project_download_zip
Build a ZIP of the project and return a short-lived signed URL the user can download and deploy themselves. `node_modules` and `dist` are excluded. The project is scanned for drainer and phishing patterns FIRST: if anything trips the gate, nothing is built, no URL is returned, and the error names the rule that fired and the line it fired on. Returns `{ url, exportId, bytes, fileCount, expiresInSec }` — the URL is a secret, so do not log it or paste it anywhere. To push to a repository instead, call `project_export_github` (currently refused: putty's GitHub OAuth app is not set up, and `project_download_zip` is the working path). Another user's project is answered with the same 'no such project' a deleted one would be.
Build a ZIP of the project and return a short-lived signed URL the user can download and deploy themselves. node_modules and dist are excluded.
Input
The tool takes a single JSON object. Every field, its type, and an example are on the generated reference at GET /mcp/tools, under this tool's name.
Calling it
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": { "name": "project_download_zip", "arguments": {} }
}Put your arguments in place of the empty object. A call that fails comes back as a normal result carrying isError: true and a message naming what went wrong, not as a JSON-RPC protocol error.
Notes
The project is scanned for drainer and phishing patterns FIRST: if anything trips the gate, nothing is built, no URL is returned, and the error names the rule that fired and the line it fired on. Returns { url, exportId, bytes, fileCount, expiresInSec } — the URL is a secret, so do not log it or paste it anywhere. To push to a repository instead, call project_export_github (currently refused: putty's GitHub OAuth app is not set up, and project_download_zip is the working path). Another user's project is answered with the same 'no such project' a deleted one would be.
The full request and response shape, and a live playground, live on the generated reference at GET /mcp/tools.
project_export_github
Push the project to a new repository in the user's own GitHub account. Requires a Privy-authenticated session and a connected GitHub integration, and scans the project for drainer / phishing patterns before anything leaves the sandbox. NOT AVAILABLE YET: putty's GitHub OAuth app has not been created, so this tool refuses with an explanation rather than pretending a repository was made. To hand the project over now, call `project_download_zip` — it is a signed URL the user can unzip, commit, and push themselves. When the OAuth app lands this tool will create a new repository (private by default) and return its `{ repoUrl, exportId }`.
project_finish
Stop the run and report what you built. This is the only way a run ends successfully, and it is refused unless `project_verify` passed during THIS run — a verify from an earlier run does not carry over. The refusal names the verify errors that are still open, so fix the first one and verify again; after three failed attempts on the same error, stop and explain it in the summary instead of looping. Pass a two-to-five line `summary` in the user's terms: what changed and what they can do next. Returns `{ ok, runId, summary }`. Once this succeeds, call nothing further — the run is over.