Server providing Argo CD integration for MCP clients.
Nothing to run from here
Mandala Computer is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
90/100
trust score
27
downloads a day
local
or remote
2k
downloads in 30d
What it does
Cloud desktops for AI agents: create a Linux computer, see its screen, click, type and run tasks.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user mandala-computer-mcp '--' npx -y mandala-computer-mcp
# 2 — ask your agent for something these tools do
# list_templates, list_sizes, list_computers and 113 more
Mandala Computer costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
MAAll 1 server
mandalacomputer1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one can run either way — at an address its publisher runs, or as a process under your own user, with your files and your network — and this marketplace is in the path of neither.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user mandala-computer-mcp '--' npx -y mandala-computer-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Or connect to its publisher’s address
Its publisher also runs it at https://app.mandala.computer/mcp: nothing to start on your machine, and this marketplace is not in the path.
claude mcp add --scope user --transport http mandala-computer-mcp https://app.mandala.computer/mcpFree on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it asks of you
Nothing is required, but it can take MANDALA_API_KEY (API key from Settings → API keys. Optional after `mandala login`, which saves one.), MANDALA_MODEL_KEY (Your model provider key. Optional; turns on run_agent.) if you want to set them.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
116 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
The base images a computer can be created from — name, OS, the default CPU and RAM each one implies, and its minimum disk (a smaller disk_gb is raised to it and charged at it). For the templates the platform publishes, name is what a create takes as template; for one you published yourself,…
No parameter schema on file.
The named sizes a computer can be launched at — each a template plus a CPU/RAM/disk shape. These are the shapes the platform keeps pre-booted, so ${opts.lifecycle ? 'create_computer with a
No parameter schema on file.
Every computer on this account that exists or may exist. Desktop credentials are deliberately not included — use get_desktop_url for those. Read state before acting on a row: it is the platform's record of whether the machine exists, which is a different question from status, what its host…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| allow_partial | boolean | no | — |
| state | string | no | — |
| workspace_id | string | no | — |
Everything the platform knows about one computer: status, size and its recorded screen resolution. Click coordinates are the capture size a screenshot returns, which can differ from the record's resolution.
No parameter schema on file.
Bind a computer to this session, so every later call can leave computer_id out. Answers with its status and screen resolution.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | yes | The id from list_computers. |
| Parameter | Type | Required | Notes |
|---|---|---|---|
| resume_only | boolean | no | — |
| idempotency_key | yes | — |
| Parameter | Type | Required | Notes |
|---|---|---|---|
| force | boolean | no | — |
| idempotency_key | yes | — |
Change a computer's name, its size, its idle window, its browser proxy, or its egress proxy. The platform refuses these in combination on purpose — a resize needs the computer stopped and the others do not, so one request cannot honour both without applying half of it. A SUSPENDED computer counts…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | — |
| cpu | integer | no | Needs the computer stopped. |
| ram_mb | integer | no | Needs the computer stopped. |
| disk_gb | integer | no | Needs the computer stopped. Disks grow only. |
| idle_suspend_min | integer | no | — |
| browser_proxy | object | no | — |
| egress_proxy | object | no | — |
| idempotency_key | yes | — |
Change which workspace a computer belongs to, within the same account. This changes who can access it. Requires an account-wide member or owner credential; workspace-scoped credentials are refused, even for a no-op. Supply computer_id explicitly and workspace_id as a wsp- ID, or null to make it…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | yes | The explicit computer ID to move. |
| workspace_id | string | yes | Destination workspace ID, or explicit null for unassigned. |
Grow a computer past what its current host can run, by moving it to another host in the same region first. Only call this after update_computer has refused a resize and said a move is possible: it is the second half of that refusal and nothing else. THIS MOVES THE MACHINE TO DIFFERENT HARDWARE and…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| ram_mb | integer | yes | The size that did not fit. Must be MORE than the computer has now. |
| cpu | integer | no | Applied with the move. Omit to leave alone. |
| disk_gb | integer | no | Applied with the move, after the copy. Disks grow only. |
| timeout_s | integer | no | — |
| idempotency_key | yes | — |
Every move on this account that this key can see — a key confined to a workspace sees only the moves of computers in that workspace: the ones running and the ones that finished in the last day. Read this after move_computer if the wait ran out, and read it when a move is refused because another…
No parameter schema on file.
