External/claude-hidden-toolkit
1
0
Fork 0
mirror of https://github.com/N1-AI/claude-hidden-toolkit.git synced 2026-06-23 11:39:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Edition 1.4: 37 tools, 4 platforms, 13 corrections, 2 contributors

Browse Source 
9 new tool cards (29–37): iOS Reminders CRUD suite (5 tools),
visualize:show_widget, gmail_create_draft, anthropic_api_in_artifacts,
persistent_storage. 13 v1.3 corrections including user_time/location
reclassified as always-loaded, memory_user_edits 500-char limit,
chart_display_v0 intermittent (not deterministic), window.storage
session-scoped. New sections: MCP connector state, artifact execution
layer, Project context behavior. iOS split from Android as distinct
platform. Contributors: anonymous security researcher, DMontgomery40.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
frmoretto
2026-03-17 19:29:02 +01:00
co-authored by Claude Opus 4.6
parent c93c692458
commit a7197e5534
8 changed files with 1063 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+22 -9
View File
@@ -2,7 +2,7 @@
## What This Repo Is
A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, and mobile app.
A technical book ("Claude's Hidden Toolkit") documenting 37 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, Android, and iOS.
## File Roles
@@ -14,28 +14,40 @@ A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented interna
## Domain Knowledge
- **28 tools** documented with confirmed JSON schemas
- **3 platforms** with different tool inventories (browser: 21 tools, desktop: 22+32 MCP, mobile: 20+11 deferred)
- **37 tools** documented with confirmed JSON schemas
- **4 platforms** with different tool inventories:
- Browser: 21 always-loaded, `tool_search` conditionally available with MCP connectors
- Desktop: 22 always-loaded + 32 MCP tools via `tool_search`
- Android: 22 always-loaded + 11 deferred consumer tools
- iOS: 22 always-loaded + 16 deferred consumer tools (Android set + 5 Reminders)
- **MCP connector state** affects tool inventory — connecting Gmail/Calendar adds tools to always-loaded pool
- **Tool cards** in the Technical Annex follow a strict template (see Appendix C in the book)
- **Figures** are numbered sequentially fig_01 through fig_22 — all currently marked [Upcoming] pending screenshot capture
- **Figures** are numbered sequentially — all currently marked [Upcoming] pending screenshot capture
- **Response formats** are all empirically confirmed — no inferred markers remain
- **Two external contributors** credited: an anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite)
## Conventions
- Tool names in backticks: `web_search`, `event_create_v0`
- Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "All"
- Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "iOS only", "All"
- Version suffixes: `_v0` (initial/experimental), `_v1` (breaking upgrade)
- MCP connector tools use `Provider:tool_name` prefix on browser (e.g., "Google Calendar:gcal_list_calendars")
- Confirmed vs unverified clearly marked — never speculate
- Anonymous contributor referenced only as "An independent security researcher who prefers to remain anonymous" — never use real name
## Architecture Context
The book documents a two-tier tool loading system:
- **Always-loaded tools**: injected into every conversation context (~17-22 depending on platform)
- **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11 consumer tools)
- **MCP tools**: discovered via `tool_search` on desktop only (32 integration tools)
The book documents a multi-tier tool system:
- **Always-loaded tools**: injected into every conversation context (~21-22 depending on platform)
- **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11-16 consumer tools depending on OS)
- **MCP tools**: discovered via `tool_search` on desktop (32 integration tools) or conditionally on browser
- **MCP connector tools**: appear in always-loaded pool when connectors (Gmail, Calendar) are active
- **Artifact execution layer**: `anthropic_api_in_artifacts` (Claude-in-Claude), `persistent_storage` (session-scoped), MCP endpoint access from React artifacts — desktop/browser only, not mobile
The calendar system has a dual-layer architecture where Projects use MCP Connector tools with email-based IDs, while standard mobile chats use deferred consumer tools with numeric string IDs. The two layers are incompatible.
`visualize:show_widget` and `chart_display_v0` are mutually exclusive by surface: `chart_display_v0` is mobile only (deferred, intermittent instability), `show_widget` is desktop/browser only.
## Quality Gates
Before any content change:
@@ -44,3 +56,4 @@ Before any content change:
3. Does the tool card follow the template structure?
4. Are figure numbers sequential with no gaps?
5. Is the response format marked as confirmed or unverified?
6. For contributor content: has it been independently verified before documenting as confirmed?
CHANGELOG.md
+31
View File
@@ -4,6 +4,37 @@ All notable changes to Claude's Hidden Toolkit are documented here.
Format follows [Keep a Changelog](https://keepachangelog.com/). Editions are tagged by version.
