Tool reference

The full tool catalogue with usage notes. Pass a topic to narrow it to one area or a single tool.

Your plan, usage, active projects, recent deployments, and how much of each per-plan cap is consumed. The cheapest way to confirm the connection works.

Ask a question about your own account in plain language. Answers over your recent activity, and renders an adaptive view on hosts that support MCP Apps.

Your token type, identity, roles, scopes, real session expiry, and the health of every OAuth discovery endpoint. Run this first on any auth error.

Prove your MCP client identity and your OpZero account are the same person. Returns a link URL to confirm in the browser. Required before a gateway backend may use an external connection.

Send raw markdown, get a themed page. Full GitHub-flavoured markdown, light/dark toggle, title lifted from the first heading. The lowest-effort way to publish.

Send body HTML, get it wrapped in the OpZero design system — glass nav, typography, colour palette. Standard HTML elements are styled for you.

Deploy one complete HTML document. Tailwind utility classes are compiled automatically, so no CDN script or config is needed.

Deploy a multi-file site — HTML, CSS, JS, assets — with full file-level control. Tailwind is still compiled for you.

Deploy a React component as a live site with zero build, via ESM.sh. React, Recharts, and Lucide are built in. Set ai and storage to turn it into a real application with a backend.

Ready-to-deploy starter files: the branded opzero theme (recommended), landing, portfolio, blog, static, vite-react, or react-esm.

Patch a live site by merging a partial file map into its latest deployment. Unmentioned files are preserved; an empty string deletes one.

Render one of your deployed pages inline in the conversation, on hosts that support MCP Apps. Identify it by URL, project ID, or project name.

An interactive widget showing your live site next to a prompt box. Edits typed there arrive back in the conversation, and the page hot-reloads once you apply them.

Everything you have deployed, with URLs and status. Filter by status, hosting target, name, or staleness.

One project by name or ID: metadata, current URLs, custom domain, status, and a summary of its latest deployment.

Create an empty project container. Usually unnecessary — the deploy tools create one for you.

Change a project name without touching its contents or deployment history.

Hide a project from default listings without deleting it. Reversible with the unarchive action.

Audit your account for duplicates, stale projects, and throwaway test deploys. Recommends, never deletes.

Take a project offline. Soft by default, with a seven-day window in which redeploying the name restores it; hard delete is immediate and permanent.

Point your own domain at a project, or remove the current one. Requires Pro or Team, plus a CNAME record you add at your registrar.

Recent deployments across all projects, or scoped to one.

Everything about one deployment, including the full deployed file contents — the way to recover source a conversation has lost.

Status, status detail, URL, file count, and size for a deployment, or the last five for a project.

Rebuild a project from its stored source. MCP server projects go through the full pipeline again, preserving auth mode and runtime.

Republish an older deployment’s files as a new deployment. Forward-only, so nothing is destroyed.

Permanently remove one deployment record from history.

Turn AI or storage on or off for a running app without redeploying its code. Also where you change the pinned system prompt, widen the model allowlist, or adjust caps. Live within about a minute.

List a project’s stored files. Metadata only, never content. Defaults to the shared scope; pass a user ID for one end user’s files.

Read one file. Text by default, base64 for binary, or metadata only. Files over 256KB come back as metadata rather than inlined.

Write a file (3MB max) where the app and its MCP servers can read it. Publish it at a credential-free URL with public.

Delete a file, and with it any public URL it was served from.

Create an assistant from a model, a system prompt, and connections to MCP servers that already exist. Served from one of your app subdomains via oz.assistant(slug).

Your assistants with their slugs, models, connected servers, and status.

Every model an assistant can run on — the live Vercel AI Gateway catalogue with context windows, prices, and capability tags. The default is Claude Sonnet 5.

One assistant’s full config and its chat endpoint URL.

Change the model, prompt, connected servers, or limits. Effective immediately, no redeploy.

Delete an assistant. Its chat endpoint stops responding at once.

Talk to one of your assistants server-side — the way to test one before any app exists. Returns the whole reply plus a trace of each tool-use round.

A known-good scaffold: minimal (synced state over HTTP and WebSocket), scheduler (cron and delayed callbacks), or chat (a broadcast room). Start here rather than from memory.

Build and deploy TypeScript that exports Agent classes. Each class becomes a stateful instance type at <endpoint>/agents/<class-name>/<instance>; the result carries the URLs and a connect block for clients.

Your agents: project, endpoint, auth mode, classes, last verification.

One agent in full: classes with URL templates, secret keys, last deployment, and the client wiring.

Set an encrypted environment secret, exposed to the agent as this.env.KEY. Hot-applied.

Remove an environment secret.

Replace the shared access token. Shown once; the old one stops working at once.

A known-good scaffold to build from: browser, connected MCP, storage/files, MCP Apps, resources, sync/webhooks, closed-loop execution, Python, and the minimal HTTP starters. Start here rather than from memory.

