in fixed_code, and the original is kept whenever the fix cannot be proven safe. The code is still never run. Use it when validation failed and you want the fix rather than the diagnosis. Alternatives: validate_python when the diagnosis is enough; execute_python when the fix has to be proven to run. Auth: a key is required. This call needs a paid key and answers HTTP 402 without one. Credits are bought without an account, 3 per call: GET /v1/pricing says where to send the xDAI. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. options.max_iterations (1..10, default 3) caps the fix/verify rounds: raise it for a file with several independent faults, leave it for a snippet. options.optimize (default false) additionally folds constants and drops dead code, and is only worth setting when you asked for a rewrite anyway. options.transpile_to (e.g. 'javascript') returns a translation of the *repaired* source in transpiled, not of what you sent. fixed_code is null when nothing could be proven safe to change, so treat null as 'no fix', not as an error. options.timeout_s, options.examples and options.expected_output do nothing here: nothing is run, so there is no clock, no stdout, and no way to check an example. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  Connector

• execute_python

  Python Code Validator

  Everything repair does, and then RUNS the code in a throwaway container — no network, read-only filesystem, killed at options.timeout_s — reporting exit code, stdout and stderr. Any '>>>' examples in the code are run too, and one that does not print what it says is an error the other tools cannot see. This is a side effect: do not submit code you do not want executed. Use it when you need proof that the code runs, or that it does what it says. Alternatives: validate_python for the diagnosis and repair_python for the fix, neither of which runs anything. Auth: a key is required. This call needs a paid key and answers HTTP 402 without one. Credits are bought without an account, 10 per call: GET /v1/pricing says where to send the xDAI. Arguments: code: the whole file, 1..200000 bytes of UTF-8 measured after encoding (empty is refused with 400, larger with 413); a fragment is fine, but line and column numbers in the answer count from 1 in what you sent. language: must be 'python'; anything else is 400, and the field may be omitted. options.max_iterations (1..10, default 3) caps the fix/verify rounds: raise it for a file with several independent faults, leave it for a snippet. options.optimize (default false) additionally folds constants and drops dead code, and is only worth setting when you asked for a rewrite anyway. options.transpile_to (e.g. 'javascript') returns a translation of the *repaired* source in transpiled, not of what you sent. fixed_code is null when nothing could be proven safe to change, so treat null as 'no fix', not as an error. options.timeout_s (seconds, default 5) is the wall clock for the run; the schema allows up to 60 but this deployment caps it at 30 and refuses a larger value with 400. options.expected_output compares stdout byte for byte and adds an 'expected-output' diagnostic (valid=false) when it differs, which is how you ask for 'it did the right thing' rather than 'it ran'. options.examples is the same question for code with no output: pass what you asked for as doctest lines ('>>> total([1, 2])' then '3') or assertions ('assert total([1, 2]) == 3'), and each is run against the code -- one that does not hold is a 'python:example-mismatch' error, and repair looks for a single-token change that makes them all pass. Send it whenever you know what you asked for: without it, code that runs but returns the wrong answer looks perfect from here. The program that runs is the repaired one, so read fixed_code before you trust runtime.stdout, and it runs exactly once however many rounds the repair took. Returns valid, score 0..1, diagnostics (rule, message, line, column), security findings, fixes, fixed_code and runtime; see outputSchema. The code and its verdict are retained to improve the service.

  Connector

• check_pricing

  Ground Truth - Fresh Evidence for AI Agents

  Fetch a public pricing page and extract first-pass pricing signals before you quote plan costs, free tiers, or plan names. Use this when you already have a likely pricing URL and need a quick live scan of visible page text. It returns price-like strings, heuristic plan labels, free or free-trial signals, and cache information. It does not map prices to exact plans, normalize currencies, execute checkout flows, or guarantee that a price applies to a specific region or customer type. JavaScript-rendered, logged-in, or heavily obfuscated pricing details can be missed. Results are cached for 5 minutes.

