---
title: Tools reference
description: Every shebang-mcp tool, grouped by service, with its real arguments and which ones require confirm.
---

# Tools reference

The local server registers 39 tools (38 always on, plus
`store_upload_file`); the hosted server (see [hosted MCP](/mcp/hosted-mcp))
registers the same 38 plus `store_upload_content` in place of
`store_upload_file` — 40 distinct tool names between the two. Arguments
marked `?` are optional; everything else is required. `confirm` columns
name the exact value the argument must equal — get it wrong and the tool
throws client-side before any network call.

## platform

HTTP routes: [platform](/api/platform).

| Tool | Arguments | Confirm |
| --- | --- | --- |
| `oauth_list_clients` | none | |
| `oauth_create_client` | `name` (string, 1-60), `redirect_uris` (string[], min 1), `client_type?` (`confidential` \| `public`, default `confidential`) | |
| `project_create` | `name` (string, 1-60), `tag` (string, 1-24), `color` (enum, see below), `slug` (string, 3-30, `^[a-z0-9_]{3,30}$`) | |
| `project_list` | none | |
| `project_get` | `id` (string) | |
| `project_set` | `id` (string), `name?`, `tag?`, `color?`, `slug?`, `oauth_client_id?` (string \| null) | |
| `project_resources` | `id` (string) | |
| `project_delete` | `id` (string), `confirm` (string), `move_to?` (string, another project's slug) | = `id` |
| `project_assign` | `id` (string), `resource_type` (`page` \| `object` \| `link` \| `database` \| `key`), `resource_id` (string) | |
| `project_unassign` | `id` (string), `resource_type` (same enum), `resource_id` (string) | |
| `project_grant_key` | `key_id` (string), `project` (string, slug or id), `level` (`read` \| `full`) | |
| `project_revoke_grant` | `key_id` (string), `project` (string, slug or id) | |
| `key_create_app` | `name` (string, 1-60), `apps` (array of `page` \| `serve` \| `link` \| `base`, min 1), `project?` (string, slug) | |
| `key_list` | none | |
| `key_revoke` | `keyId` (string), `confirm` (string) | = `keyId` |
| `email_send` | `to` (string), `subject` (string, 1-200), `text` (string, 1-50,000) | |

`project_create`/`project_set`'s `color` is a curated enum, not an
arbitrary hex value — one of: `#ef4444`, `#f97316`, `#f59e0b`, `#84cc16`,
`#22c55e`, `#14b8a6`, `#06b6d4`, `#3b82f6`, `#6366f1`, `#8b5cf6`,
`#a855f7`, `#ec4899`.

## sherpage

HTTP routes: [sherpage](/api/sherpage).

| Tool | Arguments | Confirm |
| --- | --- | --- |
| `sherpage_publish` | `title` (string, 1-200), `slug?`, `access?` (`private` \| `password` \| `allow_list` \| `public`), `entrypoint?`, `expiresAt?` (ISO 8601), `maxViews?` (positive int), `password?`, `allow?` (string[]), `files` (array of `{path, content, encoding: "utf8" | "base64"}`, min 1), `project?` | |
| `sherpage_update` | `id` (string), `title?` (string, 1-200), `slug?`, `expiresAt?` (string \| null), `maxViews?` (positive int \| null), `project?` | |
| `sherpage_list` | `status?` (`active` \| `archived`), `project?` | |
| `sherpage_get` | `id` (string), `project?` | |
| `sherpage_set_access` | `id` (string), `access` (same enum as publish), `password?` (string \| null), `project?` | |
| `sherpage_archive` | `id` (string), `restore?` (boolean), `project?` | |
| `sherpage_delete` | `id` (string), `confirm` (string), `project?` | = `id` |

## sherserve

HTTP routes: [sherserve](/api/sherserve).

| Tool | Arguments | Confirm |
| --- | --- | --- |
| `store_upload_file` (local only) | `path` (string, local filesystem path), `slug?`, `title?`, `access?`, `password?`, `expiresAt?`, `maxViews?` (positive int), `allow?` (string[]), `project?` | |
| `store_upload_content` (hosted only) | `path?` (filename hint, no filesystem access), `slug` (string), `contentBase64?` \| `text?` (exactly one required), `contentType` (string), `title?`, `access?`, `password?`, `expiresAt?`, `maxViews?` (positive int), `allow?`, `project?` | |
| `store_list_objects` | `project?` | |
| `store_get_object` | `slug?` \| `id?` (one required), `project?` | |
| `store_delete_object` | `slug?` \| `id?` (one required), `confirm` (string), `project?` | = whichever of `slug`/`id` was passed |

## sherlink

HTTP routes: [sherlink](/api/sherlink).

| Tool | Arguments | Confirm |
| --- | --- | --- |
| `link_list` | `project?` | |
| `link_get` | `code_or_id` (string), `project?` | |
| `link_set_access` | `code_or_id` (string), `access?`, `password?` (string \| null), `expires_at?` (string \| null), `max_views?` (positive int \| null), `project?` | |
| `link_set_alias` | `code_or_id` (string), `alias` (string \| null), `project?` | |
| `link_delete` | `code_or_id` (string), `confirm` (string), `project?` | = `code_or_id` |

## sherbase

HTTP routes: [sherbase](/api/sherbase).

| Tool | Arguments | Confirm |
| --- | --- | --- |
| `base_list_databases` | `project?` | |
| `base_create_database` | `slug` (string), `project?` | |
| `base_run_sql` | `database` (string), `sql` (string, a single statement) | |
| `base_drop_database` | `slug` (string), `confirm` (string) | = `slug` |
| `base_rotate_secret` | `database` (string), `confirm` (string), `project?` | = `database` |
| `base_enable_api` | `database` (string), `project?` | |
| `base_reload_schema` | `database` (string), `project?` | |

## Next

[Troubleshooting](/mcp/troubleshooting) — what the errors these tools
raise actually mean.