External/claude-hidden-toolkit
1
0
Fork 0
mirror of https://github.com/N1-AI/claude-hidden-toolkit.git synced 2026-06-23 11:39:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

Edition 1.4: 37 tools, 4 platforms, 13 corrections, 2 contributors

Browse Source 
9 new tool cards (29–37): iOS Reminders CRUD suite (5 tools),
visualize:show_widget, gmail_create_draft, anthropic_api_in_artifacts,
persistent_storage. 13 v1.3 corrections including user_time/location
reclassified as always-loaded, memory_user_edits 500-char limit,
chart_display_v0 intermittent (not deterministic), window.storage
session-scoped. New sections: MCP connector state, artifact execution
layer, Project context behavior. iOS split from Android as distinct
platform. Contributors: anonymous security researcher, DMontgomery40.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
frmoretto
2026-03-17 19:29:02 +01:00
co-authored by Claude Opus 4.6
parent c93c692458
commit a7197e5534
8 changed files with 1063 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+22 -9
View File
@@ -2,7 +2,7 @@
## What This Repo Is ## What This Repo Is
A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, and mobile app. A technical book ("Claude's Hidden Toolkit") documenting 37 undocumented internal tools in Claude.ai's consumer interfaces. Fully reverse-engineered through systematic testing across browser, desktop app, Android, and iOS.
## File Roles ## File Roles
@@ -14,28 +14,40 @@ A technical book ("Claude's Hidden Toolkit") documenting 28 undocumented interna
## Domain Knowledge ## Domain Knowledge
- **28 tools** documented with confirmed JSON schemas - **37 tools** documented with confirmed JSON schemas
- **3 platforms** with different tool inventories (browser: 21 tools, desktop: 22+32 MCP, mobile: 20+11 deferred) - **4 platforms** with different tool inventories:
- Browser: 21 always-loaded, `tool_search` conditionally available with MCP connectors
- Desktop: 22 always-loaded + 32 MCP tools via `tool_search`
- Android: 22 always-loaded + 11 deferred consumer tools
- iOS: 22 always-loaded + 16 deferred consumer tools (Android set + 5 Reminders)
- **MCP connector state** affects tool inventory — connecting Gmail/Calendar adds tools to always-loaded pool
- **Tool cards** in the Technical Annex follow a strict template (see Appendix C in the book) - **Tool cards** in the Technical Annex follow a strict template (see Appendix C in the book)
- **Figures** are numbered sequentially fig_01 through fig_22 — all currently marked [Upcoming] pending screenshot capture - **Figures** are numbered sequentially — all currently marked [Upcoming] pending screenshot capture
- **Response formats** are all empirically confirmed — no inferred markers remain - **Response formats** are all empirically confirmed — no inferred markers remain
- **Two external contributors** credited: an anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite)
## Conventions ## Conventions
- Tool names in backticks: `web_search`, `event_create_v0` - Tool names in backticks: `web_search`, `event_create_v0`
- Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "All" - Platform tags on every claim: "Mobile App only", "Browser + Desktop only", "iOS only", "All"
- Version suffixes: `_v0` (initial/experimental), `_v1` (breaking upgrade) - Version suffixes: `_v0` (initial/experimental), `_v1` (breaking upgrade)
- MCP connector tools use `Provider:tool_name` prefix on browser (e.g., "Google Calendar:gcal_list_calendars")
- Confirmed vs unverified clearly marked — never speculate - Confirmed vs unverified clearly marked — never speculate
- Anonymous contributor referenced only as "An independent security researcher who prefers to remain anonymous" — never use real name
## Architecture Context ## Architecture Context
The book documents a two-tier tool loading system: The book documents a multi-tier tool system:
- **Always-loaded tools**: injected into every conversation context (~17-22 depending on platform) - **Always-loaded tools**: injected into every conversation context (~21-22 depending on platform)
- **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11 consumer tools) - **Deferred tools**: discovered at runtime via `tool_search` (mobile only, 11-16 consumer tools depending on OS)
- **MCP tools**: discovered via `tool_search` on desktop only (32 integration tools) - **MCP tools**: discovered via `tool_search` on desktop (32 integration tools) or conditionally on browser
- **MCP connector tools**: appear in always-loaded pool when connectors (Gmail, Calendar) are active
- **Artifact execution layer**: `anthropic_api_in_artifacts` (Claude-in-Claude), `persistent_storage` (session-scoped), MCP endpoint access from React artifacts — desktop/browser only, not mobile
The calendar system has a dual-layer architecture where Projects use MCP Connector tools with email-based IDs, while standard mobile chats use deferred consumer tools with numeric string IDs. The two layers are incompatible. The calendar system has a dual-layer architecture where Projects use MCP Connector tools with email-based IDs, while standard mobile chats use deferred consumer tools with numeric string IDs. The two layers are incompatible.