  Connector

• read_data

  Quadratic

  Read-only queries on the open spreadsheet. No data is modified. Safe to auto-approve. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs reads in parallel; individual failures are reported per-entry without short-circuiting. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference • get_cell_data(selection, page?, sheet_name?) — Returns cell values for a selection in A1 notation. Supports comma-separated ranges to fetch multiple areas in ONE call, including across different sheets. Examples: "A1:B10, D1:E10", "TableName, OtherTable", "'Sheet1'!A1:B10, 'Sheet2'!C1:D10". Table names are globally unique so they work without sheet prefixes. For cell ranges on other sheets use 'SheetName'!Range. Only use when you need the full dataset (aggregations, lookups, analysis). The file summary already includes sample rows. Results may be paginated — use page (0-based) for additional pages. • has_cell_data(selection, sheet_name?) — Check if any cells in a selection have data. Returns true if ANY cell contains data. Use before creating/moving tables or code to avoid spill errors. All ranges MUST be on the same sheet. • get_code_cell_value(code_cell_position?, code_cell_name?, sheet_name?) — Get full code from an existing Python, JavaScript, or connection code cell. Do NOT use for formula cells — formulas are already in get_cell_data results and the file summary. • get_text_formats(selection, page?, sheet_name?) — Get text formatting info. Use table column references for tables ("Table_Name[Column Name]"). Results may be paginated. • get_validations(sheet_name?) — Get all validations in a sheet. • get_conditional_formats(sheet_name) — Get all conditional formatting rules. Use to check existing rules before creating/updating/deleting. • text_search(query, case_sensitive?, whole_cell?, search_code?, regex?, sheet_name?) — Search for text in cell outputs. Supports regex when enabled (e.g., "\d+", "^hello", "foo|bar"). Searches cell outputs only, not code. Booleans default false. • get_sheet_info() — List all sheets and names. • get_spreadsheet_context(sheet_name?, include_errors?) — Full context snapshot of the file. • read_data(selection, sheet_name?, max_rows?) — Read cell data as compact CSV. Auto-tiers: returns all rows for small/medium data (<5000 rows), head+tail preview for large data. Preferred over get_cell_data for most reads. • outline(sheet_name?) — Structural map of the file: sheets, bounds, tables, code cells, charts, connections, errors. Use to understand file layout before reading data. • dependencies(position, sheet_name?, direction?) — Trace cell dependencies. direction: "forward" (what this cell reads), "reverse" (what depends on this cell), or "both" (default). • list_connections(team_uuid?) — List all database connections in a team (PostgreSQL, MySQL, MS SQL, Snowflake, BigQuery, Mixpanel, Google Analytics, Plaid, etc.). Returns each connection's uuid, name, and type. team_uuid is optional — if omitted, the user's only team is used; multi-team users must pass it. Call this BEFORE get_database_schemas or set_sql_code_cell_value to discover the connection_ids and connection types you need. • get_database_schemas(connection_ids, connection_type, team_uuid) — Get table/column schemas for database connections. Always call before writing SQL. Get connection_ids from list_connections. connection_type: POSTGRES, MYSQL, MSSQL, SNOWFLAKE, BIGQUERY, COCKROACHDB, etc. • list_agent_connections(team_uuid?) — List the team's ready Agent Connections (third-party REST API bindings). Returns each connection's uuid, name, service, base URL, auth pattern, and `{{SECRET_NAME}}` references to use in fetch code. team_uuid is optional — if omitted, the user's only team is used; multi-team users must pass it. Reference secrets via `{{SECRET_NAME}}` in Python/JavaScript fetch code; the connection proxy substitutes team secret values at request time. • inspect_agent_connection(connection_id, team_uuid?) — Get the full schema (resources, endpoints, fields, docs URLs) and plan for one ready Agent Connection by uuid (from list_agent_connections). Call BEFORE writing fetch code against a connection so you don't guess at endpoints. team_uuid is optional with the same single-team fallback as list_agent_connections. Batch: • batch(actions) — actions: [{action, params}]. Runs reads in parallel through this same tool; per-entry failures are reported in the result without short-circuiting the batch. `action` may be any name from this reference. Nested `context` items are allowed and returned alongside the reads.

