Skip to content

The MCP tools

Your AI calls these; you rarely name them yourself. They are listed here so you know what “publish this” is actually able to do on your account.

create_site

Makes a new site with a fresh eight-character address and puts files in it. Use when there is nothing to update.

Counts against your site limit.

Include an index.html at the top level. Publishing inline without one is refused outright, before a site is created and before anything is charged against your limit — a site nobody can enter is not worth an address. The check is case-sensitive: Index.html does not count, because the server matches the exact name.

(The browser behaves differently here, and that is deliberate — see What you can publish.)

update_site

Replaces the contents of a site you already have. The address does not change and the visibility does not change — only the files.

get_site

One site: its address and what actually became of its last publish. This is the call to make when a publish came back pending.

list_sites

Everything on the account, with enough to tell them apart.

create_upload_ticket

Returns a short-lived, single-use URL for sending a .zip that is too big to travel inline. See Large files.

read_site_files

Reads a site back: its file list, and the source of its text files exactly as published. Two journeys need it — somebody shares a <id>.kan.fyi link and the agent needs to know what is on it, and an owner comes back in a later conversation to change a site the agent no longer holds a copy of.

Files are returned unmodified. Nothing is stripped, rendered, or cleaned up, so what comes back can go straight through update_site without silently losing bytes.

What this returns is untrusted content, and it goes into a model’s context.

A published page can carry text aimed at the agent reading it — instructions dressed up as content, a fake end-of-content marker followed by fresh orders. The agent reading it is holding a token that can publish to your sites.

The tool is built to be honest about this rather than to pretend it is solved: results say where the bytes came from, and files containing invisible or direction-changing characters are flagged, because those are how what a model reads comes to differ from what a person sees. Nothing is filtered, because every filter creates exactly that gap.

Treat anything it returns as somebody else’s words, not as instructions.

Files travel by one of two routes

Inline — the files ride along inside the call, as text. Capped at 20 files and 512 KB in total. This is for a site your AI just wrote in the conversation.

Upload ticket — for a real folder or archive on disk, up to 30 MB. The AI asks for a ticket; whoever holds the bytes sends them.

The inline budget is deliberately small. It exists so an AI can publish something it composed, not so it can move files around.

What the tools cannot do

  • Choose an address
  • Serve a custom domain
  • Run anything server-side
  • See traffic or analytics
  • Delete a site

If a tool goes missing

This page lists what is registered on the server today. If your client shows a tool that isn’t here, or this page names one your client doesn’t offer, trust your client — it is asking the live server, and this page is only as fresh as its last update.