What this account has spent: running hours weighted by cores and memory, the storage it holds, and the per-computer breakdown behind the totals — the same figures the billing page shows. Read it before and after a batch of computers to know what one cost, and read it when asked how much anything…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| from | string | no | — |
| to | string | no | — |
Poll until the computer is running, or until the software inside it answers. Use "guest" before exec, files or windows, and before expecting a screenshot to show a desktop rather than a boot screen; on Linux "guest" also waits until the desktop session is logged in, so exec with desktop: true is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| until | string | no | — |
| timeout_s | integer | no | — |
A URL that opens this computer's live desktop in a browser. Watch-only by default. These are credentials in a link: anyone holding one has that desktop until the computer restarts or is moved to another workspace, either of which issues new desktop credentials.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| control | boolean | no | — |
Build a new cloud desktop and select it for this session. Creating and running a computer costs money on this account. Continue an image preparation refusal only as its result instructs, retaining all original create arguments, including template, and adding the returned preparation token as an…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | A label. The platform picks one if you do not. |
| size | string | no | — |
| template | string | no | — |
| template_transfer | string | no | — |
| cpu | integer | no | — |
| ram_mb | integer | no | — |
| disk_gb | integer | no | — |
| resolution | string | no | — |
| start | boolean | no | Boot it immediately. True by default. |
| secrets | yes | — | |
| browser_proxy | object | no | — |
| egress_proxy | object | no | — |
| workspace_id | string | no | — |
| idempotency_key | yes | — |
Copy a computer's current disk to a new computer — the fork half of snapshot-and-fork. The source is untouched and must be stopped or suspended: a running source is refused with 409. The answer arrives as soon as the copy exists, reading status "building" while its disk is copied — wait for that…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | A name for the copy. |
| idempotency_key | yes | — |
Destroy a computer and its disk. Irreversible. Its snapshots are kept by default and become orphans, which can still be cloned but not restored. To destroy those too, read snapshot_holdings first and pass its fingerprint as expect.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | yes | — |
| confirm | boolean | yes | Must be true. This destroys the disk and everything on it. |
| delete_snapshots | boolean | no | — |
| expect | string | no | — |
| idempotency_key | yes | — |
Block until the computer reports something, instead of screenshotting in a loop to find out whether it has. This is the tool that replaces polling: a window opening, a background command exiting, the desktop coming up, the machine going idle or changing power state.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| types | array | no | — |
| pid | integer | no | — |
| timeout_s | integer | no | — |
| since | string | no | — |
| limit | integer | no | — |
Block until something is created, changed or deleted anywhere under a directory in the guest, instead of running ls in a loop to find out whether it has. This is how you wait for a build to write its output, a download to land, or a script to produce a file.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| path | string | yes | — |
| timeout_s | integer | no | — |
| since | string | no | — |
| limit | integer | no | — |
Everything the computer has reported that you have not been handed yet, without waiting. This server holds the event stream open between your turns, so this drains what accumulated while you were doing something else — including while you were running other tools on the same machine. Use it after…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| since | string | no | — |
| limit | integer | no | — |
Run a shell command inside the computer. Runs as root with no display by default — anything that opens a window needs desktop: true, anything slower than a few seconds needs background: true, and anything that needs an environment variable takes env rather than an assignment written into the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| command | string | yes | A shell command line. |
| retain_output | no | — | |
| timeout_s | integer | no | — |
| desktop | boolean | no | — |
| background | boolean | no | — |
| cwd | yes | — | |
| env | object | no | — |
What a backgrounded command has printed since the last time you asked, and whether it has finished. The output is a cursor, not a buffer: each poll gives you only the new bytes, so two readers on one pid split the output between them rather than each seeing all of it. Finishing is also what…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| pid | integer | yes | The positive, safe-integer pid exec returned. |
Kill a backgrounded command and everything it started. Answers with its final state, including whatever it printed that you had not read. Also how you make room when a computer is already running its maximum of sixteen background commands: the slot comes back with the command.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| pid | integer | yes | The positive, safe-integer pid exec returned. |
Put a web page on the screen in the guest's browser: the first of firefox-esr, firefox or chromium the image has (the Debian desktops open firefox-esr, Omarchy opens chromium). An image with none of them is an error, not a silent success. The command returns before the window draws — on a cold…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | — |
The windows the window manager knows about — id, title, class, geometry, focus. A screenshot says what the desktop looks like; this says what any of it is, which is how you tell a browser that failed to open from one that has not painted yet. Match on class, not title: the class is the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| include_all | boolean | no | — |
Focus, raise, minimize, maximize, unmaximize, close, move or resize one window. The reply is the window afterwards, not an acknowledgement — the window manager places the frame and applications snap to their own grid, so a move to 300,200 routinely lands at 305,229. Believe the response, not the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| window_id | string | yes | From list_windows, e.g. "0x2600003". |
| action | string | yes | — |
| x | integer | no | Required for move, with y: -32768 to 32767. |
| y | integer | no | Required for move, with x: -32768 to 32767. |
| width | integer | no | Required for resize, with height: 1 to 32767. |
| height | integer | no | Required for resize, with width: 1 to 32767. |
No parameter schema on file.
Puts text on the computer’s desktop clipboard, ready to paste. This leaves it on the clipboard and touches nothing on screen — follow it with press_key and keys ["ctrl","v"] to get the text into whatever has focus. Those are two separate key NAMES in the array, not one string "ctrl+v", which…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | — |
Write a file inside the computer. Paths must be absolute — the guest agent inherits whatever working directory it was started in, so a relative path resolves somewhere you did not name. By default a file already at the path is replaced. Pass overwrite: false to create the file only if nothing is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| path | yes | — | |
| content | string | yes | The file contents. |
| encoding | string | no | base64 for anything that is not text. |
| overwrite | boolean | no | — |
| no_wake | boolean | no | — |
Read a file from inside the computer. Text comes back as text and images come back as images; anything else comes back base64. A large file comes back a window at a time rather than filling the conversation: offset says where the window starts, and the note under a truncated read gives the exact…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| path | yes | — | |
| offset | integer | no | — |
| no_wake | boolean | no | — |
Every snapshot on this account. orphaned means its computer is gone: such a snapshot can still be cloned into a new computer, but cannot be restored, because a restore puts the disk back on a source that no longer exists. restore_available: false means the only usable copy is on a host its…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Only snapshots of this computer. Omit for the whole account. |
| include_unfinished | boolean | no | — |
| allow_partial | boolean | no | — |
How many snapshots a computer has, what they weigh, and the fingerprint that names that exact set. …
No parameter schema on file.
