MCP server
MCP tools
Every tool the Oxagen MCP server ships, how a client finds and loads them, and what each one reads or writes.
The Oxagen MCP server at https://mcp.oxagen.sh/mcp ships one tool for each Oxagen capability that declares the MCP surface. This page lists every one of them, grouped by domain, with its inputs, whether it writes, and whether it carries the approval marker.
Tool list
A client that connects and sends tools/list gets every tool on this page, each with its full input schema. The server does not hide tools behind a search step, and the list does not change with the key's role. The role decides what happens when a tool is called: a call the key's role does not allow is refused, and the refusal is recorded.
Two other sets of tools can appear beside the Oxagen tools:
- Workspace MCP servers. A connection from an enrolled machine also lists the tools of the MCP servers the workspace publishes, named
<server>__<tool>. A server set to search mode lists three tools instead of its whole list:<server>__search,<server>__describeand<server>__call. See External MCP servers. - The local
oxagenentry. On an enrolled machine,oxagen agent enrollandoxagen codegraph initgive each agent anoxagenMCP entry that runs on the machine. That entry lists only the reads the machine's key may make, and it adds two tools no hosted server has:build_code_graphandget_code_graph_status. See Code graph from the CLI.
Tool discovery
A client that does not want every definition in its model's context can start from two small tools:
search_toolstakes aqueryand, optionally, thekindsof row to return:tool,run,agentorapproval. It returns at most eight ranked rows, each with an id and a one-line description. Atoolrow names a capability the in-app agent may call.load_toolstakes up to eight of those names and returns each one's description, input schema, risk level, approval flag and read-only flag. A name outside that set comes back inunknown, with nothing described.
The in-app agent's set and the MCP server's set overlap but are not the same. To call a tool over MCP, use its name from this page.
Tool naming
An MCP tool has the name of the capability behind it, with no translation step. The capability list_workspace_memories is the tool list_workspace_memories.
Capability names are verb-first snake_case: an imperative verb, then the thing it acts on, joined by underscores. See Capability naming for the full rule. These names contain no dots, so they are already legal MCP tool names.
Approval marker
Some tools need a person to approve each call, even though they change nothing. reveal_secret is one: it is read-only, and it returns a plaintext secret. The standard MCP annotations cannot say this. readOnlyHint only says whether a tool changes anything, and many hosts approve every read-only tool on their own.
Every Oxagen tool therefore carries its contract's answer in the tool's _meta, which tools/list returns:
| Key | Value |
|---|---|
sh.oxagen/requiresApproval | true when a person must approve each call, false otherwise. Every tool has it. |
sh.oxagen/riskLevel | low, medium, or high, when the contract rates the tool. |
{
"name": "reveal_secret",
"annotations": { "readOnlyHint": true, "destructiveHint": false, "idempotentHint": true },
"_meta": { "sh.oxagen/requiresApproval": true, "sh.oxagen/riskLevel": "high" }
}The MCP server does not hold a call for approval. The marker is advice to the host, and we know of no host that reads these keys on its own. To hold these tools for approval, set your host to ask before every call to a tool whose sh.oxagen/requiresApproval is true, or leave such tools off its auto-approve list. A client you build can read the key from tools/list and ask the person itself.
Oxagen still checks the caller's key and role when the tool is called, whatever the host decides.
Browser sign-in
A tool that connects an account through OAuth cannot finish the sign-in itself. start_mcp_authorization returns the URL where the person signs in. Open it in a browser to finish.
Tools by domain
Each table lists the tools of one domain:
- What it does is the first sentence of the tool's description.
tools/listreturns the whole description. - Inputs names the tool's top-level fields. A field that ends in
?is optional.tools/listandload_toolsreturn the full schema. - Writes is Yes when a call changes stored state, and the tool's
readOnlyHintsays the same. Two tools differ: a call toremember_lessonorrecord_reflectionchanges nothing, but Oxagen stores what it recorded when the run ends, so theirreadOnlyHintisfalse. - Approval is Yes when the tool carries the approval marker.
