com.htmlradar/share
NPM · HTMLRADAR-MCP · 2 COMPONENTS
Send a web page to specific people, control who opens it, see how it was read, and update it.
Available components
Last scanned (9 hours ago)
Scores higher than 56% of npm servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 14 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability62
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5224 tokens (~326/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (15)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Checks we could not complete (1)
These are gaps on our side, not findings about this package. We only credit what we can confirm, so a category made up entirely of them scores 0.
- Security disclosure in Provenance & TransparencySecurity-disclosure policy not yet verified: we couldn't inspect the source repository.
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Stability: 0.97 → pass security
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −1
- Stability: pass → 0.93 functional
- 31 Oct 26 +1
- Stability: fail → pass ▲ security
- 23 Oct 26 +11
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → pass ▲ functional
- 22 Oct 26 −11
- Known CVEs: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: fail → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: pass → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.7.1 → 0.8.0 functional
- 21 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 20 Oct 26 −4
- Malware scan: pass → unverified ▼ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → pass ▲ functional
- Package version: 0.7.0 → 0.7.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Analysed npm/htmlradar-mcp@0.8.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_attachment Attach a file to a document ~220
Attaches one file to a document already on HTMLRadar, for readers of its links to download. The file types are the website's (PDF, Office documents, images, CSV, text, Markdown, ZIP) and a document holds up to 20 files. The file travels as base64 in `content_base64`, because a tool argument is JSON, so it can be at most 5.0 MB, the same limit as publishing a page this way; a larger file (the website takes 25 MB) is added on the website. Readers see the file from the next time they load the page. There is no file-path argument: a file on disk reaches this tool only as content the caller has already read.
| Name | Type | Req | Description |
|---|---|---|---|
| content_base64 | string | yes | The file's contents, base64-encoded. |
| document_id | string | yes | The document — the document id from list_documents or list_shares. |
| filename | string | yes | The file name with its extension, e.g. "pricing.pdf". The extension decides the type. |
No output schema declared.
No examples provided.
create_share Make another tracked link for an existing document ~569
Creates an additional tracked link for a document already on HTMLRadar, with its own recipient label, gate, password, expiry and address. One link per recipient is what separates their reading reports. It uploads nothing and creates no second copy of the document, and it cannot publish new markup: it takes a document id, which list_shares returns and share_html returned when the document was first published. The link is live the moment it is returned. The answer includes the saved rules and comments state.
| Name | Type | Req | Description |
|---|---|---|---|
| allowed_email_domains | array | – | Only these email domains may open the link, e.g. ["acme.com"]. Up to 500. Needs the email gate, which is on by default; with it off the call is refused. |
| allowed_emails | array | – | Only these exact addresses may open the link, e.g. ["ravi@acme.com"]. A separate list from the domains, and a visitor passes on either. Up to 500 addresses; past that a domain is the right tool. Need… |
| comments | string | – | Whether readers can comment. Off by default. Turning comments on needs the email gate and a one-time code; who sees comments follows the link. |
| document_id | string | yes | The document to make another link for — the document id from list_shares, or the one share_html returned when the document was first published. |
| expires_in_hours | integer | – | Link stops working after this many hours. |
| lock_deck | boolean | – | Blocks save and print and adds a watermark; default true. Pass false for a document the recipient is meant to keep a copy of. |
| password | string | – | Extra password gate on top of the email gate. |
| recipient_label | string | – | Who this link is for, e.g. "Acme". One link per recipient reads best. |
| request_id | string | – | Leave unset on a first attempt. When a previous call failed saying it may still have been applied, pass the request_id that error named: the retry then returns the first result instead of doing it tw… |
| require_email | boolean | – | Ask the recipient for their email before the document opens. Defaults to true. |
| slug | string | – | Custom link name, so the URL reads /r/acme-proposal. Paid plans only. |
| verify_email | boolean | – | Verify that the address really is the reader's: we email a six-digit code and open the document only when the reader types it back. Off by default. Use it when the list of who opened the document has… |
No output schema declared.
