# io.github.valetdotdev/valet Get share links, publish and manage websites, artifacts and agents. No account needed. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** io.github.valetdotdev - **License:** Unknown - **Endpoints:** streamable-http https://api.valet.dev/mcp - **Source:** https://valet.dev - **Endpoint health:** reachable (last checked 2026-09-25T17:33:01.562Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-25T17:33:01.562Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 16 declared. Observed from a live `tools/list` probe. - `attach_site_connector` — Attach an organization connector to a website so pages served from that site can call the connector's tools. Attaching is a grant, and it is wider than it looks - `call_site_connector` — Run one tool on a connector attached to a website and return what the connector answered. It is the sampling step of building a page that calls live data: disco - `create_connector` — Create an organization connector from a Valet catalog entry. It is the step after list_catalog_connectors found the entry for the product the user named; attach - `delete_site` — Permanently delete a website and stop serving it. Identify it by name, which requires connecting a Valet account, or by the site_token returned when it was publ - `detach_site_connector` — Detach a connector from a website, so pages served from that site can no longer call it. The connector itself is left in place for the rest of the organization, - `get_connector_client` — Get how a page served from a Valet site talks to the connectors attached to it. It is the pair to get_design_system: consult that tool for the artifact's identi - `get_design_system` — Get the identity brief to follow before you build or substantially rewrite an artifact. Returns the caller's organization design system when it has one, otherwi - `get_site` — Get one website's URL, access mode, version, and expiry. Identify it by name, which requires connecting a Valet account, or by the site_token returned when it w - `list_attachable_connectors` — List the organization connectors a website can hold — the discovery step before attach_site_connector. Only connectors a page can actually call appear: HTTP MCP - `list_catalog_connectors` — List the connectors Valet curates — the catalog an organization creates a connector from. Reach for it when list_attachable_connectors returned nothing that ser - `list_site_connectors` — List the connectors attached to a website, each with the tools a page served from that site can call. Read it before writing a page that calls one: the tool nam - `list_sites` — List the websites in a Valet organization: name, URL, access mode, and when each was last published. It is the way to recover a site's name when an earlier publ - `publish_site` — Publish files as a live website on the public internet, served over HTTPS. Use it when a report, essay, slide-like narrative, dashboard, marketing surface, or o - `rename_site` — Rename a website and move it to https://.valet.run/. The old address stops serving the site and its name becomes available to another site or app - `set_site_access` — Set who can reach a website: public serves it to anyone who has the link, private serves it only to members of the organization that owns it, and password serve - `share_site` — Share a website with specific people by email, whether it is private or password-protected — sharing does not change who else can reach it. Each address is mail ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"valet\": {\n \"type\": \"http\",\n \"url\": \"https://api.valet.dev/mcp\"\n }\n }\n}" ``` ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure. - Floor 33, ceiling 57 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.github.valetdotdev%2Fvalet - Install plan: https://forgeregistry.com/api/v1/packages/io.github.valetdotdev%2Fvalet/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.github.valetdotdev%2Fvalet - HTML page: https://forgeregistry.com/registry/io.github.valetdotdev%2Fvalet - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.