@sandboxapis/mcp

What changed

Changed between 26 October 2026 and 29 October 2026 (first seen 2026-10-29 13:09 UTC)

9 schema or annotation changes with the description left byte-identical.

--- pinned/check_budget
+++ observed/check_budget
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        }

--- pinned/get_pull_request
+++ observed/get_pull_request
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        },

--- pinned/get_repository
+++ observed/get_repository
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        },

--- pinned/get_snapshot
+++ observed/get_snapshot
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        }

--- pinned/get_user
+++ observed/get_user
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        }

--- pinned/list_issues
+++ observed/list_issues
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        },

--- pinned/list_pull_requests
+++ observed/list_pull_requests
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        },

--- pinned/list_repositories
+++ observed/list_repositories
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        }

--- pinned/search_commits_by_author
+++ observed/search_commits_by_author
  {
    "annotations": {
      "destructiveHint": false,
-           "statuspage"
+           "statuspage",
+           "antigravity",
+           "prometheus",
+           "grafana",
+           "datadog"
          ],
          "type": "string"
        },

Changed 2026-10-21 11:54 UTC

4 descriptions rewritten, 6 schema or annotation changes with the description left byte-identical.

--- pinned/check_budget
+++ observed/check_budget
  {
-   "description": "Costs nothing — call it before any loop of more than a handful of requests. Returns this server's real hourly window (limit, remaining, when it resets) read from the provider's own budget endpoint, which is exempt from the budget it reports, plus whether a key is set and where to raise the limit. The window is ONE bucket per caller shared across every provider host, so the numbers apply to all of them.",
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Check the remaining request budget"
+   },
+   "description": "Costs nothing. Call it before any loop of more than a handful of requests. Returns this server's real hourly window (limit, remaining, when it resets) read from the provider's own budget endpoint, which is exempt from the budget it reports, plus whether a key is set and where to raise the limit. The window is ONE bucket per caller shared across every provider host, so the numbers apply to all of them.",
    "execution": {
      "taskSupport": "forbidden"
    },
-         "description": "The host you are about to call. Optional — the budget is one shared window, so the numbers are the same for every provider.",
+         "description": "The provider host you are about to call, one of the ids orient lists, e.g. 'github'. Optional: the budget is one shared window, so the numbers are the same for every provider.",
          "enum": [
            "github",
            "slack",

--- pinned/get_pull_request
+++ observed/get_pull_request
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Get a pull/merge request with its reviews"
+   },
    "description": "Fetch one PR (GitHub) / MR (GitLab) plus its reviews (GitHub) / approvals (GitLab). Returns both in one result; each carries provider-form ids for cross-referencing.",
    "execution": {
      "taskSupport": "forbidden"
+         "description": "The pull request number as the provider shows it (the merge request iid on GitLab), a positive integer, e.g. 47.",
          "exclusiveMinimum": 0,
          "type": "integer"
        },
+         "description": "The git host to read from, one of the ids orient lists: 'github', 'gitlab', 'bitbucket' or 'ado', e.g. 'github'.",
          "enum": [
            "github",
            "slack",
+         "description": "The repository name without the organisation, e.g. 'parthenon', the flagship repo, which is used when omitted.",
          "type": "string"
        }
      },

--- pinned/get_repository
+++ observed/get_repository
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Get a repository"
+   },
    "description": "Fetch one repository by name (default: the flagship repo). Provider-shaped, with provider-form ids.",
    "execution": {
      "taskSupport": "forbidden"
+         "description": "The git host to read the repository from, one of the ids orient lists: 'github', 'gitlab', 'bitbucket' or 'ado', e.g. 'github'.",
          "enum": [
            "github",
            "slack",
-         "description": "Repo name, e.g. 'parthenon'. Defaults to the flagship repo.",
+         "description": "The repository name without the organisation, e.g. 'parthenon', the flagship repo, which is used when omitted.",
          "type": "string"
        }
      },

--- pinned/get_snapshot
+++ observed/get_snapshot
  {
-   "description": "Return the pinned, reproducible hostname for a provider — point your client's base URL at it for drift-free CI. A snapshot regenerates byte-identically on every request.",
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": false,
+     "readOnlyHint": true,
+     "title": "Get a pinned snapshot hostname"
+   },
+   "description": "Return the pinned, reproducible hostname for a provider. Point your client's base URL at it for drift-free CI. A snapshot regenerates byte-identically on every request.",
    "execution": {
      "taskSupport": "forbidden"
    },
+         "description": "The provider to pin, one of the ids orient lists, e.g. 'github'; the newest frozen generation for it is returned, with any older ones listed beside it.",
          "enum": [
            "github",
            "slack",

