MCP · Tools

Tools: functions

Six tools on the management plane. None requires a human — and none can set a secret's value; that gesture has no tool, on purpose. Descriptions are quoted as the agent reads them. How to write a function is in the edge function guide.

list_functions#

List a project's edge functions (slug, public URL, key id, log_key_ids, rate_limit — the call limits in force — and calls_today). Secret values and source code are never returned. log_key_ids are the journal ids of every generation of the function's key — filter its data-plane requests with get_logs and key_id=in.(...). Execution output (console.log, CPU overruns) is not readable through any tool or screen yet.

Calls GET /v1/projects/:pid/functions.

deploy_function#

Deploy (or replace) an edge function: server-side code that runs on the project's own subdomain. The function's secret key is minted for you and injected into the script — no elevation needed, and no value is ever returned. That key is injected into the script and never shown to anyone, including you. Redeploying an existing slug replaces it and force-rotates its key. SECRETS: call list_secrets FIRST and write code that reads env.NAME for the names it returns. Never put a key in vars or in the code — a vars value shaped like a known provider key (sk-ant-, sk-proj-, sk_live_, rk_live_, re_) is refused with a 400. If a name you need is missing, deploy anyway and ask the human to set the value in the dashboard: per project in Functions → Secrets, or once for every project on the account's Secrets screen. Either way every function gets it, including ones deployed later, and it survives redeployments. A function carries at most 126 variables of yours — its vars, the project's secrets and the account's shared secrets together — and a deployment that would pass that is refused with a 413 naming the three counts. Then check ONCE with list_function_secrets; never poll it — each call costs a Cloudflare administration request. BROWSERS: a response your code sends without Access-Control-Allow-Origin gets the platform's CORS headers, so a front end on another origin can read it. The platform answers the preflight itself: a browser may only call with GET, POST, PATCH or DELETE and the headers authorization, x-session, content-type and idempotency-key — no PUT, no custom header. A RESULT MANY VISITORS READ (a report, a summary): store it in a table the front end reads with the publishable key, created with the lecture_publique preset (partage is read by the app's signed-in users only; signed-in users can add rows to either, so read your row back by the id you wrote, never "the latest row"). Serve the stored copy while it is fresh, and take a lease before recomputing: send to POST ${env.MANYBASES_URL}/sql an UPDATE whose WHERE matches the row's id and a lease time that has passed (compute times in JavaScript — the SQL grammar has no now()); row_count 1 means you hold it. So one caller, not every visitor, pays the upstream API. CALL LIMITS: the platform counts a function's calls before its code runs — by default 60 a minute and 300 a day from one visitor address, 3000 a day in total; beyond, the caller gets a 429. Leave rate_limit out unless the owner asks, or unless the function calls a paid API: then ask the owner how many calls a day they will pay for, and set per_function_per_day to it. The slug secrets is reserved (it is the dashboard's secrets screen).

Calls POST /v1/projects/:pid/functions. The function answers at https://proj-<id>-fn-<slug>.manybases.com. Its code reads env.MANYBASES_URL and env.MANYBASES_SECRET_KEY to call its own project's API; it has no direct access to the database. There is no secrets parameter: the API refuses one with a 400. A vars value shaped like a known provider key is refused with a 400 that names the variable and the provider, never the value. A vars name that Manybases injects or reserves — the whole MANYBASES_ prefix included — is refused with a 400 that names it. A limits.cpu_ms above 10000 is refused with a 400 that names the ceiling.

list_secrets#

List the NAMES of this project's secrets, with their dates — each is what env.NAME will hold in every function of the project, including functions deployed later. Call it BEFORE writing a function's code, so the code reads names that exist; if one you need is missing, ask the human to set its value in the dashboard — per project in Functions → Secrets, or once for every project on the account's Secrets screen — a value never goes through you. Check once at the end with list_function_secrets, which reads what is actually on a deployed function. Never returns a value, and never a digest: each entry is {name, updated_at, source}, source being "project" or "shared"; a shared entry also carries note, available and, when it is not delivered, reason, and a project entry carries overrides_shared, true when it masks a shared secret of the same name.

Calls GET /v1/projects/:pid/secrets. Each entry is { name, updated_at, source }. The route adds a digest for a signed-in human; this tool never relays it.

list_function_secrets#

List the NAMES of the secrets actually present ON this function's script — the edge truth. Values are never returned — a human sets them in the dashboard, per project in Functions → Secrets or once for every project on the account's Secrets screen, and your code reads them as env.NAME. Each name carries its source: project, shared (set once for the whole account), or residue — on the script but in neither registry, which is what a removal that has not reached this function yet looks like. A project name that masks a shared one of the same name also carries overrides_shared. Use this to check a value reached this function before telling the user it is ready.

Calls GET /v1/projects/:pid/functions/:slug/secrets. The two injected names are filtered out.

rotate_function_secret#

Rotate the secret key injected into a deployed function, without re-uploading its code. No elevation needed; a new secret key is minted and injected for you. No value is returned; the old key dies with NO grace period, so the function may see brief 401s on its data calls while warm instances settle.

Calls POST /v1/projects/:pid/functions/:slug/rotate-secret.

delete_function#

Destroy an edge function: its script first, then every generation of its secret key. No elevation required — cutting off a misbehaving function must never wait. Replaying it is safe. The registry is authoritative immediately, and the function stops running: a call that arrives after this response answers 404. Redeploying the same slug brings it back without waiting.

Calls DELETE /v1/projects/:pid/functions/:slug. The project's secrets survive: redeploying the same slug starts with them.