Netlify

Yes, but not directly from the remote server. The remote deploy operation returns a shell command rather than deploying, because the upload has to happen where your files are. It mints a proxy token valid for thirty minutes, scoped in the source to one builds endpoint plus deploy reads. Running that command uploads your repo and starts a real Netlify build.

Its authorization server advertises read and write scopes, but no code path checks them. Netlify's repository contains no scope enforcement in the tool-dispatch path at the commit we read, and tools call the Netlify API with your full access token. The real read-write split is the tool names: reader tools carry readOnlyHint true, updater tools carry false.

Between nine and twenty, depending on your client and your URL. A non-Claude client sees nine tools, Claude.ai sees eleven because two design-import tools are gated on the user agent, and adding a verbose query parameter registers every operation separately for about twenty. Anthropic's directory lists six names, none of which the current server registers.

Yes, and nothing on the tool list says so. Deletion lives inside the environment-variable operation as a boolean flag, which issues a DELETE against Netlify's account environment endpoint. That operation is reached through the project updater dispatcher, whose only annotation is that it is not read-only. No tool carries a destructive hint anywhere on this server.

Yes, and it can happen without anyone asking for it. The visitor access-control operation builds a payload that resets the password to an empty string and disables SSO login by default, then applies whatever you enabled. Calling it to change one setting therefore clears the other. Netlify documents the operation as protection rather than as removal.

It can read environment variables, and secret values are the open question. The environment-variable operation fetches every variable for a site and returns them to the agent, and the same operation writes variables with a secret flag. Netlify's API treats secret values as write-only in some responses, but the connector code does not filter anything itself.

Netlify recommends splitting them by tool type. Its documentation for Claude Web suggests always allowing read-only tools, requiring approval for write and delete tools, and always allowing other tools. That maps cleanly onto the reader and updater tool names, which is the practical reason the server groups operations that way rather than exposing them individually.

Because two tools are gated on the client. Netlify's server inspects the user agent and client name, and registers a Claude Design import pair only when either matches Claude or Anthropic. Claude Code is deliberately excluded as a coding CLI. So claude.ai and Claude Desktop see eleven tools while Cursor, Windsurf and Claude Code see nine.

It can, through an action value rather than its own tool. The form-submission operation takes an action enum whose second value deletes a submission by id, issuing a DELETE against Netlify's submissions endpoint. The same operation otherwise reads submissions in pages. Form submissions are data your site visitors wrote, so deletion here removes visitor-supplied records permanently.