Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

XLIDE

PYPI · XLIDE-MCP

Read, write, analyze, test and diff the VBA in Office files, and the document around it

Available components

+15 this week 96 Trust /100

Last scanned (20 hours ago)

Scores higher than 98% of PyPI servers

Category Documents and Files

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 2 of 32 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to WilliamSmithEdward/xlide_mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 21 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 15909 tokens (~237/item across 67 items; 65 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 67 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 1 Nov 26 −15
    • Malware scan: pass → unverified ▼ security
  • 30 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 28 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
  • 27 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 26 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
  • 25 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 20 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed pypi/xlide-mcp@1.2.4

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo WilliamSmithEdward/xlide_mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/WilliamSmithEdward/xlide_mcp/.github/workflows/publish.yml@refs/tags/v1.2.4
Rekor log index 3245381838
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:3010d28c74f29eeeb80ac7de34e2bcfd6b497363dcef7745e9a52296fcf30983

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted setuptools.build_meta

Background: Why install scripts are a supply-chain risk →

Dependencies 32 packages
Packages resolved 32
Stale 1
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 65 exposed · ~14,849 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
xlide_read_module ~238

The canonical way to read VBA. Returns a module's source as the VBA editor shows it, with the attribute header stripped, plus a content_token. Pass that token back as expected_content_token when you write, and the write is refused if anything changed the module in between. start_line and end_line read a slice of a long module; both are 1-based and inclusive. line_ranges reads several slices in one call, with each pair [first, last] using body line numbers.

NameTypeReqDescription
end_lineinteger–Last line to return. 0 means the end.
file_pathstringyesAbsolute path to the Office file.
include_headerboolean–Include the Attribute VB_* header. Off by default: the header is managed for you on write, and editing it by hand is how a module loses its binding to a sheet or a form.
line_ranges––Optional list of [first, last] inclusive 1-based line ranges.
module_namestringyesModule name, matched without case.
start_lineinteger–First line to return. 0 means the start.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_read_query ~151

Reads one query's M formula, with its description, group, load target and refresh settings. The formula is the let ... in expression as the Advanced Editor shows it. start_line and end_line read a slice of a long formula; the content_token always describes the whole query. If applied steps cannot be read, steps is null and steps_error gives the reason; the M formula remains available.

NameTypeReqDescription
end_lineinteger–Last formula line. 0 means the end.
file_pathstringyesAbsolute path to the Excel workbook.
query_namestringyesQuery name, matched without case.
start_lineinteger–First formula line. 0 means the start.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_remove_duplicates ~159

Removes later rows with the same values in the chosen columns, keeping the first row of each set, and saves the workbook. A range inside a table acts on the table and shrinks it. An empty columns list compares every column. This deletes data and cannot be undone in the file: ask the user before calling it. Works on .xlsx, .xlsm and .xlam.

NameTypeReqDescription
cell_rangestringyesRange such as A1:D20.
columns––Column letters to compare; omit for all.
file_pathstringyesAbsolute path to the Excel file.
headerboolean–For a plain range: keep its first row.
sheetstringyesWorksheet name, matched without case.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_rename_module ~169

Renames a VBA module everywhere its name is stored, and saves the file. Calls to the module's procedures elsewhere in the project are not rewritten; search for the old name first with xlide_search_modules. Document modules such as ThisWorkbook and Sheet1 cannot be renamed, because the host owns them.

NameTypeReqDescription
allow_invalidate_signatureboolean–Permit saving a change that removes the VBA project's digital signature, where applicable. Set true only after the user agrees.
allow_protectedboolean–Permit saving a password-protected VBA project. Set true only after the user agrees.
file_pathstringyesAbsolute path to the Office file.
module_namestringyesModule to rename.
new_namestringyesNew name. A valid VBA identifier.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_rules ~100

The analyzer's rule catalogue: every diagnostic code with its title, default severity, category, whether it mirrors a VBA compile failure, and the MS-VBAL section it enforces. Use it to explain a code to the user, or to decide whether a finding is a compile error or a judgement call.

NameTypeReqDescription
codestring–One rule code. Empty lists them all.
searchstring–Only rules whose code or title contains this.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_run_macro ~249

Runs a procedure that already exists in an Office file, in an application this server starts and owns, under a deadline. Windows only, with the application installed. The document opens read-only unless read_only=false, and closes without saving unless save=true. Returns the procedure's return value, anything it logged, and, on a VBA error, the error number and message. The failing line and call stack come from instrumentation applied to injected source, so a procedure already in the document does not carry them; run the same code through xlide_run_vba when you need them. A run that exceeds its timeout reports 'timeout' and the application is terminated. Ask the user before running a macro that changes data.