Capture a computer so it can be restored or forked later. A disk snapshot is the filesystem; a memory snapshot also saves the running session, so a fork of it comes up with the same processes and windows already open. Name it after the step it is about — that name is what picks it out of the list…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | no | — |
| memory | boolean | no | — |
| wait | boolean | no | — |
| timeout_s | integer | no | — |
Put a snapshot back onto the computer it came from, discarding everything on that disk since. Check restore_available in list_snapshots first: where it is false, the snapshot's usable copy is on a host its computer has left, and a restore is refused…. Refused on an orphaned snapshot…. It leaves…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| snapshot_id | string | yes | — |
| confirm | boolean | yes | Must be true. This overwrites the source computer's current disk. |
| idempotency_key | yes | — |
When the platform takes this computer's automatic snapshot. Reading takes no arguments; setting takes an hour. There is deliberately no "last run" here — snapshots carry real capture times, and that is what a freshness check should read. This says when they are TAKEN and not how long they survive:…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| set | object | no | Omit to read the current schedule. Include to replace it. |
| clear | boolean | no | Remove the schedule entirely. |
The plan's retention window — the other half of snapshot_schedule, which says when snapshots are taken and deliberately has no field for how long they survive. Read it before promising anyone that a backup will still be there, and before taking a snapshot you mean to keep. Takes no arguments:…
No parameter schema on file.
Build a new computer from a snapshot, leaving the original untouched. This is the fork half of snapshot-and-fork, and the only thing that works on an orphaned snapshot. A MEMORY snapshot is resumed: the copy comes up running the captured session, and is given its own MAC, address, hostname,…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| snapshot_id | string | yes | — |
| name | string | no | A name for the new computer. |
| memory | boolean | no | — |
| inherit_secrets | boolean | no | — |
| select | boolean | no | Make the new computer this session's selected one. |
| idempotency_key | yes | — |
Remove a snapshot permanently. Later snapshots in the same chain are unaffected. THE DELETION OUTLIVES THE REQUEST that starts it: the platform accepts it and then detaches the dependent snapshots and removes the stored objects, which takes time that scales with the chain and with how much is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| snapshot_id | string | yes | — |
| confirm | boolean | yes | Must be true. |
| wait | boolean | no | — |
| timeout_s | integer | no | — |
A picture of the screen, returned as an image with its capture name and original size when available. Fresh by default; give capture to crop the earlier frame you measured. Full-size capture pixels are the coordinates click, drag and scroll take; cropped or scaled pictures include a mapping. A…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| width | integer | no | — |
| fresh | boolean | no | — |
| capture | string | no | — |
| region | object | no | — |
| scale | number | no | — |
| format | string | no | — |
| quality | integer | no | — |
Click the mouse. Left button once by default. Take a screenshot afterwards to see what happened — the desktop does not report back on its own.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| button | string | no | — |
| count | integer | no | — |
| modifiers | array | no | Keys held down for the duration of the action. |
Type a string into whatever has keyboard focus: literal text, 1 to 400 characters. For Enter, Tab or a shortcut, use press_key. Plain ASCII is typed as US-layout key events, about 12 ms a character, so 400 characters take about five seconds. Text containing any other character — accents, CJK,…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | — |
Put text on the desktop clipboard and press the paste shortcut, as one step: the fast way to insert up to … bytes of UTF-8, including accents, CJK and emoji, into whatever has focus. Linux desktops only; Windows and a guest without working clipboard support are refused. The paste REPLACES the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| text | string | yes | The text to paste: 1 to … bytes of UTF-8, no NUL. |
| shortcut | string | no | — |
Press named keys — "Return", "Tab", "Escape", "Page_Down", or a chord like ["ctrl","c"]. X keysym names, so "Return" rather than "Enter".
| Parameter | Type | Required | Notes |
|---|---|---|---|
| keys | array | yes | One key, or several for a chord pressed together. |
| hold_seconds | number | no | Hold the keys down this long instead of tapping them. Capped at 30s. |
Turn the wheel. With no coordinate it scrolls whatever is under the pointer; with one it scrolls what is at that point.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| direction | string | yes | — |
| amount | integer | no | Wheel clicks. |
| modifiers | array | no | Keys held down for the duration of the action. |
Press, move and release as one gesture — for selecting text, moving a file, or dragging a slider. Not the same as two clicks. modifiers holds keys down for the whole gesture, e.g. ["shift"] to extend a selection.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| to_x | integer | yes | — |
| to_y | integer | yes | — |
| from_x | integer | no | — |
| from_y | integer | no | — |
| modifiers | array | no | Keys held down for the duration of the action. |
Move the pointer without clicking — for hovering over a menu or a tooltip.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| x | integer | yes | — |
| y | integer | yes | — |
The two halves of a click, for gestures drag cannot express — a lasso across several stops, or a press held while the keyboard is used.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| state | string | yes | — |
Where the pointer was last put. known is false on a computer nothing has moved it on yet — the guest cannot be asked, so there is no coordinate to report and a confident 0,0 would be a wrong answer dressed as a right one. This reads a coordinate but reaches the computer to do it: a suspended one…
No parameter schema on file.
