diff --git a/content/agents/claude-code.mdx b/content/agents/claude-code.mdx index eed3bd12..3bfe2987 100644 --- a/content/agents/claude-code.mdx +++ b/content/agents/claude-code.mdx @@ -76,7 +76,7 @@ The live URL is appended only when it starts with `https://`. If the file is mis ## Verify it works -Ask the agent to find a documentation page through `execute`. It should search for the documentation operation, describe it, and call it before attempting a publish. +Ask the agent to search the docs. It should call the `searchDocs` tool directly, which proves the operation tools are wired up before you publish. Use the Spacefast MCP server to search the docs for custom domains. @@ -116,4 +116,4 @@ How much traffic did this Space get in the last 30 days? Roll this Space back to the previous version. -The first five map to typed tools. The rollback goes through `execute`, which may pause and ask you to approve the write in the browser before it runs. See [approvals](/agents/mcp-server). +Each one maps to a tool. The rollback calls the `promoteSpaceVersion` operation, which may pause and ask you to approve the write before it runs. See [approvals](/agents/mcp-server#approvals). diff --git a/content/agents/codex.mdx b/content/agents/codex.mdx index b04759c9..ddb0d34b 100644 --- a/content/agents/codex.mdx +++ b/content/agents/codex.mdx @@ -81,7 +81,7 @@ args = ["mcp", "proxy"] Use the Spacefast MCP server to search the docs for anonymous publishing. -Ask the agent to find a documentation page through `execute`. It should search for the documentation operation, describe it, and call it before attempting a publish. +Ask the agent to search the docs. It should call the `searchDocs` tool directly, which proves the operation tools are wired up before you publish. Publish this folder to Spacefast and give me the live URL. @@ -105,4 +105,4 @@ Show DNS and TLS status for every domain on this Space. Make this Space public and confirm the access setting afterwards. -The last one goes through `execute`, which can pause for your approval before the write lands. +The last one changes access, so it can pause for your approval before the write lands. See [approvals](/agents/mcp-server#approvals). diff --git a/content/agents/cursor.mdx b/content/agents/cursor.mdx index 0089366b..ee918999 100644 --- a/content/agents/cursor.mdx +++ b/content/agents/cursor.mdx @@ -3,7 +3,7 @@ title: Cursor description: Install the Spacefast plugin in Cursor, or add the MCP server to mcp.json by hand --- -The Spacefast plugin lets Cursor publish your project and call API operations through `execute`, within the permissions you approved. Some actions remain reserved for a signed-in person. +The Spacefast plugin lets Cursor publish your project and call every API operation as its own tool, within the permissions you approved. Some actions remain reserved for a signed-in person. ## Install @@ -74,7 +74,7 @@ Writing this file by hand or through the CLI keeps every other top-level key int Use the Spacefast MCP server to search the docs for version rollback. -Ask the agent to find a documentation page through `execute`. It should search for the documentation operation, describe it, and call it before attempting a publish. +Ask the agent to search the docs. It should call the `searchDocs` tool directly, which proves the operation tools are wired up before you publish. Publish this project to Spacefast and give me the live URL. diff --git a/content/agents/index.mdx b/content/agents/index.mdx index cb220d06..015956a9 100644 --- a/content/agents/index.mdx +++ b/content/agents/index.mdx @@ -7,15 +7,16 @@ Connect your coding agent to Spacefast once, then ask it to publish. This page c ## What an agent can do -Anything you can do in the dashboard, an agent can do over MCP. The Spacefast MCP server exposes five tools. +The MCP catalog exposes eligible API operations as individual tools. Each tool uses its operation ID: `getAccount`, `listSpaces`, `searchDocs`, `createDomain`, and a few hundred more. Clients that support tool search load them on demand. + +A handful of tools sit on top of that catalog. - `publish` uploads a folder, a file, an archive, or inline files and returns the live URL and the immutable version URL. - `operation_status` checks a publish that is still running. -- `show_space` opens a read-only view of deployments, domains, analytics, source files, changes, history, comparisons, or build logs. -- `execute` runs one JavaScript program against the Spacefast API catalog. Use it for