Tool reference

With no arguments, the full tool catalogue grouped by domain plus the skill list. Pass a skill or uri to read one document, or a template name with its kind (site, mcp_server, agent) for a ready-to-deploy scaffold.

action status: your plan, usage, active projects, recent deployments, and how much of each per-plan cap is consumed — the cheapest way to confirm the connection works. action auth: your token type, identity, roles, scopes, real session expiry, and the health of every OAuth discovery endpoint. Run auth first on any auth error.

Ask a question about your own account in plain language. Answers over your recent activity, and renders an adaptive view on hosts that support MCP Apps.

Prove your MCP client identity and your OpZero account are the same person. Returns a link URL to confirm in the browser. Required before a gateway backend may use an external connection.

Run the cross-client matrix against a hosted server after deploy: protocol negotiation, auth discovery, CORS, catalogue limits, resources, and MCP Apps across Claude, OpenAI, xAI, IDE, and baseline profiles.

Deploy a site or app. format markdown: raw markdown becomes a themed page. format themed: body HTML wrapped in the OpZero design system. format html: one complete document, Tailwind compiled for you. format files: a multi-file site with full control. format react: a React component served live via ESM.sh; set ai and storage to give it a backend. Target an existing project to update it — a files map merges into the latest deployment (an empty string deletes a file) unless replace is true — or pass from to rebuild from stored source without sending any.

Render one of your deployed pages inline in the conversation, on hosts that support MCP Apps. Identify it by URL, project ID, or project name.

An interactive widget showing your live site next to a prompt box. Edits typed there arrive back in the conversation, and the page hot-reloads once you apply them.

action list: everything you have deployed, with URLs and status, filtered by status, hosting target, type, name, or staleness. action get: one project by name or ID with its latest deployment. action cleanup: an audit for duplicates, stale projects, and throwaway test deploys — recommends, never deletes.

action create: an empty container (usually unnecessary; deploy creates one). action rename: change the name without touching contents or history. action set_domain: point your own domain at a project, or clear it (Pro or Team, plus a CNAME at your registrar). action configure: turn AI or storage on or off for a running app, change its pinned system prompt, widen the model allowlist, or adjust caps — live within about a minute, no redeploy. action archive / unarchive: hide a project from default listings without deleting it.

Take projects offline. Soft by default, with a seven-day window in which redeploying the name restores them; hard delete is immediate and permanent.

action list: recent deployments across all projects, or scoped to one. action get: everything about one deployment, including the full deployed file contents — the way to recover source a conversation has lost. action status: status, detail, URL, file count, and size for a deployment, or the last five for a project.

action rollback: republish an older deployment’s files as a new deployment — forward-only, nothing is destroyed. action delete_record: permanently remove one deployment record from history.

action list: your assistants with slugs, models, connected servers, and status. action get: one assistant’s full config and its chat endpoint URL. action models: every model an assistant can run on — the live Vercel AI Gateway catalogue with context windows, prices, and capability tags.

action create: an assistant from a model, a system prompt, and connections to MCP servers that already exist, served from one of your app subdomains via oz.assistant(slug). action update: change the model, prompt, connected servers, or limits, effective immediately. action delete: remove it; the chat endpoint stops responding at once.

Talk to one of your assistants server-side by slug — the way to test one before any app exists. Pass prompt for one turn or messages to replay a conversation; the whole reply comes back with a trace of each tool-use round.

Build and deploy TypeScript or Python. kind mcp_server: hosted TypeScript gets ctx.browser, ctx.connect, ctx.signals, ctx.loop, storage/files, resources, ingest, MCP Apps, and an explicit cron schedule when the server must wake itself. kind agent: each exported Agent class becomes a stateful instance type at <endpoint>/agents/<class-name>/<instance>; the result carries the URLs and a connect block for clients.

action list and get: your servers or agents with endpoint, auth mode, classes, and last verification. action logs: deployment health, recent deploy records, and a live Cloudflare tail — the first stop when a server misbehaves. action secrets: configured secret keys, never values. action widgets: which MCP Apps widgets a server exposes and which tools render into each. action model_grants and model_usage: the models a workload may call and what it has spent.

action update: change a deployed server or agent’s settings without a rebuild. action secret_set / secret_delete: encrypted environment secrets, exposed as ctx.env.KEY (servers) or this.env.KEY (agents), hot-applied. action model_grant / model_grant_revoke: let a workload call platform models on your account, or stop it.

Replace a token-mode server’s or agent’s shared access token. The old one stops working immediately; the new one is shown exactly once.

