XLIDE
PYPI · XLIDE-MCP
Read, write, analyze, test and diff the VBA in Office files, and the document around it
Available components
Last scanned (20 hours ago)
Scores higher than 98% of PyPI servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 2 of 32 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to WilliamSmithEdward/xlide_mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 21 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 15909 tokens (~237/item across 67 items; 65 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 67 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 1 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 30 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 27 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 26 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- 25 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 20 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed pypi/xlide-mcp@1.2.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | WilliamSmithEdward/xlide_mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/WilliamSmithEdward/xlide_mcp/.github/workflows/publish.yml@refs/tags/v1.2.4 |
| Rekor log index | 3245381838 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:3010d28c74f29eeeb80ac7de34e2bcfd6b497363dcef7745e9a52296fcf30983 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 32 packages
| Packages resolved | 32 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
xlide_read_module Read module ~238
The canonical way to read VBA. Returns a module's source as the VBA editor shows it, with the attribute header stripped, plus a content_token. Pass that token back as expected_content_token when you write, and the write is refused if anything changed the module in between. start_line and end_line read a slice of a long module; both are 1-based and inclusive. line_ranges reads several slices in one call, with each pair [first, last] using body line numbers.
| Name | Type | Req | Description |
|---|---|---|---|
| end_line | integer | – | Last line to return. 0 means the end. |
| file_path | string | yes | Absolute path to the Office file. |
| include_header | boolean | – | Include the Attribute VB_* header. Off by default: the header is managed for you on write, and editing it by hand is how a module loses its binding to a sheet or a form. |
| line_ranges | – | – | Optional list of [first, last] inclusive 1-based line ranges. |
| module_name | string | yes | Module name, matched without case. |
| start_line | integer | – | First line to return. 0 means the start. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_read_query Read Power Query ~151
Reads one query's M formula, with its description, group, load target and refresh settings. The formula is the let ... in expression as the Advanced Editor shows it. start_line and end_line read a slice of a long formula; the content_token always describes the whole query. If applied steps cannot be read, steps is null and steps_error gives the reason; the M formula remains available.
| Name | Type | Req | Description |
|---|---|---|---|
| end_line | integer | – | Last formula line. 0 means the end. |
| file_path | string | yes | Absolute path to the Excel workbook. |
| query_name | string | yes | Query name, matched without case. |
| start_line | integer | – | First formula line. 0 means the start. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_remove_duplicates Remove duplicate worksheet rows ~159
Removes later rows with the same values in the chosen columns, keeping the first row of each set, and saves the workbook. A range inside a table acts on the table and shrinks it. An empty columns list compares every column. This deletes data and cannot be undone in the file: ask the user before calling it. Works on .xlsx, .xlsm and .xlam.
| Name | Type | Req | Description |
|---|---|---|---|
| cell_range | string | yes | Range such as A1:D20. |
| columns | – | – | Column letters to compare; omit for all. |
| file_path | string | yes | Absolute path to the Excel file. |
| header | boolean | – | For a plain range: keep its first row. |
| sheet | string | yes | Worksheet name, matched without case. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_rename_module Rename module ~169
Renames a VBA module everywhere its name is stored, and saves the file. Calls to the module's procedures elsewhere in the project are not rewritten; search for the old name first with xlide_search_modules. Document modules such as ThisWorkbook and Sheet1 cannot be renamed, because the host owns them.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_invalidate_signature | boolean | – | Permit saving a change that removes the VBA project's digital signature, where applicable. Set true only after the user agrees. |
| allow_protected | boolean | – | Permit saving a password-protected VBA project. Set true only after the user agrees. |
| file_path | string | yes | Absolute path to the Office file. |
| module_name | string | yes | Module to rename. |
| new_name | string | yes | New name. A valid VBA identifier. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_rules Analyzer rules ~100
The analyzer's rule catalogue: every diagnostic code with its title, default severity, category, whether it mirrors a VBA compile failure, and the MS-VBAL section it enforces. Use it to explain a code to the user, or to decide whether a finding is a compile error or a judgement call.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | One rule code. Empty lists them all. |
| search | string | – | Only rules whose code or title contains this. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_run_macro Run a macro ~249
Runs a procedure that already exists in an Office file, in an application this server starts and owns, under a deadline. Windows only, with the application installed. The document opens read-only unless read_only=false, and closes without saving unless save=true. Returns the procedure's return value, anything it logged, and, on a VBA error, the error number and message. The failing line and call stack come from instrumentation applied to injected source, so a procedure already in the document does not carry them; run the same code through xlide_run_vba when you need them. A run that exceeds its timeout reports 'timeout' and the application is terminated. Ask the user before running a macro that changes data.
