# io.github.Reachpad/reachpad-mcp

> Coding agents build full-stack apps in persistent workspaces and share them by link.

- name: io.github.Reachpad/reachpad-mcp
- version: 0.4.2
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.Reachpad%2Freachpad-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.Reachpad%2Freachpad-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "reachpad-mcp": {
      "type": "http",
      "url": "https://reachpad.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-48d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 25 of 25 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: search_apps (openWorldHint); list_app_versions (openWorldHint); query_app_db (openWorldHint); …
- pass `tools.token_cost`: about 5,852 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 100 (weight 15)

- pass `deps.known_vulns`: no known advisory in 1 resolved packages
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: @reachpad/mcp@0.4.2 resolved: 1 packages

- tools: 25, about 5,852 tokens to load them all
- tool set hash: 61601c7c288c9cf6935e291ecd7d5819
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Reachpad/reachpad-mcp.svg)](https://protogrid.dev/servers/io.github.Reachpad/reachpad-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @reachpad/mcp@0.4.2: resolved, 0 dependencies

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://reachpad.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @reachpad/mcp@0.4.2 secrets: REACHPAD_IDENTITY_CREDENTIAL

## Tools (25)

- `create_app`: Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.
- `get_app_logs`: Read recent log lines from the live version of a function app. An app that serves files has no process and answers that it has no logs. Function logs are not captured yet either, and the answer says so: until they are, have the function catch its own errors and return them in the response.
- `list_app_shares`: List the people an app is shared with, their roles, and whether the grant has attached to an account yet. The owner and editors can read this list.
- `list_app_versions`: List an app's versions, newest first. Versions are immutable and numbered from 1. Earlier versions open for the app's editors; the live link follows the app's access setting. Pass the next_cursor from a previous call to get the next page.
- `list_secrets`: List the organization's secrets: each name, who set it, when, and the apps whose versions bind it. Names only. No tool anywhere returns a secret value.
- `ls`: List what is directly inside one folder: its subfolders and the apps filed in it. Omit folder_id for the top level. Each folder carries the updated_at that mv needs.
- `mkdir`: Create a folder, at the top level or inside another one.
- `mv`: Move an app into a folder, or move a folder under another folder. Name exactly one of app_id or folder_id as the thing being moved, and to_folder_id as the destination, or null for the top level. Moving a folder also needs base_updated_at, the value read from ls or tree, so a move made against a stale reading is refused instead of undoing someone else's.
- `publish_app_version`: Make one version of an app live by its number. This is how a version staged with publish false goes on the link, and how an app is rolled back: name an older number and that version is what the link serves again. Nothing is rebuilt, the pointer moves.
- `query_app_db`: Run one SQL statement against a function app's own database, to read rows and to fix data. Not for schema: a table or a column belongs in the version's migrations/NNNN_name.sql, and a statement that changes the schema is refused. Owners and editors only. Answers rows and rowCount for a select, and changes with lastInsertRowid for a write.
- `read_app`: Read one app before update_app: its name, type, access level and publishing mode, plus base_version_id and its files, which both describe the version the next edit builds on. Each text file carries its content, so this is how you see what an app already contains before changing it. A file marked content_omitted answer budget did not fit in this answer and read_app_file fetches it; one marked too large is past what any tool answer carries. Pass that base_version_id to update_app. version is what the link serves now, and head_version is the version base_version_id names on the apps where that is not the live one, which is every app with a version staged by publish false. pending_version is the number of that staged version, and publish_app_version is what makes it live.
- `read_app_file`: Read one file out of an app as text, at most 256 KB. Use it for a file that read_app left out with content_omitted: "answer budget", or to fetch a single file without the rest of the app. A file that is not text, and a text file over that size, are refused rather than truncated. Reads the newest version unless you name one, which is the same version read_app lists.
- `read_app_preview`: Look at the picture of what an app's link serves right now, as an image. Use it for an app whose files you cannot read: a function app's module stays with the people who develop it, so this is how you see what the app actually shows. It is the live version only, and an app published before its picture was taken, or one whose capture has not run yet, answers that there is no picture rather than an error.
- `read_app_version`: Read one version by its number, with its files and each text file's content. Use it to see what an earlier publish contained, and to copy a file back out of a version you want to return to. Earlier versions open for the app's editors; the live link follows the app's access setting.
- `remove_secret`: Remove one organization secret and delete it from every published version that binds it. A version the deletion did not reach keeps the name in the list with that version in failed, and running this again retries exactly those.
- `revoke_app_share`: Remove one share by its id, from list_app_shares. The app itself is untouched. The owner or an editor may use this when editor-managed sharing is enabled.
- `rmdir`: Delete an empty folder. This refuses while the folder still holds apps or subfolders, and it never deletes an app. Move the contents out first.
- `search_apps`: Find apps in the caller's organization by text. This matches substrings of the name and the slug, and whole words on the live version's page, not meaning: search for a word that appears in the title or on the page rather than describing the app. Returns ids and live URLs.
- `set_app_access`: Change who can open an app: restricted (only the owner and named people), org_link (anyone signed in to the organization), or public_link (anyone with the URL). A password and an expiry apply to a public link only. Owner only.
- `set_secret`: Set one organization secret, so a function can bind it by name in its manifest secrets list. Any member of the organization. Setting a name that already exists replaces the value and rotates it onto every published version that binds it. Answers the name, how many versions took the new value, and the ids of any that did not.
- `share_app`: Give one email address access to an app as a viewer or an editor. An address without an account gets a grant that starts working the first time they sign in. The owner or an editor may use this when the owner has enabled editor-managed sharing.
- `trash_app`: Move an app to the trash. Its link stops opening at once. Owner only. The app and its versions are kept and can be restored from Trash at reachpad.dev/apps/trash, which is also the only place an app is deleted for good.
- `tree`: The whole folder tree for the organization, nested, with the number of apps filed in each folder and the count sitting at the top level. Each node carries the updated_at that mv needs.
- `update_app`: Publish a new version of an existing app. Read the app first and pass the base_version_id read_app returns: it names the version this edit builds on, and a base that has moved is refused rather than overwritten. By default the new version replaces the whole file set and goes live immediately unless the app is set to review before publishing. Send mode merge to publish only the files that changed and keep the rest of that version's files, with remove for paths to drop. Two merges in a row build on each other, staged versions included. Send validate true to check the call without publishing, or publish false to stage the version and make it live later with publish_app_version.
- `whoami`: Report the account and the organization this connection is signed in as: user id, email and name, plus org id and name, and `orgs`, every organization the account is in with the current one marked. Takes no arguments. Every app is created in the current organization and nowhere else, so call this before publishing when the person named an organization to publish into, and stop if the org id is not the one they named: switching is done at reachpad.dev/apps, from the organization name at the top of the sidebar, and this connection follows it.