`visualize:show_widget` and `chart_display_v0` are mutually exclusive by surface: `chart_display_v0` is mobile only (deferred, intermittent instability), `show_widget` is desktop/browser only.
## Quality Gates ## Quality Gates
Before any content change: Before any content change:
@@ -44,3 +56,4 @@ Before any content change:
3. Does the tool card follow the template structure? 3. Does the tool card follow the template structure?
4. Are figure numbers sequential with no gaps? 4. Are figure numbers sequential with no gaps?
5. Is the response format marked as confirmed or unverified? 5. Is the response format marked as confirmed or unverified?
6. For contributor content: has it been independently verified before documenting as confirmed?
CHANGELOG.md
+31
View File
@@ -4,6 +4,37 @@ All notable changes to Claude's Hidden Toolkit are documented here.
Format follows [Keep a Changelog](https://keepachangelog.com/). Editions are tagged by version. Format follows [Keep a Changelog](https://keepachangelog.com/). Editions are tagged by version.
## [1.4] — 2026-03-15
### Added
- **9 new tool cards** (Cards 29–37): `reminder_list_search_v0`, `reminder_create_v0`, `reminder_search_v0`, `reminder_update_v0`, `reminder_delete_v0` (iOS Reminders CRUD suite), `visualize:show_widget`, `gmail_create_draft`, `anthropic_api_in_artifacts`, `persistent_storage`
- **Artifact execution layer section** (Chapter 9) — documents Claude-inside-Claude architecture: `anthropic_api_in_artifacts` (authenticated API calls from artifacts without API key), `persistent_storage` (session-scoped `window.storage`), MCP endpoint access from React artifacts
- **MCP connector state** as an architectural variable (Chapter 2) — connecting/disconnecting Gmail or Google Calendar changes the always-loaded tool pool
- **Project context behavior** section — confirmed Projects do not change tool behavior
- **Ghost tools** section (Chapter 12) — `gmail_send_draft` and `gmail_modify_thread` exist in schema but are not deployed
- **Contributors section** — credited anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite)
- **iOS vs Android differences** — `user_location_v0` returns richer response on iOS (sub_locality, accuracy fields); `user_time_v0` timestamp format differs (no microseconds on iOS)
### Changed (Corrections)
- **`user_time_v0` and `user_location_v0`**: reclassified from deferred to **always-loaded** on mobile — MCP connector state is irrelevant (v1.3 error)
- **`memory_user_edits`**: limit corrected from 200 characters (server-enforced) to **500 characters** (client-side validation). The limit may vary by tier or build
- **`chart_display_v0`**: crash status downgraded from deterministic (100%) to **intermittent/state-dependent**. Tool is always deferred on mobile, not first-class
- **`tool_search` on browser**: corrected from "does not exist" to **conditionally available** when MCP connectors are active, returning tools with `Provider:tool_name` prefix
- **`window.storage`**: reframed from "persistent" to **session-scoped** — data is destroyed when session closes, does not persist across chats even within the same Project
- **`anthropic_api_in_artifacts`**: corrected from Desktop-only to working on **both Desktop and Browser** React artifacts (HTML artifacts blocked by CSP)
- **`web_fetch`**: corrected from 8 to **9 parameters** (added `html_extraction_method`)
- **`bash_tool`**: corrected from 1 to **2 parameters** (added required `description`)
- **`str_replace`**: corrected from 3 to **4 parameters** (added required `description`)
- **`chart_display_v0` values parameter**: accepts integers on iOS (v1.3 documented strings only)
- **Calendar tools**: always-loaded when MCP Calendar connector active (not always deferred)