Pause before looking again — for a page that is still painting or an application that is still starting. Capped at 30 seconds, because a wait here is a held HTTP request and a longer one would not return, it would fail.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| seconds | number | no | — |
The JSON Schema for a mandala/v1 template document — the declarative form a template is written in. Read this before writing one: it describes the ref, the image family, what the template is layered onto, and the shape a computer gets when a create names no numbers.
No parameter schema on file.
Check a document against the SCHEMA, without publishing it. Nothing is stored and no ref is claimed, so this is safe on a draft and safe to call repeatedly, and every problem comes back at once. Always check before publishing: a ref is immutable, so a document published with a mistake in it cannot…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document | string | yes | The document itself, as JSON or YAML — the file contents, not a wrapper. |
Store a document under a ref of your own, so … can launch it by name.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document | string | yes | The document itself, as JSON or YAML — the file contents, not a wrapper. |
One template as the document it was written as — the lineage, the build steps and the digest, which list_templates drops. Works for your own namespace and for system, so you can read what you are layering onto before writing a document of your own. Without version this is the newest, which is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| version | string | no | — |
Stop a template resolving, and give its row back against your ceiling. WITHOUT version THIS RETIRES EVERY VERSION OF THE NAME — that is what retiring a template means here, and it is deliberately not get_template's "the newest". Pass version to take exactly one. THIS CANNOT BE UNDONE: a…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| version | string | no | — |
| confirm | boolean | yes | — |
Compile a document that declares spec.build steps into a golden image. Returns IMMEDIATELY with a job — a build takes minutes, an agent image roughly fifteen — and watch_build is how you follow it. THE NAMESPACE AND THE FAMILY BOTH HAVE TO BE YOURS: spec.family is what the image is called on a…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document | string | yes | The document itself, as JSON or YAML — the file contents, not a wrapper. |
| no_reuse | boolean | no | — |
Every build this account has started that the fleet still holds a record of, newest first. A build lives on the hypervisor that ran it, so this asks all of them — and WITHOUT allow_partial, one that cannot be reached makes the platform refuse rather than answer short, so an empty or small list is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| allow_partial | boolean | no | — |
What became of one build, which template it was for, and which step it is on. Reads once and returns; watch_build is what follows a running one. It stays readable after the build has finished, so this is also how you find out which step failed on a build nobody was watching. Needs an account-wide…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| build_id | string | yes | The id build_template returned. |
Follow a build to its end and report what happened. Streams the platform's own progress — each event is sent only when something actually moved — and logs each one as it arrives, so a long build is visibly alive rather than indistinguishable from a hang. A build that FAILED is a normal answer…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| build_id | string | yes | The id build_template returned. |
Who the API key this server runs with belongs to: the person (id, email, name), the account it acts on (id, name, plan, status: active or suspended), the role it acts with now (owner, member or viewer), the workspace it is confined to (null for the whole account), and the key itself (id, name,…
No parameter schema on file.
The API keys of the person this server's key belongs to, on the account it acts on, newest first: id, name, prefix (display only), scope, when last used, manage_keys, and minted_by_key_id: the key that minted this one (null for a key minted from the dashboard); revoking a key does not revoke the…
No parameter schema on file.
The account's workspaces, oldest first: id, name and created_at. A workspace partitions the account's computers: a key confined to one reaches that workspace's computers only, and a computer's workspace_id names the one it is in. A key confined to a workspace lists only that one. create_workspace,…
No parameter schema on file.
One workspace: id, name and created_at. An id this key cannot see is not found, the same as one that does not exist — another account's, any workspace but its own for a key confined to one, and a deleted workspace a computer's workspace_id can still name.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| workspace_id | string | yes | The workspace id (wsp-…), from list_workspaces or a computer's workspace_id. |
The people who reach a workspace, oldest member first: user_id, email, name (null when unset), role, accepted_at, suspended (a sign-in suspension: they cannot sign in anywhere) and seat_suspended (true while they wait for a seat on this account and cannot act on it; it returns to false when their…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| workspace_id | string | yes | The workspace id (wsp-…), from list_workspaces or a computer's workspace_id. |
Make a workspace on this account: a partition of its computers, which API keys can be confined to. Answers its id, name and created_at. A name the account already uses, a blank or over-long one, or an account already holding 500 workspaces is refused with 400. Needs an owner's key that is not…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
Rename a workspace. Its id does not change, so the API keys confined to it and the computers in it are untouched. The name follows create_workspace's rules; a name the account already uses is refused with 400, and an id this key cannot see is not found. Needs an owner's key that is not confined to…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| workspace_id | string | yes | The workspace id (wsp-…), from list_workspaces or a computer's workspace_id. |
| name | string | yes | — |
Permanently delete a workspace. It REVOKES every API key confined to it, whoever holds it, in the same step: anything using one of those keys — a person's CI, another agent — is refused from its next request, and this cannot be undone. The answer says how many were revoked. Only an empty workspace…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| workspace_id | string | yes | The workspace id (wsp-…), from list_workspaces or a computer's workspace_id. |
| confirm | boolean | yes | Must be true. Every API key confined to this workspace is revoked with it. |
Read account-wide plan ceilings, per-computer maxima, current consumption and advisory remaining quota. Viewer or stronger; workspace-scoped keys receive aggregates without resource identities. No arguments, selected computer or model key. Incomplete computer/snapshot groups have null consumption…
No parameter schema on file.