No examples provided.
get_document Read a document to change it ~216
Returns the current contents of a document on HTMLRadar so they can be changed and put back with replace_document. Each image embedded as a data URI appears as a short htmlradar-image reference instead of its data; keep references exactly as they are. A page over 5 MB of text even with its images as references is too large to read whole; with `query`, a word or phrase from the part to change, any page returns only the passages where that text appears, which replace_document `edits` can then change. It reads only this account's documents and changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document to read — the document id from list_documents or list_shares. |
| query | string | – | Text to find, 1 to 200 characters, matched literally with letter case ignored, such as a product name or a price. Returns up to 20 passages around the matches, and how many there are, instead of the… |
No output schema declared.
No examples provided.
get_page_guidelines Get page guidelines ~28
Returns HTMLRadar's guidelines for pages that read well on phones and give accurate section reading
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_reading_records Get a document's reading records ~256
Returns the reading records the HTMLRadar website exports as a spreadsheet, as CSV text: one row per section per read, with the link's label and address, the reader, whether their address was verified, when they opened it, how long they read, how far they scrolled, and their country and device where recorded. The sender's own previews and internal viewers are left out, as on the website. Pass `share_id` for one link; without it every link of the document is included. A very long answer is cut at a whole record and gives a `continue_from` value: call again with the same arguments and that value for the next rows, until it says it is every row. For a quick answer about who read one link, get_share_activity is shorter. It changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| continue_from | string | – | The `continue_from` value a previous answer gave, to read the rows after it. Omit it to start from the first row. |
| document_id | string | yes | The document — the document id from list_documents or list_shares. |
| share_id | string | – | Limit the records to one link: the share id, the share's slug, or the link itself. |
No output schema declared.
No examples provided.
get_share Read a tracked link's settings ~156
Returns a tracked link's current settings, in the form update_share changes them: who can open it (the full allowed-domain and allowed-address lists), the email gate and its one-time code, whether a password is set (never the password), the end date, the copy lock, comments, the label, who the gate names, whether the sender is emailed on the first open, and the settings version. It reads one of this account's links and changes nothing. The answer includes the saved Rules line and the version used by expected_settings_version.
| Name | Type | Req | Description |
|---|---|---|---|
| share_id | string | yes | The share id, the share's slug (the part after /r/ in its link), or the link itself. list_shares returns all three. |
No output schema declared.
No examples provided.
get_share_activity Check who read a tracked link ~175
Reports whether a tracked HTMLRadar link has been opened, by whom, for how long, how far they scrolled, and which sections held their attention. Per viewer it names the all recorded sections, ordered by reading time. Reading times are rounded down; scroll percentages are rounded to the nearest whole percent. It accepts a share id, a slug or a link; list_shares returns all three.
| Name | Type | Req | Description |
|---|---|---|---|
| include_detail | boolean | – | Also return each reader's country, city, device and referrer. Off by default: that is a named person's location and device, and whether the document was read and which parts of it is answered without… |
| share_id | string | yes | The share id returned by share_html, or the share's slug (the part after /r/ in its link), or the link itself. |
No output schema declared.
No examples provided.
list_attachments List a document's attached files ~95
Lists the files attached to a document on HTMLRadar (supporting materials a reader can download beside the page): the file name, its size and the attachment id that remove_attachment takes. It returns no file contents and changes nothing. Call it before add_attachment or remove_attachment, and after an add that failed without an answer.
| Name | Type | Req | Description |
|---|---|---|---|
| document_id | string | yes | The document — the document id from list_documents or list_shares. |
No output schema declared.
No examples provided.
list_documents List documents on this account ~148
Lists the account's documents, newest first: the title, when it was created, how many tracked links point at it, and the document id that create_share and replace_document take. A document with no links appears here and nowhere else, because list_shares only knows documents that have been sent. It returns no document contents. Returns at most 50 per call; the `before` cursor pages back through older documents.
| Name | Type | Req | Description |
|---|---|---|---|
| before | string | – | Cursor for the next page: the `next_before` value printed at the end of a previous list_documents result, of the form <created_at>|<document id>. Pass it back exactly as printed. Omit for the most re… |
No output schema declared.
