Valet MCP Server

Permanently delete a website and stop serving it. Identify it by name, which requires connecting a Valet account, or by the site_token returned when it was published anonymously — whoever published a site can always take it down. This cannot be undone.

Get one website's URL, access mode, version, and expiry. Identify it by name, which requires connecting a Valet account, or by the site_token returned when it was published anonymously. A password-protected site reports that it is gated and never its visitor password. Read the password from the Valet dashboard instead.

List the connectors attached to a website, each with the tools a page served from that site can call. Read it before writing a page that calls one: the tool names and argument schemas it returns are what the page's own calls have to match, and guessing them produces a page that fails on its first click. It lists what is attached to this one site, not what the organization has available. A connector nobody attached to this site does not appear here, and attaching one is a separate, deliberate act — it hands the connector's reach to everyone who can open the page. Each connector says whether a page can call it, and whether the server keeps an MCP session the page must hold — the page runs the initialize handshake, replays the Mcp-Session-Id header, and re-initializes when the session lapses. The broker forwards the handshake and the tool calls, and always hands the page one JSON document per request, whatever framing the server chose. A connector that could not be reached reports its own error and leaves every other row intact, so one expired credential does not hide the rest. Requires connecting a Valet account.

Set who can reach a website: public serves it to anyone who has the link, private serves it only to members of the organization that owns it, and password serves it to anyone who enters a shared visitor password. Requires connecting a Valet account. Password mode takes the password as the password argument. It is a shared visitor password the owner hands to whoever should see the site, not a Valet credential, and it is at most 72 bytes.

Create an organization connector from a Valet catalog entry. It is the step after list_catalog_connectors found the entry for the product the user named; attach_site_connector then lets a website's pages call it. It creates an entry whose credential is a secret. Pass each slot the entry asks for in secrets, as slot name to value. A slot the organization already holds as a secret needs no value here. If a required slot has neither, nothing is created and the answer names the slots still needed. A key given here passes through this conversation. That is a real cost and it is the user's call to make: if they hand you the key, use it, and say that they could instead enter it on the dashboard's Integrations page, where it goes straight to Valet. The answer names the slots that were filled and never the values in them. An entry that authorizes in a browser — OAuth, or a Composio toolkit — is not created here. The answer gives the entry's name and the Integrations page, which creates the connector and runs the authorization in one place. An entry the organization already has is reported as already there; no second connector is made. Requires connecting a Valet account.

Get how a page served from a Valet site talks to the connectors attached to it. It is the pair to get_design_system: consult that tool for the artifact's identity, this one for how it talks to its connectors. Call it before writing any page code that fetches from a connector. Returns the same-origin request contract and a paste-whole session helper that handles both sessionless and stateful connectors, plus the rules a page has to follow: handling a 403, recovering a lapsed session, and never caching a response on the caller's behalf. This needs no Valet account. It answers with static guidance about how pages work — nothing here reads an organization or a site — so an agent can call it before running any OAuth flow.

Attach an organization connector to a website so pages served from that site can call the connector's tools. Attaching is a grant, and it is wider than it looks: every person who can open the page can call every tool the connector exposes, using the credential Valet holds for it. On a private site that is every member of the organization; on a password-protected or shared one it is everyone holding the password or the link. Valet does not narrow the connector's reach for a page, so attach only what the page needs and check the site's access mode before you do. Only an organization connector that is an HTTP MCP server — transport sse or streamable-http — can be attached; list_attachable_connectors reports exactly that set. A connector that belongs to a single agent cannot back a page. A page calls the connector by its own name, which is what list_site_connectors reports and what the page's request path carries. Attaching a connector that is already attached changes nothing and is safe to repeat. Requires connecting a Valet account.

List the organization connectors a website can hold — the discovery step before attach_site_connector. Only connectors a page can actually call appear: HTTP MCP servers reached over the sse or streamable-http transport. Command connectors and stdio MCP servers are excluded by definition — they run inside an agent's container and no page can reach them — so a connector the organization has that is not listed here cannot back a site. Pass site to mark which connectors that site already holds; attached connectors stay listed because attaching is idempotent. Tool schemas are not included — attach the connector, then list_site_connectors reports its live tools and their schemas, which is the moment to write the page's calls. Requires connecting a Valet account.

Run one tool on a connector attached to a website and return what the connector answered. It is the sampling step of building a page that calls live data: discover, attach, read the schemas, then call one tool for real before you write any page code. Call it because a schema is not a shape. list_site_connectors gives you each tool's name and argument schema, which is what your call has to satisfy; this tells you what comes back, which is what the page has to parse. Results are text to read, not JSON to assume: many servers answer in markdown tables or prose, some expose a single meta-tool taking a whole command as one string, and a server that completes the handshake can still refuse half its tools when the stored credential's scope does not cover them. One real call settles all three. This runs the tool for real, with the organization's own credential and whatever side effects the tool has. It is not a dry run and there is no preview: a tool that sends, writes, or deletes will do so. Prefer a read-only tool when you are only learning the shape, and ask the user before running anything that changes their systems. The connector must already be attached to the site — attach_site_connector does that — and must be an HTTP MCP server. A tool that answers with an error is reported as an error carrying the connector's own text, which is usually the sentence that says what to fix. Requires connecting a Valet account.

