teamonly
dev.teamonly/teamonly · version 0.9.0 · 2,437 weekly npm downloads · audited 2026-11-03
Notes
Findings
No hidden-instruction or invisible-character findings in any tool, prompt, or resource description.
Claude Connectors Directory readiness
- ✅ Every tool has a title 15 of 15 tools
- ❌ Every tool declares readOnlyHint or destructiveHint Missing on 10 of 15: init, deploy, rollback, pull and 6 more
- ✅ Tool names are 64 characters or fewer All within limit
- ❌ Descriptions avoid instructions about model behavior or other tools 10 of 15 descriptions reference other tools or tell the model what it must do: get_app_rules, deploy, versions, rollback and 6 more
- ✅ No hidden instructions or invisible characters in tool metadata None found
Checks the directory's published tool requirements that are visible from tools/list. Passing them does not guarantee acceptance.
What this server's tools can do
- Has delete or destructive operations:
delete_app
Not a vulnerability by itself. It tells you what an injected prompt could ask this server to do, so you can decide which tools need approval.
Supply chain
- Install scripts: none
- npm provenance: no
- Source repository linked: no
- License: SEE LICENSE IN LICENSE
- Direct dependencies: 1
Tools (15)
| Name | Title | Hint | Description |
|---|---|---|---|
get_app_rules | How to write a TeamOnly app | read-only | The rules for writing an app that deploys on TeamOnly: the supported stack, how to read the signed-in person, the database, files, secrets, email to coworkers, scheduled jobs and roles. Read this before writing or changi… |
init | Set up a folder for TeamOnly | none | In an empty folder, creates a starter app (or a ready-made one with "template"). In a folder with an existing app, adds teamonly.json and the TeamOnly instructions for Claude Code, Cursor and other AI tools. Leave "templ… |
deploy | Deploy the app | none | Builds the app in "directory" and puts it online at https://<app>.<company>.teamonly.app, behind the company login. Takes up to a minute. If the person is not signed in, the result says what to do (use sign_in). |
versions | List the app's versions | read-only | Lists the deployed versions of the app, newest first: number, when, who deployed it, and which one is live. The last 10 can be put back with rollback. |
rollback | Put an earlier version back | none | Puts the previous version of the app back live (or "version", a number from versions). Use it when a deploy broke the app and the person wants the last working one back now. Code, pages and scheduled jobs go back; the da… |
pull | Download an app's code | none | Downloads the code of a deployed app (kept with each deploy) into a new folder named after the app, inside "directory". Use it when the person wants to change an app whose code is not on this computer, for example one a … |
status | Who is signed in, plan and apps | read-only | Shows who is signed in to TeamOnly on this computer, the company and plan (with free trial days left), and every app with its address, who can open it and when it was last deployed. |
logs | Watch the live app | read-only | Collects the live app's requests, console.log output and errors for a few seconds and returns them. Ask the person to open the app (or trigger the problem) while it runs. |
access | Who can open the app | none | Shows or changes who can open the app. "show" (default), "everyone" (everyone at the company), "only" (only these people and the owner), "add" or "remove" people on that list. |
roles | Roles inside the app | none | Shows or changes the roles people have inside the app (the app reads them as ctx.user.roles), such as approver or finance. "show" (default), "add" or "remove" a role for some people. |
set_secret | Save a secret | none | Saves a secret (API key, password) for the deployed app. The app reads it with ctx.secrets.get(NAME). Names are UPPER_SNAKE_CASE. Ask the person for the value; never put it in code. |
sign_in | Sign in with a work email | none | Signs in to TeamOnly on this computer. Call it with "email" first: TeamOnly emails that address a 6-digit code. Ask the person for the code, then call again with "code". If their company is new, the result says so; then … |
start_trial | Start a free 14-day trial | none | For a company that doesn't have TeamOnly yet, after sign_in verified the email: starts a free 14-day trial (one builder, up to 3 apps, no card). |
subscribe | Pick a paid plan | none | Starts paying for TeamOnly (also ends a free trial): opens a payment page in the person's browser and returns its link. The person pays there; call subscribe again afterwards to finish. Plans: builder ($19/mo, one builde… |
delete_app | Delete the app | destructive | Deletes the live app with its database, files and secrets. It cannot be undone. Only call this when the person asked for it, and pass the app name (from teamonly.json) as "confirm". |
Check your own setup
npx mcpvetter scan --liveBadge
Add this to a README:
[](https://mcpvetter.com/servers/teamonly)Publish this server?
Get the MCPVetter verified badge, a re-audit within 24 hours of every npm release, and an email whenever tools, findings, or Claude directory readiness change. $29 per server per month. You prove ownership first, free.