- **Platform matrix**: updated to reflect iOS as distinct surface with 5 additional Reminders tools
- **`visualize:show_widget` vs `chart_display_v0`**: documented as mutually exclusive by surface — `chart_display_v0` mobile only, `show_widget` desktop/browser only
### Removed
- Deterministic crash claim for `chart_display_v0`
- "tool_search absent on browser" claim
- 200-character server-enforced limit claim for `memory_user_edits`
## [1.3] — 2026-02-16 ## [1.3] — 2026-02-16
### Added ### Added
CITATION.cff
+11 -6
View File
@@ -6,8 +6,8 @@ authors:
- family-names: "Marinoni Moretto" - family-names: "Marinoni Moretto"
given-names: "Francesco" given-names: "Francesco"
orcid: "" orcid: ""
version: "1.3" version: "1.4"
date-released: "2026-02-16" date-released: "2026-03-17"
url: "https://github.com/n1-ai/claude-hidden-toolkit" url: "https://github.com/n1-ai/claude-hidden-toolkit"
license: "CC-BY-4.0" license: "CC-BY-4.0"
keywords: keywords:
@@ -19,9 +19,14 @@ keywords:
- tool-use - tool-use
- model-context-protocol - model-context-protocol
- claude-ai - claude-ai
- artifact-api
- ios-reminders
abstract: >- abstract: >-
Comprehensive reverse-engineering documentation of 28 undocumented internal Comprehensive reverse-engineering documentation of 37 undocumented internal
tools in Claude.ai's consumer interfaces (browser, desktop app, mobile app). tools in Claude.ai's consumer interfaces (browser, desktop app, Android, iOS).
Covers complete parameter schemas, confirmed response formats, platform-specific Covers complete parameter schemas, confirmed response formats, platform-specific
behavior differences, and a three-tier tool loading architecture across three behavior differences, a three-tier tool loading architecture across four client
client surfaces. Based on 35+ manual tests with empirical verification. surfaces, the artifact execution layer (Claude-inside-Claude API calls, session-scoped
storage, MCP endpoint access), and MCP connector state as an architectural variable.
Based on 50+ manual tests with empirical verification across all platforms. Edition 1.4
includes contributions from two external researchers.
CLAUDE.md
+24 -6
View File
@@ -2,7 +2,7 @@
## Project Overview ## Project Overview
This is "Claude's Hidden Toolkit" — a living technical book documenting Claude.ai's undocumented internal tools. The book reverse-engineers 28 tools across three platforms (browser, desktop app, mobile app) with confirmed schemas, response formats, and behavioral patterns. This is "Claude's Hidden Toolkit" — a living technical book documenting Claude.ai's undocumented internal tools. The book reverse-engineers 37 tools across four platforms (browser, desktop app, Android, iOS) with confirmed schemas, response formats, and behavioral patterns. Edition 1.4 includes contributions from two external researchers.
## Repository Structure ## Repository Structure
@@ -22,9 +22,11 @@ LICENSE # CC BY 4.0
1. **The .md file is the source of truth.** All content edits happen here. 1. **The .md file is the source of truth.** All content edits happen here.
2. **All tool claims must be empirically verified.** No speculative schemas. If you haven't tested it, mark it as unverified. 2. **All tool claims must be empirically verified.** No speculative schemas. If you haven't tested it, mark it as unverified.
3. **Platform matters.** Every tool claim must specify which platform(s) it applies to: browser, desktop app, mobile app, or all. 3. **Platform matters.** Every tool claim must specify which platform(s) it applies to: browser, desktop app, Android, iOS, or all. iOS and Android are distinct — iOS has 5 additional Reminders tools.