## [1.4] — 2026-03-15
### Added
- **9 new tool cards** (Cards 29–37): `reminder_list_search_v0`, `reminder_create_v0`, `reminder_search_v0`, `reminder_update_v0`, `reminder_delete_v0` (iOS Reminders CRUD suite), `visualize:show_widget`, `gmail_create_draft`, `anthropic_api_in_artifacts`, `persistent_storage`
- **Artifact execution layer section** (Chapter 9) — documents Claude-inside-Claude architecture: `anthropic_api_in_artifacts` (authenticated API calls from artifacts without API key), `persistent_storage` (session-scoped `window.storage`), MCP endpoint access from React artifacts
- **MCP connector state** as an architectural variable (Chapter 2) — connecting/disconnecting Gmail or Google Calendar changes the always-loaded tool pool
- **Project context behavior** section — confirmed Projects do not change tool behavior
- **Ghost tools** section (Chapter 12) — `gmail_send_draft` and `gmail_modify_thread` exist in schema but are not deployed
- **Contributors section** — credited anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite)
- **iOS vs Android differences** — `user_location_v0` returns richer response on iOS (sub_locality, accuracy fields); `user_time_v0` timestamp format differs (no microseconds on iOS)
### Changed (Corrections)
- **`user_time_v0` and `user_location_v0`**: reclassified from deferred to **always-loaded** on mobile — MCP connector state is irrelevant (v1.3 error)
- **`memory_user_edits`**: limit corrected from 200 characters (server-enforced) to **500 characters** (client-side validation). The limit may vary by tier or build
- **`chart_display_v0`**: crash status downgraded from deterministic (100%) to **intermittent/state-dependent**. Tool is always deferred on mobile, not first-class
- **`tool_search` on browser**: corrected from "does not exist" to **conditionally available** when MCP connectors are active, returning tools with `Provider:tool_name` prefix
- **`window.storage`**: reframed from "persistent" to **session-scoped** — data is destroyed when session closes, does not persist across chats even within the same Project
- **`anthropic_api_in_artifacts`**: corrected from Desktop-only to working on **both Desktop and Browser** React artifacts (HTML artifacts blocked by CSP)
- **`web_fetch`**: corrected from 8 to **9 parameters** (added `html_extraction_method`)
- **`bash_tool`**: corrected from 1 to **2 parameters** (added required `description`)
- **`str_replace`**: corrected from 3 to **4 parameters** (added required `description`)
- **`chart_display_v0` values parameter**: accepts integers on iOS (v1.3 documented strings only)
- **Calendar tools**: always-loaded when MCP Calendar connector active (not always deferred)
- **Platform matrix**: updated to reflect iOS as distinct surface with 5 additional Reminders tools
- **`visualize:show_widget` vs `chart_display_v0`**: documented as mutually exclusive by surface — `chart_display_v0` mobile only, `show_widget` desktop/browser only
### Removed
- Deterministic crash claim for `chart_display_v0`
- "tool_search absent on browser" claim
- 200-character server-enforced limit claim for `memory_user_edits`
## [1.3] — 2026-02-16
### Added
CITATION.cff
+11 -6
View File
@@ -6,8 +6,8 @@ authors:
- family-names: "Marinoni Moretto"
given-names: "Francesco"
orcid: ""
version: "1.3"
date-released: "2026-02-16"
version: "1.4"
date-released: "2026-03-17"
url: "https://github.com/n1-ai/claude-hidden-toolkit"
license: "CC-BY-4.0"
keywords:
@@ -19,9 +19,14 @@ keywords:
- tool-use
- model-context-protocol
- claude-ai
- artifact-api
- ios-reminders
abstract: >-
Comprehensive reverse-engineering documentation of 28 undocumented internal
tools in Claude.ai's consumer interfaces (browser, desktop app, mobile app).
Comprehensive reverse-engineering documentation of 37 undocumented internal
tools in Claude.ai's consumer interfaces (browser, desktop app, Android, iOS).
Covers complete parameter schemas, confirmed response formats, platform-specific
behavior differences, and a three-tier tool loading architecture across three
client surfaces. Based on 35+ manual tests with empirical verification.
behavior differences, a three-tier tool loading architecture across four client
surfaces, the artifact execution layer (Claude-inside-Claude API calls, session-scoped
storage, MCP endpoint access), and MCP connector state as an architectural variable.
Based on 50+ manual tests with empirical verification across all platforms. Edition 1.4
includes contributions from two external researchers.