documentation, account information, API reads without a visual view, and mutations. -- `resume_execution` continues the same program after it pauses for your approval. +- The `show_space_*` tools open a visual view of a Space: its preview, deployments, domains, analytics, comments, source, build logs, or database. +- `resume_execution` continues a call that paused for your approval. -Inside `execute`, search for an operation with `tools.search`, read its contract with `tools.describe`, then call it. Check each write with a read before reporting success. +Check each write with a read before reporting success. If your team has a saved [Design System](/design-system), your agent can read its standards and files while working on a project. Ask it to apply the system to a new build or bring an existing project into line with the current rules. @@ -31,7 +32,7 @@ Show me the deployments for this Space and whether the last build passed. Point docs.example.com at this Space and tell me which DNS records to add. -Read [the MCP server page](/agents/mcp-server) for the tool schemas, the sandbox contract, and the approval model. +Read [the MCP server page](/agents/mcp-server) for the full tool list, the scopes, and the approval model. ## Three ways to connect diff --git a/content/agents/mcp-server.mdx b/content/agents/mcp-server.mdx index 6b81fefa..06458912 100644 --- a/content/agents/mcp-server.mdx +++ b/content/agents/mcp-server.mdx @@ -1,6 +1,6 @@ --- title: MCP server -description: Connect to the Spacefast MCP server over hosted HTTP or local stdio, and use its five tools, execute sandbox, and approval model +description: Connect to the Spacefast MCP server over hosted HTTP or local stdio, call any API operation as a tool, and approve sensitive writes --- The hosted MCP server uses OAuth and accepts inline files. The local server uses your CLI login or `SPACEFAST_TOKEN` and can publish files from your workspace. @@ -9,15 +9,15 @@ The hosted MCP server uses OAuth and accepts inline files. The local server uses You don't need this page. It's the technical reference for wiring up the MCP server by hand — see [Claude Desktop](/agents/claude-desktop) or [Claude Code](/agents/claude-code) for the point-and-click setup instead. ::: -## Two runtimes, one tool set +## Two runtimes, one tool catalog -The same server ships in two runtimes. Both register the same five tools. The difference is the filesystem. +The same server ships in two runtimes. Both expose each eligible Spacefast API operation as its own tool. The difference is the filesystem. | | Hosted | Local | |---|---|---| | Transport | Streamable HTTP | stdio | | Endpoint or command | `https://mcp.spacefast.com` | `sf mcp`, or `npx -y spacefast mcp` | -| Filesystem | None. `publish` requires inline `files` | Reads your workspace. `publish` takes a `path` or publishes the current workspace | +| Filesystem | None. `publish` takes inline `files` or a completed `uploadId` | Reads your workspace. `publish` also takes a `path` or publishes the current workspace | | Auth | OAuth, per client | Your CLI login, or `SPACEFAST_TOKEN` | | Where it runs | Spacefast | Your machine | @@ -39,24 +39,21 @@ By default a client asks for these scopes. |---|---| | `teams:read` | Read the teams the account belongs to | | `teams:create` | Create teams | +| `teams:members.write` | Invite people to teams the account can administer | +| `sell:write` | Set up Sell, enable live sales, resend downloads, and mark orders shipped | | `spaces:read` | Read spaces, versions, and build status | | `spaces:write` | Create and update spaces and their settings | | `spaces:rename` | Rename space slugs and managed addresses | +| `spaces:access.write` | Change who can open a site, including making it public | +| `versions:download` | Read files from deployment versions | | `publish:write` | Publish new immutable versions | -| `domains:read` | Read domain inventory and DNS diagnostics | -| `domains:write` | Attach, verify, and mutate domains and DNS records | +| `domains:read` | Read Space hostnames and certificate status, plus registrations and DNS records when enabled | +| `domains:write` | Manage Space hostnames, plus buying domains and managing DNS records when enabled | | `offline_access` | Refresh access without another sign-in | -Each tool declares the scopes it needs, and clients can read them from `tools/list` before calling. +`spaces:delete` is the one scope left out of the default. Add it to the request, or approve it when an agent asks to delete