| Name | Type | Req | Description |
|---|---|---|---|
| args | – | – | Arguments, in order. Scalars only. |
| file_path | string | yes | Absolute path to the Office file. |
| procedure | string | yes | Procedure to call, as 'Proc' or 'Module.Proc'. |
| read_only | boolean | – | Open the document read-only. False lets the macro change it. |
| save | boolean | – | Save the document after the run. Needs read_only=false. |
| timeout | number | – | Seconds before the run is terminated. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_run_tests Run VBA tests ~148
Runs the VBA tests in an Office file: every zero-argument procedure whose name starts with Test. Windows only, with the application installed. Each test is run on its own, so one that hangs is reported as a timeout and the rest still run. Returns pass or fail per test with the assertion message, failing line, call stack and any logged output. Use PyVbaAssert and PyVbaAssertEqual in the tests; the harness supplies them.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the Office file. |
| module_name | string | – | Run only this module's tests. Empty runs every module's. |
| timeout | number | – | Seconds allowed for each test. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_run_vba Run VBA source ~232
Injects VBA source into a document and calls one procedure from it, under a deadline. Windows only. Use it to check what a piece of code actually does before writing it into a file, or to read something out of a document that no existing macro exposes. With no file_path it runs in a new empty document. Errors come back as data with the failing line and call stack, never as a dialog. Call PyVbaLog "text" from the code to return output; Debug.Print and MsgBox do not work under automation.
| Name | Type | Req | Description |
|---|---|---|---|
| args | – | – | Arguments, in order. Scalars only. |
| file_path | string | – | Run against this document instead of a new empty one. |
| host | string | – | 'excel', 'word', 'powerpoint' or 'access'. Ignored with file_path. |
| procedure | string | – | Procedure to call. Empty calls the first one in the source. |
| read_only | boolean | – | Open the document read-only. |
| source | string | yes | VBA source to inject. |
| timeout | number | – | Seconds before the run is terminated. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_search_modules Search VBA ~189
Searches every module's source in an Office file and returns each match with its module, line number and the line itself. Use it to find where a name is declared or used before changing it. content_tokens maps returned module names to tokens for guarded xlide_edit_module calls without a separate read. Use offset and next_offset to page through broad searches; total_match_count counts all matches. Plain text by default; set is_regex for a Python regular expression.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the Office file. |
| is_regex | boolean | – | Treat query as a regular expression. |
| match_case | boolean | – | Match case. Off by default, because VBA itself ignores case. |
| max_results | integer | – | Return at most this many matches. |
| offset | integer | – | Skip this many matches before a page. |
| query | string | yes | Text or pattern to find. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_set_shape_macro Point a shape at a macro ~172
Changes which macro an existing shape or button runs when clicked, and saves the workbook. An empty macro clears the link. Use it after writing a Sub, so a button actually calls it, and after renaming one, because nothing rewrites an OnAction. Give the procedure as Proc or Module.Proc; it must already exist in the project, so write it first. To add a button with its macro, or to remove one, use xlide_manage_shape.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the Excel file. |
| macro | string | yes | The procedure to run, as Proc or Module.Proc. Empty clears the link. |
| shape_name | string | yes | Shape name, as xlide_list_shapes reports it. |
| sheet | string | yes | Worksheet the shape is on. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_sort_rows Sort worksheet rows ~244
Sorts a range, a table's data rows, or a sheet autofilter's data rows, and saves the workbook. Keys are evaluated in order; each names a column letter for a range or filter, or a header name for a table. A range can keep its first row as a header. Hidden rows keep their places. Formulas, formatting, notes and links move with their rows. This changes existing data order and has no undo in the file: ask the user before calling it. Works on .xlsx, .xlsm and .xlam.