No examples provided.
list_shares List tracked links on this account ~174
Lists the account's tracked links, newest first: the slug, the recipient label, the document title, whether it has been opened and when, and the share and document ids the other tools take. This is where the identifiers for a link made in an earlier conversation come from. The `opened` and `last_open` fields answer "which of my links has nobody opened" on their own, without a get_share_activity report for each one. Returns at most 50 per call; the `before` cursor pages back through older links.
| Name | Type | Req | Description |
|---|---|---|---|
| before | string | – | Cursor for the next page: the `next_before` value printed at the end of a previous list_shares result, of the form <created_at>|<share id>. Pass it back exactly as printed. Omit for the most recent l… |
No output schema declared.
No examples provided.
remove_attachment Remove a file from a document ~135
Removes one attached file from a document. Readers lose the download from the next time they load the page. It removes the file only: the page, its links and its reading history are untouched, and there is no tool that deletes a page or a link. Claude cannot restore it, and it cannot be recovered from HTMLRadar, so attach it again from the original if the user changes their mind. Take the attachment id from list_attachments.
| Name | Type | Req | Description |
|---|---|---|---|
| attachment_id | string | yes | The attachment id from list_attachments. |
| document_id | string | yes | The document the file is attached to — from list_documents or list_shares. |
No output schema declared.
No examples provided.
replace_document Replace a document, keeping every link ~527
Replaces the contents of a document already on HTMLRadar. Every existing link stays exactly as it is — same address, same settings, same reading history — and serves the new contents from the next time it is opened, so nobody is sent a second link. The new HTML is screened for phishing signals as every upload is, and the previous version stays listed in the document's version history on the website. Restoring an earlier version is not available, from Claude or on the website; to go back, replace the contents again with the earlier page. Recipients may already have read the old contents. Pass either the whole new page in `html`, or `edits`: pieces of text to find in the page get_document returned, each with its replacement and each appearing exactly once. Edits suit small changes to a large page, because only the changes travel. Images that need a login, expiring image addresses and local file paths do not load for readers of the link. Images embedded in the HTML as data URIs always do. On an update, get_document shows each embedded image as a short htmlradar-image reference; keep each one exactly as it is and HTMLRadar puts the image back, so only new images count towards the 5 MB limit.
| Name | Type | Req | Description |
|---|---|---|---|
| announce | boolean | – | Tell readers what changed and alert subscribers. Omit to announce only when every live link is company-only; otherwise the replacement is quiet. |
| document_id | string | yes | The document whose contents are being replaced. Every link to it keeps working. |
| edits | array | – | Changes to the page get_document returned, applied in order. Each `find` must appear exactly once in the page at that point. Between 1 and 200. Pass this or `html`. |
| expected_version | integer | yes | The document's current version as you last saw it: get_document and list_documents show it, and each replace_document result gives the new one. When the document has been replaced since, nothing is r… |
| html | string | – | The new HTML markup, in full. It may keep the htmlradar-image references get_document returned. Pass this or `edits`, not both. |
| note | string | – | Optional note for an announced update, at most 140 characters. |
| request_id | string | – | Leave unset on a first attempt. When a previous call failed saying it may still have been applied, pass the request_id that error named: the retry then returns the first result instead of doing it tw… |
No output schema declared.
No examples provided.
revoke_share Switch a tracked link off, or back on ~206
Switches off a tracked link that has already been sent. Anyone who opens it afterwards sees that it is no longer available, and the sender is emailed that somebody tried. This changes what a recipient can see. It is reversible — `revoked: false` switches the link back on, so use this tool to turn a switched-off link on again — and it deletes nothing: the link, its settings and its whole reading history survive. Deleting a link is possible only on the website, because it deletes its reading records for good. To change a link's settings, use update_share on the same link: switching one off to make a replacement leaves the recipient holding a dead address.
| Name | Type | Req | Description |
|---|---|---|---|
| revoked | boolean | – | True (the default) switches the link off. False switches it back on. |
| share_id | string | yes | The share id, the share's slug (the part after /r/ in its link), or the link itself. list_shares returns all three. |
No output schema declared.