4. **Figure numbering is sequential** (fig_01 through fig_22). If adding figures, continue the sequence. Never use letter suffixes (e.g., fig_14b). 4. **MCP connector state matters.** Some tools are only available when specific connectors (Gmail, Calendar) are active. State this explicitly.
5. **Tool cards follow a strict template.** See Appendix C in the book for the template. Every card needs: quick facts table, overview, parameters table, example call with JSON, "When Claude Uses It" table, "Watch Out" section, and platform availability table. 5. **Figure numbering is sequential.** If adding figures, continue the sequence. Never use letter suffixes (e.g., fig_14b).
6. **Tool cards follow a strict template.** See Appendix C in the book for the template. Every card needs: quick facts table, overview, parameters table, example call with JSON, "When Claude Uses It" table, "Watch Out" section, and platform availability table.
7. **Contributor privacy.** The anonymous security researcher must only be referenced as "An independent security researcher who prefers to remain anonymous." Never use their real name anywhere.
## Writing Style ## Writing Style
@@ -37,9 +39,23 @@ LICENSE # CC BY 4.0
## Tool Naming Conventions ## Tool Naming Conventions
- Always-loaded tools: `web_search`, `memory_user_edits`, etc. - Always-loaded tools: `web_search`, `memory_user_edits`, etc.
- Deferred tools (mobile only): `user_time_v0`, `alarm_create_v0`, etc. - Deferred tools (mobile only): `alarm_create_v0`, `chart_display_v0`, etc.
- Version suffixes: `_v0` = initial, `_v1` = breaking change upgrade - Always-loaded on mobile (not deferred): `user_time_v0`, `user_location_v0`
- MCP connector tools: `gmail_create_draft`, `gcal_list_calendars`, etc.
- Artifact-layer tools: `anthropic_api_in_artifacts`, `persistent_storage`
- Visualization: `visualize:show_widget` (colon-namespaced, desktop/browser only)
- iOS-only tools: `reminder_create_v0`, `reminder_search_v0`, etc.
- Version suffixes: `_v0` = initial/experimental, `_v1` = breaking change upgrade
- Unversioned tools are considered stable - Unversioned tools are considered stable
- Ghost tools (schema-present, not deployed): `gmail_send_draft`, `gmail_modify_thread`
## Architecture Quick Reference
- `chart_display_v0` (mobile only) and `visualize:show_widget` (desktop/browser only) are mutually exclusive by surface
- `window.storage` / `persistent_storage` is session-scoped only — "persistent" naming is misleading
- `anthropic_api_in_artifacts` works in React artifacts (desktop + browser), blocked in HTML artifacts by CSP
- MCP connector state changes the always-loaded tool pool — this is a v1.4 finding
- Project context does not change tool behavior
## What Not To Do ## What Not To Do
@@ -47,3 +63,5 @@ LICENSE # CC BY 4.0
- Don't change the figure numbering scheme without renumbering all references - Don't change the figure numbering scheme without renumbering all references
- Don't remove the [Upcoming] tags on figures — they indicate screenshots pending capture - Don't remove the [Upcoming] tags on figures — they indicate screenshots pending capture
- Don't merge the .md living repository links with personal GitHub links — they serve different purposes - Don't merge the .md living repository links with personal GitHub links — they serve different purposes
- Don't use the anonymous contributor's real name — ever, anywhere
- Don't document ghost tools as functional — they exist in schema only
CONTRIBUTING.md
+15 -6
View File
@@ -2,6 +2,8 @@
Thanks for your interest in contributing! This project documents Claude.ai's undocumented internal tools — every contribution helps the community understand what's really happening under the hood. Thanks for your interest in contributing! This project documents Claude.ai's undocumented internal tools — every contribution helps the community understand what's really happening under the hood.
Two external contributors have already shaped v1.4: an anonymous security researcher (11 findings) and DMontgomery40 (iOS Reminders suite). Your discoveries are welcome too.