| Name | Type | Req | Description |
|---|---|---|---|
| cell_range | string | – | For target='range': block such as A1:D20. |
| file_path | string | yes | Absolute path to the Excel file. |
| header | boolean | – | For a range: leave its first row in place. |
| keys | array | yes | Ordered sort keys; each names a column and direction. |
| match_case | boolean | – | Use case-sensitive text order. |
| sheet | string | yes | Worksheet name, matched without case. |
| table_name | string | – | For target='table': table name. |
| target | string | – | range, table or filter. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_update_shape Update a shape or form control ~253
Moves, resizes, renames or changes an existing shape's text, alt text or visibility without replacing it. A Forms control can also change its linked cell or list range. Coordinates and sizes are in points; omit any field to leave it unchanged, and pass an empty text or link to clear it. ActiveX, embedded objects and groups cannot be updated. Works on .xlsx, .xlsm and .xlam.
| Name | Type | Req | Description |
|---|---|---|---|
| alt_text | – | – | New accessibility text; empty clears it. |
| file_path | string | yes | Absolute path to the Excel file. |
| height | – | – | New height in points. |
| hidden | – | – | Hide or show the shape. |
| left | – | – | New left position in points. |
| linked_cell | – | – | Forms control link; empty clears it. |
| list_range | – | – | Forms list source; empty clears it. |
| new_name | – | – | New name; omit to keep the current one. |
| shape_name | string | yes | Current name from xlide_list_shapes. |
| sheet | string | yes | Worksheet name, matched without case. |
| text | – | – | New caption or text; empty clears it. |
| top | – | – | New top position in points. |
| width | – | – | New width in points. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_validate_project Validate VBA project ~125
Checks a file's VBA project for structural problems: records that disagree with each other, a module the directory names but the container does not hold, and the like. This is about the container, not about the code; use xlide_analyze for the code. Worth calling before risky work on an old or repaired file. Use offset and next_offset to read later problems from a damaged file.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path to the Office file. |
| max_results | integer | – | Most problems to return. |
| offset | integer | – | Problems to skip. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_write_cells Write cells ~383
Writes a rectangular block of values and formulas into a worksheet, starting at one cell, and saves the file. Each row of data is a row of the sheet. A string starting with '=' is written as a formula, as you would type it into Excel 365 with no _xlfn prefixes; anything else is a value. A cell given as {"rich_text": [{"text": "Total ", "bold": true}, {"text": "42"}]} is text in more than one font. A value written over a formula removes that formula, which is what typing into the cell does. On .xlsx, .xlsm and .xlam, only the touched worksheet rows are rewritten; their cached formula results remain stale until Excel opens the file or xlide_read_cells calculates them in memory. Writing .xlsb cells needs Windows with Excel, which recalculates and saves the workbook. Writing .xls cells is not offered. Cells that hold data are refused until allow_overwrite=true; ask the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_overwrite | boolean | – | Allow replacing cells that already hold data or formulas. Ask the user first. Without it, the write is refused before saving. |
| data | array | yes | Rows of cell values. Numbers, strings, booleans, null for empty, strings starting with '=' for formulas, and {"rich_text": [runs]} for text in several fonts, each run a text with any of bold, italic,… |
| file_path | string | yes | Absolute path to the Excel file. |
| sheet | string | yes | Worksheet name, matched without case. |
| start_cell | string | yes | Top-left cell of the block, such as B2. |
| timeout | number | – | Seconds allowed if Excel has to do the write. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_write_module Write module ~325