a Space. -| Tool | Required scopes | -|---|---| -| `publish` | `publish:write` | -| `operation_status` | `spaces:read` | -| `show_space` | The scopes required by the selected view | -| `execute`, `resume_execution` | The called API operation checks the credential's scopes | - -A scope shortfall applies to the requested operation. A credential that can read analytics may still lack access to domains. +Each tool declares the scopes it needs in `tools/list`, under `_meta["spacefast/requiredScopes"]`. An operation tool takes its scopes from the API operation it calls, and the API checks them again on every call. When a call needs a scope your grant lacks, a client that supports MCP step-up authorization asks you to approve it and retries. The hosted server mints a delegation token for each authenticated request instead of handing your client a Spacefast API token. That delegation token lives five minutes and carries the source credential's policy verbatim, so a leaked MCP session can't be replayed against the wider API. @@ -74,17 +71,33 @@ The local server takes its credential from the process, never from client config ## The tools -| Tool | What it does | Key inputs | Returns | -|---|---|---|---| -| `publish` | Uploads files and creates an immutable version | `path` or `files`, `spaceId`, `teamId`, `access` | Publish receipt and status | -| `operation_status` | Checks a publish that is still running | `operationId` | Status, progress, diagnostics, `done` | -| `show_space` | Opens a read-only Space view | `request.view`, `request.input` | The selected view and its data | -| `execute` | Runs a JavaScript program against the API catalog | `code` | Program result or a pause for approval | -| `resume_execution` | Continues a paused program | `executionId` and the requested decision fields | The continued program's result | +### Operation tools + +Each API operation exposed through MCP is a tool named by its `operationId`: `getAccount`, `listSpaces`, `searchDocs`, `createDomain`, `promoteSpaceVersion`, and a few hundred more. Its input schema is the operation's own contract, with `path`, `query`, and `body` groups. Its result is the API response. There is nothing to discover at runtime and no program to write: read the schema from `tools/list`, then call the tool. + +That is a big list. Clients that support tool search load the tools they need on demand. A client that loads everything up front still works, just with a larger tool list. + +A few operations stay in the dashboard, such as buying a domain. The `domains:write` scope does not add a domain-purchase MCP tool. A few stay in the CLI and API, such as claiming an anonymous Space with its key. Those have no tool. + +### Product tools + +A handful of tools sit on top of the catalog. + +| Tool | What it does | Key inputs | +|---|---|---| +| `publish` | Uploads files and creates an immutable version | `path`, `files`, or `uploadId`, plus `spaceId`, `teamId`, `access` | +| `operation_status` | Checks a publish that is still running | `url` or `operationId` from the publish result | +| `show_space_*` | Opens a visual view of one Space | `space`, plus the view's own fields | +| `show_domains` | Searches domain names and compares prices | `team`, `query` | +| `choose_space` | Asks you to pick a Space when the target is unclear | `query` | +| `resume_execution` | Continues a call that paused for approval | `executionId` | +| `cli_login` | Signs the `sf` CLI in with this connection's access, when you ask for it | None | + +The local runtime adds `search_connector_tools`, which reaches services your team connected in Spacefast. The hosted runtime adds `import-claude-design-from-url` and `get-design-import-job-status` for Claude Design. -Every result is capped at 24,000 characters across the whole structured value, with an explicit truncation marker when it hits the cap. +Every result is capped at 24,000 characters of text across the whole structured value, with an explicit truncation marker when it hits the cap. Source views have their own byte limits. -Three requests that exercise the typed tools. +Three requests that exercise the tools. Publish this folder to Spacefast and give me the live URL. @@ -104,8 +117,9 @@ Point docs.example.com at this Space and tell me which DNS records to add. | Field | Type | What it does | |---|---|---| -| `path` | string | Local runtime only. One local directory, file, or archive. Omit `path` and `files` to publish the current workspace | -| `files` | array of 1 to 1000 | Inline