NameTypeReqDescription
args––Arguments, in order. Scalars only.
file_pathstringyesAbsolute path to the Office file.
procedurestringyesProcedure to call, as 'Proc' or 'Module.Proc'.
read_onlyboolean–Open the document read-only. False lets the macro change it.
saveboolean–Save the document after the run. Needs read_only=false.
timeoutnumber–Seconds before the run is terminated.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_run_tests ~148

Runs the VBA tests in an Office file: every zero-argument procedure whose name starts with Test. Windows only, with the application installed. Each test is run on its own, so one that hangs is reported as a timeout and the rest still run. Returns pass or fail per test with the assertion message, failing line, call stack and any logged output. Use PyVbaAssert and PyVbaAssertEqual in the tests; the harness supplies them.

NameTypeReqDescription
file_pathstringyesAbsolute path to the Office file.
module_namestring–Run only this module's tests. Empty runs every module's.
timeoutnumber–Seconds allowed for each test.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_run_vba ~232

Injects VBA source into a document and calls one procedure from it, under a deadline. Windows only. Use it to check what a piece of code actually does before writing it into a file, or to read something out of a document that no existing macro exposes. With no file_path it runs in a new empty document. Errors come back as data with the failing line and call stack, never as a dialog. Call PyVbaLog "text" from the code to return output; Debug.Print and MsgBox do not work under automation.

NameTypeReqDescription
args––Arguments, in order. Scalars only.
file_pathstring–Run against this document instead of a new empty one.
hoststring–'excel', 'word', 'powerpoint' or 'access'. Ignored with file_path.
procedurestring–Procedure to call. Empty calls the first one in the source.
read_onlyboolean–Open the document read-only.
sourcestringyesVBA source to inject.
timeoutnumber–Seconds before the run is terminated.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_search_modules ~189

Searches every module's source in an Office file and returns each match with its module, line number and the line itself. Use it to find where a name is declared or used before changing it. content_tokens maps returned module names to tokens for guarded xlide_edit_module calls without a separate read. Use offset and next_offset to page through broad searches; total_match_count counts all matches. Plain text by default; set is_regex for a Python regular expression.

NameTypeReqDescription
file_pathstringyesAbsolute path to the Office file.
is_regexboolean–Treat query as a regular expression.
match_caseboolean–Match case. Off by default, because VBA itself ignores case.
max_resultsinteger–Return at most this many matches.
offsetinteger–Skip this many matches before a page.
querystringyesText or pattern to find.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_set_shape_macro ~172

Changes which macro an existing shape or button runs when clicked, and saves the workbook. An empty macro clears the link. Use it after writing a Sub, so a button actually calls it, and after renaming one, because nothing rewrites an OnAction. Give the procedure as Proc or Module.Proc; it must already exist in the project, so write it first. To add a button with its macro, or to remove one, use xlide_manage_shape.

NameTypeReqDescription
file_pathstringyesAbsolute path to the Excel file.
macrostringyesThe procedure to run, as Proc or Module.Proc. Empty clears the link.
shape_namestringyesShape name, as xlide_list_shapes reports it.
sheetstringyesWorksheet the shape is on.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_sort_rows ~244

Sorts a range, a table's data rows, or a sheet autofilter's data rows, and saves the workbook. Keys are evaluated in order; each names a column letter for a range or filter, or a header name for a table. A range can keep its first row as a header. Hidden rows keep their places. Formulas, formatting, notes and links move with their rows. This changes existing data order and has no undo in the file: ask the user before calling it. Works on .xlsx, .xlsm and .xlam.

NameTypeReqDescription
cell_rangestring–For target='range': block such as A1:D20.
file_pathstringyesAbsolute path to the Excel file.
headerboolean–For a range: leave its first row in place.
keysarrayyesOrdered sort keys; each names a column and direction.
match_caseboolean–Use case-sensitive text order.
sheetstringyesWorksheet name, matched without case.
table_namestring–For target='table': table name.
targetstring–range, table or filter.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_update_shape ~253

Moves, resizes, renames or changes an existing shape's text, alt text or visibility without replacing it. A Forms control can also change its linked cell or list range. Coordinates and sizes are in points; omit any field to leave it unchanged, and pass an empty text or link to clear it. ActiveX, embedded objects and groups cannot be updated. Works on .xlsx, .xlsm and .xlam.

NameTypeReqDescription
alt_text––New accessibility text; empty clears it.
file_pathstringyesAbsolute path to the Excel file.
height––New height in points.
hidden––Hide or show the shape.
left––New left position in points.
linked_cell––Forms control link; empty clears it.
list_range––Forms list source; empty clears it.
new_name––New name; omit to keep the current one.
shape_namestringyesCurrent name from xlide_list_shapes.
sheetstringyesWorksheet name, matched without case.
text––New caption or text; empty clears it.
top––New top position in points.
width––New width in points.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_validate_project ~125

Checks a file's VBA project for structural problems: records that disagree with each other, a module the directory names but the container does not hold, and the like. This is about the container, not about the code; use xlide_analyze for the code. Worth calling before risky work on an old or repaired file. Use offset and next_offset to read later problems from a damaged file.

