SpringRoll
Register, deploy, review, and govern internal applications built with coding agents.
| Endpoint | https://springroll.dev/api/mcp (streamable-http) |
|---|---|
| Registry version | 0.1.0 |
| Now | 23 tools · grade F (21) · pin ts_2abf4f52459ac8d3024e8ea656aa0f61 · protocol 2025-06-18 |
| First / last listed | 2026-11-09 00:30 UTC / 2026-11-09 00:30 UTC |
| Grade over time | 2026-11-09: F (21), 23 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: springroll.security.audit springroll.security.status springroll.feedback.submit springroll.feedback.list springroll.context springroll.deploy springroll.deploy.status springroll.deploy.promote springroll.placement.preview springroll.app.get springroll.app.list springroll.app.update springroll.app.presentation.get springroll.app.presentation.save springroll.app.presentation.upload springroll.app.presentation.generate_icon springroll.approval.submit springroll.approval.get springroll.policy.check springroll.connect.data_products springroll.connect.request_access springroll.connect.access_status springroll.app.record_prompts
springroll.security.audit | Start the company's configured security checks for an immutable release and environment. May send code only to policy-approved audit models within the configured budget. Does not deploy or waive Block. Returns an existing matching audit on retry. params: application*, releaseId*, environmentType*, context* |
springroll.security.status | Read the current job status, company policy decision, redacted findings and unchecked controls. Never starts or retries a scanner. params: auditId*, context* |
springroll.feedback.submit | Submit a bug report, idea, or other feedback about SpringRoll on behalf of the authenticated member. Do not include credentials. Reuse the idempotency key when retrying the same submission. params: category*, message*, idempotencyKey*, context* |
springroll.feedback.list | List only the authenticated member's SpringRoll feedback in the current organization, newest first. Use nextOffset for the next page. params: limit, offset, context* |
springroll.context | Returns the organization, identity, and permissions this agent token acts as, together with the deployment runtimes configured for it. Call this first: it tells you which tenant you are in, what you are allowed to do, and whether a deployment can actually land. It never returns credentials. params: context* |
springroll.deploy | Registers the project if it is new, attaches whatever source you give it, and deploys it using the application's Deployment workflow. Direct applications go to Production; Staged applications go to Development. Returns the live URL, or a deployment id to poll if the build is still running.
**You do not decide whether this project needs git.** Send what you have and SpringRoll works it out:
• a params: application, name, slug, manifest, description, department, supportContact, dataClassification, tags, repositoryUrl, ref, archive, files, filesEncoding, preferSource, framework, installCommand, buildCommand, outputDirectory, rootDirectory, placement, waitSeconds, idempotencyKey*, context* |
springroll.deploy.status | Returns a deployment's current status, refreshing it from the runtime provider when the build is still in progress. Statuses: QUEUED, VALIDATING, BUILDING, DEPLOYING, READY, FAILED, CANCELLED, SUPERSEDED, ROLLED_BACK. Poll this after deploying rather than assuming success.
Pass `includeLogs` to get the normalised build and deploy log lines alongside the status. Do that once the status is FAILED, params: deploymentId*, includeLogs, logLimit, context* |
springroll.deploy.promote | Promotes a tested deployment into the next environment (development -> uat, uat -> production). Reuses the already-built artifact rather than rebuilding, so the bytes that were tested are the bytes that ship.
Promotion into an environment that requires approval will be refused until the approval exists. For production, submit the request first. params: deploymentId*, targetEnvironmentType*, idempotencyKey*, context* |
springroll.placement.preview | Scores where SpringRoll would place this application and what it would cost, without deploying or writing anything. It shares its implementation with springroll.deploy, so the receipt it returns is what a deploy right now would decide: the provider and plan, the estimated monthly cost range, every limit the plan carries, what was inferred rather than declared, and why each other candidate lost.
I params: application*, environmentType, placement, context* |
springroll.app.get | Returns an application's registry record: metadata, lifecycle stage, risk score, and whichever of the optional sections you ask for. No secrets are included.