  Connector

• write_data

  Quadratic

  Write operations on the open spreadsheet. Call as {"action": "<name>", "params": {...}} — per-action params are listed in the Action Reference below. Numbers, booleans, and nulls in cell values are coerced to strings. Special actions (not shown in the action enum): • batch — {"action": "batch", "params": {"actions": [{"action": "<name>", "params": {...}}, ...]}}. Runs writes sequentially; errors short-circuit the batch. • context — {"action": "context", "params": {"topic": "<name>"}} or {"action": "context", "params": {"action": "<name>"}}. Returns deeper docs for a topic or a single action's signature. Plural "topics" / "actions" arrays are also accepted and may be combined. Topics: python, javascript, formula, connection, validation, a1, quadratic, chart, pivot_table. Action Reference Cell Data: • set_cell_values(top_left_position, cell_values, sheet_name?) — Sets cell values as a 2D string array (first row = headers). top_left_position: single cell in A1 notation. Don't place over existing data unless requested. Values replace existing content; use empty string to clear. For merged cells, place at the anchor (top-left) cell. Prefer this over add_data_table for tabular data; only use add_data_table when the user explicitly asks for a data table or the file already uses data tables. When writing tabular data as plain cells, format the header row afterward with set_text_formats (at least bold) so it's visually distinct — plain cells don't auto-style headers like data tables do. Don't use for formulas or code. • delete_cells(selection, sheet_name?) — Delete cell values in a selection (A1 notation). Don't delete cells referenced by code cells unless explicitly asked. To delete table columns: "TableName[Column Name]". To delete tables: "TableName". • move_cells(source_selection_rect, target_top_left_position, sheet_name?) — Move a rectangular block of cells. Target is the top-left corner (single cell). For spilled code cells, move just the anchor cell. • add_data_table(sheet_name, top_left_position, table_name, table_data) — Adds a data table. Data tables are discouraged by default — only use when the user specifically requests a data table or the file already uses data tables; otherwise use set_cell_values. First row of table_data is headers. Leave 2 rows below and 2 columns right as spacing. All rows must have equal length (use empty strings for missing values). To convert existing data, use convert_to_table instead. To delete a table, use set_cell_values with empty string at the anchor. A single-value formula or code cell MAY be written into a data cell of an editable (imported/value) table — it's stored as in-place single-cell code computing a 1x1 result; avoid the table's name/column-header rows and read-only code-output tables/charts, and don't put multi-cell output (dataframes/charts) inside a table. Code: • set_code_cell_value(code_cell_position, code_cell_language, code_cell_name, code_string, sheet_name?) — Sets and runs a Python or JavaScript code cell. Prefer set_formula_cell_value whenever a formula can do the task; only use code when the functionality is not available in formulas (e.g. charts, ML, correlations, complex data transforms, or web/API requests). For static data use set_cell_values. For SQL use set_sql_code_cell_value. IMPORTANT: Always reference sheet data with q.cells() — never hardcode data values. For charts, use Plotly ONLY (import plotly.express or plotly.graph_objects). Do NOT use Matplotlib/Seaborn. Name the output (no spaces/special chars, _ allowed). Placement: Estimate output size before placing. Charts default to 7 wide x 23 tall cells. Cell must be empty (avoids spill error). Leave one extra column/row gap between the code cell and nearest content. Empty sheet → A1. • set_formula_cell_value(formulas) — formulas: [{code_cell_position, formula_string, sheet_name?