No examples provided.
share_html Share HTML as a tracked link ~725
Publishes an HTML document — a deck, report, dashboard, proposal or one-pager — as a tracked HTMLRadar link, and returns two addresses: the link for the recipient, and a dashboard address for the sender. The recipient sees the document as written and never the tracking. The markup goes in `html`; there is no file-path argument, so a document on disk reaches this tool only as markup the caller has already read, which leaves the user's permissions on their own file tools in charge of what is published. By default the recipient is asked for their email address before the document opens, which is a step the person receiving the link has to take. The link is live the moment it is returned. The answer includes the saved rules and comments state. Images that need a login, expiring image addresses and local file paths do not load for readers of the link. Images embedded in the HTML as data URIs always do. On an update, get_document shows each embedded image as a short htmlradar-image reference; keep each one exactly as it is and HTMLRadar puts the image back, so only new images count towards the 5 MB limit.
| Name | Type | Req | Description |
|---|---|---|---|
| allowed_email_domains | array | – | Only these email domains may open the link, e.g. ["acme.com"]. Up to 500. Needs the email gate, which is on by default; with it off the call is refused. |
| allowed_emails | array | – | Only these exact addresses may open the link, e.g. ["ravi@acme.com"]. A separate list from the domains, and a visitor passes on either. Up to 500 addresses; past that a domain is the right tool. Need… |
| comments | string | – | Whether readers can comment. Off by default. Turning comments on needs the email gate and a one-time code; who sees comments follows the link. |
| expires_in_hours | integer | – | Link stops working after this many hours. |
| html | string | yes | The HTML markup to publish, in full. There is no file-path argument: a document on disk reaches this tool only as markup the caller has already read. |
| lock_deck | boolean | – | Blocks save and print and adds a watermark; default true. Pass false for a document the recipient is meant to keep a copy of. |
| password | string | – | Extra password gate on top of the email gate. |
| recipient_label | string | – | Who this link is for, e.g. "Acme". One link per recipient reads best. |
| request_id | string | – | Leave unset on a first attempt. When a previous call failed saying it may still have been applied, pass the request_id that error named: the retry then returns the first result instead of doing it tw… |
| require_email | boolean | – | Ask the recipient for their email before the document opens. Defaults to true. |
| slug | string | – | Custom link name, so the URL reads /r/acme-proposal. Paid plans only. |
| title | string | – | Name shown on your dashboard. Recipients do not see it. |
| verify_email | boolean | – | Verify that the address really is the reader's: we email a six-digit code and open the document only when the reader types it back. Off by default. Use it when the list of who opened the document has… |
No output schema declared.
No examples provided.
update_share Change a tracked link's settings ~1,098
Changes the settings of a tracked link that has already been sent, on the same link: who can open it (allowed domains and addresses), the email gate and its one-time code, the password, the end date, the copy lock, the label, who the gate names and whether the sender is emailed on the first open. Comments can be on or off; enabling needs a code-confirmed email gate. The answer includes the saved Rules line. The link, its address and its whole reading history stay the same. Only the settings you name change; every other setting is left as it is, and a setting is removed only when it is named in `clear`. The list arguments add_allowed_emails, remove_allowed_emails, add_allowed_email_domains and remove_allowed_email_domains: the server merges them over the stored list and says what was added, removed and not found. Sending allowed_emails or allowed_email_domains replaces the whole list and needs expected_settings_version from get_share, so a change made since is never overwritten. A stale version is refused without saving. A change applies from the next time the page is loaded: someone reading it right now keeps the page they have until they reload. If the sender is on a company team, the team's rules apply to this change exactly as on the website (for example a required one-time code or company domains), and a change that breaks one is refused with the rule named. Narrowing who can open a link, or removing a list, changes what recipients can see.
