Connections
What actually connects, and what does not
A site built here holds no credentials at all, and its policy forbids it from reaching any outside address. That is not a temporary limit — it is the reason other people's code can run here without putting them at risk.
So the site asks us, and we ask the source. These are the four sources that exist, and after them, the ones that do not.
Shabbat start and end
Whether the business is open right now, and when that changes. The calendar is cached for a day, but the answer is computed on every request — "open" is a fact about the clock, and it was already wrong minutes after it was stored. A booking form can ask this too, before it accepts an appointment for twenty minutes after candle-lighting.
await shabbat.status("tel-aviv")- The data belongs to
- Hebcal
- An answer is kept for
- 24 hours
- If the source is unreachable
- Answers from the last copy, and marks that answer as old.
The coming holidays
The dates a business has to plan around: an early close, a delivery that will not arrive, a mailing better left unsent. Every date is marked as one where work stops or not — using the source's own flag, never our reading of it.
await holidays.upcoming(5)- The data belongs to
- Hebcal
- An answer is kept for
- 24 hours
- If the source is unreachable
- Answers from the last copy, and marks that answer as old.
Active alerts
An empty list means we checked and there is nothing. An error means we could not check — and those are not the same answer. The threat code is passed through untranslated: no published mapping from these codes exists, and a life-safety message is the last place to invent one.
await alerts.active()- The data belongs to
- פיקוד העורף
- An answer is kept for
- 30 seconds
- If the source is unreachable
- Does not answer at all. "No alerts" from an old copy is not old information — it is a false all-clear.
Exchange rates
The official rates exactly as published. Every rate carries its unit, because the yen is quoted per 100 — a site that prints the number on its own is wrong by two digits.
await rates.today()- The data belongs to
- בנק ישראל
- An answer is kept for
- 6 hours
- If the source is unreachable
- Answers from the last copy, and marks that answer as old.
Three addresses, and a closed list of cities
Our server talks to three addresses and no others, and all three are written into a closed list in the code. What a visitor typed never becomes an address we call — that is what stops a mechanism like this from turning into a back door.
A question about a city is allowed for the 28 cities on that list and no others, each one verified against the source. A city that is not on it is rejected and never sent out.
Every answer comes back with the time it was checked and a credit to whoever owns the data, so a site showing live information can say when it looked.
Connect an agent to the system
An MCP server that lets an agent — Claude Code, Cursor, anything that speaks the protocol — drive the system end to end. It is a thin client over the same API the browser uses, not a second implementation: every ownership check and every limit already sits behind those routes.
Authentication is an API key issued on the settings screen. The key identifies a person, and every route it reaches still checks that the app belongs to them — a key is a way in, never a way around.
Open on every plan, the free one included.
list_appsמציג את כל הפרויקטים שהמפתח הזה מחזיק, עם הכתובת החיה של כל אחד.
create_appפותח פרויקט חדש וריק ומחזיר את הכתובת שלו.
build_appבונה או משנה פרויקט מתיאור בשפה חופשית, ומחזיר את כל שלבי הבנייה.
get_appכל מה שיש בפרויקט אחד: הקבצים, הטבלאות וההרשאות שלהן, הגרסאות והשיחה.
read_recordsקורא את השורות שהפרויקט שמר, בתור בעל הפרויקט.
list_templatesמדפדף בקטלוג התבניות ומחפש בו.
use_templateמשכפל תבנית לפרויקט חדש — הקוד והטבלאות עוברים, הנתונים לא.
search_skillsמחפש בספרייה הזו ומחזיר את ההנחיה עצמה, עם הרישיון והמקור.
The library shows the same tools beside the knowledge a build draws on.
Doors that open without a key
The template catalogue is served as JSON too, with no authentication: a template already running at a public address is not a secret, and an agent looking for somewhere to start should not need an account for that.
The Israeli knowledge library is reachable the same way, with each item's licence and source — because this is other people's work, and attribution buried in a code comment satisfies a licence while missing its point.
And what does not exist
Four connections it would have been easy to draw a logo for. They were not built, so they are written here rather than in small print.
No Slack, no Google, no HubSpot, no Zapier. Connecting in one click means holding a token for someone else's account, and that was not built — so it does not appear here as a logo either.
The platform sends a verification email to whoever signs up to your site. Sending mail from the site's own code — an order confirmation, a reminder — does not exist.
You can build a catalogue and an order form that saves a record. Actually charging a card, and uploading an image from inside a built site, exist nowhere in the code.
There is no address an outside system can push an event to. The only direction that exists is outward: an agent driving the system through MCP, or an API key.