NameTypeReqDescription
file_pathstringyesAbsolute path to the Office file.
max_resultsinteger–Most problems to return.
offsetinteger–Problems to skip.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_write_cells ~383

Writes a rectangular block of values and formulas into a worksheet, starting at one cell, and saves the file. Each row of data is a row of the sheet. A string starting with '=' is written as a formula, as you would type it into Excel 365 with no _xlfn prefixes; anything else is a value. A cell given as {"rich_text": [{"text": "Total ", "bold": true}, {"text": "42"}]} is text in more than one font. A value written over a formula removes that formula, which is what typing into the cell does. On .xlsx, .xlsm and .xlam, only the touched worksheet rows are rewritten; their cached formula results remain stale until Excel opens the file or xlide_read_cells calculates them in memory. Writing .xlsb cells needs Windows with Excel, which recalculates and saves the workbook. Writing .xls cells is not offered. Cells that hold data are refused until allow_overwrite=true; ask the user first.

NameTypeReqDescription
allow_overwriteboolean–Allow replacing cells that already hold data or formulas. Ask the user first. Without it, the write is refused before saving.
dataarrayyesRows of cell values. Numbers, strings, booleans, null for empty, strings starting with '=' for formulas, and {"rich_text": [runs]} for text in several fonts, each run a text with any of bold, italic,…
file_pathstringyesAbsolute path to the Excel file.
sheetstringyesWorksheet name, matched without case.
start_cellstringyesTop-left cell of the block, such as B2.
timeoutnumber–Seconds allowed if Excel has to do the write.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_write_module ~325

The canonical way to change VBA. Writes a module's source into the Office file and saves it. It replaces the module's whole source, so send all of it; send the body only, because the attribute header is managed for you. A module that does not exist is created: standard by default, or a class with kind='class'. Pass expected_content_token from your read and the write is refused if the module changed since. The result carries a diff of what the file now holds, read back after saving, which is what to show the user when they ask what changed. After writing, call xlide_analyze and treat any error as a build failure. Identical source is reported without saving. Ask the user first when the project is protected or signed.

NameTypeReqDescription
allow_invalidate_signatureboolean–Write to a digitally signed project, dropping the signature. Ask the user first.
allow_protectedboolean–Write to a password-protected project. Ask the user first.
expected_content_tokenstring–The content_token from your read. Leave empty only when creating a module.
file_pathstringyesAbsolute path to the Office file.
include_diffboolean–Include a unified diff of what changed. Off in a loop that writes many modules and reads none of them back.
kindstring–Kind for a module being created: 'standard' or 'class'.
module_namestringyesModule to write, or to create.
sourcestringyesThe module's complete VBA source.

Structured output declared, but exposes no named fields.

No examples provided.

xlide_write_query ~417

Changes a workbook's Power Query and saves it. action='set' replaces a query's M formula, creating it if it does not exist; 'rename' renames it and rewrites the queries that reference it by name; 'remove' deletes it and everything that loaded it onto a sheet, which has no undo, so ask the user first. 'load' puts a query's result on a worksheet and 'unload' takes it back off. Loading needs the column names, because writing the connection means naming the columns and knowing them means running the query, which nothing here does; Excel settles them against the real result on the first refresh. A query already loaded keeps its rows until Excel refreshes it. Pass expected_content_token from xlide_read_query to refuse a change if that query changed meanwhile.

NameTypeReqDescription
actionstringyes'set', 'rename', 'remove', 'load' or 'unload'.
cellstring–For load: the table's top-left cell.
columns––For load: the column names the query returns, in order. Required, because the connection has to name them and nothing here runs the query to find out. Excel corrects them on the first refresh.
descriptionstring–For set: the query's description.
expected_content_tokenstring–Optional read token to guard the change.
file_pathstringyesAbsolute path to the Excel workbook.
formulastring–For set: the whole M expression, such as 'let Source = 1 in Source'.
groupstring–For set on a new query: the folder in the Queries pane.
include_diffboolean–For set: include a unified diff of the M that changed. Nothing to diff for the other actions.
new_namestring–For rename: the new name.
query_namestringyesThe query to change.
sheetstring–For load: the worksheet. Empty uses the first.

Structured output declared, but exposes no named fields.

No examples provided.

Install

How do I install the XLIDE MCP server?

XLIDE runs locally as a PyPI package, launched with uvx xlide-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · xlide-mcp

# add to Claude Code
claude mcp add williamsmithedward-xlide-excel-office-vba-mcp -- uvx xlide-mcp
Common questions

What is the XLIDE MCP server?

XLIDE is an MCP server listed in the public MCP registry as io.github.WilliamSmithEdward/xlide-excel-office-vba-mcp. Read, write, analyze, test and diff the VBA in Office files, and the document around it. This page covers its PyPI package (xlide-mcp).

Is the XLIDE MCP server safe to use?

XLIDE scores 96 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the XLIDE MCP server expose?

XLIDE exposes 65 tools: xlide_list_projects, xlide_project_info, xlide_validate_project, xlide_create_project, xlide_doctor, and 60 more. Their descriptions and schemas cost roughly 14,849 tokens of context every time the server is loaded.

Is the XLIDE MCP server still maintained?

XLIDE is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the XLIDE MCP server under?

XLIDE declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.