Everything in Modulify, from an AI client
The MCP server now reaches the whole product, from the editor and storage to workspaces, your account, direct file writes, SQL, publish diagnostics and exports.
Everything in the editor is now reachable over MCP
A connected AI client could already read your sites, send prompts and publish. It could not create a scheduled job, edit a webhook, read a comment or see a single line of your server logs. That is fixed across the whole editor.
Scheduled jobs. create_site_cron, update_site_cron, delete_site_cron and delete_all_site_crons manage the jobs, and preview_cron_schedule checks a schedule before it is saved so a job cannot be committed firing more often than intended. delete_site_cron_run and clear_site_cron_runs clean the history, and export_site_crons copies a set of jobs between sites.
Webhooks. create_site_webhook, update_site_webhook, delete_site_webhook and delete_all_site_webhooks, plus delete_webhook_delivery and clear_webhook_deliveries for the log.
Environment variables. set_secrets applies a whole .env in one call, creating, replacing and deleting together. set_secret gained the public/plaintext option for NEXT_PUBLIC_ style variables.
Visitor analytics. query_site_analytics answers anything the fixed reports do not: top pages, sources, countries, browsers, operating systems, devices, or a series over time. set_analytics_enabled and clear_site_analytics cover the settings and the danger zone.
The database. create_site_database gives a site a database, list_reference_options and list_enum_options mean a value written to a reference or enum column is no longer a guess, and clear_site_database empties every collection.
Folders. The whole feature, from nothing: create, list, rename, change the slug, reorder, delete, move sites in and out, and move a folder to another workspace.
Comments. Also from nothing. A client can read what reviewers asked for, reply to say it is done, resolve a thread, react, and read the screenshots attached to a request. It can only edit or delete comments it wrote itself.
Server logs. get_site_logs returns the same lines the Logs panel shows, for the preview machine or the published site. This is the one an agent debugging a site needed most: it could read your code and change your code, but never see what the server actually printed.
Site settings. The project category and server location joined rename_site, check_subdomain_available tests a free subdomain before it is taken, set_site_thumbnail and clear_site_thumbnail handle the dashboard card, and clear_site_chat covers the Delete chat action in the danger zone.
Storage over MCP is no longer read-only
A connected AI client could already browse your storage, organise it and delete from it, but it could never put a file in. That is fixed, along with the rest of the Storage panel.
Five tools are new:
upload_storage_fileputs a file into the bucket and returns its permanent public CDN address, ready to embed in a page. Up to 100MB, sent base64 encoded.read_storage_filereturns the contents of a stored file, so a client can read back a JSON, CSV or SVG it placed there. Files over 5MB are refused, since a tool result is capped.clear_storageempties the whole bucket in one call, the same action as Clear all storage in the Configuration sub-tab.get_storage_keyreveals the private storage key in plain text.rotate_storage_keyreplaces it with a new one and re-syncs the live site.
Workspaces, members and roles
A connected client could see your workspaces but nothing inside them. Now list_workspace_members reads the people and the pending invitations, invite_workspace_member, resend_workspace_invite, cancel_workspace_invite and remove_workspace_member manage them, and assign_member_role moves someone between roles. Custom roles can be created, changed and deleted, with the grantable permissions listed for you so a role cannot be built out of names that do not exist.
create_workspace, rename_workspace, set_default_workspace and leave_workspace cover the workspace itself. get_workspace_credits and get_workspace_credit_usage answer where your AI credits went rather than only how many are left.
Deleting a workspace is deliberately not available to a client, because it cancels the subscription.
Your account and referrals
get_account and update_account read and change your name, phone, avatar and notification preferences. get_site_usage reports how close you are to your plan's site limit, and list_pending_invitations shows what is waiting for you. list_referrals, list_payouts, check_affiliate_code and update_affiliate cover the referral programme.
Changing your email address still needs the confirmation link and can only be done in the product.
Writing files directly
write_file replaces source files straight in the running preview, without going through the AI. It is the fast path for a mechanical edit, a typo, a colour token, a config line, where asking the AI would spend credits and run a whole generation for one line.
Each file is confirmed individually by the preview, so the response tells you which paths were written and which failed and why, rather than reporting a blanket success.
It is deliberately blunt. It replaces the whole file rather than patching it, it needs the preview to be running, and the change is not captured in version history, so it cannot be undone by restoring a version. Take a backup first for anything substantial, and keep using the chat when you want a change described rather than dictated.
Run SQL against your database
execute_sql runs a statement against a site's database and returns the rows. It covers everything the collection tools cannot express: a join, an aggregate, a migration, a bulk update, adding a column, creating an index.
It runs whatever it is given. There is no read-only mode and nothing blocks DROP, TRUNCATE or a DELETE without a WHERE. It therefore sits behind its own data:sql permission, and needs the same role permission as deleting a site, so an ordinary member cannot use it.
Values go through params as $1, $2 rather than being pasted into the statement. Statements are capped at 20,000 characters and time out after 15 seconds, and at most 200 rows come back, so put your own LIMIT in the query.
Find out why a publish failed
get_publish_status told you a publish failed and nothing more. get_publish_logs returns the actual build output, paged, with the error alongside it.
get_publish_timeline returns the publish step by step, from provisioning through compiling and uploading to the health check and the switch, with how long each step took. Those per-step durations were recorded but had never been shown anywhere.
stop_publish stops a publish that is still running. The build is abandoned and its machines are torn down; whatever was already live stays up untouched. A publish that has passed the point of switching over is refused rather than half-cancelled.
Exports
export_collection reads a whole collection in one call with its column types, where list_rows pages 50 at a time. export_site_analytics returns the all-time breakdowns in one response. export_site_webhooks returns your whole webhook setup, with signing secrets excluded and destinations shown as hosts, matching how webhooks are already listed.
The storage and code archives stay browser downloads. A connected client receives structured data rather than files, and it can already reach the same content through list_storage_files with get_storage_file_url, or list_files with read_file.
Ten new permissions
comments:read, logs:read and account:read are ticked by default, being ordinary reads of your own site and account.
comments:write is not, because it can delete a comment. workspaces:write, members:write, account:write and code:write are not either, and members:write is worth its own thought before you grant it: it sends real email to real colleagues and can remove someone's access to every site in a workspace.
data:sql is unticked because the statement it runs is not inspected. credentials:reveal is unticked because it is the only permission that hands a client a live credential in plain text, covering environment variable values, the private storage key and webhook signing secrets.
Two existing labels were widened to match what they always did. data:read now reads Read CMS collections and stored files and data:write reads Change CMS rows and stored files.
A safer default on every call
Every tool now has to resolve to a workspace before it runs. A call that names neither a site nor a workspace, or names one that does not exist, is refused before it reaches the endpoint behind it rather than being left to that endpoint to catch. list_workspaces and list_templates are the only exceptions, because neither belongs to a workspace.
See MCP tools and Tokens and scopes.