Open the read-only candidate workbench. Ask for an uploaded reference, data profile, or plotting goal before searching.

Search the complete ranked Local Published, bundled Community, FigureYa, and opted-in personal Provider match set, open the candidate App, then stop and wait for the user to choose. Working, Capture, and flat-v1 entries remain excluded.

App-only pagination for an existing complete search result set.

Describe an exact Local Published release, bundled/personal public template, or commit-pinned FigureYa module. A bare templateId is deliberately insufficient.

Return one selected preview as standard MCP image content and optionally copy it to a trusted absolute directory. This compatibility tool does not authorize materialization.

App-only exact preview. It returns image bytes only to the component and issues a session-bound confirmation challenge.

Model-visible exact preview. Call only after the user selects a candidate, explicitly delegates visual review, or an App updateModelContext handoff selects one candidate; do not iterate all results.

App-only confirmation. The candidate workbench calls this only after the exact image load event and an explicit user click.

Model-visible confirmation after figure_library_preview_exact_headless. Use only after a user selection, explicit delegation, or an App updateModelContext handoff when serverTools is unavailable; this call cannot prove UI visibility.

Internal App-only structured diagnostics. It accepts a fixed event enum and no arbitrary log text.

Export a bounded, secret-safe diagnostic ZIP for the current server session. Defaults to sanitized_bundle, excludes user text and absolute paths, and never uploads data.

Return complete text and structured status for the global portable Library, immutable lifecycle, write lock, and every registered Local, Community, FigureYa, or personal Provider. Capture/project-pin status is intentionally absent.

Validate the user-selected global Library directory and optionally stage a non-destructive flat-v1 copy. This read-only plan never chooses a project directory implicitly.

Apply the exact reviewed binding plan using operation-id idempotency and stale-plan checks.

Validate the user-selected Local workspace directory. First-time machine confirmation only; later starts reuse the saved locator. Never infers the current project folder.

Apply the exact reviewed workspace binding plan. After this first confirmation, later MCP starts reuse the same directory across projects.

Inspect one exact Library write lock. The user must stop every Wisp, Codex, Claude, and other writer before approving recovery; locks are never auto-stolen.

Archive the exact unchanged abandoned lock and write a recovery receipt after all writers are confirmed stopped.

Host-neutral read-only inspection of Working, Published, history, Diff, and Review findings.

Return the canonical image for an exact active pending Working plan or current Working Head. This read-only tool does not create a preview receipt or authorize materialization.

Return immutable Content Revision and Release history.

Compare complete revision fields and asset inventories without modifying either revision.

Validate user-confirmed image/code intake and return an immutable Working Revision plan. The server never calls a model or executes code.

Reverify source bytes and apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Create a read-only lifecycle plan. No files or pointers are changed.

Apply the exact cached plan with operation-id idempotency and stale-state checks.

Require a one-time confirmed exact preview receipt, then resolve the provider-qualified selector and check the destination without writing files.

Apply the cached exact plan once. All failures are terminal and must not be retried with another mode, provider, downloader, or substitute template.

Inventory either the authoritative Library (excluding rebuildable indexes/runtime locks) or one exact reachable Published Release. Produces a directory-bundle plan and writes nothing.

Reverify the exact source inventory and visible expectedTarget, write a new directory bundle without overwrite, and persist an idempotent export receipt. A durable pre-write intent can recover a completed target after server restart.

Verify a full backup directory. Restore preserves libraryId and requires explicit authority transfer; Fork creates a new libraryId with fork provenance.

Restore/fork into an absent target, verify every byte, and write an immutable operation receipt. It never changes the active locator automatically.

Verify an exact Published-template bundle, copy its immutable assets into a new local candidate, and plan a Working Revision. Source approval is provenance only and is never inherited.

Reverify the exact bundle and apply only the planned Working Revision. Local review and publish remain mandatory.

Read-only check of the official gh login and central repository permissions. SFL never reads or prints the token.

Return a terminal command for the user to run. This tool never launches a browser or login process.

Read-only Archive or Catalog PR Plan. Archive uses one sanitized submission; Catalog requires a manually merged Archive PR and re-verifies its fixed merge commit and ZIP.

Re-check the gh account, permissions, source, merge gate, base, and file identities; then create a branch/commit/PR through Git Data API. Never merges the PR.

Resolve one exact reachable Local Published Release and show every included/excluded asset, rights declaration, public metadata conflict, render trace, and target without writing files.

Revalidate the exact Local Published Release and selected asset bytes, then atomically create one deterministic sanitized submission at a new target. This call never uses the network, signs content, or creates a PR.

Read the configured personal provider sources and their last-known-good snapshot identities without making any network request. The raw trusted public key is never returned.

Plan Add, Update, Configure, Remove, or explicit Trust Reset for a signed personal provider. Network access occurs only when the requested action must verify a snapshot. Planning never writes configuration or snapshots.

Apply the exact cached provider-source plan with stale-state checks and operation-id replay protection. Apply never accepts a raw public key or endpoint override.