Agents
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
answer_interjection | Answer the question an agent paused to ask: with text, or, for a repository the workspace has not bound, by linking it or creating a workspace for it. | interjectionId, answer?, path?, create?, residue?, fromRule? | Yes | No |
assign_agent_role | Assign an IAM role to an agent's delegated principal. | agentId, roleName, reason? | Yes | Yes |
assign_agent_toolbelt | Give an agent another toolbelt and keep its principal, roles and grants. | agentId, toolbeltId | Yes | Yes |
authorize_mcp_server | Finish OAuth authorization for an MCP server: exchange the code the authorization server returned, store the tokens encrypted, and list the server's tools | state, code, redirectUrl | Yes | No |
delete_mcp_server | Soft-delete a registered external MCP server. | mcpServerId | Yes | Yes |
draft_interjection_answer | Draft the answer to an agent's question from your steering records, citing the record it came from. | interjectionId | No | No |
get_agent | Read one agent: principal, harness, operator and status; the runtime it runs on and the toolbelt it carries; its versions; its long-lived credentials; the roles on its principal; and the hosts enrolled under it. | agentId | No | No |
get_agent_role | Get one IAM role's status relative to an agent: whether the agent's delegated principal holds it, the assignment provenance when held, and the role's capability grant list (what attaching it confers). | agentId, roleName | No | No |
get_agent_toolbelt | Compute the toolbelt an agent would be shown without executing anything: the decision and rule per tool, each tool's input schema and schema hash, how the belt was computed, what the model receives in full or searchable mode, and what the agent cannot see. | agentId, mode? | No | No |
list_agent_roles | List the IAM roles attached to an agent's delegated principal: the active, non-expired principal_role_assignments with role identity, scope, and assignment provenance. | agentId | No | No |
list_agent_tools | List the capabilities surfaced as agent tools for the active workspace, after allowlist and risk filtering | includeExternal? | No | No |
list_agents | List the agents registered in this workspace with their purpose, principal, harness, operator, status, enrollment and credential counts, live host, live run count, latest enforcement tier, active mandates, and the 30-day run, spend, token and incident figures the stores record. | limit?, cursor?, includeRetired? | No | No |
list_approvals | List the workspace's pending tool-call approvals, soonest expiry first, cursor-paged, optionally narrowed to one run | runId?, limit?, cursor? | No | No |
list_attention | List everything that waits on you in this workspace: approvals and questions on your runs, work orders you sent that wait in review, ready work items assigned to you, and steering suggestions. | operatorId?, state?, since?, limit?, cursor? | No | No |
list_fleet | List your work items grouped by workstream, each with its live and recent runs and their subagents, and a state on every row: waiting on you, working, quiet, failed or done. | scope? | No | No |
list_interjections | List the questions agents in this workspace paused to ask a person, soonest expiry first, cursor-paged, optionally narrowed to one run | runId?, open?, limit?, cursor? | No | No |
list_mcp_consents | List external MCP tool consent grants in the active workspace (which tools the agent may invoke without re-prompting) | mineOnly? | No | No |
list_mcp_servers | List registered external MCP servers in the active workspace with their current health, the tokens each server's tool definitions add to a model call, and an estimate of what those tokens cost the workspace a week | priced? | No | No |
list_resolved_approvals | List the workspace's resolved approvals, most recently resolved first, cursor-paged, optionally narrowed to one run or a resolved-at time range, including the rule that auto-approved a call no person looked at | runId?, since?, until?, limit?, cursor? | No | No |
move_agent | Move an agent to another runtime and keep its principal, roles and runs. | agentId, runtimeId | Yes | Yes |
record_reflection | Reflect on the current run: its outcome, a summary, a grade for the work and each tool, and what the person corrected, refused, preferred, or decided. | outcome, summary, grades, lessons?, tool_feedback? | No | No |
register_mcp_server | Register an external MCP server with the workspace; its tools become available to the agent after health check. | name, transportType, endpointUrl, authStrategy?, authConfig? | Yes | No |
remember_lesson | Keep one thing the person taught you in the current run: a correction, a refusal, a preference, or a decision, in their words. | statement, kind?, repos?, applies_to?, tools?, evidence? | No | No |
reopen_interjection | Take back an answer stella gave to an agent's question from one of your rules. | interjectionId | Yes | No |
resolve_approval | Approve or deny a pending tool-call approval request; an approved call the in-app assistant parked runs at once, and the answer says what became of it | approvalId, decision, note? | Yes | No |
