app-visibility.json

{
 "_note": "The one list of apps 1Helm never offers or lets the helper use. Read by src/ee/app-visibility.js (the Worker: find_app, offer_connect, the hint, app_actions, app_run, app_proxy, connect and app-detail routes, and the catalog the Apps popup loads). \"twins\" maps each side of a plain-app / \"X MCP\" pair that isn't offered to the side that is (rule 4 in app-visibility.js); the test fails when a catalog file has a pair that isn't listed. test/app-visibility.test.mjs checks it.",
 "hidden": {
  "malwarebytes_mcp": "wrong verdicts in the audit (google.com 'not a recognized site', an obvious phishing domain 'unknown'), sends the person's link, email or phone to a third party, injects 'User Guidance' text",
  "codeinterpreter": "duplicates the helper's own computer; runs code on a third-party sandbox, and every run needs a confirm card",
  "text_to_pdf": "uploads the text to a third party and returns a public link; the helper makes PDFs itself",
  "excalidraw_mcp": "its export publishes the diagram publicly; widget-only output",
  "mermaid_chart_mcp": "a 55k-char SVG per call for a widget 1Helm doesn't have; the helper renders Mermaid on its computer",
  "aiwyn_tax_mcp": "invites bank, routing and date-of-birth data; its PDF action isn't read-only",
  "clarity_ai_mcp": "a demo API that asks for an email; too narrow"
 },
 "prefixes": [
  {
   "prefix": "cloudflare",
   "except": [
    "cloudflare_mcp"
   ],
   "reason": "Only Cloudflare MCP (one-click sign-in) is offered. The other Cloudflare toolkits (cloudflare, cloudflare_api_key, cloudflare_browser_rendering, and any future cloudflare* slug) need an API key or Global API Key that the person must never be asked for."
  }
 ],
 "twins": {
  "ahrefs": "ahrefs_mcp",
  "amplitude": "amplitude_mcp",
  "apify": "apify_mcp",
  "better_stack": "better_stack_mcp",
  "box_mcp": "box",
  "browserbase_tool": "browserbase_mcp",
  "calendly": "calendly_mcp",
  "canva": "canva_mcp",
  "clay": "clay_mcp",
  "clickhouse": "clickhouse_mcp",
  "clickup": "clickup_mcp",
  "close": "close_mcp",
  "cloudflare": "cloudflare_mcp",
  "consensus": "consensus_mcp",
  "customerio": "customerio_mcp",
  "datadog": "datadog_mcp",
  "explorium": "explorium_mcp",
  "fuseai": "fuseai_mcp",
  "github_mcp": "github",
  "higgsfield": "higgsfield_mcp",
  "highlevel": "highlevel_mcp",
  "intercom_mcp": "intercom",
  "linear": "linear_mcp",
  "mintlify": "mintlify_mcp",
  "modem": "modem_mcp",
  "monday": "monday_mcp",
  "neon": "neon_mcp",
  "notion": "notion_mcp",
  "pandadoc": "pandadoc_mcp",
  "posthog": "posthog_mcp",
  "railway_mcp": "railway",
  "ramp": "ramp_mcp",
  "resend": "resend_mcp",
  "search_api": "searchapi_mcp",
  "semrush": "semrush_mcp",
  "sentry": "sentry_mcp",
  "sideshow": "sideshow_mcp",
  "statsig": "statsig_mcp",
  "stripe": "stripe_mcp",
  "supabase": "supabase_mcp",
  "tavily": "tavily_mcp",
  "tinyfish": "tinyfish_mcp",
  "todoist": "todoist_mcp",
  "vercel": "vercel_mcp",
  "wix": "wix_mcp"
 }
}