The canonical way to change VBA. Writes a module's source into the Office file and saves it. It replaces the module's whole source, so send all of it; send the body only, because the attribute header is managed for you. A module that does not exist is created: standard by default, or a class with kind='class'. Pass expected_content_token from your read and the write is refused if the module changed since. The result carries a diff of what the file now holds, read back after saving, which is what to show the user when they ask what changed. After writing, call xlide_analyze and treat any error as a build failure. Identical source is reported without saving. Ask the user first when the project is protected or signed.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_invalidate_signature | boolean | – | Write to a digitally signed project, dropping the signature. Ask the user first. |
| allow_protected | boolean | – | Write to a password-protected project. Ask the user first. |
| expected_content_token | string | – | The content_token from your read. Leave empty only when creating a module. |
| file_path | string | yes | Absolute path to the Office file. |
| include_diff | boolean | – | Include a unified diff of what changed. Off in a loop that writes many modules and reads none of them back. |
| kind | string | – | Kind for a module being created: 'standard' or 'class'. |
| module_name | string | yes | Module to write, or to create. |
| source | string | yes | The module's complete VBA source. |
Structured output declared, but exposes no named fields.
No examples provided.
xlide_write_query Write Power Query ~417
Changes a workbook's Power Query and saves it. action='set' replaces a query's M formula, creating it if it does not exist; 'rename' renames it and rewrites the queries that reference it by name; 'remove' deletes it and everything that loaded it onto a sheet, which has no undo, so ask the user first. 'load' puts a query's result on a worksheet and 'unload' takes it back off. Loading needs the column names, because writing the connection means naming the columns and knowing them means running the query, which nothing here does; Excel settles them against the real result on the first refresh. A query already loaded keeps its rows until Excel refreshes it. Pass expected_content_token from xlide_read_query to refuse a change if that query changed meanwhile.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | 'set', 'rename', 'remove', 'load' or 'unload'. |
| cell | string | – | For load: the table's top-left cell. |
| columns | – | – | For load: the column names the query returns, in order. Required, because the connection has to name them and nothing here runs the query to find out. Excel corrects them on the first refresh. |
| description | string | – | For set: the query's description. |
| expected_content_token | string | – | Optional read token to guard the change. |
| file_path | string | yes | Absolute path to the Excel workbook. |
| formula | string | – | For set: the whole M expression, such as 'let Source = 1 in Source'. |
| group | string | – | For set on a new query: the folder in the Queries pane. |
| include_diff | boolean | – | For set: include a unified diff of the M that changed. Nothing to diff for the other actions. |
| new_name | string | – | For rename: the new name. |
| query_name | string | yes | The query to change. |
| sheet | string | – | For load: the worksheet. Empty uses the first. |
Structured output declared, but exposes no named fields.
No examples provided.
How do I install the XLIDE MCP server?
XLIDE runs locally as a PyPI package, launched with uvx xlide-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · xlide-mcp
claude mcp add williamsmithedward-xlide-excel-office-vba-mcp -- uvx xlide-mcp
What is the XLIDE MCP server?
XLIDE is an MCP server listed in the public MCP registry as io.github.WilliamSmithEdward/xlide-excel-office-vba-mcp. Read, write, analyze, test and diff the VBA in Office files, and the document around it. This page covers its PyPI package (xlide-mcp).
Is the XLIDE MCP server safe to use?
XLIDE scores 96 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the XLIDE MCP server expose?
XLIDE exposes 65 tools: xlide_list_projects, xlide_project_info, xlide_validate_project, xlide_create_project, xlide_doctor, and 60 more. Their descriptions and schemas cost roughly 14,849 tokens of context every time the server is loaded.
Is the XLIDE MCP server still maintained?
XLIDE is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the XLIDE MCP server under?
XLIDE declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.