--- pinned/get_user
+++ observed/get_user
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Get a user"
+   },
    "description": "Fetch a user by login/username. Provider-shaped, with provider-form ids.",
    "execution": {
      "taskSupport": "forbidden"
-         "description": "The user's login (GitHub) / username (GitLab).",
+         "description": "The user's login (GitHub) or username (GitLab), e.g. 'athena'.",
          "type": "string"
        },
        "provider": {
+         "description": "The git host to read the user from, one of the ids orient lists: 'github', 'gitlab', 'bitbucket' or 'ado', e.g. 'github'.",
          "enum": [
            "github",
            "slack",

--- pinned/list_issues
+++ observed/list_issues
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "List issues"
+   },
    "description": "List a repo's issues. Optional state filter (open/closed/all).",
    "execution": {
      "taskSupport": "forbidden"
+         "description": "The provider to read issues from, one of the ids orient lists: 'github' or 'gitlab' (per repository), or 'jira' or 'linear' (across the whole tracker), e.g. 'jira'.",
          "enum": [
            "github",
            "slack",
+         "description": "The repository name without the organisation, e.g. 'parthenon', the flagship repo, which is used when omitted; ignored by 'jira' and 'linear'.",
          "type": "string"
        },
        "state": {
+         "description": "Filter by state, one of 'open', 'closed' or 'all', e.g. 'closed'; when omitted the provider's own default applies.",
          "enum": [
            "open",
            "closed",

--- pinned/list_pull_requests
+++ observed/list_pull_requests
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "List pull requests / merge requests"
+   },
    "description": "List a repo's pull requests (GitHub) or merge requests (GitLab). Optional state filter.",
    "execution": {
      "taskSupport": "forbidden"
+         "description": "The git host to read from, one of the ids orient lists: 'github', 'gitlab', 'bitbucket' or 'ado', e.g. 'gitlab' for merge requests.",
          "enum": [
            "github",
            "slack",
+         "description": "The repository name without the organisation, e.g. 'parthenon', the flagship repo, which is used when omitted.",
          "type": "string"
        },
        "state": {
-         "description": "Provider state filter.",
+         "description": "Filter by state, one of 'open', 'closed', 'merged' or 'all', e.g. 'merged'; when omitted the provider's own default applies.",
          "enum": [
            "open",
            "closed",

--- pinned/list_repositories
+++ observed/list_repositories
  {
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "List the org's repositories"
+   },
    "description": "List repositories for the universe's org. Results are identical to the provider's REST API and carry provider-form ids (node_id / numeric id).",
    "execution": {
      "taskSupport": "forbidden"
+         "description": "The git host to list repositories from, one of the ids orient lists: 'github', 'gitlab', 'bitbucket' or 'ado', e.g. 'github'.",
          "enum": [
            "github",
            "slack",

--- pinned/orient
+++ observed/orient
  {
-   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), where the coverage manifest lives, and this server's access block — whether a key is set and how many requests are left this hour. Writes: this server is READ-ONLY, including for a scratch-enabled key — the scratch layer (a per-key, 24-hour overlay: GitHub issues and issue comments, Jira comments and transitions, and Slack messages into existing channels) is a REST feature, so use the GitHub, Jira or Slack base URL above with your key for it, and expect the tools here to answer from the shared data set alone.",
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Orient in the SandboxAPIs universe"
+   },
+   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), where the coverage manifest lives, and this server's access block: whether a key is set and how many requests are left this hour. Writes: this server is READ-ONLY, including for a scratch-enabled key. The scratch layer (a per-key, 24-hour overlay: GitHub issues and issue comments, Jira comments and transitions, and Slack messages into existing channels) is a REST feature, so use the GitHub, Jira or Slack base URL above with your key for it, and expect the tools here to answer from the shared data set alone.",
    "execution": {
      "taskSupport": "forbidden"
    },

--- pinned/search_commits_by_author
+++ observed/search_commits_by_author
  {
-   "description": "Find commits authored by a given login in a repo. Returns SHAs (identical across GitHub and GitLab, invariant #5) with a REST path to fetch each — so you can cross-reference against either provider.",
+   "annotations": {
+     "destructiveHint": false,
+     "idempotentHint": true,
+     "openWorldHint": true,
+     "readOnlyHint": true,
+     "title": "Search commits by author"
+   },
+   "description": "Find commits authored by a given login in a repo. Returns SHAs (identical across GitHub and GitLab, invariant #5) with a REST path to fetch each, so you can cross-reference against either provider.",
    "execution": {
      "taskSupport": "forbidden"
    },
-         "description": "Author login, e.g. 'athena'.",
+         "description": "The author's login, matched without regard to case, e.g. 'athena'.",
          "type": "string"
        },
        "provider": {
+         "description": "The git host whose REST path each returned commit carries, 'github', 'gitlab', 'bitbucket' or 'ado', defaulting to 'github'; commits are read from GitHub either way, because the SHAs are identical on every host.",
          "enum": [
            "github",
            "slack",
+         "description": "The repository name without the organisation, e.g. 'parthenon', the flagship repo, which is used when omitted.",
          "type": "string"
        }
      },

Changed 2026-10-08 13:36 UTC

1 description rewritten.