Give the computer a task in plain language and let the platform drive it — screenshot, decide, click, type, repeat — until it is done. Runs on the Anthropic or OpenAI key this server was configured with, and bills that key for every step. Use it to delegate a long stretch of pixel work; drive with…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Which computer. Defaults to the one selected with use_computer. |
| prompt | string | yes | The task, in plain language. |
| system | string | no | Standing instructions carried into the run. |
| provider | string | no | — |
| model | string | no | — |
| max_steps | yes | — |
The public URLs of one computer, oldest first: each is https://<label>.<base_domain> serving a port inside the computer, public (anyone with the link) or private (an API key of this account). Also says whether they can answer here at all — enabled is false, with a reason, where public URLs are…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Which computer. Defaults to the one selected with use_computer. |
Serve a port inside the computer at https://<label>.<base_domain> (e.g. https://brave-otter-3f2a.mandala.dev), on 443 with no port in the address. PUBLIC BY DEFAULT: anyone on the internet with the link can open it — pass access: "private" to require an API key of this account instead. The app…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| port | yes | — | |
| label | string | no | — |
| access | yes | — |
Point a public URL at another port, switch it between public and private, or both. The label is the URL and does not change — delete it and create another for a new name. Fields you leave out are kept; name at least one.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| port | yes | — | |
| access | yes | — |
The URL stops answering at once. Its label stays with this account: no other account can ever take it, and this account may use it again (create_public_url with that label) unless the platform has blocked it. The app inside the computer keeps running. A URL made again is a new id.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| confirm | boolean | yes | Must be true. The URL stops answering at once. |
Which of the account's secrets a computer is bound to: for each, the secret id, the revision last delivered, and where the guest finds it — an environment variable name, or a file under /run/mandala-secrets/user/files. Values are NEVER shown — no value crosses this route. Also answers version,…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Which computer. Defaults to the one selected with use_computer. |
Replace the WHOLE list of secrets a computer is bound to — not a merge: any binding left out is removed, and secrets: [] removes every binding. Each entry names a secret id and exactly one of env (the environment variable it is delivered under) or file (delivered as…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| secrets | yes | — | |
| version | integer | no | — |
The secrets stored on this account, in one scope: the account-wide ones by default, or one workspace's with workspace_id. For each: its name, its id (what set_computer_secrets binds), its current revision_id (what replace_secret and delete_secret need), its scope and when it was last delivered to…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| workspace_id | yes | — |
One secret's name, scope, current revision_id and when it was last delivered — never its value. Read it for the current revision_id after replace_secret or delete_secret is refused because the revision moved. A secret in a workspace is found only with its workspace_id; otherwise it is not found.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| secret_id | yes | — | |
| workspace_id | yes | — |
Store a value under a name on this account, encrypted, for binding to computers with set_computer_secrets (or the secrets field of a create). The value is sent once and NEVER shown again: this answer, every other tool and every route give back only the name, id and revision. Do not put the value…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| value | yes | — | |
| workspace_id | yes | — |
Make a name hold a value: create the secret if the scope has no secret by that name, or replace its value if it has — the one to reach for when either will do. It reads the scope first and replaces against the revision it read; names match ignoring ASCII case, as the platform keeps them unique. If…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| name | string | yes | — |
| value | yes | — | |
| workspace_id | yes | — |
Replace a stored secret's value, and move its revision_id. Send the revision_id list_secrets or get_secret answered: if it has moved since, this is refused with 409 and nothing changed — read it again, and replace again only if you still mean to. The new value is NEVER shown back. Owners only.…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| secret_id | yes | — | |
| value | yes | — | |
| revision_id | yes | — | |
| workspace_id | yes | — |
Permanently delete a stored secret. This cannot be undone, and it is NOT refused while computers are bound to it: such a computer keeps the value it already holds, but can never be given its secrets again — its next start is refused (409), a restart or a reboot inside it stops it, and a suspended…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| secret_id | yes | — | |
| revision_id | yes | — | |
| workspace_id | yes | — | |
| confirm | boolean | yes | — |
Every webhook subscription on the account, with its health: whether it is enabled, when its endpoint last accepted a delivery and when one last failed. A webhook is an HTTPS endpoint the platform POSTs events to — the other transport for the same events wait_for_event reads, for a CI job or a…
No parameter schema on file.
