io.github.Reachpad/reachpad-mcp
REMOTE · REACHPAD.DEV · 2 COMPONENTS
Coding agents build full-stack apps in persistent workspaces and share them by link.
Available components
Last scanned (7 minutes ago)
Scores higher than 99% of remote servers
Reachable. Last reached 17 Oct 2026.
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3558 tokens (~142/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 98% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 10 Oct 26 +14
- Stability: fail → pass ▲ security
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 9 Sept 26 0
- Tool “search_apps” rewrote its description, which is the text the model reads security
- New tool “read_app_preview” functional
- “search_apps” reworded the description of “q” cosmetic
- “update_app” reworded the description of “files” cosmetic
- “update_app” reworded the description of “manifest” cosmetic
- “update_app” reworded the description of “validate” cosmetic
- “create_app” reworded the description of “files” cosmetic
- “create_app” reworded the description of “manifest” cosmetic
- “create_app” reworded the description of “validate” cosmetic
- 8 Sept 26 0
- Tool “share_app” rewrote its description, which is the text the model reads security
- Tool “revoke_app_share” rewrote its description, which is the text the model reads security
- Tool “list_app_shares” rewrote its description, which is the text the model reads security
- 7 Sept 26 0
- Tool “read_app_file” rewrote its description, which is the text the model reads security
- Tool “read_app_version” rewrote its description, which is the text the model reads security
- Tool “list_app_versions” rewrote its description, which is the text the model reads security
- Tool “rmdir” changed its title: Delete an empty folder cosmetic
- Tool “mv” changed its title: Move an app or folder cosmetic
- Tool “publish_app_version” changed its title: Make a version live cosmetic
- Tool “query_app_db” changed its title: Run one SQL statement cosmetic
- Tool “read_app” changed its title: Read an app cosmetic
- Tool “read_app_file” changed its title: Read one file cosmetic
- Tool “read_app_version” changed its title: Read a version cosmetic
- Tool “remove_secret” changed its title: Remove a secret cosmetic
- Tool “revoke_app_share” changed its title: Remove a share cosmetic
- Tool “mkdir” changed its title: Create a folder cosmetic
- Tool “search_apps” changed its title: Search apps cosmetic
- Tool “set_app_access” changed its title: Set who can open an app cosmetic
- Tool “set_secret” changed its title: Set a secret cosmetic
- Tool “share_app” changed its title: Share an app cosmetic
- Tool “trash_app” changed its title: Move an app to the trash cosmetic
- Tool “tree” changed its title: Read the folder tree cosmetic
- Tool “update_app” changed its title: Publish a new version cosmetic
- Tool “whoami” changed its title: Who am I cosmetic
- Tool “create_app” changed its title: Publish a new app cosmetic
- Tool “get_app_logs” changed its title: Read app logs cosmetic
- Tool “list_app_shares” changed its title: List shares cosmetic
- Tool “list_app_versions” changed its title: List versions cosmetic
- Tool “list_secrets” changed its title: List secrets cosmetic
- Tool “ls” changed its title: List a folder cosmetic
- 6 Sept 26 0
- New tool “remove_secret”, which the server declares destructive security
- New tool “set_secret”, which the server declares destructive security
- New tool “trash_app”, which the server declares destructive security
- Tool “whoami” rewrote its description, which is the text the model reads security
- Tool “read_app_version” rewrote its description, which is the text the model reads security
- Tool “read_app” rewrote its description, which is the text the model reads security
- Tool “get_app_logs” rewrote its description, which is the text the model reads security
- Tool “rmdir” is now declared destructive security
- Tool “revoke_app_share” is now declared destructive security
- Schema quality: 2496 → 3551 ▼ functional
- Destructive annotations: All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
- New tool “read_app_file” functional
- New tool “query_app_db” functional
- New tool “list_secrets” functional
- “update_app” reworded the description of “validate” cosmetic
- “update_app” reworded the description of “manifest” cosmetic
- “update_app” reworded the description of “files” cosmetic
- “create_app” reworded the description of “validate” cosmetic
- “create_app” reworded the description of “manifest” cosmetic
- “create_app” reworded the description of “files” cosmetic
- 5 Sept 26 0
- Stability: 0.33 → fail ▼ security
- Tool “checkpoint_workspace” was removed ▼ security
- Tool “create_workspace” was removed ▼ security
- Tool “delete_workspace” was removed ▼ security
- Tool “expose_port” was removed ▼ security
- Tool “get_credit_balance” was removed ▼ security
- Tool “get_workspace” was removed ▼ security
- Tool “list_ports” was removed ▼ security
- Tool “list_workspaces” was removed ▼ security
- Tool “pause_workspace” was removed ▼ security
- Tool “revoke_port” was removed ▼ security
- Tool “run_command” was removed ▼ security
- Schema quality: pass → fail ▼ functional
- Tool coverage: 37% → 98% ▲ functional
- Destructive annotations: 0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "create_app" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. functional
- Server version: 0.4.1 → 1.0.0 functional
- New tool “create_app” functional
- New tool “get_app_logs” functional
- New tool “list_app_shares” functional
- New tool “list_app_versions” functional
- New tool “ls” functional
- New tool “mkdir” functional
- New tool “mv” functional
- New tool “publish_app_version” functional
- New tool “read_app” functional