resolve_mcp_consent | Grant or deny first-use consent for an external MCP tool; the decision resumes the paused agent stream and is remembered for subsequent calls | approvalId, decision, grantAllTools? | Yes | No |
revoke_agent_role | Revoke an IAM role from an agent's delegated principal. | agentId, roleName | Yes | Yes |
search_mcp_registry | Search the official MCP Registry and Oxagen's verified first-party servers for MCP servers a workspace can add as a tool provider | query?, cursor?, limit? | No | No |
set_agent_budget | Set or clear the spend budget of one agent in the active workspace, in cents. | agent, budgetCents | Yes | No |
set_agent_cache_keep_alive | Turn the cache keep-alive on or off for one agent in the active workspace. | agent, cacheKeepAlive | Yes | No |
set_mcp_enabled | Enable or disable a registered external MCP server. | mcpServerId, enabled | Yes | No |
start_mcp_authorization | Start OAuth authorization for an MCP server: a new provider from the registry or a custom endpoint, or a reconnect of one already added. | mcpServerId?, name?, endpointUrl?, description?, iconUrl?, registryId?, client?, redirectUrl | Yes | No |
API keys
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
acknowledge_api_key_rotation | Confirm receipt of a rotated API key's secret. | keyPublicId | Yes | Yes |
create_api_key | Create an API key: an organization key, which an organization Owner makes, or a key for the call's workspace, which its Admins make. | name, scope?, expiresAt?, scopeKind?, role? | Yes | Yes |
list_api_keys | List API keys with their metadata: public id, name, prefix, scope, role, creator, creation, last use, expiry and revocation times, and, for a key a rotation replaced, when it was superseded and by which key. | scopeKind? | No | No |
revoke_api_key | Revoke an API key by its aky_ public ID. | keyPublicId | Yes | Yes |
rotate_api_key | Issue a replacement API key and keep the old one working for 24 hours. | keyPublicId, name? | Yes | Yes |
Approval rules
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
delete_approval_rule | Remove one auto-approval rule from the workspace's rule set | ruleId | Yes | Yes |
get_auto_eligibility | The auto-approval evaluation recorded for one approval request, and who resolved it | approvalId | No | No |
list_approval_rules | List the workspace's auto-approval rules, with the calls each released and held in the last 30 days | None | No | No |
set_approval_rule_enabled | Switch one auto-approval rule on or off | ruleId, enabled | Yes | Yes |
set_approval_rules | Replace the workspace's auto-approval rules: the conditions under which a call a policy sent to a person may skip them. | rules, replaces?, saving? | Yes | Yes |
Assets
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
upload_asset | Ingest a binary asset from a source URL into object storage and return its stored URL and key. | sourceUrl, kind, filename?, source?, conversationId? | Yes | No |
Assistant
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
ask_assistant | Take one turn with the in-app agent: append the message to a conversation, record the turn as a run of its own, drive it on the assistant engine with every completion and tool call answered by Oxagen, and return the reply with the run it was recorded as. | conversationId?, content, pageContext?, goal?, turnId?, attachments? | Yes | No |
draft_record | Draft a record for one create flow from a person's description with stella: a steering record, a skill, a work item, a tool classification, a mandate, a repository import, an API key, a runtime, a sandbox runtime, a role, an approval rule, a budget, a connection, a collector, an SSO provider, a clone or an agent. | kind, description, tools?, files?, source? | No | No |
get_assistant_engine | Probe the in-app agent's engine: its readiness state as the engine reported it, or unreachable after the attempts made, with the host the probe was aimed at. | None | No | No |
get_briefing | Read what changed since you last opened the Stella page in this workspace: your runs that ended, your work orders that reached review, the progress updates your runs posted, and how many things wait on you now, with a summary of at most three sentences that states only those figures. | None | No | No |
get_operator_status | Read your day in this workspace, in your own time zone: the runs you started today against yesterday by this time and all of yesterday, what waits on you now, the work you sent, accepted and merged today and yesterday, your pull requests by state, the repositories and kinds of work you worked on, and the ready work items you can send next. | None | No | No |
get_stella_permissions | Read what stella may do alone for you in this workspace: answer agent questions from your rules, relaunch failed work, create issues, update source issues, and steer your agents. | None | No | No |
record_reply_feedback | Record a person's verdict on one reply of the in-app assistant, useful or wrong, with an optional short note, against the run the reply was recorded as. | conversationId, runId, verdict, note? | Yes | No |
rewrite_field | Rewrite the text of one prose field, or a group of up to four that belong together, with stella. | fields | No | No |