}]. Prefer this whenever a formula can do the task; only use set_code_cell_value when formulas can't. For basic historical stock prices use the STOCKHISTORY formula; for financial data with no formula equivalent (adjusted prices, statements, dividends, real-time/intraday, technicals, economic data) use set_code_cell_value with Python + q.financial. Don't prefix formulas with =. code_cell_position can be a single cell ("A1"), range ("A1:A10"), or collection ("A1,A2:B2"). Cell references adjust relatively (like copy-paste). Use $ for absolute references ($A$1). Place near referenced data, no extra spacing needed. Aggregations go directly below or beside data. • rerun_code(sheet_name?, selection?) — Re-run code cells. Do NOT call after set_code_cell_value, set_formula_cell_value, or set_sql_code_cell_value — those already run automatically. Only use to refresh unchanged code (e.g., external data). • set_sql_code_cell_value(code_cell_position, code_cell_name, connection_kind, sql_code_string, connection_id, sheet_name?) — Sets and runs a SQL connection code cell. connection_kind: POSTGRES, MYSQL, MSSQL, SNOWFLAKE, BIGQUERY, COCKROACHDB, MARIADB, SUPABASE, NEON, MIXPANEL, GOOGLE_ANALYTICS, PLAID, QUICKBOOKS. Always call get_database_schemas before writing SQL. Cell must be empty. Empty sheet → A1. Import: • import_file(file_name, file_data, sheet_name?, insert_at?) — Import CSV/Excel/Parquet. file_data: base64-encoded. Extension determines format (.csv, .xlsx/.xls, .parquet/.parq/.pqt). To create a new file from an import, call files create_file first, then import_file. Formatting: • set_text_formats(formats) — formats array: [{selection, bold?, italic?, underline?, strike_through?, text_color?, fill_color?, align?, vertical_align?, wrap?, font_size?, number_type?, currency_symbol?, numeric_decimals?, numeric_commas?, date_time?, sheet_name?}]. For table columns use table references ("Table_Name[Column Name]") instead of A1 ranges. Colors: hex ("#FF0000"), empty string to remove. align: "left"/"center"/"right". vertical_align: "top"/"middle"/"bottom". wrap: "wrap"/"clip"/"overflow". number_type: "number"/"currency"/"percentage"/"exponential" (currency requires currency_symbol, e.g. "$"). numeric_decimals: integer >= 0, number of decimal places to display (e.g. "format percents as 2 decimals" → 2). Percentages: .01 → 1%, 1 → 100%. date_time: chrono format e.g. "%Y-%m-%d". font_size: points (default 10). Set to null to clear any format. • set_borders(borders) — borders: [{selection, border_selection, color, line, sheet_name?}]. border_selection: all/inner/outer/horizontal/vertical/left/top/right/bottom/clear. line: line1 (thin)/line2 (medium)/line3 (thick)/dotted/dashed/double/clear. color: CSS color string. • merge_cells(selection, sheet_name?) — Merge a range of cells (e.g. A1:D1). All values except top-left are cleared. • unmerge_cells(selection, sheet_name?) — Unmerge merged cells overlapping the selection. Sheets: • add_sheet(sheet_name, insert_before_sheet_name?) — Sheet names: unique, max 31 chars, no / \ ? * : [ ] • duplicate_sheet(sheet_name_to_duplicate, name_of_new_sheet) • rename_sheet(sheet_name, new_name) • delete_sheet(sheet_name) • move_sheet(sheet_name, insert_before_sheet_name?) • color_sheets(sheet_names_to_color) — [{sheet_name, color}]. color: CSS color string. • set_frozen_panes(sheet_name?, frozen_row_count, frozen_column_count) — freeze/pin rows from row 1 and columns from column 1. Use 0 to unfreeze an axis. Tables: • convert_to_table(selection, table_name, first_row_is_column_names, sheet_name?) — Convert existing cell data to a data table. Only use when the user explicitly asks for a data table or the file already uses data tables; otherwise keep data as plain cells. Selection must NOT contain code cells or existing tables. Table name row is added above, pushing data down by one row. • table_meta(table_location, new_table_name?, show_name?, show_columns?, alternating_row_colors?, first_row_is_column_names?, sheet_name?) — Set table metadata. table_location: anchor cell (top-left, e.g. A5). • table_column_settings(table_location, column_names, sheet_name?) — column_names: [{old_name, new_name, show}]. Only include columns to change. To delete columns use delete_cells with "TableName[Column Name]". Layout: • resize_columns(selection, size, sheet_name?) — size: "auto" (fit content), "default", or pixels (20-2000). • resize_rows(selection, size, sheet_name?) — size: "auto", "default", or pixels (10-2000). • set_default_column_width(size, sheet_name?) — size in pixels (20-2000, default 100). • set_default_row_height(size, sheet_name?) — size in pixels (10-2000, default 21). • insert_columns(column, right, count, sheet_name?) — column: letter (e.g. "C"). right: true=insert right, false=insert left. • insert_rows(row, below, count, sheet_name?) — row: number. below: true=insert