files. Required on hosted. Each is `{ path, content, encoding }` with `encoding` one of `utf8` or `base64`, default `utf8` | +| `path` | string | Local runtime only. One local directory, file, or archive. Omit `path`, `files`, and `uploadId` to publish the current workspace | +| `files` | array of 1 to 1000 | Inline files. Each is `{ path, content, encoding }` with `encoding` one of `utf8` or `base64`, default `utf8` | +| `uploadId` | string | A completed durable upload from `completeUpload`, for files too big to send inline. Reuse it when retrying | | `spaceId` | string starting `spc_` | Update this Space. Omit to create one, or on local to use the Space linked to this workspace | | `teamId` | string | Destination team id or slug for a new Space. Send one after a `team_required` error | | `access` | `private` or `public` | Initial root access for a Space this publish creates. `private` admits the owning team, `public` also admits anyone on the web. Omit to use the team default. Invalid with `spaceId` | @@ -115,6 +129,8 @@ Point docs.example.com at this Space and tell me which DNS records to add. | `description` | string, up to 2000 | Changelog for this version. It does not change the Space description | | `requestId` | string, 16 to 200 | Idempotency handle. Reuse the same value only when retrying a call that timed out | +Send at most one of `path`, `files`, and `uploadId`. + ```json { "path": "dist", @@ -122,7 +138,7 @@ Point docs.example.com at this Space and tell me which DNS records to add. } ``` -The result carries `status` of `publishing` or `published`, `liveUrl`, `immutableUrl`, and a `receipt` with the Space, the version, and any diagnostics. When `status` is `publishing`, `result.job.poll.operationId` is the handle for `operation_status`. +The result carries `status` of `publishing` or `published`, `liveUrl`, `immutableUrl`, and a `receipt` with the Space, the version, and any diagnostics. When `status` is `publishing`, `result.job.poll` holds the handle for `operation_status`. Archives are recognized by extension: `.zip`, `.tar`, `.tgz`, `.tar.gz`. @@ -130,7 +146,10 @@ Archives are recognized by extension: `.zip`, `.tar`, `.tgz`, `.tar.gz`. | Field | Type | What it does | |---|---|---| -| `operationId` | string, required | Copy `publish.result.job.poll.operationId` | +| `url` | string | Copy `publish.result.job.poll.url`. Prefer it when present | +| `operationId` | string | Copy `publish.result.job.poll.operationId` | + +Send exactly one of the two. ```json { "operationId": "opr_7f2b8c1d4e5a6b7c" } @@ -138,177 +157,72 @@ Archives are recognized by extension: `.zip`, `.tar`, `.tgz`, `.tar.gz`. Poll about every two seconds. Stop when `result.done` is true. Report success only when `result.status` is `succeeded`; the other terminal states are `failed` and `canceled`. -### show_space +### Space views -Choose a view, then provide the input that view requires. Detailed views require a claimed Space. +Each view is its own tool. Pass the Space as an id, slug, hostname, or URL. Detailed views require a claimed Space. -| View | What it shows | +| Tool | What it shows | |---|---| -| `deployments` | Deployment history and build status | -| `domains` | Domains, DNS records, and TLS status | -| `analytics` | Traffic over the selected window | -| `source_files` | Repository files and folders | -| `source_changes` | Pending source workspace changes | -| `source_history` | Repository commits | -| `source_comparison` | Differences between source commits | -| `deployment_comparison` | Differences between published versions | -| `build_logs` | Logs from one build | +| `show_space_preview` | One deployed version, for visual review | +| `show_space_deployments` | Deployment history and build status | +| `show_space_domains` | Domains, DNS records, and TLS status | +| `show_space_analytics` | Traffic over the selected window | +| `show_space_comments` | Comment threads with replies and screenshots | +| `show_space_source_files` | Repository files and folders | +| `show_space_source_changes` | Pending source workspace changes | +| `show_space_source_history` | Repository commits | +| `compare_space_source_versions` | Differences between source commits | +| `compare_space_deployment_versions` | Differences between published versions | +| `show_space_build_logs` | Logs from one build | +| `show_space_database` | The database schema, rows, and table relations | ```json -{ - "request": { - "view": "deployments", - "input": { "space": "docs.example.com" } - } -} +{ "space": "docs.example.com" } ``` -Read the input schema from `tools/list` before selecting another view. `show_space` never changes source, deployments, domains, or settings. Use `execute` for those changes. - -### execute - -| Field | Type | What it does | -|---|---|---| -| `code` | string, required | One complete JavaScript program | - -See the sandbox contract below. +A view never changes anything. Call the matching operation tool for changes. ### Find documentation -Use `execute` to discover the generated documentation operation with `tools.search`. Read its schema with `tools.describe`, then call it with the documentation query. The documentation API supports ranked search, an exact page slug, and listing pages with an empty query. +Call `searchDocs` with your query, then `getDocsPage` with a result's slug for the full page. `listDocs` lists every page. For an error, open the problem document's `type` URL to read the matching error page. -### resume_execution - -The input depends on where the approval decision is made. +## Approvals -In browser mode, which is what the hosted server uses, the model cannot decide for you. +A sensitive write can pause before its HTTP request goes out. -| Field | Type | What it does | -|---|---|---| -| `executionId` | string, required | The id from the paused `execute` result | + + + The tool returns `status: "user_approval_required"` with an `executionId`, and either an `approvalUrl` or an approval card in clients that render MCP Apps. + + + The card or the approvals page in the dashboard shows the exact action the agent wants to run. Approve or decline it. + + + The agent calls `resume_execution` with the same `executionId`. If you have not decided yet, it gets `user_approval_required` again. Once you decide, the saved call runs exactly once. + + -```json -{ "executionId": "exe_9c3f1b7a20d4" } -``` +A pause waits up to 24 hours for a decision, so you can step away. The agent must reuse the `executionId`; calling the original tool again starts a separate request instead of resuming this one. -In model mode, which stdio connections use by default, the client supplies the decision. +On the local runtime there is no browser step. The agent relays your decision itself. | Field | Type | What it does | |---|---|---| -| `executionId` | string, required | The id from the paused `execute` result | -| `action` | `accept`, `decline`, or `cancel` | The decision | +| `executionId` | string, required | The id from the paused result | +| `action` | `accept`, `decline`, or `cancel` | Your decision. Local runtime only | | `content` | string, default `"{}"` | JSON-encoded form response. Leave the default when the pause has no form fields | -## The execute sandbox - -`execute` runs your program in QuickJS inside a worker. The whole Spacefast OpenAPI catalog is mounted as a lazy `tools` proxy, so every API operation is reachable without an allowlist. - -| Limit | Value | -|---|---| -| Runtime | 30 seconds | -| Memory | 64 MiB | -| Stack | 1 MiB | -| Network | No `fetch`. Only `tools.*` | - -Three things exist in the program. - -- `tools.search({ query, limit })` returns `{ items, hasMore, nextOffset }`. -- `tools.describe.tool({ path })` returns the operation's shape, including `inputTypeScript`. -- `tools[item.path](input)` calls the operation. Input groups are `path`, `query`, and `body`. - -Every call returns `{ ok: true, data, http }` or `{ ok: false, error }`. Check `ok`. A successful call puts the HTTP body in `result.data`, never in `result.result`. Return one compact value at the end; returning the search page or the schema wastes the result budget. - -`emit` delivers user-visible content and files. A Space file is delivered by emitting its minted link as `{ type: "resource_link", uri, name }`. Returning the link object does not deliver the file. - -Do not enumerate or spread `tools`, and do not use `fetch`. Credentials, scopes, and approvals are applied by `tools.