CLAUDE.md
+24 -6
View File
@@ -2,7 +2,7 @@
## Project Overview
This is "Claude's Hidden Toolkit" — a living technical book documenting Claude.ai's undocumented internal tools. The book reverse-engineers 28 tools across three platforms (browser, desktop app, mobile app) with confirmed schemas, response formats, and behavioral patterns.
This is "Claude's Hidden Toolkit" — a living technical book documenting Claude.ai's undocumented internal tools. The book reverse-engineers 37 tools across four platforms (browser, desktop app, Android, iOS) with confirmed schemas, response formats, and behavioral patterns. Edition 1.4 includes contributions from two external researchers.
## Repository Structure
@@ -22,9 +22,11 @@ LICENSE # CC BY 4.0
1. **The .md file is the source of truth.** All content edits happen here.
2. **All tool claims must be empirically verified.** No speculative schemas. If you haven't tested it, mark it as unverified.
3. **Platform matters.** Every tool claim must specify which platform(s) it applies to: browser, desktop app, mobile app, or all.
4. **Figure numbering is sequential** (fig_01 through fig_22). If adding figures, continue the sequence. Never use letter suffixes (e.g., fig_14b).
5. **Tool cards follow a strict template.** See Appendix C in the book for the template. Every card needs: quick facts table, overview, parameters table, example call with JSON, "When Claude Uses It" table, "Watch Out" section, and platform availability table.
3. **Platform matters.** Every tool claim must specify which platform(s) it applies to: browser, desktop app, Android, iOS, or all. iOS and Android are distinct — iOS has 5 additional Reminders tools.
4. **MCP connector state matters.** Some tools are only available when specific connectors (Gmail, Calendar) are active. State this explicitly.
5. **Figure numbering is sequential.** If adding figures, continue the sequence. Never use letter suffixes (e.g., fig_14b).
6. **Tool cards follow a strict template.** See Appendix C in the book for the template. Every card needs: quick facts table, overview, parameters table, example call with JSON, "When Claude Uses It" table, "Watch Out" section, and platform availability table.
7. **Contributor privacy.** The anonymous security researcher must only be referenced as "An independent security researcher who prefers to remain anonymous." Never use their real name anywhere.
## Writing Style
@@ -37,9 +39,23 @@ LICENSE # CC BY 4.0
## Tool Naming Conventions
- Always-loaded tools: `web_search`, `memory_user_edits`, etc.
- Deferred tools (mobile only): `user_time_v0`, `alarm_create_v0`, etc.
- Version suffixes: `_v0` = initial, `_v1` = breaking change upgrade
- Deferred tools (mobile only): `alarm_create_v0`, `chart_display_v0`, etc.
- Always-loaded on mobile (not deferred): `user_time_v0`, `user_location_v0`
- MCP connector tools: `gmail_create_draft`, `gcal_list_calendars`, etc.
- Artifact-layer tools: `anthropic_api_in_artifacts`, `persistent_storage`
- Visualization: `visualize:show_widget` (colon-namespaced, desktop/browser only)
- iOS-only tools: `reminder_create_v0`, `reminder_search_v0`, etc.
- Version suffixes: `_v0` = initial/experimental, `_v1` = breaking change upgrade
- Unversioned tools are considered stable
- Ghost tools (schema-present, not deployed): `gmail_send_draft`, `gmail_modify_thread`
## Architecture Quick Reference
- `chart_display_v0` (mobile only) and `visualize:show_widget` (desktop/browser only) are mutually exclusive by surface
- `window.storage` / `persistent_storage` is session-scoped only — "persistent" naming is misleading
- `anthropic_api_in_artifacts` works in React artifacts (desktop + browser), blocked in HTML artifacts by CSP
- MCP connector state changes the always-loaded tool pool — this is a v1.4 finding
- Project context does not change tool behavior
## What Not To Do
@@ -47,3 +63,5 @@ LICENSE # CC BY 4.0
- Don't change the figure numbering scheme without renumbering all references
- Don't remove the [Upcoming] tags on figures — they indicate screenshots pending capture
- Don't merge the .md living repository links with personal GitHub links — they serve different purposes
- Don't use the anonymous contributor's real name — ever, anywhere
- Don't document ghost tools as functional — they exist in schema only
CONTRIBUTING.md
+15 -6
View File
@@ -2,6 +2,8 @@
Thanks for your interest in contributing! This project documents Claude.ai's undocumented internal tools — every contribution helps the community understand what's really happening under the hood.
Two external contributors have already shaped v1.4: an anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite). Your discoveries are welcome too.
