weegloo-script

Author declarative server-side Scripts in Weegloo Spaces executed via POST /execute endpoints.

1|2|Updated Feb 20, 2026
One-click install
npx skills add https://github.com/weeglooapi/weegloo-mcp-plugin --skill weegloo-script-weeglooapi
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: weegloo-script
Source: https://github.com/weeglooapi/weegloo-mcp-plugin/tree/main/plugins/weegloo/skills/weegloo-script
Command: npx skills add https://github.com/weeglooapi/weegloo-mcp-plugin --skill weegloo-script-weeglooapi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Products often need backend logic — calling third-party APIs, enforcing ownership or credits, verifying webhook signatures, performing atomic multi-step writes — without hosting a dedicated backend server. This Skill teaches how to build Weegloo Scripts: declarative, statement-based endpoints stored in a Space that run server-side and return results over an ordinary HTTP call. ## Core Features & Use Cases - Statement-based backend logic: Compose sequences of ResourceRead/Find/Create/Update/Patch/Delete, Http, EmailSend, SetVar, Cache, ParseJson, Signature, Hash, Regex, If/Loop/Parallel/Try, and Return statements with { /pointer } value expressions and JsonLogic operators. - Security patterns: Verify inbound webhook signatures with HMAC Signature statements, gate anonymous edit/delete on caller-supplied secrets, and delegate one privileged operation to low-privilege callers via author-delegated execution. - Concurrency and reliability: Use optimistic locking with sys.version, Try/catch compensation for all-or-nothing multi-step work, and the directCallEnabled/anonymousCallEnabled flags to control invocation. - Use Case: On Content.Publish, a Webhook triggers a Script that POSTs the item to a search-index API, then patches an indexedAt value back onto the content — all server-side with no backend to host. ## Quick Start Ask the agent to create a Weegloo Script that verifies an inbound webhook HMAC signature and writes the payload into a Content entry.

Frequently Asked Questions about weegloo-script

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run backend logic in Weegloo without hosting a server?

Create a Script resource in a Space with a definition containing a method and statements array, then invoke it with POST to script.weegloo.com/v1/spaces/{spaceId}/scripts/{scriptId}/execute. The platform runs the statements server-side and returns the Return statement's value as the response.

How do I verify an inbound webhook signature in a Weegloo Script?

Use the Signature statement with the algorithm, secret, the raw payload via { /rawPayload }, and the expected code from the request header. It compares in constant time and accepts hex or base64 encodings; combine with Regex Capture to unpack headers like t=timestamp,v1=signature.

Can anonymous users call a Weegloo Script without a token?

Yes, when anonymousCallEnabled is true the Script can be invoked via POST /execute/anonymous with no token. It runs as the Script's author, cannot use the :self filter, and the Script itself must verify the request since no role permission is consulted.

How do I prevent lost updates when writing Content concurrently?

Read the resource first, then pass its sys.version in the ResourcePatch or ResourceUpdate call for optimistic locking. If another writer changed the row, the write fails with a conflict, which you catch with Try/catch and retry by re-reading and re-applying.

When should I not use a Weegloo Script?

Avoid Scripts for work needing no server authority, such as summing, sorting, or formatting data the client already holds, since executions consume a monthly Organization-wide allowance shared with Webhooks and Schedulers. Client-side code is the right place for pure presentation logic.

Why does a Weegloo Script Http statement fail on large responses?

The Http statement caps response bodies at 10 MiB and throws when exceeded, failing the statement. Instead of pulling large binaries through Http, have the provider return a URL and ingest it as Media with encoding set to url.