Sections, all returned by default:
• `source`: repository or uploaded bundle, and `cannotBuildReason` when a deploy would be refused for want of a source
• `history`: recent releases and deployments
• `status`: each environment's curre params: application*, include, context* |
springroll.app.list | Lists applications in this organization, newest first. Use `search` to find one by name or slug. params: search, limit, context* |
springroll.app.update | Updates App Portal metadata: description, icon, tags, department, support contact, and data classification. Visibility is deliberately not editable here, because widening an audience requires an approval request (sec. 15.4). params: application*, description, iconUrl, tags, department, supportContact, dataClassification, context* |
springroll.app.presentation.get | Read a private app listing draft and available artwork. Does not publish or expose the app. params: application*, context* |
springroll.app.presentation.save | Save listing copy and selected image IDs to a private draft. Read the revision first. Use factual copy and real, reviewed screenshots. Only the owner or admin can publish in SpringRoll. params: application*, revision*, draft*, context* |
springroll.app.presentation.upload | Upload a real screenshot or app icon as base64 PNG, JPEG, or WebP (8 MB maximum). Metadata is stripped. Images remain private until selected in an owner-published snapshot. Never upload confidential screen content. params: application*, kind*, base64*, idempotencyKey*, context* |
springroll.app.presentation.generate_icon | Queue one premium icon draft from the app's reviewed purpose. Requests are limited and deduplicated. Artwork never blocks deployment or publishes itself. params: application*, purpose*, idempotencyKey*, context* |
springroll.approval.submit | Submits an approval request of any supported type: UAT_PROMOTION, UAT_SIGN_OFF, PRODUCTION_PROMOTION, VISIBILITY_CHANGE, OWNERSHIP_TRANSFER, RETIREMENT, DOMAIN_CHANGE, or ROLLBACK. **An agent may submit but never decide**: SpringRoll requires a human approver, and an agent token cannot approve its own request.
Confirm with the user before calling this. It creates review work for named people.
Ty params: application*, requestType*, releaseId, targetEnvironmentType, justification, payload, idempotencyKey*, context* |
springroll.approval.get | Returns an approval request with its assigned reviewers, decisions so far, and the policy snapshot taken at submission. Poll this to find out whether a release has been approved. params: approvalRequestId*, context* |
springroll.policy.check | Reports which governance policies an application would pass or fail for an environment.
Send `manifest` (YAML or JSON) to validate a document without creating anything. Call this before springroll.deploy to avoid a rejected submission. Read the `springroll://manifest/example` resource for the document's shape.
Send `application` instead to explain why an existing application cannot deploy or pro params: manifest, application, environmentType, releaseId, context* |
springroll.connect.data_products | Without `dataProduct`, lists the governed data products this organization publishes: what each one holds, who owns it, and how sensitive it is.
With `dataProduct`, returns that product's schema: its datasets, the available fields with their types and sensitivity, the business glossary its owner wrote, and what the underlying source can compute. Read this before requesting access, so you request t params: dataProduct, context* |
springroll.connect.request_access | Requests access to a data product for one environment, naming the exact fields the application needs. A data owner must approve, and may narrow the field list or add a row filter before doing so. Nothing is readable until then. You never receive a credential: an approved grant lets the deployed application ask questions through the SpringRoll Connect gateway, which enforces the grant on every requ params: application*, dataProduct*, environmentType*, fields*, purpose, context* |
springroll.connect.access_status | Returns the status of a data access request: REQUESTED, APPROVED, REJECTED, REVOKED, or EXPIRED, with the fields actually approved. Approved fields are often narrower than requested, and a row filter may restrict which rows the application can see at all. params: grantId*, context* |
springroll.app.record_prompts | Attaches the conversation that produced this application to its record, as reference for whoever maintains it next and for the reviewer who has to approve it.
Ask the user before calling this, every time. The transcript is STORED and is READABLE BY ANYONE who can see the application record. SpringRoll scrubs credentials it recognises before writing (agent tokens, cloud keys, private keys, connect params: application*, sessionKey*, turns*, startTurnIndex, agentName, modelName, inputTokens, outputTokens, releaseId, idempotencyKey*, context* |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.