set_stella_permissions | Change what stella may do alone for you in this workspace. | operator?, answerFromRules?, relaunchFailedWork?, createIssues?, updateSourceIssues?, steerAgents? | Yes | No |
upload_assistant_attachment | Store one image, PDF or text file a person attaches to a message for the in-app assistant, after checking its bytes match its type and size cap, and return the id the message sends in ask_assistant's attachments. | name, mediaType, data | Yes | No |
Audit log
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
export_audit_events | Export the org's security audit events over the query_audit_log filters as CSV or NDJSON, locked with HMAC-SHA256 so a check after download shows any change to the file. | format?, eventType?, actorUserId?, actorPublicId?, capability?, outcome?, workspaceId?, from?, to? | No | No |
query_audit_log | Query the org's security audit events (security_events) with filters (actor, capability, outcome, event type, time range), returning a time-ordered feed. | source?, eventType?, actorUserId?, actorPublicId?, capability?, outcome?, workspaceId?, from?, to?, limit?, offset? | No | No |
Billing
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
export_billing_statement | Export the organization's billing statement for a week, month, quarter, year or custom period longer than 48 hours, as CSV with every billed governed action (paged by cursor) or as a printable HTML document. | period, anchor?, from?, to?, format?, limit?, cursor? | No | No |
get_billing_statement | Get the organization's billing statement for a week, month, quarter, year or custom period longer than 48 hours: governed action units by source, workspace, agent, operator, capability and tool, and by day; the month buckets; settlements, reversals, prepaid orders and invoices; usage credits from opening to closing balance; model usage reported at zero; and the reconciliation checks the figures satisfy. | period, anchor?, from?, to?, top? | No | No |
get_contract_rate | The organisation's contracted governed-action terms: per-GAU rate in micro-dollars, block size, currency, included GAUs per month, effective dates, and whether they are the published tier's figures or a negotiated agreement's | None | No | No |
get_evidence_retention | Evidence-retention posture and its price: the included window, the organisation's effective retention window from its pinned retention policy, whether it has opted into paying for retention beyond the included months, the per-GB-month rate, and retention credits charged so far. | None | No | No |
get_gau_bucket | Read the organization's governed action unit bucket for the current month: the billing mode, the period, the units included, purchased, carried forward, used and remaining, the invoice thresholds of an invoice-billed organization, and the saved card. | None | No | No |
get_rate_card | The published rate card for governed actions: each self-serve plan's monthly price, monthly included actions, rate per action and block size, the evidence-retention price beyond the included window, confirmation that model tokens are reported at zero charge, and the caller's own monthly terms. | None | No | No |
get_spend_budget | Read the hard period-to-date spend ceilings governing the active scope: the org-level ceiling, which covers every workspace, and this workspace's own ceiling, if configured. | None | No | No |
get_subscription | Read the current subscription, plan, and period bounds for the active tenant | None | No | No |
get_usage_breakdown | Aggregated usage for a time window broken down by model, surface, workspace, capability, acting principal, and user, plus a daily time series of tokens, cost, and chat-turn (message) counts. | start, end, workspaceId? | No | No |
list_invoices | List the organization's invoices, newest first, in one cursor-paged list: number, status, what each invoice charged for (the subscription, a block purchase, an auto top-up, an interim or a period-close charge), amounts due and paid, period and the Stripe-hosted page. | limit?, cursor? | No | No |
list_prepaid_orders | List the organization's prepaid orders, newest first: the licence, governed action units and usage credits each invoice sold, with amounts, the service period, status, when the units and credits were granted, and the invoice number and hosted page. | limit?, cursor? | No | No |
preview_action_cost | Convert a projected number of agent runs per month into governed actions and a monthly overage price, using the published conversion from run class to actions. | runsPerMonth, runClass?, actionsPerRun?, plan? | No | No |
purchase_credits | Start a Stripe Checkout session for a dynamic usage-credit purchase; returns a URL the customer opens to complete payment | amountUsd, successUrl?, cancelUrl? | Yes | Yes |
purchase_gau_bucket | Buy governed action units in block quantities at the organisation's contracted rate through Stripe Checkout; returns the Checkout URL, the quantity, the block size and the number of blocks | quantityGau, successPath, cancelPath | Yes | Yes |
set_spend_budget | Set (create or replace) the hard period-to-date spend ceiling for one scope: the org-level ceiling that covers every workspace, or this workspace's own ceiling. | scope, enabled, period, windowDays?, limit | Yes | Yes |