| Name | Type | Req | Description |
|---|---|---|---|
| add_allowed_email_domains | array | – | Domains to ADD to the stored list of allowed domains, merged on the server. |
| add_allowed_emails | array | – | Addresses to ADD to the stored list of allowed addresses. The server merges them over the list as it is now, so nothing has to be copied back. Needs the email gate on. |
| allowed_email_domains | array | – | Only these email domains may open the link, e.g. ["acme.com"]. This REPLACES the whole stored list: call get_share first and send the domains that should stay with the new one. To remove the list, us… |
| allowed_emails | array | – | Only these exact addresses may open the link. A separate list from the domains; a visitor passes on either. This REPLACES the whole stored list: call get_share first and send the addresses that shoul… |
| clear | array | – | Settings to remove: the label, the password, the end date, the domain list, the address list. Removing a list lets anyone who passes the email gate in, so say so to the user first. A setting that is… |
| comments | string | – | Whether readers can comment. Omitted keeps the current choice. Turning comments on needs the email gate and a one-time code; who sees comments follows the link. |
| expected_settings_version | integer | – | The settings version get_share showed. The change is made only if the link is still at that version; otherwise nothing is changed and you are told to call get_share again. Required when you replace o… |
| expires_at | string | – | When the link stops working, as a date and time such as 2026-12-31T17:00:00Z. Give this or `expires_in_hours`. To remove the end date, use `clear`. |
| expires_in_hours | number | – | The link stops working this many hours from now. Give this or `expires_at`. |
| lock_deck | boolean | – | The copy lock: true blocks save and print and adds a watermark; false allows them. |
| notify_first_open | boolean | – | Whether the sender is emailed when someone first opens this link. |
| password | string | – | Set a password (at least 8 characters) on top of the email gate. To remove one, use `clear`. |
| recipient_label | string | – | A new label for who this link is for, e.g. "Acme". |
| remove_allowed_email_domains | array | – | Domains to REMOVE from the stored list of allowed domains, merged on the server. |
| remove_allowed_emails | array | – | Addresses to REMOVE from the stored list of allowed addresses. The answer says which were not on the list. Removing the last entry of every list is refused; use `clear` for that. |
| require_email | boolean | – | Turn the email gate on or off. Turning it off removes the check that the list of allowed domains and addresses relies on, so clear those in the same call. |
| share_id | string | yes | The share id, the share's slug (the part after /r/ in its link), or the link itself. list_shares returns all three. |
| show_sender | string | – | Who the gate names to the reader: nobody, the sender's company, or the sender's name. The company needs a work sign-up address; the name needs one set in Settings. |
| verify_email | boolean | – | Turn the one-time-code check on or off: we email the reader a six-digit code and open the document only when they type it back. Needs the email gate on. |
No output schema declared.
No examples provided.
whoami Show the HTMLRadar plan and free links left ~38
Reports which HTMLRadar account the API key belongs to (its email address), the plan it is on and how many of its free tracked links remain.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the com.htmlradar/share MCP server?
com.htmlradar/share runs locally as an npm package, launched with npx -y htmlradar-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · htmlradar-mcp
claude mcp add com-htmlradar-share -- npx -y htmlradar-mcp
What is the com.htmlradar/share MCP server?
com.htmlradar/share is an MCP server listed in the public MCP registry as com.htmlradar/share. Send a web page to specific people, control who opens it, see how it was read, and update it. This page covers its npm package (htmlradar-mcp).
Is the com.htmlradar/share MCP server safe to use?
com.htmlradar/share scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 6 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.htmlradar/share MCP server expose?
com.htmlradar/share exposes 16 tools: share_html, create_share, list_shares, list_documents, get_share_activity, and 11 more. Their descriptions and schemas cost roughly 4,766 tokens of context every time the server is loaded.
Is the com.htmlradar/share MCP server still maintained?
com.htmlradar/share is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.htmlradar/share MCP server under?
com.htmlradar/share declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the com.htmlradar/share MCP server?
VerifyMCP ran 15 checks on com.htmlradar/share, covering Malware scan, Known CVEs, Install scripts, Dependency health and 11 more. One item could not be completed, a gap on our side rather than a finding about com.htmlradar/share: Security disclosure. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.