--- pinned/orient
+++ observed/orient
  {
-   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), where the coverage manifest lives, and this server's access block — whether a key is set and how many requests are left this hour. Writes: this server is READ-ONLY, including for a scratch-enabled key — the scratch layer (a per-key, 24-hour overlay on GitHub issues and issue comments) is a REST feature, so use the GitHub base URL above with your key for it, and expect the tools here to answer from the shared data set alone.",
+   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), where the coverage manifest lives, and this server's access block — whether a key is set and how many requests are left this hour. Writes: this server is READ-ONLY, including for a scratch-enabled key — the scratch layer (a per-key, 24-hour overlay: GitHub issues and issue comments, Jira comments and transitions, and Slack messages into existing channels) is a REST feature, so use the GitHub, Jira or Slack base URL above with your key for it, and expect the tools here to answer from the shared data set alone.",
    "execution": {
      "taskSupport": "forbidden"
    },

Changed 2026-10-05 14:36 UTC

1 description rewritten, 8 schema or annotation changes with the description left byte-identical, 1 tool added.

+ tool added: check_budget

--- pinned/get_pull_request
+++ observed/get_pull_request
  {
    "description": "Fetch one PR (GitHub) / MR (GitLab) plus its reviews (GitHub) / approvals (GitLab). Returns both in one result; each carries provider-form ids for cross-referencing.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        },

--- pinned/get_repository
+++ observed/get_repository
  {
    "description": "Fetch one repository by name (default: the flagship repo). Provider-shaped, with provider-form ids.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        },

--- pinned/get_snapshot
+++ observed/get_snapshot
  {
    "description": "Return the pinned, reproducible hostname for a provider — point your client's base URL at it for drift-free CI. A snapshot regenerates byte-identically on every request.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        }

--- pinned/get_user
+++ observed/get_user
  {
    "description": "Fetch a user by login/username. Provider-shaped, with provider-form ids.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        }

--- pinned/list_issues
+++ observed/list_issues
  {
    "description": "List a repo's issues. Optional state filter (open/closed/all).",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        },

--- pinned/list_pull_requests
+++ observed/list_pull_requests
  {
    "description": "List a repo's pull requests (GitHub) or merge requests (GitLab). Optional state filter.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        },

--- pinned/list_repositories
+++ observed/list_repositories
  {
    "description": "List repositories for the universe's org. Results are identical to the provider's REST API and carry provider-form ids (node_id / numeric id).",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        }

--- pinned/orient
+++ observed/orient
  {
-   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), and where the coverage manifest lives.",
+   "description": "START HERE. Returns everything needed to use SandboxAPIs with no docs: the universe/theme, every API surface and its base URL (git hosts and issue trackers), live-vs-snapshot modes and how to pin, the org and its teams/repos, notable entry points (each with a ready-to-run REST path), where the coverage manifest lives, and this server's access block — whether a key is set and how many requests are left this hour. Writes: this server is READ-ONLY, including for a scratch-enabled key — the scratch layer (a per-key, 24-hour overlay on GitHub issues and issue comments) is a REST feature, so use the GitHub base URL above with your key for it, and expect the tools here to answer from the shared data set alone.",
    "execution": {
      "taskSupport": "forbidden"
    },

--- pinned/search_commits_by_author
+++ observed/search_commits_by_author
  {
    "description": "Find commits authored by a given login in a repo. Returns SHAs (identical across GitHub and GitLab, invariant #5) with a REST path to fetch each — so you can cross-reference against either provider.",
    "execution": {
+           "circleci",
+           "zendesk",
            "gitlab",
            "bitbucket",
            "ado",
-           "pagerduty"
+           "pagerduty",
+           "salesforce",
+           "hubspot",
+           "buildkite",
+           "statuspage"
          ],
          "type": "string"
        },

Current tools

Watch this server yourself

If you run this server, put the proxy in front of it. It pins these exact fingerprints on first connect and stops the session if they move.

npx -y mcp-pin@0.2.3 -- <your @sandboxapis/mcp command>

Or subscribe to this page's RSS feed to be told when it changes.

Badge

The badge states one fact about time and nothing else. It never claims a server is safe.

[![mcp-pin](https://mcp-pin.gautamkhosla.com/badge/1a1be9b62a85657b.svg)](https://mcp-pin.gautamkhosla.com/servers/1a1be9b62a85657b.html)