External/claude-hidden-toolkit
1
0
Fork 0
mirror of https://github.com/N1-AI/claude-hidden-toolkit.git synced 2026-06-23 11:39:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Edition 1.4: 37 tools, 4 platforms, 13 corrections, 2 contributors

Browse Source 
9 new tool cards (29–37): iOS Reminders CRUD suite (5 tools),
visualize:show_widget, gmail_create_draft, anthropic_api_in_artifacts,
persistent_storage. 13 v1.3 corrections including user_time/location
reclassified as always-loaded, memory_user_edits 500-char limit,
chart_display_v0 intermittent (not deterministic), window.storage
session-scoped. New sections: MCP connector state, artifact execution
layer, Project context behavior. iOS split from Android as distinct
platform. Contributors: anonymous security researcher, DMontgomery40.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
frmoretto
2026-03-17 19:29:02 +01:00
co-authored by Claude Opus 4.6
parent c93c692458
commit a7197e5534
8 changed files with 1063 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+22 -9
View File
@@ -2,7 +2,7 @@
## What This Repo Is
A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, and mobile app.
A technical book ("Claude's Hidden Toolkit") documenting 37 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, Android, and iOS.
## File Roles
@@ -14,28 +14,40 @@ A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented interna
## Domain Knowledge
- **28 tools** documented with confirmed JSON schemas
- **3 platforms** with different tool inventories (browser: 21 tools, desktop: 22+32 MCP, mobile: 20+11 deferred)
- **37 tools** documented with confirmed JSON schemas
- **4 platforms** with different tool inventories:
- Browser: 21 always-loaded, `tool_search` conditionally available with MCP connectors
- Desktop: 22 always-loaded + 32 MCP tools via `tool_search`
- Android: 22 always-loaded + 11 deferred consumer tools
- iOS: 22 always-loaded + 16 deferred consumer tools (Android set + 5 Reminders)
- **MCP connector state** affects tool inventory — connecting Gmail/Calendar adds tools to always-loaded pool
- **Tool cards** in the Technical Annex follow a strict template (see Appendix C in the book)
- **Figures** are numbered sequentially fig_01 through fig_22 — all currently marked [Upcoming] pending screenshot capture
- **Figures** are numbered sequentially — all currently marked [Upcoming] pending screenshot capture
- **Response formats** are all empirically confirmed — no inferred markers remain
- **Two external contributors** credited: an anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite)
## Conventions
- Tool names in backticks: `web_search`, `event_create_v0`
- Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "All"
- Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "iOS only", "All"
- Version suffixes: `_v0` (initial/experimental), `_v1` (breaking upgrade)
- MCP connector tools use `Provider:tool_name` prefix on browser (e.g., "Google Calendar:gcal_list_calendars")
- Confirmed vs unverified clearly marked — never speculate
- Anonymous contributor referenced only as "An independent security researcher who prefers to remain anonymous" — never use real name
## Architecture Context
The book documents a two-tier tool loading system:
- **Always-loaded tools**: injected into every conversation context (~17-22 depending on platform)
- **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11 consumer tools)
- **MCP tools**: discovered via `tool_search` on desktop only (32 integration tools)
The book documents a multi-tier tool system:
- **Always-loaded tools**: injected into every conversation context (~21-22 depending on platform)
- **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11-16 consumer tools depending on OS)
- **MCP tools**: discovered via `tool_search` on desktop (32 integration tools) or conditionally on browser
- **MCP connector tools**: appear in always-loaded pool when connectors (Gmail, Calendar) are active
- **Artifact execution layer**: `anthropic_api_in_artifacts` (Claude-in-Claude), `persistent_storage` (session-scoped), MCP endpoint access from React artifacts — desktop/browser only, not mobile
The calendar system has a dual-layer architecture where Projects use MCP Connector tools with email-based IDs, while standard mobile chats use deferred consumer tools with numeric string IDs. The two layers are incompatible.
`visualize:show_widget` and `chart_display_v0` are mutually exclusive by surface: `chart_display_v0` is mobile only (deferred, intermittent instability), `show_widget` is desktop/browser only.
## Quality Gates
Before any content change:
@@ -44,3 +56,4 @@ Before any content change:
3. Does the tool card follow the template structure?
4. Are figure numbers sequential with no gaps?
5. Is the response format marked as confirmed or unverified?
6. For contributor content: has it been independently verified before documenting as confirmed?