## How to Contribute ## How to Contribute
### Reporting New Tools or Changes ### Reporting New Tools or Changes
@@ -11,7 +13,7 @@ If you've discovered a new tool, a schema change, or platform-specific behavior
1. **Open an Issue** with the label `discovery` 1. **Open an Issue** with the label `discovery`
2. Include: 2. Include:
- Tool name (exact internal name if known) - Tool name (exact internal name if known)
- Platform tested on (browser / desktop app / mobile app / iOS / Android) - Platform tested on (browser / desktop app / Android / iOS)
- How you discovered it (e.g., `tool_search` query, system prompt extraction, behavioral observation) - How you discovered it (e.g., `tool_search` query, system prompt extraction, behavioral observation)
- Parameter schema if available (JSON) - Parameter schema if available (JSON)
- Response format with a real example - Response format with a real example
@@ -40,9 +42,9 @@ For direct content changes:
## Formatting Conventions ## Formatting Conventions
- **Tool names** in backticks: `web_search`, `event_create_v0` - **Tool names** in backticks: `web_search`, `event_create_v0`
- **Platform availability** stated on every claim - **Platform availability** stated on every claim — distinguish Android from iOS where relevant
- **Tool cards** follow the template in Appendix C — don't freestyle the structure - **Tool cards** follow the template in Appendix C — don't freestyle the structure
- **Figures** are numbered sequentially (fig_01 through fig_22+). Continue the sequence; never reuse or skip numbers - **Figures** are numbered sequentially. If adding figures, continue the sequence; never reuse or skip numbers
- **Response formats** marked as confirmed with real output. If you can't confirm, note it explicitly - **Response formats** marked as confirmed with real output. If you can't confirm, note it explicitly
- **Tables** for structured comparisons, not bullet lists - **Tables** for structured comparisons, not bullet lists
@@ -60,12 +62,19 @@ If you've observed something but can't fully verify it, open an Issue rather tha
High-value contributions include: High-value contributions include:
- **iOS-specific tools** (Reminders suite, Siri integration) — we have limited iOS testing coverage - **Android-specific tools** we might be missing
- **Screenshot captures** for the 22 figures currently marked [Upcoming] - **Team/Enterprise-exclusive tools** — we have no coverage of enterprise-tier features
- **Screenshot captures** for figures currently marked [Upcoming]
- **Cross-platform verification** of existing tool cards on platforms we haven't tested - **Cross-platform verification** of existing tool cards on platforms we haven't tested
- **New deferred tools** discovered via `tool_search` sweeps - **New deferred tools** discovered via `tool_search` sweeps
- **Schema changes** from Anthropic updates that break or modify existing tools - **Schema changes** from Anthropic updates that break or modify existing tools
- **MCP Connector behavior** differences between Projects and standard chats - **MCP Connector behavior** differences — especially new connectors beyond Gmail/Calendar/Drive
- **Ghost tool activation** — monitoring `gmail_send_draft` and `gmail_modify_thread` for deployment
- **Artifact execution layer** findings — new capabilities in `anthropic_api_in_artifacts` or `persistent_storage`
## Contributor Credits
All contributors are credited in the book and README. If you prefer to remain anonymous, let us know — we respect privacy (see our existing anonymous contributor as an example).
## Code of Conduct ## Code of Conduct
Claude_Hidden_Toolkit.md
+931 -112
View File
File diff suppressed because it is too large Load Diff
README.md
+25 -12
View File
@@ -2,17 +2,17 @@
**The Definitive Guide to Claude.ai's Undocumented Internal Tools** **The Definitive Guide to Claude.ai's Undocumented Internal Tools**
*28 tools. Zero official documentation. Fully reverse-engineered.* *37 tools. Zero official documentation. Fully reverse-engineered.*
--- ---
## What Is This? ## What Is This?
Claude.ai ships with 28+ internal tools — capabilities that let Claude check the time, search your calendar, render interactive charts, draft emails with native app integration, find nearby restaurants, display them on a map, set alarms on your phone, and more. Claude.ai ships with 37+ internal tools — capabilities that let Claude check the time, search your calendar, render interactive charts, draft emails directly into your Gmail, find nearby restaurants, display them on a map, set alarms on your phone, manage iOS Reminders, build AI-powered artifacts that call Claude from within Claude, and more.