*`, not by you. - -Cancelling a runaway program terminates the worker, not the session. The connection stays usable. - -### Find the Space, then publish to it - -`execute` is not the publish path. Use it to resolve which Space you want, then call `publish` with the id. - -```js -const page = await tools.search({ query: "list spaces", limit: 10 }); -const match = page.items.find((item) => item.path.endsWith(".spaces.listSpaces")); -if (!match) return { error: "No matching list-spaces operation." }; - -const shape = await tools.describe.tool({ path: match.path }); -if (shape.error) return { error: shape.error }; - -const result = await tools[match.path]({}); -if (!result.ok) return { error: result.error }; - -const spaces = result.data?.data ?? result.data; -return spaces.map((space) => ({ id: space.id, slug: space.slug })); -``` - -Then, with the id in hand: - ```json -{ "spaceId": "spc_4a91c0de2f3b", "path": "dist" } -``` - -### Add a domain, then watch it - -One program creates the domain and binds it to the Space. Use `show_space` with the `domains` view to inspect DNS and TLS afterward. - -```js -const found = await tools.search({ query: "create domain for space", limit: 10 }); -const create = found.items.find((item) => item.path.endsWith(".domains.createDomain")); -if (!create) return { error: "No matching create-domain operation." }; - -const shape = await tools.describe.tool({ path: create.path }); -if (shape.error) return { error: shape.error }; - -const added = await tools[create.path]({ - body: { name: "docs.example.com", teamId: "tm_2b7d40a9" }, -}); -if (!added.ok) return { error: added.error }; -const domain = added.data?.data ?? added.data; - -const page = await tools.search({ query: "assign domain to space", limit: 10 }); -const bind = page.items.find((item) => item.path.endsWith(".domains.updateDomain")); -if (!bind) return { error: "No matching update-domain operation." }; - -const bound = await tools[bind.path]({ - path: { domainId: domain.id }, - body: { spaceId: "spc_4a91c0de2f3b", primary: true }, -}); -return bound.ok ? { domainId: domain.id, name: domain.name } : { error: bound.error }; -``` - -Then watch the DNS and TLS state with a read tool until it settles. - -```json -{ "space": "spc_4a91c0de2f3b" } +{ "executionId": "exe_9c3f1b7a20d4" } ``` -## Approvals - -A write inside an `execute` program can pause before its HTTP request goes out. - - - - `execute` returns `status: "user_approval_required"` with an `executionId`, an `approvalUrl`, and a `resumePrompt`. - - - The `approvalUrl` opens the approvals page in the dashboard, which shows the exact action the program wants to run. Accept, decline, or cancel. - - - The agent calls `resume_execution` with the same `executionId`. That call blocks until your decision lands, then the saved program continues from where it stopped. - - - -You have four minutes to decide. The agent must reuse the `executionId`; starting a second `execute` call throws away the pause. - Choosing "always allow" is deliberately narrow. Only a plain confirmation gate, a pause with nothing to fill in, can be auto-approved later. A pause that asks you to open a URL, or one that wants form content, always comes back to you. -If the request changes between the pause and your decision, the resume fails with "This approval no longer matches the request. Run execute again." +If the request changes between the pause and your decision, the resume fails and nothing runs. Make the call again. -Tools also declare how risky they are, and clients use that to decide what to confirm on their own. `publish`, `execute`, and `resume_execution` are marked destructive. `operation_status` and `show_space` are marked read-only. +Tools also declare how risky they are, and clients use that to decide what to confirm on their own. Read operations are marked read-only. Writes, `publish`, and `resume_execution` are marked destructive. ## Local file access diff --git a/content/agents/other-clients.mdx b/content/agents/other-clients.mdx index 7d26422e..290bcdb7 100644 --- a/content/agents/other-clients.mdx +++ b/content/agents/other-clients.mdx @@ -61,7 +61,7 @@ MCP configuration varies by client: `mcp` for OpenCode, `servers` for VS Code, a Amp puts the server map at the top level with no root key. Use `sf setup agent` for a [supported client](/cli/agents#sf-mcp-install); otherwise adapt the transport example to your client's configuration format. -Ask the agent to find a documentation page through `execute`. It should search for the documentation operation, describe it, and call it before attempting a publish. +Ask the agent to search the docs. It should call the `searchDocs` tool directly, which proves the operation tools are wired up before you publish. Use the Spacefast MCP server to search the docs for custom domains. diff --git a/content/agents/skills.mdx b/content/agents/skills.mdx index e239c779..f1b23205 100644 --- a/content/agents/skills.mdx +++ b/content/agents/skills.mdx @@ -40,10 +40,10 @@ The trigger line is the frontmatter `description`. Your client matches it