- New tool “read_app_version” functional
- New tool “revoke_app_share” functional
- New tool “rmdir” functional
- New tool “search_apps” functional
- New tool “set_app_access” functional
- New tool “share_app” functional
- New tool “tree” functional
- New tool “update_app” functional
- New tool “whoami” functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Probed https://reachpad.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=reachpad.dev | CN=YR2,O=Let's Encrypt,C=US | 19 Aug 2026 | 17 Nov 2026 | RSA 2048 | SHA256-RSA | 6ff69264ac5a1ef26ebddf0d5682d632cc9 |
| SANs: reachpad.dev | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of reachpad.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| reachpad.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://reachpad.dev/.well-known/oauth-protected-resource", error="invalid_token", error_description="no bearer token"
Bearer resource_metadata="https://reachpad.dev/.well-known/oauth-protected-resource", error="invalid_token", error_description="no bearer token"| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Protected resource metadata
| Document | https://reachpad.dev/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://reachpad.dev/mcp |
| Authorisation server | https://splendid-experience-99.authkit.app |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://reachpad.dev/mcp | Verified | 200 | |
| http (plaintext) | http://reachpad.dev/mcp | HTTPS enforced | 308 | https://reachpad.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_app Publish a new app ~382
Publish new files as an app and get its URL back. Version 1 goes live at once, so show the person the content and the destination before calling this. Access defaults to org_link, which lets anyone signed in to the same organization open the link.
| Name | Type | Req | Description |
|---|---|---|---|
| access | object | – | Who may open the link. Defaults to org_link. |
| files | array | yes | Files to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/… |
| manifest | object | – | Omit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and en… |
| message | string | – | What version 1 contains. |
| name | string | yes | What the app is called. Shown in listings. |
| slug | string | – | The readable part of the subdomain to publish at, 3 to 34 characters of a-z, 0-9 and single hyphens. Derived from the name when omitted. A random 5-character tag is always appended, so a name is neve… |
| type | string | – | The badge on the row. Defaults to app. |
| validate | boolean | – | Check without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characte… |
No output schema declared.
No examples provided.
get_app_logs Read app logs ~127
Read recent log lines from the live version of a function app. An app that serves files has no process and answers that it has no logs. Function logs are not captured yet either, and the answer says so: until they are, have the function catch its own errors and return them in the response.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| limit | integer | – | How many rows to return. Defaults to 50. |
| since | string | – | RFC 3339 timestamp to read from. |
No output schema declared.
No examples provided.
list_app_shares List shares ~67
List the people an app is shared with, their roles, and whether the grant has attached to an account yet. The owner and editors can read this list.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
No output schema declared.
No examples provided.
list_app_versions List versions ~115
List an app's versions, newest first. Versions are immutable and numbered from 1. Earlier versions open for the app's editors; the live link follows the app's access setting. Pass the next_cursor from a previous call to get the next page.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| cursor | string | – | next_cursor from a previous call. |
| limit | integer | – | How many rows to return. Defaults to 50. |
No output schema declared.
No examples provided.
list_secrets List secrets ~42
List the organization's secrets: each name, who set it, when, and the apps whose versions bind it. Names only. No tool anywhere returns a secret value.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ls List a folder ~81
List what is directly inside one folder: its subfolders and the apps filed in it. Omit folder_id for the top level. Each folder carries the updated_at that mv needs.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | – | The folder to look inside. Omit for the top level. |
| limit | integer | – | How many rows to return. Defaults to 50. |
No output schema declared.
No examples provided.
mkdir Create a folder ~51
Create a folder, at the top level or inside another one.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The folder name. |
| parent_id | string | – | The folder to create it inside. Omit for the top level. |
No output schema declared.
No examples provided.
mv Move an app or folder ~178
Move an app into a folder, or move a folder under another folder. Name exactly one of app_id or folder_id as the thing being moved, and to_folder_id as the destination, or null for the top level. Moving a folder also needs base_updated_at, the value read from ls or tree, so a move made against a stale reading is refused instead of undoing someone else's.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | – | The app to move. Name this or folder_id, not both. |
| base_updated_at | string | – | The moved folder's updated_at, from ls or tree. Required when folder_id is given. |
| folder_id | string | – | The folder to move. Name this or app_id, not both. |
| to_folder_id | string|null | yes | The destination folder id, or null to move to the top level. |
No output schema declared.