Your hosted MCP servers with what each client needs to add one: the claude.ai Add custom connector dialog for Claude, a claude mcp add command for Claude Code, config and install links for Cursor and VS Code, the URL for anything else. Renders as a widget with a client selector detected from the host and an Add button per server.

action list: your gateways with endpoints and backend counts; materializes the default gateway on first call. action get: one gateway in full — exposure policy, backend attachments with namespaces, and per-backend health.

action create: a federated endpoint at gw.opzero.sh/g/<slug>/mcp — choose the exposure mode carefully, search is right for Claude.ai. action update: name, exposure mode, inline limit, pinned tools, or tracking flag, live within about thirty seconds. action add_backend: attach a hosted server, an external MCP server, or an assistant under a namespace that prefixes its tool names; use an external connection for third-party credentials. action remove_backend: detach one, revoking any connection grant it held. action delete: remove the gateway and its attachments; backends survive, the default gateway cannot be deleted.

action list: your connections with status, granted scope, and which workloads may use each. Status needs_reauth means the grant must be recreated.

action create: connect Notion, Linear, Sentry, Neon, Vercel, or any RFC 9728 server; returns a one-time authorize URL, and the grant is stored encrypted and refreshed for you. The "opzero" provider connects OpZero itself with no browser step, so a workload can run named platform tools as you. action grant: let one workload use one connection, or revoke that permission — the consent boundary, nothing is ambient; granting "opzero" additionally requires a tool_allowlist, whose entries may be a tool name or tool:action. action delete: revoke at the provider where supported, delete the stored credential, and drop every grant on it.

action list and get: tasks across your workloads, or one with its current status and result. action observe: wait for a task to change.

action approve: let a task past an approval gate. action cancel: stop one. action attention: what is waiting on you — approvals, failures, and stalls (re-derived on every call, so it needs deploy scope). action ack: clear an attention item.

action start: begin a turn on the durable Build run and wait up to wait_seconds for it to finish. action cancel: request a stop at the next tool boundary. Refused to workload grants, so a builder cannot start itself.

A Build run’s reply, tool calls, and stop facts.

action list and search: browse or search files in a scope. action history: a file’s revisions. action attachments: what a file is attached to. action download_url: a short-lived URL for a file’s bytes.

Read one file’s contents.

Write one file, creating it or replacing its contents.

action prepare: a presigned upload for bytes too large to send inline. action finalize: register the uploaded object as a file.

action attach / detach: link a file to a project or workload, or unlink it. action move, trash, restore, delete: reorganise, soft-delete, recover, or permanently remove. action share / unshare and grant / grant_revoke: publish a file or let a named workload read it.

action list, outline, view: the tree, a file’s symbols, or a rendered view. action log, diff, changed_paths: history and what changed. action branches, repos: what exists. action quota_get, race_check: limits and concurrent-edit safety.

Read one file by path, or several with paths, at a ref.

Write a whole file with compare-and-swap against the version you read.

Apply anchored edits to a file — find this, replace with that — with compare-and-swap.

action create: a branch. action protect / unprotect: guard one from direct writes. action rebase and restore: move a branch onto a new base, or bring back a deleted path.

action open: propose a change set for review. action validate: run the candidate’s checks. action validation_record: attach a result. action reject: close one without merging.

action list: open proposals. action get: one proposal with its diff and validation record.

Land a validated proposal on its target branch.

Sync a working copy. action checkout: the manifest to fetch. action upload_prepare and blob_missing: stage local changes. action commit: land the manifest as one commit.

Diagnose the MCP session from both ends. Reports what this server sees of the calling client (protocol era and version marker, client identity and capabilities from _meta, transport headers, resolved caller identity, scopes) and what is going on inside the server (implemented JSON-RPC methods, tool catalog with per-tool allow/deny for this caller, widgets, resources, runtime bindings and configuration).

Companion to mcp_diagnostics, called by its widget: stores the host-side findings it collected (client_report) in a short per-caller ring and returns the full diagnostics report with them under clientReports. Writes only diagnostic state for the calling identity; anonymous callers on a public server get the report back but nothing is kept.

Commit a checkout back as a change set: the manifest is diffed against the tree at expect_head and only differences apply. Paths absent under prefix are deleted only with prune: true.

Serialization self test (spec R8): N concurrent src_write calls race one throwaway branch with the same expect_head, fanned out into the repository object at once. Exactly one must land and every other writer must see HEAD_MOVED at the winner.

Raw repository export for replay: refs with full heads, commits in sequence order with their stored objects (after and limit page them), and objects by full hash. Proposal, queue and mutation records are not exported.