**Almost none of this is documented.** **Almost none of this is documented.**
Anthropic's official docs cover the API. But the consumer product — claude.ai — has a rich, evolving toolkit that exists in a documentation void. This book fills that gap through systematic reverse-engineering across three platforms (browser, desktop app, mobile app). Anthropic's official docs cover the API. But the consumer product — claude.ai — has a rich, evolving toolkit that exists in a documentation void. This book fills that gap through systematic reverse-engineering across four platforms (browser, desktop app, Android, iOS).
## Key Discoveries ## Key Discoveries
@@ -20,41 +20,54 @@ Anthropic's official docs cover the API. But the consumer product — claude.ai
| Platform | Always-Loaded | tool_search | Deferred Tools | | Platform | Always-Loaded | tool_search | Deferred Tools |
|----------|:---:|:---:|:---:| |----------|:---:|:---:|:---:|
| Browser (claude.ai) | 21 | ❌ | None | | Browser (claude.ai) | 21 | MCP only (when connectors active) | None |
| Desktop App | 22 | MCP only | 32 (Chrome + Filesystem) | | Desktop App | 22 | MCP only | 32 (Chrome + Filesystem) |
| Mobile App | 20 | Consumer | 11 (alarm, timer, calendar, etc.) | | Mobile (Android) | 22 | Consumer | 11 (alarm, timer, calendar, etc.) |
| Mobile (iOS) | 22 | Consumer | 16 (Android set + 5 Reminders tools) |
**Every response format has been empirically confirmed** — no inferred schemas remain in Edition 1.3. **MCP connector state changes the tool inventory.** Connecting Gmail or Google Calendar adds tools to the always-loaded pool. Disconnecting removes them. This is a new architectural variable documented in v1.4.
**The artifact execution layer.** Claude artifacts can make authenticated API calls back to Claude itself — Claude-inside-Claude — without API keys. The runtime injects authentication. This, along with session-scoped storage and MCP endpoint access, means artifacts are evolving into a lightweight application platform.
**Every response format has been empirically confirmed** — no inferred schemas remain.
## What's Inside ## What's Inside
| Chapter | Coverage | | Chapter | Coverage |
|---------|----------| |---------|----------|
| 1–2 | Architecture: two-tier loading, platform inventory, versioning | | 1–2 | Architecture: two-tier loading, platform inventory, MCP connector state, versioning |
| 3 | Context tools: `user_time_v0`, `user_location_v0` | | 3 | Context tools: `user_time_v0`, `user_location_v0` |
| 4 | Interaction widgets: `ask_user_input_v0`, `message_compose_v1` | | 4 | Interaction widgets: `ask_user_input_v0`, `message_compose_v1` |
| 5 | Inline charts: `chart_display_v0` | | 5 | Inline charts: `chart_display_v0`, `visualize:show_widget` |
| 6 | Calendar & device: 6 calendar tools + alarms + timers | | 6 | Calendar & device: 6 calendar tools + alarms + timers |
| 7 | Search & data: web, images, places, maps, sports, Drive, weather, recipes | | 7 | Search & data: web, images, places, maps, sports, Drive, weather, recipes |
| 8 | Memory: `memory_user_edits`, `conversation_search`, `recent_chats` | | 8 | Memory: `memory_user_edits`, `conversation_search`, `recent_chats` |
| 9 | Computer use: bash, files, artifacts, the skill system | | 9 | Computer use: bash, files, artifacts, the skill system, artifact execution layer |
| 10 | The meta-tool: `tool_search` and enumeration methodology | | 10 | The meta-tool: `tool_search` and enumeration methodology |
| 11 | Complete tool reference index | | 11 | Complete tool reference index |
| 12 | MCP convergence and what comes next | | 12 | Ghost tools, MCP convergence, and what comes next |
| Annex | 28 detailed tool cards with confirmed JSON schemas | | Annex | 37 detailed tool cards with confirmed JSON schemas |