No examples provided.
publish_app_version Make a version live ~102
Make one version of an app live by its number. This is how a version staged with publish false goes on the link, and how an app is rolled back: name an older number and that version is what the link serves again. Nothing is rebuilt, the pointer moves.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| number | integer | yes | The version number to make live. |
No output schema declared.
No examples provided.
query_app_db Run one SQL statement ~167
Run one SQL statement against a function app's own database, to read rows and to fix data. Not for schema: a table or a column belongs in the version's migrations/NNNN_name.sql, and a statement that changes the schema is refused. Owners and editors only. Answers rows and rowCount for a select, and changes with lastInsertRowid for a write.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| params | array | – | The values for the ? placeholders, in order. Strings, numbers, booleans and null. |
| sql | string | yes | One statement, with ? placeholders for every value that comes from somewhere else. A second statement in the same string is refused. |
No output schema declared.
No examples provided.
read_app Read an app ~197
Read one app before update_app: its name, type, access level and publishing mode, plus base_version_id and its files, which both describe the version the next edit builds on. Each text file carries its content, so this is how you see what an app already contains before changing it. A file marked content_omitted answer budget did not fit in this answer and read_app_file fetches it; one marked too large is past what any tool answer carries. Pass that base_version_id to update_app. version is what the link serves now, and head_version is the version base_version_id names on the apps where that is not the live one, which is every app with a version staged by publish false. pending_version is the number of that staged version, and publish_app_version is what makes it live.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
No output schema declared.
No examples provided.
read_app_file Read one file ~167
Read one file out of an app as text, at most 256 KB. Use it for a file that read_app left out with content_omitted: "answer budget", or to fetch a single file without the rest of the app. A file that is not text, and a text file over that size, are refused rather than truncated. Reads the newest version unless you name one, which is the same version read_app lists.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| number | integer | – | The version number to read from. Defaults to the newest version. |
| path | string | yes | The path inside the app, as it appears in read_app's files, for example index.html. |
No output schema declared.
No examples provided.
read_app_preview See an app ~125
Look at the picture of what an app's link serves right now, as an image. Use it for an app whose files you cannot read: a function app's module stays with the people who develop it, so this is how you see what the app actually shows. It is the live version only, and an app published before its picture was taken, or one whose capture has not run yet, answers that there is no picture rather than an error.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
No output schema declared.
No examples provided.
read_app_version Read a version ~106
Read one version by its number, with its files and each text file's content. Use it to see what an earlier publish contained, and to copy a file back out of a version you want to return to. Earlier versions open for the app's editors; the live link follows the app's access setting.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| number | integer | yes | The version number. |
No output schema declared.
No examples provided.
remove_secret Remove a secret ~65
Remove one organization secret and delete it from every published version that binds it. A version the deletion did not reach keeps the name in the list with that version in failed, and running this again retries exactly those.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The secret name, from list_secrets. |
No output schema declared.
No examples provided.
revoke_app_share Remove a share ~84
Remove one share by its id, from list_app_shares. The app itself is untouched. The owner or an editor may use this when editor-managed sharing is enabled.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| share_id | string | yes | The share id. Starts with shr_. |
No output schema declared.
No examples provided.
rmdir Delete an empty folder ~50
Delete an empty folder. This refuses while the folder still holds apps or subfolders, and it never deletes an app. Move the contents out first.
| Name | Type | Req | Description |
|---|---|---|---|
| folder_id | string | yes | The folder to delete. |
No output schema declared.
No examples provided.
search_apps Search apps ~174
Find apps in the caller's organization by text. This matches substrings of the name and the slug, and whole words on the live version's page, not meaning: search for a word that appears in the title or on the page rather than describing the app. Returns ids and live URLs.
| Name | Type | Req | Description |
|---|---|---|---|
| created_by | string | – | Keep only apps owned by this user id or email address. |
| limit | integer | – | How many rows to return. Defaults to 50. |
| q | string | – | Text to match against the name, the slug and the words on the live page. |
| type | string | – | Keep only apps carrying this badge. |
| updated_by | string | – | Keep only apps owned by this user id or email address. Version authors are not indexed in v1, so this filters on the owner. |
No output schema declared.
No examples provided.
set_app_access Set who can open an app ~150
Change who can open an app: restricted (only the owner and named people), org_link (anyone signed in to the organization), or public_link (anyone with the URL). A password and an expiry apply to a public link only. Owner only.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| clear_expiry | boolean | – | Remove the expiry. |
| clear_password | boolean | – | Remove the password. |
| expires_at | string | – | RFC 3339 timestamp after which a public link stops working. |
| level | string | yes | – |
| password | string | – | Set a password on a public link. |
No output schema declared.