Build and deploy TypeScript or Python on a stable MCP endpoint. Hosted TypeScript includes ctx.browser, ctx.connect, ctx.signals, ctx.loop, storage/files, resources, ingest, MCP Apps, and an explicit cron schedule when the server must wake itself.

Deployment health, recent deploy records, and a live Cloudflare tail when one is available. The first stop when a server misbehaves.

Which MCP Apps widgets your server exposes and which tools render into each — including tools pointing at a widget that does not exist.

Run the cross-client matrix after deploy: protocol negotiation, auth discovery, CORS, catalogue limits, resources, and MCP Apps across Claude, OpenAI, xAI, IDE, and baseline profiles.

Set an encrypted environment secret, exposed to the server as ctx.env.KEY. Cloudflare picks it up immediately.

The secret keys configured on a server. Values are never returned.

Remove an environment secret.

Replace a token-mode server’s access token. The old one stops working immediately; the new one is shown exactly once.

A federated endpoint at gw.opzero.sh/g/<slug>/mcp. Choose the exposure mode carefully — search is right for Claude.ai.

Your gateways with endpoints and backend counts. Materializes the default gateway on first call.

One gateway in full: exposure policy, backend attachments with namespaces, and per-backend health.

Change the name, exposure mode, inline limit, pinned tools, or tracking flag. Live within about thirty seconds.

Attach a hosted server, an external MCP server, or an assistant, under a namespace that prefixes its tool names. Use an external connection for third-party credentials.

Detach a backend. The backend itself survives; any connection grant it held through this gateway is revoked.

Delete a gateway and its attachments. Backends are untouched. The default gateway cannot be deleted.

Connect Notion, Linear, Sentry, Neon, Vercel, or any RFC 9728 server. Returns a one-time authorize URL; the grant is stored encrypted and refreshed for you. The "opzero" provider connects OpZero itself, with no browser step, so a workload can run named deploy tools as you.

Your connections with status, granted scope, and which workloads may use each. Status needs_reauth means the grant must be recreated.

Let one workload use one connection, or revoke that permission. This is the consent boundary — nothing is ambient. Granting the "opzero" connection, which lets a workload call these deploy tools as you, additionally requires a tool_allowlist.

Revoke at the provider where supported, delete the stored credential, and drop every grant on it.

Read one of the OpZero skill documents: the step-by-step workflow, ordering constraints, and failure modes for a multi-step task (assistants, gateways, mcp-servers, agents, src). Call it before deploying or debugging an assistant, gateway, hosted MCP server, agent, or project source, and whenever guidance points you at a skill:// URI — this tool returns the same markdown as resources/read, for clients that only speak tools.

Change a deployed MCP server's settings without resending its source. This is the tool for flipping auth_mode, opening or closing multi-tenant admission, toggling public shared storage, or setting/clearing the cron schedule - deploy_mcp_server requires the full file map, and reading a server's source back just to change a setting is what this exists to avoid.

Platform build evaluator for a proposal run: materializes the candidate tree the run would land (the merge result src_checkout_manifest returns for run), builds it as a hosted MCP server bundle exactly as deploy_mcp_server would, and records the outcome on the run as build evidence (class build, verdict pass or fail, evidence bundle_bytes or error) under the platform evaluator principal. This is the only way build evidence enters a repository: src_validation_record refuses direct callers.

Change a deployed agent's settings without resending its source. Covers auth_mode, the oauth allowed_callers list, and idle_archive_days - deploy_agent requires the full file map, so this is the tool for a settings-only change.

Diagnose the MCP session from both ends. Reports what this server sees of the calling client (protocol era and version marker, client identity and capabilities from _meta, transport headers, resolved caller identity, scopes) and what is going on inside the server (implemented JSON-RPC methods, tool catalog with per-tool allow/deny for this caller, widgets, resources, runtime bindings and configuration).

Companion to mcp_diagnostics, called by its widget: stores the host-side findings it collected (client_report) in a short per-caller ring and returns the full diagnostics report with them under clientReports. Writes only diagnostic state for the calling identity; anonymous callers on a public server get the report back but nothing is kept.

Open the repository view: branches, log, file tree, file contents, proposals, positions, conflicts and diff, as structured content. Pass path to show a file, proposal to inspect one, tab to choose the tab.

Mark a branch protected so it moves only through merge finalization, or unprotect it, and set its validation policy: require_validation names the classes a run must carry a pass for before src_merge_finalize lands it; an empty array clears the requirement. Only classes a platform evaluator can produce are accepted (build today, through validate_candidate; the set grows as test, policy and review evaluators land), so a gate can never be configured that nothing can satisfy: another class is refused UNSUPPORTED_VALIDATION_CLASS.

List branches with heads, protection, and the validation policy (require_validation and its policy_hash) each enforces at finalize.

List a directory at a snapshot. Depth 1 by default; entries carry hash and size.

Read a file at a snapshot. Returns lines with a range_hash for src_edit.

Read several small files at one snapshot in one call. Pass run instead of ref to read from the candidate tree a run would land (the merge result, which has no commit until finalized).