## Read the Book ## Read the Book
- **[Claude_Hidden_Toolkit.md](Claude_Hidden_Toolkit.md)** — Full book, Markdown (~21,600 words) - **[Claude_Hidden_Toolkit.md](Claude_Hidden_Toolkit.md)** — Full book, Markdown (~25,000 words)
## Edition History ## Edition History
| Edition | Date | Changes | | Edition | Date | Changes |
|---------|------|---------| |---------|------|---------|
| 1.4 | Mar 2026 | 9 new tools (28→37), 13 corrections, 2 external contributors. New: iOS Reminders suite (5 tools), `visualize:show_widget`, `gmail_create_draft`, `anthropic_api_in_artifacts`, `persistent_storage`. Corrected: `user_time_v0`/`user_location_v0` always-loaded on mobile, `memory_user_edits` 500-char limit, `chart_display_v0` intermittent (not deterministic crash), `window.storage` session-scoped, `tool_search` on browser with MCP. New chapter sections on artifact execution layer and MCP connector state. |
| 1.3 | Feb 2026 | Platform architecture chapter, 3 new tool cards (weather, recipe, end_conversation), cross-platform verification of all 28 cards, settings/connectors appendix, all response formats confirmed | | 1.3 | Feb 2026 | Platform architecture chapter, 3 new tool cards (weather, recipe, end_conversation), cross-platform verification of all 28 cards, settings/connectors appendix, all response formats confirmed |
| 1.2 | Feb 2026 | 25 tool cards, discovery methodology, initial availability matrix | | 1.2 | Feb 2026 | 25 tool cards, discovery methodology, initial availability matrix |
| 1.0–1.1 | Feb 2026 | Initial discovery and documentation | | 1.0–1.1 | Feb 2026 | Initial discovery and documentation |
## Contributors
This project is maintained by Francesco Marinoni Moretto and has benefited from external contributions:
- **An independent security researcher** (anonymous by request) — 11 findings including the artifact API discovery, session-scoped storage, MCP endpoints in artifacts, skill filesystem topology, and egress proxy JWT architecture
- **DMontgomery40** ([GitHub](https://github.com/DMontgomery40)) — Documented the complete iOS Reminders CRUD suite (5 tools) via GitHub issues
## Prior Art & Credits ## Prior Art & Credits
This work builds on contributions from: **Shlok Khemani** (memory tool schemas, Sept 2025), **Simon Willison** (system prompt analysis), **Adversa AI** (security research, named `message_compose_v1`), **Federico Viticci / MacStories** (iOS tools and `_v0` naming convention discovery). This work builds on contributions from: **Shlok Khemani** (memory tool schemas, Sept 2025), **Simon Willison** (system prompt analysis), **Adversa AI** (security research, named `message_compose_v1`), **Federico Viticci / MacStories** (iOS tools and `_v0` naming convention discovery).
SECURITY.md
+4 -2
View File
@@ -13,6 +13,7 @@ If you discover a tool behavior that could be exploited to:
- Exfiltrate sensitive information via tool parameters or responses - Exfiltrate sensitive information via tool parameters or responses
- Manipulate tool behavior through prompt injection in tool inputs - Manipulate tool behavior through prompt injection in tool inputs
- Escalate permissions beyond intended scope - Escalate permissions beyond intended scope
- Abuse the artifact execution layer (`anthropic_api_in_artifacts`, `persistent_storage`, MCP endpoints) for unintended access
**Please report it responsibly:** **Please report it responsibly:**
@@ -42,5 +43,6 @@ If you discover a tool behavior that could be exploited to:
| Version | Supported | | Version | Supported |
|---------|-----------| |---------|-----------|
| 1.3 | Yes | | 1.4 | Yes |
| < 1.3 | No — please reference the latest edition | | 1.3 | No — please reference the latest edition |
| < 1.3 | No |