start_subscription_upgrade | Start a Stripe Checkout session for a plan change; returns a URL the user opens to complete the upgrade | planSlug, interval, successUrl, cancelUrl | Yes | Yes |
Capability registry
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_capability_registry | Read one typed capability contract from the live registry as the full enforced object: identity grants, tenancy scope, permitted action with input/output field specs, commercial terms (billing gate + entitlement pack), and chaining metadata. | name | No | No |
list_capability_registry | List the platform's typed capability contracts from the live in-process registry: the name, domain, surfaces, layers, sensitivity, default IAM grants, entitlement gate, and audit binding for each. | domain?, q?, surface?, missingLayer?, sensitivity?, limit?, offset? | No | No |
Chat
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
send_message | Append a user message to a conversation and stream the assistant reply | conversationId, parentMessageId, branchReason, content, contentBlocks? | Yes | No |
Code graph
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
check_change | Check a unified diff against the code graph before it merges: the symbols it changes, the blast radius summary, the tests to run, the environment variables it adds or leaves missing, the scripts it affects with their effect classes, the new crossings between domains it makes, and the conventions of the code it changes. | budget?, minConfidence?, scope?, responseFormat?, at?, diff, repo? | No | No |
create_work_items | Create the work items a person confirmed from what the code graph found. | items | Yes | Yes |
export_openapi_draft | Draft an OpenAPI 3.1 file for the HTTP routes found only in code, which no spec describes, in a repo, package, or folder. | budget?, minConfidence?, scope?, responseFormat?, at?, within | No | No |
find_definition | Find where a symbol, file, table, route, or other code graph node is defined. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
find_implementations | Find the types that implement, extend, or override one code graph node, up to two steps away. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
find_references | Find the code that calls, imports, or refers to one code graph node. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
get_api_docs | Read what the code graph knows about one API operation or MCP tool: its description, input and output schemas, the handler that serves it, the tables that handler reads and writes, its flags, and example calls from tests. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
get_blast_radius | List everything a change to a target affects: callers, overrides, code that reads or writes it, foreign keys and views, migrations, the APIs and agent tools it serves, entry points, build targets, covering tests, docs, specs, decisions, and co-change partners, grouped by kind with each item's confidence and path. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
get_code_graph_settings | Read the code graph's settings from the codegraph/ files of the workspace's steering repo, at the last approved commit. | None | No | No |
get_code_graph_spend | Read this month's code graph AI spend against the workspace's monthly cap, and the key that pays for it. | None | No | No |
get_dataflow_slice | Follow one value through the code: the statements that define it before the target, or the statements that read it after, in order, with each step's file, lines, role and confidence. | budget?, minConfidence?, scope?, responseFormat?, at?, target, line?, variable?, direction?, depth?, crossCalls? | No | No |
get_domain_brief | Get the brief of one domain of the workspace's code: what it is for, its entry points, core types, tables, APIs and agent tools, rules, key tests, and owners. | budget?, minConfidence?, scope?, responseFormat?, at?, domain | No | No |
get_env_vars | List the environment variables a service, deployable, package, file, or function needs and where each one is set per environment, missing ones first. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
get_execution_flow | Walk the calls from an entry point or a function into an ordered call tree, with the tables each step reads and writes and repeated subtrees shared once. | budget?, minConfidence?, scope?, responseFormat?, at?, target, mode? | No | No |
get_infra | Show where a function, file, package, or deployable runs in each environment and what those services connect to. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
get_intended_behavior | State what a function is meant to do, in one or two sentences, with the evidence each claim cites: behavior statements, requirements, decisions, conventions, comments and the issue's text, in that order. | budget?, minConfidence?, scope?, responseFormat?, at?, target, failure? | No | No |
get_repair_context | Pack what a fix needs to read into one bundle, 8,000 tokens by default and 16,000 at most, in fixed sections: the suspect code, its callers and callees, the tests to run and the failing assertion, each suspect's intended behavior, the governing decisions and conventions, and the variables and infrastructure the code touches. | budget?, minConfidence?, scope?, responseFormat?, at?, suspects?, failure?, sections? | No | No |
