{"data":{"slug":"tldraw","verdict":"passed","scannedAt":"2026-10-26T02:53:43.487Z","scannerVersion":"1.2.1","latest":{"id":"62cb1e0b-0eab-4c2d-964a-3399b4f258f9","createdAt":"2026-10-26T02:53:43.487Z","version":"0.1.0","trigger":"tools_changed","scannerVersion":"1.2.1","verdict":"passed","checks":[{"id":"hidden_instructions","status":"passed","findings":0,"label":"Hidden instructions"},{"id":"hidden_text","status":"passed","findings":0,"label":"Invisible text"},{"id":"sensitive_access","status":"passed","findings":0,"label":"Access to credentials"},{"id":"remote_code","status":"passed","findings":0,"label":"Downloads and runs code"},{"id":"exfiltration","status":"passed","findings":0,"label":"Sends data out"},{"id":"secrets","status":"passed","findings":0,"label":"Leaked secrets"}],"findings":[],"toolCount":6},"history":[{"id":"62cb1e0b-0eab-4c2d-964a-3399b4f258f9","createdAt":"2026-10-26T02:53:43.487Z","version":"0.1.0","trigger":"tools_changed","scannerVersion":"1.2.1","verdict":"passed","checks":[{"id":"hidden_instructions","status":"passed","findings":0,"label":"Hidden instructions"},{"id":"hidden_text","status":"passed","findings":0,"label":"Invisible text"},{"id":"sensitive_access","status":"passed","findings":0,"label":"Access to credentials"},{"id":"remote_code","status":"passed","findings":0,"label":"Downloads and runs code"},{"id":"exfiltration","status":"passed","findings":0,"label":"Sends data out"},{"id":"secrets","status":"passed","findings":0,"label":"Leaked secrets"}],"findings":[],"toolCount":6},{"id":"0ac55f93-75ff-4763-971c-23146d5cf0b8","createdAt":"2026-10-25T23:23:27.449Z","version":"0.1.0","trigger":"new","scannerVersion":"1.2.1","verdict":"passed","checks":[{"id":"hidden_instructions","status":"passed","findings":0,"label":"Hidden instructions"},{"id":"hidden_text","status":"passed","findings":0,"label":"Invisible text"},{"id":"sensitive_access","status":"passed","findings":0,"label":"Access to credentials"},{"id":"remote_code","status":"passed","findings":0,"label":"Downloads and runs code"},{"id":"exfiltration","status":"passed","findings":0,"label":"Sends data out"},{"id":"secrets","status":"passed","findings":0,"label":"Leaked secrets"}],"findings":[],"toolCount":null}],"endpoint":{"url":"https://tldraw-mcp-app.tldraw.workers.dev/mcp","transport":"streamable-http","status":"ok","checkedAt":"2026-10-26T02:52:52.070Z","toolCount":6,"latencyMs":1322,"error":null},"tools":[{"name":"_exec_callback","title":"Exec Callback","description":"App-only: widget calls this to resolve a pending exec request.","access":"write","accessDeclared":true,"hash":"f8585a4d41d8707a10ccac1576aa38b0380493db1243f85c60c4c0f0faa3f8e4","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"channel\": {\n      \"type\": \"string\"\n    },\n    \"error\": {\n      \"type\": \"string\"\n    },\n    \"execKey\": {\n      \"type\": \"string\"\n    },\n    \"result\": {\n      \"properties\": {\n        \"canvasId\": {\n          \"type\": \"string\"\n        },\n        \"error\": {\n          \"type\": \"string\"\n        },\n        \"result\": {},\n        \"success\": {\n          \"type\": \"boolean\"\n        }\n      },\n      \"required\": [\n        \"success\"\n      ],\n      \"type\": \"object\"\n    }\n  },\n  \"required\": [\n    \"channel\"\n  ],\n  \"type\": \"object\"\n}"},{"name":"_get_canvas_state","title":"Get Canvas State","description":"App-only: get the latest checkpoint for a canvas by its canvasId.","access":"read","accessDeclared":true,"hash":"212aec5beb225c626fc2a2eba2a400ca6cc8cc5099b91714ffd4333493572bdd","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"canvasId\": {\n      \"minLength\": 1,\n      \"type\": \"string\"\n    }\n  },\n  \"required\": [\n    \"canvasId\"\n  ],\n  \"type\": \"object\"\n}"},{"name":"exec","title":"Execute Code","description":"Execute JavaScript code on a tldraw canvas. The code runs in the widget with access to the live `editor` instance, helper functions, and normal js. Use the `search` tool first to discover available Editor methods and shape types.\n\nEach canvas has a unique `canvasId`. Omit `canvasId` to create a new blank canvas. To edit an existing canvas, pass the `canvasId` that was returned by a previous exec call.\n\nShapes and text grow depending on the amount of text they have. Use clever scripting to ensure there are no unintended overlaps.