Markdown headings or top level code symbols with line ranges. A symbol ends where the brackets opened on its first line close; an anonymous export default is listed under its callee name (export default defineServer({ is the symbol defineServer, kind default).

Commit history. first_parent defaults to true so a branch that receives merges reads as one entry per landed proposal.

Compare two snapshots. Default is per path added and removed line counts; text: true returns a unified diff.

Paths that differ between two snapshots. Use after HEAD_MOVED to reread only what changed.

Exact manifest of a snapshot for materialization: commit, root, and every path with hash, mode and size. Write .src/HEAD in the checkout with the commit hash and use it as expect_head on ingest.

Which of these full blob hashes are neither stored inline nor verified in R2. A blob that was prepared but not yet uploaded counts as missing and is listed again under staged.

Stage blobs over 1 MB (INLINE_MAX) through R2: per blob, a 15 minute presigned PUT URL plus the headers to send, or already_present when the hash is stored. PUT the Git blob object (the frame "blob <size>\0" followed by the content, so its SHA-256 is the blob hash) with the headers verbatim; the bucket refuses a body whose digest differs.

List proposals (pull request equivalents) with each current run: candidate_root, projected_base_root (a tree root, not a commit), policy_hash and the validation verdicts per class. With target, entries come in queue order with positions.

One proposal with its current run, queue position, predecessor, projected_base_root and candidate_root (tree root hashes; source_head, target_head, and merge_base are commit hashes), and conflicts. A read: it reports the run the queue produced and never creates one.

Object counts, mutation and rebase metrics, queue depths, and limits.

Write, replace, or delete whole files on a branch in one commit. Compare and swap on expect_head with path tier rebase by default.

Edit one file with anchored edits: a unique old/new string, a line range with range_hash returned by src_read, a markdown section, or a symbol. Section and symbol edits replace exactly the anchor body bytes, byte for byte; pass the anchor_hash src_read returned so the edit is bound to the body you read.

Create a branch (O(1)) pointing at an existing commit. Defaults to contrib/<you>/<n>.

New commit whose tree equals snapshot to. History is preserved.

Move a branch onto another snapshot by replaying its change set from the merge base as one new commit whose parent is onto (a squashing rebase, like git rebase --onto then squash). Resolves add/add conflicts that editing the source branch cannot: the merge base moves to onto.

Commit a checkout back as a change set: the manifest is diffed against the tree at expect_head and only differences apply. Paths absent under prefix are deleted only with prune: true.

Commit a manifest of paths that reference blobs by hash only: inline blobs already stored, R2 blobs staged with src_upload_prepare (verified before the commit; BLOB_NOT_STAGED lists any without an object), or unchanged blobs. Change set semantics like src_ingest: only differences from the tree at expect_head apply, and prune deletes paths absent from the manifest.

Open a proposal (equivalent to a pull request) and enqueue it on the target. The dry merge runs against the projected base, which is the candidate of the entry ahead or the target head; the run reports it as projected_base_root (a tree root hash, unlike source_head, target_head, and merge_base, which are commit hashes).

Reject a proposal and remove it. Entries behind it repin, and conflicted proposals on the same target are re-evaluated against the new queue.

Gate tool: land an evaluated run. Succeeds only at the head of its queue and only when the target root equals the run projected base.

Record validation evidence on an evaluated run: one class (build, test, policy, review) with a pass or fail verdict, bound to the run candidate_root, projected base and policy hash at the moment of recording. Only the platform evaluator principal records, and never on a proposal it opened; the platform refuses direct calls with CAPABILITY_DENIED, because evidence comes from a platform owned evaluator such as validate_candidate, not from the caller.

Serialization self test (spec R8): N concurrent src_write calls race one throwaway branch with the same expect_head, fanned out into the repository object at once. Exactly one must land and every other writer must see HEAD_MOVED at the winner.

Raw repository export for replay: refs with full heads, commits in sequence order with their stored objects (after and limit page them), and objects by full hash. Proposal, queue and mutation records are not exported.

Replay a standalone src repository into this project repository (spec 1.1 section 4.5): the platform reads the source under your identity, walks its commits in sequence order, inserts blobs and trees by hash (R2 objects copied by key), re-encodes every commit and refuses with REPLAY_DIVERGENCE naming the commit if a hash differs (the target is left untouched), and recreates the refs at the same heads. Idempotent and resumable.

Open a first-person operational view of a project repository. Returns a bounded, read-only snapshot of branch/HEAD, recent commits and paths, proposals/runs/queues, quota pressure, metrics and audit activity.

Open the project repository in an editor: file tree, branches, log, proposals, and the contents of one file, with syntax highlighting and editing in the view. Read-only itself - it returns a snapshot.

List your projects as repositories: project id, slug, main_head (abbreviated; null until the repository is first touched), created, and each row's canonical repo identity { id, authority, uri }. Every project has one repository, created on first touch with a protected main; there is no create tool.