agains -The MCP variant routes publishing, inspection, and management requests to the current tools. +The MCP variant triggers on building, publishing, and changing Spaces, sharing, domains, and team standards. ```text -Use publish for local files or a new inline artifact, operation_status for an active publish, and show_space for read-only views. Use execute for documentation, API reads, and mutations. Use resume_execution to continue a paused program. +Build and publish websites, edit existing Spaces, manage sharing and domains, and apply saved team standards with Spacefast. Use the installed task skill for the requested workflow. ``` @@ -87,14 +87,14 @@ The skill's job is routing and conduct. The MCP variant follows these tool choic | Job | Tool | |---|---| | Publish local files or a new inline artifact | `publish` | -| View deployments, domains, analytics, source, or build logs | `show_space` | +| See a Space's preview, deployments, domains, analytics, comments, source, build logs, or database | The matching `show_space_*` tool | | Check an active publish | `operation_status` | -| Documentation, account context, other API reads, and mutations | `execute` | +| Documentation, account context, other API reads, and mutations | The operation's own tool, such as `searchDocs` or `promoteSpaceVersion` | | Continue an approval | `resume_execution` | The rest sets behavior the tools alone do not enforce. -- Call the matching tool first. Inside `execute`, search for and describe each operation before calling it. +- Call the matching tool first. Read an operation tool's input schema before calling it. - Reuse the `.spacefast/` link in the current directory. Do not list Spaces before an ordinary publish, and set `createNew` only when you asked for a separate Space. - Publish once, then poll `operation_status` until it settles, then read the deployment, then report. - Report the live URL and the immutable version URL, plus the access URL when the receipt includes one. Current clients create team-owned Spaces without automatic access URLs: the owning team signs in at the live URL, and `sf share link create` makes a link for people outside the team. For an anonymous publish, state the claim expiry and point at the claim action rather than copying the credential into the transcript. @@ -105,7 +105,7 @@ The rest sets behavior the tools alone do not enforce. ## Kept in sync with the tools -A CI check re-renders every skill variant and compares the tool names it mentions against the live tool list, in both directions. A tool added without a skill update fails the build, and so does a skill that names a tool which no longer exists. The base skill names exactly the five tools the server registers. +A CI check renders every skill variant and checks each tool it names against the tools the server registers. A skill that names a tool which no longer exists fails the build. ## Install the base skill on its own diff --git a/content/cli/agents.mdx b/content/cli/agents.mdx index a3fe85c0..f1cba946 100644 --- a/content/cli/agents.mdx +++ b/content/cli/agents.mdx @@ -31,7 +31,7 @@ That detects your agent clients, installs the Spacefast skill, and writes MCP co Pick `--local` instead when you want the MCP server to publish files from your working directory. Pick `--remote --oauth` when you want the editor to own the credential rather than the CLI. -For the tool list, scopes, the `execute` sandbox, and the approval model, see [the MCP server](/agents/mcp-server). For the long form of the setup flow, including what each client gets written where, see [sf setup agent](/agents/sf-setup). +For the tool list, scopes, and the approval model, see [the MCP server](/agents/mcp-server). For the long form of the setup flow, including what each client gets written where, see [sf setup agent](/agents/sf-setup). ## sf mcp install diff --git a/evals.yaml b/evals.yaml index 96005bbc..6c1a3c1b 100644 --- a/evals.yaml +++ b/evals.yaml @@ -48,9 +48,9 @@ questions: question: What is the URL of the hosted Spacefast MCP server? expected: ["https://mcp.spacefast.com"] routes: /agents/mcp-server - - id: execute-limits - question: What are the limits of the MCP execute sandbox? - expected: ["30 seconds", "64 MiB", "no fetch"] + - id: mcp-approval-resume + question: How long can an MCP operation wait for approval, and how does the agent continue the saved call? + expected: ["24 hours", "resume_execution", "same executionId"] routes: /agents/mcp-server - id: team-roles question: Which team roles exist?