get_repo_map | Get a map of a repo, package, or folder: the names and parameters of its most important functions and classes, without their bodies, grouped by file and cut to the token budget. | budget?, minConfidence?, scope?, responseFormat?, at?, within | No | No |
label_link | Label one agent link of the code graph's independent sample as right or wrong, with an optional note. | id, label, note? | Yes | Yes |
list_ci_jobs | List the CI jobs that run for a workflow, a job, a file, a package, a symbol, a script, an image, or an environment. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
list_co_changes | List the files and functions that usually change together with a file or a function, learned from git history. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
list_code_graph_releases | List the code graph's release archive: each tagged copy with its commit, its build time, the default-branch builds since the last tag, and the embedding tokens those builds used. | repo?, limit? | No | No |
list_domain_reviews | List the new domains waiting in the code graph's review queue, oldest first. | limit? | No | No |
list_governing_decisions | List the decision records (ADRs) that govern a symbol, file, package, table, or other node, or a domain. | budget?, minConfidence?, scope?, responseFormat?, at?, target?, domain? | No | No |
list_held_decisions | List the ADR copies the code graph holds in its inbox because they failed the publication rule. | limit? | No | No |
list_link_labels | List the independent label sample of agent links that published on their own, stratified by relation, language, and repo pair, with each link's nodes, relation, and evidence. | unlabeledOnly?, limit? | No | No |
list_link_reviews | List the agent links waiting in the code graph's review queue, oldest first: links that passed the checker with a score under 0.6, and published links a recheck no longer found. | limit? | No | No |
list_neighbors | List the code graph nodes one link away from a node, with the edge kind and direction of each link. | budget?, minConfidence?, scope?, responseFormat?, at?, target, edges?, nodeKinds?, direction? | No | No |
list_scripts | List the scripts that build, test, lint, run, and deploy a package, file, or function, each with its exact command from the repo root, its effect class, its known effects, and the host default that applies. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
list_unit_tests | List the tests that cover a function, file, table, column, environment variable, or cloud resource, grouped by file, with fast and stable tests first and the command that runs each one. | budget?, minConfidence?, scope?, responseFormat?, at?, target, kind? | No | No |
localize_fault | Rank the files, functions and lines most likely to have caused a failure, each with the signals that put it there: the change since the last green build, the coverage spectrum, stack frames, a backward slice, rank, co-change partners and the issue's text. | budget?, minConfidence?, scope?, responseFormat?, at?, failure?, issue?, stackTrace?, limit? | No | No |
post_intent_question | Ask the issue's author the one question get_intended_behavior drafted. | item_id, expected_version, question, symbol? | Yes | Yes |
propose_code_graph_settings | Change one code graph settings file, codegraph/<group>.toml, through a steering PR credited to you. | group, settings, title? | Yes | Yes |
propose_edge | Propose one link between two code graph nodes, such as a spec and the function that builds it. | source, target, relation, evidence, confidence | Yes | No |
rank_symbols | List the most important functions and classes in a repo, package, or folder, ranked by PageRank over the code graph. | budget?, minConfidence?, scope?, responseFormat?, at?, within | No | No |
review_domain | Accept or reject one domain in the code graph's review queue. | id, decision, name?, definition?, note? | Yes | Yes |
review_link | Accept or reject one agent link in the code graph's review queue. | id, decision, note? | Yes | Yes |
search_code_graph | Search the code graph with a plain-language question, such as "payments and checkout related code and tables". | budget?, minConfidence?, scope?, responseFormat?, at?, query, groups? | No | No |
trace_spec | Trace one spec or design doc to the code that builds it and the tests that prove it. | budget?, minConfidence?, scope?, responseFormat?, at?, target | No | No |
Configuration clones
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_clone_draft | Read a configuration into an editable clone draft with a new suggested name and slug. | kind, sourceId | No | No |
propose_configuration_clone | Validate a clone draft and open a create-only suggestion under its new identity. | kind, sourceId, sourceDigest, slug, name, source, files | Yes | Yes |
Connections
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
create_connection | Create a new data source connection for a workspace. | connectorId, displayName, connectionConfig?, authCredential, deliveryMethod? | Yes | Yes |
delete_connection | Delete a data source connection. | connectionId, mode | Yes | Yes |