## How to Contribute
### Reporting New Tools or Changes
@@ -11,7 +13,7 @@ If you've discovered a new tool, a schema change, or platform-specific behavior
1. **Open an Issue** with the label `discovery`
2. Include:
- Tool name (exact internal name if known)
- Platform tested on (browser / desktop app / mobile app / iOS / Android)
- Platform tested on (browser / desktop app / Android / iOS)
- How you discovered it (e.g., `tool_search` query, system prompt extraction, behavioral observation)
- Parameter schema if available (JSON)
- Response format with a real example
@@ -40,9 +42,9 @@ For direct content changes:
## Formatting Conventions
- **Tool names** in backticks: `web_search`, `event_create_v0`
- **Platform availability** stated on every claim
- **Platform availability** stated on every claim — distinguish Android from iOS where relevant
- **Tool cards** follow the template in Appendix C — don't freestyle the structure
- **Figures** are numbered sequentially (fig_01 through fig_22+). Continue the sequence; never reuse or skip numbers
- **Figures** are numbered sequentially. If adding figures, continue the sequence; never reuse or skip numbers
- **Response formats** marked as confirmed with real output. If you can't confirm, note it explicitly
- **Tables** for structured comparisons, not bullet lists
@@ -60,12 +62,19 @@ If you've observed something but can't fully verify it, open an Issue rather tha
High-value contributions include:
- **iOS-specific tools** (Reminders suite, Siri integration) — we have limited iOS testing coverage
- **Screenshot captures** for the 22 figures currently marked [Upcoming]
- **Android-specific tools** we might be missing
- **Team/Enterprise-exclusive tools** — we have no coverage of enterprise-tier features
- **Screenshot captures** for figures currently marked [Upcoming]
- **Cross-platform verification** of existing tool cards on platforms we haven't tested
- **New deferred tools** discovered via `tool_search` sweeps
- **Schema changes** from Anthropic updates that break or modify existing tools
- **MCP Connector behavior** differences between Projects and standard chats
- **MCP Connector behavior** differences — especially new connectors beyond Gmail/Calendar/Drive
- **Ghost tool activation** — monitoring `gmail_send_draft` and `gmail_modify_thread` for deployment
- **Artifact execution layer** findings — new capabilities in `anthropic_api_in_artifacts` or `persistent_storage`
## Contributor Credits
All contributors are credited in the book and README. If you prefer to remain anonymous, let us know — we respect privacy (see our existing anonymous contributor as an example).
## Code of Conduct
Claude_Hidden_Toolkit.md
+931 -112
View File
File diff suppressed because it is too large Load Diff
README.md
+25 -12
View File
@@ -2,17 +2,17 @@
**The Definitive Guide to Claude.ai's Undocumented Internal Tools**
*28 tools. Zero official documentation. Fully reverse-engineered.*
*37 tools. Zero official documentation. Fully reverse-engineered.*
---
## What Is This?
Claude.ai ships with 28+ internal tools — capabilities that let Claude check the time, search your calendar, render interactive charts, draft emails with native app integration, find nearby restaurants, display them on a map, set alarms on your phone, and more.
Claude.ai ships with 37+ internal tools — capabilities that let Claude check the time, search your calendar, render interactive charts, draft emails directly into your Gmail, find nearby restaurants, display them on a map, set alarms on your phone, manage iOS Reminders, build AI-powered artifacts that call Claude from within Claude, and more.
**Almost none of this is documented.**
Anthropic's official docs cover the API. But the consumer product — claude.ai — has a rich, evolving toolkit that exists in a documentation void. This book fills that gap through systematic reverse-engineering across three platforms (browser, desktop app, mobile app).
Anthropic's official docs cover the API. But the consumer product — claude.ai — has a rich, evolving toolkit that exists in a documentation void. This book fills that gap through systematic reverse-engineering across four platforms (browser, desktop app, Android, iOS).
## Key Discoveries
@@ -20,41 +20,54 @@ Anthropic's official docs cover the API. But the consumer product — claude.ai
| Platform | Always-Loaded | tool_search | Deferred Tools |
|----------|:---:|:---:|:---:|
| Browser (claude.ai) | 21 | ❌ | None |
| Browser (claude.ai) | 21 | MCP only (when connectors active) | None |
| Desktop App | 22 | MCP only | 32 (Chrome + Filesystem) |
| Mobile App | 20 | Consumer | 11 (alarm, timer, calendar, etc.) |
| Mobile (Android) | 22 | Consumer | 11 (alarm, timer, calendar, etc.) |
| Mobile (iOS) | 22 | Consumer | 16 (Android set + 5 Reminders tools) |
**Every response format has been empirically confirmed** — no inferred schemas remain in Edition 1.3.
**MCP connector state changes the tool inventory.** Connecting Gmail or Google Calendar adds tools to the always-loaded pool. Disconnecting removes them. This is a new architectural variable documented in v1.4.