Subscribe an HTTPS endpoint to this account’s events. THE ANSWER CARRIES THE SIGNING SECRET ONCE — it is not readable again, so store it or hand it over before doing anything else. Each event is POSTed as the same JSON object wait_for_event hands you, byte for byte, signed with Standard Webhooks…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | yes | — |
One subscription with its health: whether it is enabled and why not if not, when the endpoint last accepted a delivery, when one last failed, and the status of the newest attempt. Never the secret. For the individual deliveries and what became of each, list_webhook_deliveries.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| webhook_id | string | yes | The subscription id — whk- and sixteen hex characters. |
Change the endpoint, the description, the filters, or whether it is enabled. Fields you leave out are kept as they are; name at least one. A new url is checked exactly as on create. enabled: true clears a disable the platform imposed for failures and starts fresh; enabled: false stops deliveries…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| url | string | no | — |
Mint a new signing secret for a subscription. THE ANSWER CARRIES IT ONCE, like create_webhook. The old secret goes on being honoured for 24 hours — every delivery in that window carries two signatures on the one webhook-signature header, new first, so a receiver that accepts either passes…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| webhook_id | string | yes | The subscription id — whk- and sixteen hex characters. |
Queue one signed delivery of a synthetic webhook.test event through the ordinary path, so it is signed, retried and recorded exactly as a real one. The answer is the delivery record, ACCEPTED rather than finished: the endpoint has not been called yet when this returns. Read what it said back with…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| webhook_id | string | yes | The subscription id — whk- and sixteen hex characters. |
The newest hundred deliveries to one subscription, newest first, each with its state (pending, in_flight, delivered, exhausted or dropped), its attempt count, and the HTTP status or one-line error of its newest attempt. This is where a delivery that ran out of attempts shows up — nothing is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| webhook_id | string | yes | The subscription id — whk- and sixteen hex characters. |
Remove a subscription and every delivery record it holds, pending ones included. Nothing more is sent to the endpoint. Irreversible: a new subscription to the same url gets a new id and a new secret. To stop deliveries without losing the record, update_webhook with enabled: false instead.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| confirm | boolean | yes | Must be true. This removes the subscription and its delivery history. |
Selected, retained, best-effort request history; not all guest work or an agent identity. Accepted background work is not completed execution; a dispatched error may have had effects. Activity IDs identify requests, never idempotency keys. History is newest first with a fixed watermark. Changes…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| cursor | string | no | — |
| changes | boolean | no | — |
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| activity_id | string | yes | — |
Metadata only: at most eight newest links. more has no cursor and does not mean all versions were returned. No content reads, guest files, captures, execution polling or downloads. An unavailable link is not empty content. Caller-selected artifact association does not prove creation or command…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| activity_id | string | yes | — |
Explicitly capture a caller-nominated absolute Linux, Windows drive or UNC file path with expected_size and lowercase expected_sha256 already supplied. One guest file read, no preflight stat/list/hash/exec. Optional execution_id is verified caller-selected association, not proof of authorship.…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| path | string | yes | — |
| expected_size | integer | yes | — |
| expected_sha256 | string | yes | — |
| execution_id | string | no | — |
| max_bytes | integer | no | — |
| retention_seconds | integer | no | — |
Passive finite metadata for one retained artifact. No guest file or execution lookup, resume, capture or fallback.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| artifact_id | string | yes | — |
Read metadata, then only if the complete artifact fits max_bytes (default 4096/max 16384), read the whole immutable object and verify size/SHA-256. Over cap returns metadata only, with zero content GETs. One 90s operation budget; no Range, prefix, assembly, file destination, guest fallback or…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| max_bytes | integer | no | — |
Delete exactly this retained artifact, without metadata preflight or guest file deletion. Same deletion effect on repeat; repeated 404 remains unavailable. No retry.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| artifact_id | string | yes | — |
Run the same hosted computer agent using OpenAI-shaped textual messages and JSON-only results (stream:false). The last user message is the task; system messages provide standing instructions. Previous user/assistant conversation is not replayed. This is BYOK computer control, not hosted inference…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| messages | array | yes | — |
| provider | string | no | — |
| model | string | no | — |
| max_steps | integer | no | — |
This account's Mandala AI credits, which pay for run_agent when no model key is configured: available (balance minus debt and credits held for runs in progress; can be negative, and zero while frozen), balance, held, debt, frozen (no plan or a suspended account: credits are kept and still expire,…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| before | integer | no | Older journal entries: the next_before of the page before. |
| limit | integer | no | Journal entries per page, 1 to …; the platform defaults to 50. |
Read one passive, unordered directory listing from an already running computer. No resume or idle extension; ordinary API rate/capacity admission still applies. At most 512 examined entries/128 KiB, with no continuation token. Narrow the path when partial. Symlinks are not followed; a final…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| path | string | yes | — |
Read one background execution by stable execution_id. Last-observed running, exited or lost; running is not proof the computer is awake, and lost establishes no success or failure. Metadata only: no guest I/O, activity refresh, resume, polling loop, PID fallback or command replay. Handles are…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Computer to read; defaults to use_computer selection. |
| execution_id | string | yes | Stable execution_id returned by an accepted background exec; never a PID. |