below, false=insert above. • delete_columns(columns, sheet_name?) — columns: array of letters (e.g. ["A", "C"]). • delete_rows(rows, sheet_name?) — rows: array of numbers (e.g. [1, 5, 10]). Charts (Excel-native; prefer over Plotly/Chart.js code cells for standard charts of sheet data — see the "chart" topic for details): • add_chart(chart_type, position, series, sheet_name?, title?, name?, categories?, legend?, x_axis_title?, x_axis_min?, x_axis_max?, x_axis_number_format?, y_axis_title?, y_axis_min?, y_axis_max?, y_axis_number_format?, width_cells?, height_cells?, chart_3d_rot_x?, chart_3d_rot_y?, chart_3d_perspective?, chart_3d_depth_gap?) — Adds an Excel-native chart anchored at position (single cell). chart_type: column, column_stacked, column_percent_stacked, bar, bar_stacked, bar_percent_stacked, line, line_stacked, area, area_stacked, pie, doughnut, scatter, scatter_line, bubble, radar, radar_filled, stock, column_3d, bar_3d, line_3d, area_3d, pie_3d, waterfall, funnel, histogram, pareto, box_whisker, treemap, sunburst, region_map. series: [{values, name?, bubble_sizes?, color?}] where values is one row or column of numbers in A1 ("B2:B13", table references allowed). categories: labels range (x values for scatter/bubble). Charts float over the grid (no spill errors); the anchor is nudged to free space if the cell would cover content. Returns the chart_id for update_chart/delete_chart. • update_chart(chart_id, sheet_name?, chart_type?, position?, series?, title?, name?, categories?, legend?, axis and 3d options as in add_chart) — Changes an existing chart; omitted arguments leave that part unchanged. Chart ids are returned by add_chart and listed in the file context under "Native Chart". • delete_chart(chart_id, sheet_name?) — Removes a chart. Pivot Tables: • set_pivot_table(action, pivot_table_name?, sheet_name?, source?, destination?, rows?, columns?, values?, filters?, layout?, values_layout?, row_grand_total?, column_grand_total?, subtotal_position?) — Creates ("create"), reconfigures ("update"), or removes ("delete") a PivotTable: a live cross-tabulation that groups source rows and aggregates values, recomputing when the source changes. Prefer it over SUMIFS or a Python groupby for "totals by category" requests. Reference source columns by header name, not letter. source (create): A1 range with a header row or a table name. destination (create): "new_sheet" (default) or a top-left cell. rows/columns: [{field, label?, sort?, show_totals?, group_by?, numeric_interval?}]. values (at least one): [{field, aggregation?, name?, show_as?, number_format?, decimals?, visual?}]. filters: [{field, include?, exclude?}]. For update: null leaves an area as it is, an empty array clears it — send only the areas you're changing. pivot_table_name is required for update/delete; names are listed in the file context. The report's cells are read-only; change it with this action. See the "pivot_table" topic for details. Validation: • add_logical_validation(selection, show_checkbox?, ignore_blank?, sheet_name?) — True/false validation with optional checkbox. • add_list_validation(selection, list_source_list?, list_source_selection?, drop_down?, ignore_blank?, sheet_name?) — list_source_list: comma-separated values ("Item 1, Item 2"). list_source_selection: A1 cell reference. Use one, not both. • remove_validation(selection, sheet_name?) — Remove all validations from the selection. Conditional Formatting: • update_conditional_formats(sheet_name, rules) — rules: [{action, id?, selection?, type?, rule?, bold?, italic?, underline?, strike_through?, text_color?, fill_color?, apply_to_empty?, color_scale_thresholds?, auto_contrast_text?}]. action: "create"/"update"/"delete". type: "formula" (apply styles when formula is true) or "color_scale" (gradient colors). For formula type: rule examples: "A1>100", "ISBLANK(A1)", "AND(A1>=5,A1<=10)". For color_scale: thresholds: [{value_type: "min"/"max"/"number"/"percent"/"percentile", value, color}]. For table columns use table references instead of A1 ranges. For delete: only id required. History: • undo(count?) — Default 1. • redo(count?) — Default 1. Batch: • batch(actions) — actions: [{action, params}]. Runs writes sequentially through this same tool; errors short-circuit the batch. `action` may be any name from this reference. Nested `context` items are allowed and returned alongside the writes.

