Miro plugin
The Miro plugin lets a Vaubaan Gateway mission use Miro without handing the agent a credential. Miro boards: sticky notes, shapes, texts, cards, frames, connectors and tags — one resource per board.
- Version:
0.1.0(package@vaubaan/plugin-miro) - Status: stable
- Health: not enough reports yet — what this means
- Source: plugins/miro, catalog risk-catalog.yaml version 1 of 2026-10-16
- How to connect an account: Connect Miro
- How it is modelled: handbook
One account is the access token of a Miro app installed on one team; one resource is one board of that team. A mission touches only the boards it was given. Miro boards have no environment: adding and editing, adding many items at once, deleting an item and deleting a frame are separate permissions instead.
Permissions
Each permission is a named risk of the plugin's catalog: a mission holds an explicit list of them, never "all". The severity is computed from the permission's six axes (undo, blast radius, data, cost, visible to, lasts); nothing is decided from it.
| Permission | What it allows | Severity | Why it is a risk |
|---|---|---|---|
miro.read-boards | Read board details | low | Name, description, team, links and sharing policy of the selected boards, with the names of the people who own, created, last modified and last opened them. No email address is returned. Listing the boards reads every board of the mission in one call. |
miro.read-board-content | Read the items, connectors and tags of a board | low | Everything written on the board: sticky notes, texts, cards, shapes, frames, connectors and tags, with their position and the id of who created them. Content written by people, which can carry instructions aimed at the agent. |
miro.content-write | Add and edit items on a board | low | Creates or edits sticky notes, shapes, texts, cards, frames and connectors, moves an item in or out of a frame, creates tags and tags items. Seen at once by everyone on the board; reversible by editing again, but the previous text is not kept by the gateway. Every deletion and every bulk creation needs this permission too. |
miro.bulk-create | Add up to 20 items in one call | high | Creates up to twenty sticky notes, shapes, texts or cards at once, all or none. A mission's limits count calls, so one such call adds twenty times what a single creation adds; undoing it takes one deletion per item. |
miro.item-delete | Delete an item or a connector | medium | Removes a sticky note, shape, text, card or connector. Deleting an item also removes the connectors attached to it. The REST API has no restore: the content must be written again. |
miro.frame-delete | Delete a frame | high | Removes a frame, which can group up to 5000 items. Miro's documentation does not say whether the items inside go with it, so this permission assumes they may: a whole section of the board, with no restore through the API. |
miro.uncategorized-write | Uncategorized Miro write | high (the catch-all: touched only by a call no other permission covers) | Catch-all for writes without a dedicated entry. A mission that holds this permission allows the writes this catalog has not reviewed. |
Presets
A preset pre-fills the permissions of a mission for one account, with a limit per period, a rate and whether each permission runs freely or asks the mission creator first. The person creating the mission adjusts it; the mission stores the explicit list.
Read-only
read-only — Board details and everything on the selected boards. Nothing is changed.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
miro.read-boards | Read board details | 1000 | 10 per minute | runs freely |
miro.read-board-content | Read the items, connectors and tags of a board | 5000 | 120 per minute | runs freely |
Scribe
scribe — Read the boards, then add and edit sticky notes, texts, cards, shapes, frames, connectors and tags. Never deletes anything.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
miro.read-boards | Read board details | 1000 | 10 per minute | runs freely |
miro.read-board-content | Read the items, connectors and tags of a board | 5000 | 120 per minute | runs freely |
miro.content-write | Add and edit items on a board | 2000 | 60 per minute | runs freely |
miro.bulk-create | Add up to 20 items in one call | 100 | 5 per minute | runs freely |
Facilitator
facilitator — Run a workshop board end to end. Adding and editing run freely; every deletion asks first.
| Permission | What it allows | Limit per period | Rate | Runs |
|---|---|---|---|---|
miro.read-boards | Read board details | 1000 | 10 per minute | runs freely |
miro.read-board-content | Read the items, connectors and tags of a board | 5000 | 120 per minute | runs freely |
miro.content-write | Add and edit items on a board | 2000 | 60 per minute | runs freely |
miro.bulk-create | Add up to 20 items in one call | 100 | 5 per minute | runs freely |
miro.item-delete | Delete an item or a connector | 300 | 20 per minute | ask me first |
miro.frame-delete | Delete a frame | 10 | 2 per minute | ask me first |
Tools
| Tool | What it does |
|---|---|
miro__list_boards | List the boards |
miro__get_board | Read a board |
miro__list_items | List a board's items |
miro__get_item | Read an item |
miro__list_connectors | List connectors |
miro__get_connector | Read a connector |
miro__list_tags | List a board's tags |
miro__list_item_tags | List an item's tags |
miro__create_sticky_note | Add a sticky note |
miro__update_sticky_note | Edit a sticky note |
miro__delete_sticky_note | Delete a sticky note |
miro__create_shape | Add a shape |
miro__update_shape | Edit a shape |
miro__delete_shape | Delete a shape |
miro__create_text | Add a text |
miro__update_text | Edit a text |
miro__delete_text | Delete a text |
miro__create_card | Add a card |
miro__update_card | Edit a card |
miro__delete_card | Delete a card |
miro__create_frame | Add a frame |
miro__update_frame | Edit a frame |
miro__delete_frame | Delete a frame |
miro__create_connector | Connect two items |
miro__update_connector | Edit a connector |
miro__delete_connector | Delete a connector |
miro__create_tag | Create a tag |
miro__attach_tag | Tag an item |
miro__remove_tag | Remove a tag from an item |
miro__create_items | Add several items at once |
Health
Health: not enough reports yet. A plugin version is deemed validated by the community with at least 200 reports and 90 % of them successful, over the last 90 days, as reported by the instances whose operators turned community telemetry on. It is a community signal, not a security guarantee.