List the connectors Valet curates — the catalog an organization creates a connector from. Reach for it when list_attachable_connectors returned nothing that serves the data a page needs: the organization has no connector for it yet, and this says whether Valet has an entry for the product and what setting it up would take. Each entry says how its credential arrives. An entry that takes a secret names each slot it asks for and what the slot is. An entry that authorizes in a browser, or connects through Composio, says so — a person completes those on the dashboard's Integrations page, and no answer here can stand in for that. Each entry also says whether a website's pages could call it. That is a marker, not a filter: an entry only an agent's container can run is still listed, because "Valet has your product, but no page can call it" is a real answer and reporting it as missing is not. Requires connecting a Valet account.

Get the identity brief to follow before you build or substantially rewrite an artifact. Returns the caller's organization design system when it has one, otherwise the Valet default. Honor an artifact form the user requests. Otherwise choose the artifact form and treatment from its audience, job, and material. The design system supplies identity, not structure. Follow it wherever it speaks, subject to the user's explicit request and to safety, accessibility, and medium correctness. Artifact guidance and model judgment decide every choice it leaves open; do not layer the default design system beneath it. Files a user supplies finished are published unchanged, not restyled. By default this requires a connected account. Pass anonymous: true only when building an explicitly anonymous site; no organization is then consulted and the Valet default is returned.

Detach a connector from a website, so pages served from that site can no longer call it. The connector itself is left in place for the rest of the organization, and nothing else about the site changes. This is how the grant attaching made is taken back. While a connector is attached, everyone who can open the page can call every tool it exposes with the credential Valet holds, so detaching is the way to end that reach. A page that still calls the connector starts getting an error, which is the intended outcome. Requires connecting a Valet account.

Publish files as a live website on the public internet, served over HTTPS. Use it when a report, essay, slide-like narrative, dashboard, marketing surface, or other static artifact reads better at a live URL than as conversation text. Honor an artifact form the user requests. Otherwise choose the artifact form and treatment from its audience, job, and material. A request for a live URL chooses delivery, not one long scrolling page. Before building or substantially rewriting an artifact, call get_design_system. The organization design system supplies identity, not structure. Follow it wherever it speaks. Artifact guidance and model judgment decide the remaining choices; do not layer the default design system beneath it. Safety, accessibility, and medium correctness may adapt an identity choice. When the artifact is HTML, render it at 390px and verify the document itself does not overflow. Give wide flex or grid children min-width: 0. Use minmax(0, 1fr) for flexible tracks so local scrollers stay local. When a local scroller is necessary, show a visible cue when more content is available. For a table, keep the identifying column visible when practical or use another narrow-screen representation. Inspect computed foreground and background colors and verify rendered text contrast on every surface; safe tokens do not prove the intended selectors matched. Valet may place a bottom-center dock over the published page. When the page scrolls vertically, give its main scroll container bottom padding or equivalent clearance of about calc(6rem + env(safe-area-inset-bottom)) so the final content can scroll fully above the dock. Do not introduce scrolling solely to create this clearance. For fixed-height or slide-like artifacts, keep essential content and controls away from the bottom center when the composition allows. title and description are required on every publish, and a call missing either is refused: title names the site for a person, and description says in one sentence what it holds. A site's name is a hostname, so those two are what a reader has to go on wherever the site is listed. Write them for the person who will come back to this page in a month. Content is text written here: HTML, CSS, JavaScript, Markdown, JSON, SVG. Images, PDFs, video, and other binary assets are not supported on this surface — publish those with the Valet CLI. Publishing uses a connected Valet account by default and creates a permanent, private site. Pass anonymous: true only when the user explicitly wants a temporary public site. It is public to anyone who has the link, and it may be removed 36 hours after it is created, unless it is claimed. The result carries a claim URL that moves the site into a Valet account and makes it permanent, and a site_token that updates the same site on a later call. Give that token back to revise the site instead of publishing a second copy of it; with an account, give the site's name instead.

Rename a website and move it to the URL derived from its new name. The old URL stops serving the site and its name becomes available to another site or app in the same organization. Requires connecting a Valet account.

Share a website with specific people by email, whether it is private or password-protected — sharing does not change who else can reach it. Each address is mailed a link from Valet that opens the site; the recipient needs no Valet account of their own, only the link, so anyone holding the email can open the site and forwarding it forwards access. Sharing again with an address that already has access re-sends the same link rather than creating a second one. Requires connecting a Valet account.

List the websites in a Valet organization: name, URL, access mode, and when each was last published. It is the way to recover a site's name when an earlier publish has scrolled out of the conversation. Requires connecting a Valet account.