Read volatile, mutable guest output once at explicit independent stdout_offset and stderr_offset byte positions. Performs guest I/O but does not refresh activity, resume, change shared PID cursors, retry, tail, capture or replay a command. Unsuitable for passive Activities/history. Each stream is…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| stdout_offset | integer | yes | — |
| stderr_offset | integer | yes | — |
| limit | integer | no | — |
One lifecycle operation: what an accepted create, clone, start, stop, suspend, restart, snapshot restore, resize, move or delete started, and where it got to. A call made with an idempotency_key is recorded pending before it is carried out, so it can be found even when its answer was lost; one the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| operation_id | string | yes | — |
The lifecycle operations started on this account, from the API or the dashboard, newest first, a page at a time: kind, computer_id, state, error and timestamps. A key confined to a workspace sees only the operations of computers in that workspace. computer_id keeps one computer's (for a clone, the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Only this computer's operations. Not defaulted to the selected computer. |
| limit | integer | no | Page size; default 20. |
| cursor | string | no | The next_cursor of the page before. |
| idempotency_key | string | no | — |
Poll a lifecycle operation until it is final. Answers once it has succeeded; a failed one is an error carrying error.code and the platform's sentence (resize_not_applied is a move that landed at the old size: the computer has moved, and update_computer finishes the resize). succeeded means the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| operation_id | string | yes | — |
| timeout_s | integer | no | How long to wait before handing back and letting you poll. |
Capture one immutable prefix version from volatile guest output by stable execution_id. Explicit guest I/O; never resumes, retries or replays a command. Each call creates a separate version. Capture may commit even if its response is lost. Default 1 MiB per stream/max 4 MiB and default 86400s/max…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Computer, or the current use_computer selection. |
| execution_id | string | yes | — |
Read one immutable result manifest without guest output/files, resume, capture or command replay. Expiry, current scope or storage availability can make a version unavailable.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Computer, or the current use_computer selection. |
| result_id | string | yes | — |
Read one passive retained stdout, stderr or diagnostic page at an explicit offset. Default 4096/max 16384 bytes. EOF concerns this immutable prefix, not task completion. Lossless UTF-8/BOM or exact base64; no guest read, shared cursor, implicit capture, iteration or replay.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| stream | string | yes | — |
| offset | integer | yes | — |
| limit | integer | no | — |
Delete exactly this immutable result version. No metadata preflight or guest mutation. Same deletion effect on repeat, but a repeated 404 remains unavailable; no automatic retry.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Computer, or the current use_computer selection. |
| result_id | string | yes | — |
Read finite daemon facts without waking the computer, guest contact, event socket, watcher, capture or polling loop. Omit since or send empty for a head-only baseline with no replay; neither a baseline nor gap proves no earlier activity or task success. Keep the returned cursor even on an empty…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | yes | — | |
| since | string | no | — |
| limit | integer | no | — |
The SSH public keys registered to the person this API key belongs to — the same list whichever account the key acts on. A key added from the dashboard is accepted by every computer with SSH on, on every account where that person is an owner or member; one added through an API key or connected app…
No parameter schema on file.
Register an OpenSSH public key to the person this API key belongs to. It is accepted only by computers with SSH on in the account this credential acts on, and is removed when the credential is revoked. Accepted: Ed25519, ECDSA (P-256, P-384, P-521), their security-key forms, and RSA of at least…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| public_key | string | yes | — |
| name | string | no | A label, up to 60 characters. Defaults to the comment on the line. |
Remove one of your SSH keys. New connections with it are refused at once, and it is removed from the computers it was written into within moments, and any session opened with it is closed as each computer receives the new key list. Only a key bound to the account this API key acts on, one…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| confirm | boolean | yes | Must be true. This stops the key opening connections. |
Whether SSH is switched on for a computer, whether that computer can run SSH at all (one made from an older template image cannot), how many keys can log in, whether its hypervisor has the current setting yet, and whether that hypervisor refused the setting (it is not sent again until a key or the…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| computer_id | string | no | Which computer. Defaults to the one selected with use_computer. |
Turn SSH on or off for a computer. On, the computer runs an SSH server reachable only through the platform jump host, accepting the keys of every owner and member of the account, except keys added through an API key or connected app on another account, and keys of a member whose seat is suspended;…
| Parameter | Type | Required | Notes |
|---|---|---|---|
| enabled | boolean | yes | true to switch SSH on, false to switch it off. |
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Mandala Computer or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 90 / 100
Release 0.14.0 · scanned 17 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score90
Findings0 threat · 15 capability
Capabilitycritical
Coveragesource
Verificationsource
Surface digest6bf13308174984ed5781e9da52cd3fd1be0a24be6d169f528fc8bf7e751c0f52
Score vectorthreat 100 → client 90
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | critical | capability blast radius (critical) — client exposure if the model is manipulated | −10 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (116 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
1 of the 116 recovered tools are registered only when session.modelKey holds (dist/tools/agent.js:48) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes only the other 109.
1 of the 116 recovered tools are registered only when !session.modelKey is false (dist/tools/chat.js:186) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes only the other 109.
3 of the 116 recovered tools are registered only when !opts.lifecycle is false (dist/tools/computers.js:1480) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes only the other 109.
2 of the 116 recovered tools are registered only when !opts.lifecycle is false (dist/tools/snapshots.js:617) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes only the other 109.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.