\n\nExamples:\n- Create a rectangle: editor.createShape({ _type: 'rectangle', shapeId: 'box1', x: 200, y: 120, w: 320, h: 180, text: 'Hello' })\n- Connect shapes with an arrow: editor.createShape({ _type: 'arrow', shapeId: 'a1', fromId: 'box1', toId: 'box2', x1: 0, y1: 0, x2: 100, y2: 0 })\n- Select and zoom: editor.select('box1'); editor.zoomToSelection()\n- Read shapes: return editor.getCurrentPageShapes()\n- Distribute evenly: editor.distributeShapes(editor.getSelectedShapeIds(), 'horizontal')\n- Box around shapes: boxShapes(['box1', 'box2'], { text: 'Group label', color: 'blue' })\n- Stack shapes dynamically: editor.createShape({ _type: 'rectangle', shapeId: 'a', x: 0, y: 0, w: 300, h: 200, text: 'First box\\nwith wrapping text' }); const bounds = editor.getShapePageBounds('a'); editor.createShape({ _type: 'rectangle', shapeId: 'b', x: 0, y: bounds.maxY + 20, w: 300, h: 200, text: 'Below first' })","access":"write","accessDeclared":true,"hash":"acf7f2a7048e381633b3ad70d72fb294d554052e1733b0f757dd3a3a0f6b66ed","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"canvasId\": {\n      \"description\": \"Canvas ID to edit. Omit to create a new blank canvas. Pass a canvasId from a previous exec result to continue editing that canvas.\",\n      \"type\": \"string\"\n    },\n    \"code\": {\n      \"description\": \"JavaScript code to execute. Has access to `editor` (tldraw Editor instance) and helper functions.\",\n      \"type\": \"string\"\n    }\n  },\n  \"required\": [\n    \"code\"\n  ],\n  \"type\": \"object\"\n}"},{"name":"read_checkpoint","title":"Read Checkpoint","description":"App-only: read shapes from a checkpoint by ID.","access":"read","accessDeclared":true,"hash":"444e4cba7d295ffe6597f8b7219a3d293ba34ca4f4423ee2f7dcf17bbe002aae","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"checkpointId\": {\n      \"minLength\": 1,\n      \"type\": \"string\"\n    }\n  },\n  \"required\": [\n    \"checkpointId\"\n  ],\n  \"type\": \"object\"\n}"},{"name":"save_checkpoint","title":"Save Checkpoint","description":"App-only: save shapes to a checkpoint (from user edits). shapesJson and assetsJson must be JSON array strings.","access":"write","accessDeclared":true,"hash":"6ea13e108a4ec9f2bcde806972b0a5d8c1a53bee2e2308a1ce71d693485b9366","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"assetsJson\": {\n      \"type\": \"string\"\n    },\n    \"bindingsJson\": {\n      \"type\": \"string\"\n    },\n    \"canvasId\": {\n      \"type\": \"string\"\n    },\n    \"checkpointId\": {\n      \"minLength\": 1,\n      \"type\": \"string\"\n    },\n    \"shapesJson\": {\n      \"type\": \"string\"\n    }\n  },\n  \"required\": [\n    \"checkpointId\",\n    \"shapesJson\"\n  ],\n  \"type\": \"object\"\n}"},{"name":"search","title":"Search Editor API","description":"Search the tldraw Editor API spec by writing JavaScript that receives a `spec` object and returns a result. The spec contains: spec.members (all Editor methods/properties with name, kind, signature, description, category), spec.categories (category names), spec.types.shapes (focused shape type definitions with props), spec.types.shapeTypes (list of all shape type strings), spec.helpers (exec helper functions with descriptions, params, examples).\n\nExamples:\n- Find shape methods: return spec.members.filter(m => m.category === \"shapes\").map(m => ({ name: m.name, signature: m.signature }))\n- Get arrow shape props: return spec.types.shapes.find(s => s.shapeType === \"arrow\")\n- List all categories: return spec.categories\n- Find a helper: return spec.helpers.find(h => h.name === \"createArrowBetweenShapes\")","access":"read","accessDeclared":true,"hash":"384a452c0c4175c61e306d998b3f9eefa1ffc213ba11bb607a9d5c47dcd3199d","inputSchema":"{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"properties\": {\n    \"code\": {\n      \"description\": \"JavaScript code that receives `spec` and returns a result. Must use `return` to produce output.\",\n      \"type\": \"string\"\n    }\n  },\n  \"required\": [\n    \"code\"\n  ],\n  \"type\": \"object\"\n}"}],"toolsHash":"f38a163db69f32b3635561de081b94beaec9b7c2aed84ec906c5986d09121aa4","toolsPinnedAt":"2026-10-26T02:52:52.105Z","toolsLastSeenAt":"2026-10-26T02:52:52.070Z","toolChanges":[]}}