# ai.finestructure/fine-structure

Build and host full-stack apps from a prompt, with agents that reach you on WhatsApp and email.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.0.2
- **Author:** ai.finestructure
- **License:** Unknown
- **Endpoints:** streamable-http https://finestructure.ai/api/mcp
- **Source:** https://finestructure.ai
- **Endpoint health:** reachable (last checked 2026-09-14T05:27:55.355Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-14T05:27:55.355Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.

## Tools

84 declared. Observed from a live `tools/list` probe.
- `create_app` — Create a new application from a natural language prompt. The AI generates a complete web app with pages, components, styling, and data models. Returns a job_id 
- `agency_create_client` — Agency mode only. Create or update a client record for an account-level agent. This does not create a verified Fine Structure user account and does not transfer
- `agency_list_clients` — Agency mode only. List client records and app handoff status for the authenticated agent.
- `agency_create_client_app` — Agency mode only. Create a new app owned by the agent, start generation, and create a claim link for the client. Ownership transfers only when the invited clien
- `agency_create_claim_link` — Agency mode only. Create a client claim link for an existing app owned by the agent. The client must log in with the invited email before ownership transfers.
- `agency_get_claim_status` — Agency mode only. Inspect one handoff status without exposing the raw claim token.
- `update_app` — Update an existing application with a new prompt. The AI modifies the app based on your instructions. Creates a Saved Version before the update. Returns a job_i
- `publish_app` — Publish an app - freeze current state and make it live at a URL. Also configures whether the public URL is open, app-login gated, private, or inferred from the 
- `get_platform_guide` — Return a machine-readable Fine Structure / FSe2 guide for AI agents. Call this at the start of an MCP session to learn app files, entities, safe edit workflows,
- `get_recommended_workflow` — Return the recommended MCP tool sequence for a task type. Use this before creating apps, editing files, seeding data, publishing, setting up A/B tests, restorin
- `get_job_status` — Poll the status of an async generation job. Use this after create_app or update_app to know when the job is done. Returns status ('running' or 'done'), progress
- `get_app_status` — Get app overview: files, published state, URL, active jobs.
- `get_app_links` — Return editor, preview, published path, subdomain, and custom-domain links plus whether each works for anonymous visitors, app users, or Studio users based on p
- `list_app_domains` — List an app's platform path, subdomain, and configured custom domain with verification, SSL, primary-domain, redirect, publish, and login-gating status.
- `set_app_subdomain` — Set or clear the app platform subdomain - the '<subdomain>.<base domain>' host Fine Structure already serves the app on. Runs the same ownership, format, reserv
- `check_subdomain_available` — Check whether a platform subdomain can be claimed before calling set_app_subdomain. Returns available plus a status of available, invalid, reserved, taken, curr
- `add_custom_domain` — Attach or replace the app custom domain through the same Fine Structure Studio custom-domain flow. Returns exact DNS verification and routing records for the us
- `get_domain_verification` — Return the exact DNS records and instructions required to verify and route the app custom domain.
- `check_domain_verification` — Check Fine Structure custom-domain verification and SSL status for the configured custom domain, then save the latest status.
- `set_primary_domain` — Set which app host should be treated as primary for generated links and custom-domain redirects.
- `remove_custom_domain` — Remove the configured custom domain from the app and clean up the platform-side hostname registration when possible.
- `get_domain_ssl_status` — Return SSL/certificate status and pending certificate validation DNS records for the app custom domain.
- `configure_domain_redirects` — Configure custom-domain redirect policy: primary domain, optional www/root redirect, and HTTPS enforcement.
- `list_apps` — List applications owned by the authenticated user, newest activity first. Returns up to `limit` apps per call plus the total count; page with `offset` when the 
- `get_app_files` — Get the file tree for an app with paths and byte sizes.
- `read_app_file` — Read one source file from an app's virtual filesystem. Paths follow the Fine Structure app file API, documented at https://finestructure.ai/api/mcp/docs.
- `read_app_files` — Read several source files from an app's virtual filesystem. Paths follow the Fine Structure app file API, documented at https://finestructure.ai/api/mcp/docs.
- `write_app_file` — Create or replace one file in an app's virtual filesystem. Creates a Saved Version before changing content. Paths and file model follow the Fine Structure app f
- `patch_app_file` — Patch one file by replacing exact text. Safer than full overwrite for targeted edits. Creates a Saved Version before changing content. Paths follow the Fine Str
- `rename_app_file` — Rename or move one app source file atomically. Internally stages an upsert at new_path and a delete at old_path, validates the resulting app state, and creates 
- `get_app_detail` — Deep introspection of an app: entities, pages, settings, integrations, environment variables, and file structure. Use this to understand what an app contains be
- `get_entities` — Get all entity (data model) schemas for an app, with record counts. Each entity has fields, types, and relationships.
- `query_entity` — Query app data records for one entity with optional exact-match filters.
- `seed_entity` — Compatibility tool for starter-record creation. Inserts directly for the authenticated app owner; by default it only seeds an empty entity (skip_if_not_empty).
- `create_entity_records` — Create/insert records in one app entity. Executes directly for the authenticated app owner and returns the created record ids.
- `update_entity_record` — Compatibility tool that updates one record by ID. Executes directly for the authenticated app owner.
- `update_entity_records` — Update exact records. Select explicit record_ids or exact-match filters and provide shared changes, or provide per-record updates. Executes directly for the aut
- `delete_entity_records` — Delete exact records by ID or exact-match filters. Executes directly for the authenticated app owner; pass expected_count as a safety check to abort on a mismat
- `get_pages` — Get all pages in an app with their file paths and sizes.
- `get_errors` — Get recent runtime errors for an app (last 20). Useful for diagnosing issues before updating.
- …and 44 more

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"fine-structure\": {\n      \"type\": \"http\",\n      \"url\": \"https://finestructure.ai/api/mcp\"\n    }\n  }\n}"
```

## Blast radius

Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; 8 privileged tools.
- Floor 38, ceiling 62 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/ai.finestructure%2Ffine-structure
- Install plan: https://forgeregistry.com/api/v1/packages/ai.finestructure%2Ffine-structure/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/ai.finestructure%2Ffine-structure
- HTML page: https://forgeregistry.com/registry/ai.finestructure%2Ffine-structure
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.