No examples provided.
set_secret Set a secret ~158
Set one organization secret, so a function can bind it by name in its manifest secrets list. Any member of the organization. Setting a name that already exists replaces the value and rotates it onto every published version that binds it. Answers the name, how many versions took the new value, and the ids of any that did not.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The environment variable name the function reads, for example STRIPE_SECRET_KEY. Letters, digits and underscores. |
| value | string | yes | The value. It is sealed on write: no tool returns it, this one included, and it is never written to a log or to this app's database. Ask the person to paste it themselves rather than repeating a key… |
No output schema declared.
No examples provided.
share_app Share an app ~112
Give one email address access to an app as a viewer or an editor. An address without an account gets a grant that starts working the first time they sign in. The owner or an editor may use this when the owner has enabled editor-managed sharing.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| string | yes | The address to share with. | |
| role | string | yes | viewer can open it, editor can also publish versions. |
No output schema declared.
No examples provided.
trash_app Move an app to the trash ~84
Move an app to the trash. Its link stops opening at once. Owner only. The app and its versions are kept and can be restored from Trash at reachpad.dev/apps/trash, which is also the only place an app is deleted for good.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
No output schema declared.
No examples provided.
tree Read the folder tree ~45
The whole folder tree for the organization, nested, with the number of apps filed in each folder and the count sitting at the top level. Each node carries the updated_at that mv needs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
update_app Publish a new version ~542
Publish a new version of an existing app. Read the app first and pass the base_version_id read_app returns: it names the version this edit builds on, and a base that has moved is refused rather than overwritten. By default the new version replaces the whole file set and goes live immediately unless the app is set to review before publishing. Send mode merge to publish only the files that changed and keep the rest of that version's files, with remove for paths to drop. Two merges in a row build on each other, staged versions included. Send validate true to check the call without publishing, or publish false to stage the version and make it live later with publish_app_version.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | The app id, as returned by search_apps or create_app. Starts with app_. |
| base_version_id | string | yes | The base_version_id read_app returned, which is the version this edit was made against. Starts with ver_. |
| files | array | yes | Files to publish as plain text, not base64: HTML, Markdown or JavaScript exporting default { fetch }. A page serves index.html at its URL. Functions declaring db include schema changes as migrations/… |
| manifest | object | – | Omit on create_app for a static page; omit on update_app to keep the previous version's manifest. If supplied, replaces the entire manifest: include every field still needed. services, secrets and en… |
| message | string | – | What changed in this version. |
| mode | string | – | replace, the default, publishes files as the whole file set: anything left out is gone. merge sends only the files that changed and carries every other file of the base version into the new version. |
| publish | boolean | – | false stages the version instead of putting it on the link. It is built and readable at its own version URL, and publish_app_version makes it live. Defaults to true. |
| remove | array | – | Paths from the base version to leave out of the new one. Merge only, and a path that is not in the base version is refused rather than ignored. A call that only removes files sends an empty files arr… |
| validate | boolean | – | Check without writing. Validates and returns the resulting file set, total bytes, entry and kind. create_app also validates the slug and returns it with the URL; <tag> stands for five random characte… |
No output schema declared.
No examples provided.
whoami Who am I ~121
Report the account and the organization this connection is signed in as: user id, email and name, plus org id and name, and `orgs`, every organization the account is in with the current one marked. Takes no arguments. Every app is created in the current organization and nowhere else, so call this before publishing when the person named an organization to publish into, and stop if the org id is not the one they named: switching is done at reachpad.dev/apps, from the organization name at the top of the sidebar, and this connection follows it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.Reachpad/reachpad-mcp server?
io.github.Reachpad/reachpad-mcp is a hosted endpoint at https://reachpad.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · reachpad.dev
claude mcp add --transport http reachpad-reachpad-mcp 'https://reachpad.dev/mcp'
What is the io.github.Reachpad/reachpad-mcp server?
io.github.Reachpad/reachpad-mcp is listed in the public MCP registry as io.github.Reachpad/reachpad-mcp. Coding agents build full-stack apps in persistent workspaces and share them by link. This page covers its hosted endpoint (https://reachpad.dev/mcp).
Is the io.github.Reachpad/reachpad-mcp server safe to use?
io.github.Reachpad/reachpad-mcp scores 92 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Reachpad/reachpad-mcp server expose?
io.github.Reachpad/reachpad-mcp exposes 25 tools: whoami, search_apps, read_app, read_app_preview, list_app_versions, and 20 more. Their descriptions and schemas cost roughly 3,492 tokens of context every time the server is loaded.
Does the io.github.Reachpad/reachpad-mcp server require authentication?
Yes. io.github.Reachpad/reachpad-mcp asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the io.github.Reachpad/reachpad-mcp server still maintained?
io.github.Reachpad/reachpad-mcp is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.