109 tools are registered unconditionally · (1) 1 more only when session.modelKey holds (dist/tools/agent.js:48) · (2) 1 more only when !session.modelKey is false (dist/tools/chat.js:186) · (3) 3 more only when !opts.lifecycle is false (dist/tools/computers.js:1480) · (4) 2 more only when !opts.lifecycle is false (dist/tools/snapshots.js:617) — typically when a key or option is configured. All 116 are in the table below and were analysed; the conditional ones are marked.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| whoami | no tags | |
| list_api_keys | no tags | |
| list_workspaces | no tags | |
| get_workspace | no tags | |
| list_workspace_members | no tags | |
| create_workspace | state-write | state-write: declares readOnlyHint: false |
| rename_workspace | no tags | |
| delete_workspace | no tags | |
| get_account | no tags | |
| list_activities | no tags | |
| get_activity | no tags | |
| get_activity_results | no tags | |
| run_agent conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| publish_artifact | no tags | |
| get_artifact | no tags | |
| read_artifact | no tags | |
| delete_artifact | no tags | |
| run_agent_chat conditional (2) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_templates | no tags | |
| list_sizes | no tags | |
| list_computers | no tags | |
| get_computer | no tags | |
| use_computer | no tags | |
| start_computer | no tags | |
| stop_computer | no tags | |
| update_computer | no tags | |
| move_computer_to_workspace | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| move_computer | no tags | |
| list_moves | no tags | |
| get_usage | no tags | |
| wait_for_computer | no tags | |
| get_desktop_url | no tags | |
| create_computer conditional (3) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| clone_computer conditional (3) | no tags | |
| delete_computer conditional (3) | state-write | state-write: declares destructiveHint: true |
| get_credits | no tags | |
| list_directory | no tags | |
| wait_for_event | no tags | |
| wait_for_file_change | untrusted-input | untrusted-input: keyword "download" |
| poll_events | no tags | |
| get_execution | no tags | |
| read_execution_output | no tags | |
| exec | code-exec | code-exec: keyword "exec" in tool name, parameter "command" |
| exec_poll | code-exec | code-exec: keyword "exec" in tool name |
| exec_kill | code-execstate-write | code-exec: keyword "exec" in tool name; state-write: declares destructiveHint: true |
| open_url | no tags | |
| list_windows | no tags | |
| window_action | no tags | |
| read_clipboard | no tags | |
| write_clipboard | no tags | |
| write_file_chunk | file-write | file-write: keyword "write_file" in tool name |
| write_file | file-write | file-write: keyword "write_file" in tool name |
| read_file | sensitive-source | sensitive-source: keyword "read_file" |
| get_file_upload | no tags | |
| cancel_file_upload | no tags | |
| screenshot | no tags | |
| click | no tags | |
| type_text | no tags | |
| paste_text | no tags | |
| press_key | no tags | |
| scroll | no tags | |
| drag | no tags | |
| move_mouse | no tags | |
| mouse_button | no tags | |
| cursor_position | no tags | |
| wait | external-sink | external-sink: keyword "http_request" |
| get_operation | no tags | |
| list_operations | no tags | |
| wait_for_operation | no tags | |
| list_public_urls | no tags | |
| create_public_url | no tags | |
| update_public_url | no tags | |
| delete_public_url | state-write | state-write: declares destructiveHint: true |
| retain_execution_output | state-write | state-write: declares readOnlyHint: false |
| get_result | no tags | |
| read_result_output | no tags | |
| delete_result | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| get_computer_secrets | no tags | |
| set_computer_secrets | state-write | state-write: declares destructiveHint: true |
| list_secrets | sensitive-source | sensitive-source: keyword "list_secrets" |
| get_secret | sensitive-source | sensitive-source: keyword "get_secret", parameter "secret" |
| create_secret | no tags | |
| set_secret | state-write | state-write: declares destructiveHint: true |
| replace_secret | state-write | state-write: declares destructiveHint: true |
| delete_secret | state-write | state-write: declares destructiveHint: true |
| read_signals | no tags | |
| list_snapshots | no tags | |
| snapshot_holdings | no tags | |
| create_snapshot | no tags | |
| restore_snapshot | state-write | state-write: declares destructiveHint: true |
| snapshot_schedule | no tags | |
| get_retention | no tags | |
| clone_snapshot conditional (4) | no tags | |
| delete_snapshot conditional (4) | state-write | state-write: declares destructiveHint: true |
| list_ssh_keys | no tags | |
| add_ssh_key | no tags | |
| remove_ssh_key | state-write | state-write: declares destructiveHint: true |
| get_computer_ssh | no tags | |
| set_computer_ssh | no tags | |
| get_template_schema | no tags | |
| check_template | no tags | |
| publish_template | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_template | no tags | |
| retire_template | state-write | state-write: declares destructiveHint: true |
| build_template | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_builds | no tags | |
| get_build | no tags | |
| watch_build | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_webhooks | no tags | |
| create_webhook | external-sink | external-sink: keyword "webhook" |
| get_webhook | no tags | |
| update_webhook | external-sink | external-sink: keyword "webhook" |
| rotate_webhook_secret | external-sink | external-sink: keyword "webhook", parameter "webhook" |
| test_webhook | external-sink | external-sink: keyword "webhook", parameter "webhook" |
| list_webhook_deliveries | no tags | |
| delete_webhook | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares destructiveHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
build_template → get_secret → create_webhook
A cross-tool exfiltration chain exists: build_template → get_secret ⇒ create_webhook.
Supply chain and provenance
Integrityfirst-seen
Surface digest6bf13308174984ed
Scanned2026-10-17
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.14.0. Pin a release below and the command asks for exactly that one.
0.14.0
16 Oct 2026
latestNo release note was published with this version.
0.13.2
16 Oct 2026
No release note was published with this version.
0.13.1
undated
- The version this listing was on when mcprush began following its releases. The registry was not asked when it shipped, so this row carries no date.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Mandala Computer can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.