**The artifact execution layer.** Claude artifacts can make authenticated API calls back to Claude itself — Claude-inside-Claude — without API keys. The runtime injects authentication. This, along with session-scoped storage and MCP endpoint access, means artifacts are evolving into a lightweight application platform.
**Every response format has been empirically confirmed** — no inferred schemas remain.
## What's Inside
| Chapter | Coverage |
|---------|----------|
| 1–2 | Architecture: two-tier loading, platform inventory, versioning |
| 1–2 | Architecture: two-tier loading, platform inventory, MCP connector state, versioning |
| 3 | Context tools: `user_time_v0`, `user_location_v0` |
| 4 | Interaction widgets: `ask_user_input_v0`, `message_compose_v1` |
| 5 | Inline charts: `chart_display_v0` |
| 5 | Inline charts: `chart_display_v0`, `visualize:show_widget` |
| 6 | Calendar & device: 6 calendar tools + alarms + timers |
| 7 | Search & data: web, images, places, maps, sports, Drive, weather, recipes |
| 8 | Memory: `memory_user_edits`, `conversation_search`, `recent_chats` |
| 9 | Computer use: bash, files, artifacts, the skill system |
| 9 | Computer use: bash, files, artifacts, the skill system, artifact execution layer |
| 10 | The meta-tool: `tool_search` and enumeration methodology |
| 11 | Complete tool reference index |
| 12 | MCP convergence and what comes next |
| Annex | 28 detailed tool cards with confirmed JSON schemas |
| 12 | Ghost tools, MCP convergence, and what comes next |
| Annex | 37 detailed tool cards with confirmed JSON schemas |
## Read the Book
- **[Claude_Hidden_Toolkit.md](Claude_Hidden_Toolkit.md)** — Full book, Markdown (~21,600 words)
- **[Claude_Hidden_Toolkit.md](Claude_Hidden_Toolkit.md)** — Full book, Markdown (~25,000 words)
## Edition History
| Edition | Date | Changes |
|---------|------|---------|
| 1.4 | Mar 2026 | 9 new tools (28→37), 13 corrections, 2 external contributors. New: iOS Reminders suite (5 tools), `visualize:show_widget`, `gmail_create_draft`, `anthropic_api_in_artifacts`, `persistent_storage`. Corrected: `user_time_v0`/`user_location_v0` always-loaded on mobile, `memory_user_edits` 500-char limit, `chart_display_v0` intermittent (not deterministic crash), `window.storage` session-scoped, `tool_search` on browser with MCP. New chapter sections on artifact execution layer and MCP connector state. |
| 1.3 | Feb 2026 | Platform architecture chapter, 3 new tool cards (weather, recipe, end_conversation), cross-platform verification of all 28 cards, settings/connectors appendix, all response formats confirmed |
| 1.2 | Feb 2026 | 25 tool cards, discovery methodology, initial availability matrix |
| 1.0–1.1 | Feb 2026 | Initial discovery and documentation |
## Contributors
This project is maintained by Francesco Marinoni Moretto and has benefited from external contributions:
- **An independent security researcher** (anonymous by request) — 11 findings including the artifact API discovery, session-scoped storage, MCP endpoints in artifacts, skill filesystem topology, and egress proxy JWT architecture
- **DMontgomery40** ([GitHub](https://github.com/DMontgomery40)) — Documented the complete iOS Reminders CRUD suite (5 tools) via GitHub issues
## Prior Art & Credits
This work builds on contributions from: **Shlok Khemani** (memory tool schemas, Sept 2025), **Simon Willison** (system prompt analysis), **Adversa AI** (security research, named `message_compose_v1`), **Federico Viticci / MacStories** (iOS tools and `_v0` naming convention discovery).
SECURITY.md
+4 -2
View File
@@ -13,6 +13,7 @@ If you discover a tool behavior that could be exploited to:
- Exfiltrate sensitive information via tool parameters or responses
- Manipulate tool behavior through prompt injection in tool inputs
- Escalate permissions beyond intended scope
- Abuse the artifact execution layer (`anthropic_api_in_artifacts`, `persistent_storage`, MCP endpoints) for unintended access
**Please report it responsibly:**
@@ -42,5 +43,6 @@ If you discover a tool behavior that could be exploited to:
| Version | Supported |
|---------|-----------|
| 1.3 | Yes |
| < 1.3 | No — please reference the latest edition |
| 1.4 | Yes |
| 1.3 | No — please reference the latest edition |
| < 1.3 | No |