Replay a standalone src repository into this project repository (spec 1.1 section 4.5): the platform reads the source under your identity, walks its commits in sequence order, inserts blobs and trees by hash (R2 objects copied by key), re-encodes every commit and refuses with REPLAY_DIVERGENCE naming the commit if a hash differs (the target is left untouched), and recreates the refs at the same heads. Idempotent and resumable.

Open a first-person operational view of a project repository. Returns a bounded, read-only snapshot of branch/HEAD, recent commits and paths, proposals/runs/queues, quota pressure, metrics and audit activity.

Open the project repository in an editor: file tree, branches, log, proposals, and the contents of one file, with syntax highlighting and editing in the view. Read-only itself - it returns a snapshot.

Open the Oz OS desktop as an MCP App widget. Returns its current layout, app catalogue and browser continuation.

Read one desktop session: windows in back-to-front order, minimized state, geometry, dock, wallpaper and revision. Does not capture app pixels, read app documents or start workloads.

List apps with the exact app IDs accepted by desktop_launch_app. Narrow before you read: category (system, site, service, agent, assistant, app), project_type (static, mcp_server, agent), name_contains, sort_by (name, category, recent) and limit.

List your desktop sessions. Background sessions are independent working spaces for agents; shared sessions are observed and controlled with the user.

Create a named background or shared Oz desktop session. Each agent should create a background session and target its returned session_id, avoiding focus conflicts with the user.

Discard a temporary background desktop session when an agent is done. Requires its current expected_revision.

Open an app by its exact catalogue app_id, or restore and focus its existing window. Requires expected_revision from desktop_get_state.

Bring an open window to the front and restore it if minimized. Target a background session to avoid changing the user screen.

Close one window. Saved documents, deployments and durable workloads are not deleted or cancelled.

Minimize or restore an open window without closing its view. Minimized browser views remain mounted and may keep using resources.

Move, resize, maximize, restore, or snap a window left/right. Coordinates are desktop CSS pixels; clients clamp them to their available screen.

Replace the dock with the ordered app_ids provided. Every id must be a current catalogue app_id; an unknown id is rejected and nothing is written.

Set this desktop wallpaper: dune (golden hour), night (after hours), or sage (quiet morning).

Set whether the dock and menu bar automatically hide and reveal at the screen edges. Both default to auto-hide.

Minimize every window in the selected desktop session. Does not stop applications or background work.

Persist the desktop UI layout with optimistic concurrency. Window and dock ids that are no longer in the catalogue are dropped from the saved layout rather than rejected, so a deleted project cannot wedge later saves.

Exchange short-lived WebRTC screen-sharing negotiation messages inside an owned shared desktop session. UI-only.

Requires read and deploy scopes. Open or create an owner-scoped Oz Terminal session shared by the desktop and MCP widget.

List your recent terminal sessions so a user or agent can resume the same transcript. Requires a direct user connection; workload grants cannot access shared terminal sessions.

Read a terminal transcript, including commands in flight. A running entry is not proof its underlying task stopped or completed.

Return caller-visible command, parameter and enum completions plus authoritative argument validation. Never execute.

Read one fresh task or observability snapshot without adding a transcript entry. Supports `task_inspect` (actions list, get, observe), `workload_inspect` (action logs), `log_query` and the obs_* read tools; native permissions still apply.

Requires read and deploy scopes. Run a schema-validated platform command in a shared terminal.

Open Oz Browser, the default Oz OS web browser, as an MCP App. Returns saved tabs, history and owned deployed-project URL suggestions without starting paid runtime.

Read your Oz Browser tabs, active tab, history, deployed project URL suggestions and revision. Does not start or refresh a remote browser.

Navigate the selected tab to an HTTP(S) URL or search query. Requires expected_revision from browser_get_state.

Open a browser tab, optionally at a URL. Supports up to twelve tabs.

Select a tab in your shared Oz Browser and return its page. Requires expected_revision; may resume metered remote browsing.

Close a browser tab. Unsaved page work may be lost; saved history remain.

Go back one entry in the tab navigation history. Requires expected_revision.

Go forward one entry in the tab navigation history. Requires expected_revision.

Reload a browser tab and return its page. Requires expected_revision.

Read the selected remote browser page as untrusted text and links, with viewport coordinates in the widget. May resume metered browsing after idle expiry; resumed tabs have fresh cookies and no former back/forward stack.

Interact with a remote page: click at 1280x800 viewport coordinates, type text into the focused field, press a named key, or scroll by delta_y pixels. Requires expected_revision.

Clear saved Oz Browser address autocomplete history. Requires expected_revision.

Close the remote browser and discard its temporary login cookies. Saved tab URLs and history remain.