  Connector

• migrate_to_propelauth_frontend

  PropelAuth Integration MCP Server

  Returns instructions for migrating to PropelAuth in a frontend framework such as React, JavaScript, TypeScript, or when using Next.js for just the frontend (e.g. client-side rendered). Guidance includes migrating from several auth providers, such as Clerk or Auth0. Each guidance will include documentation from the auth provider and PropelAuth. It is important to follow the instructions carefully to ensure a successful integration. Make sure to use the 'Installation' guidance first. It is important to call every guidance to ensure a successful integration. Do not update a component/hook/etc from the auth provider until you receive guidance about that component/hook/etc. CRITICAL: If the current implementation uses a traditional OAuth/OIDC flow (e.g., via express-openid-connect, passport-auth0, or similar backend-managed session libraries), you MUST select 'OAuth' as the framework, regardless of the frontend library (React/Vue/etc.). Only select 'React' or 'Javascript' if the current implementation uses a frontend-only SDK (like @auth0/auth0-react) or if using fullstack Next.js.

  Connector

• foura_browser

  mcp

  Load a public URL in a full browser session. JavaScript runs, the DOM renders, and cookies come back with the response. Use it for single-page apps, lazy-loaded content, or supported browser challenges. For a protected page, call foura_proxy first and pass its returned proxy ID here to reuse that exit. Set unblocker:false when you want the page exactly as it loads.

  Connector

• test_regex

  mcp

  Use this when you need the true matches of a JavaScript regular expression rather than predicting regex behavior yourself, which is easy to get wrong. Deterministic: same input, same output. Returns every match with its index, length, matched text, positional capture groups (null for a group that didn't participate), and named groups (an object, or null when the pattern has none). Without the g flag only the first match is returned; with g all matches are collected, capped at 10,000 with truncated=true. Inputs are length-bounded (pattern 2,000 chars, text 50,000 chars) as a ReDoS guard. Example: pattern (?<y>\d{4})-(?<m>\d{2}) over "2024-01" with flag g -> matchCount 1, match "2024-01", groups ["2024","01"], named {y:"2024",m:"01"}.

  Connector

• run

  Bowmark

  **Executes the task on the real websites** (the search, the price check, the availability lookup, the configurator, the booking flow) and returns what came back. Runs a script you authored against the `get_library` vocabulary, on the live sites, and returns `{ ok, result, logs, error, ms }`. Call `get_library` FIRST — it gives the exact function names, argument shapes, and return types; this description is the LANGUAGE + how-to (get_library is just the vocabulary). THE LANGUAGE — plain async JavaScript: • `bowmark` is a ready global (no import). Call capabilities off it — `await bowmark.<capability>.<method>(...)` — always `await`, they're async. • Individual sites are callable too, at `await bowmark.providers.<provider>.<fn>(...)`. Use one when you specifically want THAT site; otherwise prefer the capability, which fans out across sites and routes around failures. • Real control flow: `await`, `if`, loops, array methods (`map`/`filter`/`sort`/`slice`), and `Promise.all` for fan-out. • `return` a value to get it back (JSON-serialized). `log(...)` for progress lines. • `bowmark` is the ONLY I/O — no `fetch`, `process`, filesystem, or `import`/`require`. Write a plain async body, not a wrapping function. • Keep scripts small and deterministic — no infinite loops. Runs in a hard sandbox with CPU + memory + wall-clock limits. SENDING IT: pass the script text as `run({ script })` — `script` is the only argument (there is no `site` argument; the library exposes every capability under `bowmark`). `result` is whatever you returned; `logs` are your `log()` lines in order; on a throw/timeout `ok:false` and `error` is set. CHECK `status` BEFORE `ok`. It is `ok` | `error` | `partial` | `needs_user`. • `partial` means the script RAN and `result` is real and usable, but some of what it called never answered — so the result is narrower than what you asked for. `ok` is still `true`; this is not a failure. `incomplete.summary` says what happened in one sentence, `incomplete.failures` names each call that threw and what the site said, and `incomplete.degraded` names each call that answered while reporting its OWN results thin. You MUST say so when you present the result: name what was missed, and do not describe it as complete, exhaustive, or 'all' of anything. A `partial` you report as whole is a wrong answer, not a slightly smaller right one. • Before you conclude a `partial` is final, check `incomplete.failures[].fixable`. `fixable: true` means YOUR ARGUMENT was rejected, not the site — the error text names what that function actually takes, so re-read it in `get_library`, fix the argument and run again; that recovers the whole answer. For any other failure re-running usually returns the same thing. • `needs_user` means a site needs the USER signed in — it is NOT a failure and NOT something you can fix by editing the script. `needs` lists the sites; `meta.handoff.url` is a single-use link that expires (`meta.handoff.expiresAt`). Give the user that URL, say which sites it covers, and WAIT. When they tell you they're done, send the SAME script again unchanged. Do NOT retry before then — it will stop at the same place and cost another run. Do NOT try to log in yourself, ask them for a password, or work around it with a different site. • Logged-in runs need a Bowmark API key on the connection; if you get `needs_user` saying so, tell the user to add one rather than retrying. `trace` is the execution trace — every capability you called and the providers it fanned out to under the hood: `[{ kind:'capability', capability:'flights', method:'search', ms }, { kind:'provider', capability:'flights', provider:'google_flights', fn:'search', results, status, ms }, …]`. The script never visits websites — it calls capabilities that route to providers, and the trace is the receipt. Composition is the point — call a method MULTIPLE times and combine results. To sweep a date range, call the search per date inside `Promise.all` and sort/filter the merged array (each flight result carries its `date`, so you can tell the runs apart). See the `get_library` examples for the exact shape. SOME capabilities return their rows alongside a `warnings` array — `{ flights, warnings }`, `{ hotels, warnings }`, `{ cars, warnings }`. Others return a bare array. The signature in `get_library` tells you which; go by it rather than assuming. Where there IS a `warnings` array it names any site dropped from the fan-out, and the rows themselves look identical with or without it. Read it, and pass on anything it says rather than quoting a 'cheapest' that only ranks the sites that happened to answer. Dropping `warnings` from what you return does not hide it — the run comes back `status: 'partial'` regardless, because the runtime counts what your script CALLED, not what it chose to report.

  Connector

• web.url.redirects

  1cent Web Intelligence for AI Agents

  Return the safely validated redirect chain. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector

• web.url.content_type

  1cent Web Intelligence for AI Agents

  Classify MIME type, charset and bounded content length. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector

• web.url.images

  1cent Web Intelligence for AI Agents

  List up to 100 image references without downloading images. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector

• web.site.sitemaps

  1cent Web Intelligence for AI Agents

  Discover up to five sitemap links declared by the requested page. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector

• ios_safari_capture_network

  Robot Actions — Remote Device Control

  Capture network requests made by a Safari page on an iOS device over a time window. Collects Network.requestWillBeSent, Network.responseReceived, Network.loadingFinished, and Network.loadingFailed events and returns merged records. Returns { records, bodiesOmitted? } in summary format, or a HAR 1.2 document when format="har". Each record: { requestId, method, url, requestHeaders?, status?, statusText?, mimeType?, resourceType?, responseHeaders?, encodedDataLength?, state, errorText?, startTimestamp?, endTimestamp?, body?, bodyTruncated?, bodyError? }. Set includeBodies=true to fetch response bodies for completed text-like responses (json|text|xml|javascript|html|css|svg|x-www-form-urlencoded); per-body cap: 10 000 chars (bodyTruncated=true when hit); total cap: 200 000 chars (excess records counted in bodiesOmitted). Body fetch failures set bodyError on that record. Set throttle to emulate bandwidth for the capture window only (best-effort; cleared afterwards): slow-3g (51 200 B/s) or fast-3g (209 715 B/s). NOTE: throttle="offline" is NOT supported on iOS — WebKit only has bandwidth throttling; use android_devtools_capture_network for offline. When throttle was active, a top-level throttle field appears in the output. Returns at most `limit` records (default 100, most-recent first) so heavy pages stay within the token budget — filter with urlSubstring / onlyErrors; total/returned appear when records were dropped. Default window: 5 000 ms. Maximum: 30 000 ms. Omit pageId to auto-pick the active page. Pass url to navigate inside the capture session and record the full page-load waterfall (pass the current URL to reload).

  Connector

• web.url.performance

  1cent Web Intelligence for AI Agents

  Return safe network timing, payload and cacheability diagnostics. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.

  Connector