get_connection | Get details of a single data source connection. | connectionId | No | No |
get_connection_mappings | Get the current entity type mappings for a data source connection. | connectionId | No | No |
list_connections | List all data source connections for a workspace. | status?, connectorId? | No | No |
pause_connection | Pause or resume syncing for a data source connection. | connectionId, paused | Yes | No |
preview_connection | Preview sample records from a data source connection. | connectionId | No | No |
set_connection_mappings | Save entity type mappings for a data source connection. | connectionId, mappings, activateConnection?, installationId?, selectedRepos?, syncDepthDays?, owner?, repo?, defaultBranch? | Yes | Yes |
suggest_connection_mappings | Use an LLM to suggest entity type mappings for a connection based on previewed record types. | connectionId, recordTypes, existingEntityTypes? | Yes | No |
update_connection | Update a data source connection: rename it (displayName) and/or adjust its delivery configuration (sync schedule, scope). | connectionId, displayName?, deliveryConfig? | Yes | No |
Conversations
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
add_conversation_attachment | Link an already-uploaded asset to a conversation as a chat attachment and return its conversation-file record. | conversationId, assetPublicId | Yes | No |
archive_conversation | Archive or unarchive conversations (reversible: sets or clears archived_at, with no data loss). | conversationIds, archived | Yes | No |
clear_conversation | Clear one of your conversations: keep its id and title, and hide every message written before now from the thread and from the assistant's history. | conversationId | Yes | No |
delete_conversation | Permanently delete the caller's conversations, with their messages and the files the caller sent in them. | conversationIds | Yes | Yes |
export_conversation | Export an entire conversation (active branch) as a Markdown document or a formatted PDF | conversationId, format | Yes | No |
fork_conversation | Start a new conversation from one reply of an existing conversation. | conversationId, runId | Yes | No |
get_conversation | Read one of your conversations in this workspace with its messages, oldest first, or your most recently updated active conversation when no id is given | conversationId?, limit?, before? | No | No |
list_conversation_files | List the ready generated assets attached to a conversation, access-policy filtered, newest-first, keyset-paginated | conversationId, kind?, limit?, cursor? | No | No |
list_conversations | List a user's conversations in a workspace, filtered by active or archived state, newest first, keyset-paginated | filter?, limit?, cursor? | No | No |
post_conversation_message | Post a message to a conversation | conversation_id, message? | Yes | No |
purge_conversations | Permanently delete every archived conversation the caller owns in this workspace, with its messages and the files the caller sent in it. | None | Yes | Yes |
rename_conversation | Rename a conversation (set its title) | conversationId, title | Yes | No |
Credential grants
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_credential_grants | List the credential broker's grants for the workspace: every credential put to use for a tool server on behalf of a run, with the connection, the scope it could reach, its TTL and whether it is still live. | connectionId?, limit?, cursor? | No | No |
Enrolled hosts
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_tacho_session_policy | Read the workspace model enforcement mode, allow and deny lists, and legacy recorded dollar ceiling. | None | No | No |
list_incidents | List the workspace's tamper and integrity incidents, newest first, cursor-paged, optionally narrowed to one agent or to open incidents. | agentId?, open?, limit?, cursor? | No | No |
list_tacho_hosts | List the machines enrolled as Tacho hosts in this workspace with their status, liveness, and counters. | status?, limit?, cursor? | No | No |
update_tacho_session_policy | Set the workspace model allow and deny lists for routed calls from upgraded hosts. | mode?, sessionLimitUsd?, modelAllow?, modelDeny? | Yes | Yes |
Environments
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
create_environment | Create a workspace environment (e.g. production, development, preview) for scoping secrets and sandbox config. | name, slug, description? | Yes | No |
delete_environment | Soft-delete a workspace environment. | environmentId | Yes | No |
get_environment | Fetch a single workspace environment by its public id. | environmentId | No | No |
list_environments | List the environments configured in the active workspace. | None | No | No |
set_default_environment | Promote an environment to the workspace default. | environmentId | Yes | No |
update_environment | Update a workspace environment's name, slug, description, or active state. | environmentId, name?, slug?, description?, isActive? | Yes | No |
Error clusters
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_error_clusters | Cluster recent captured errors by fingerprint to see which error classes are recurring and how often across the org. | sinceHours?, severity?, source?, limit? | No | No |
Graph schemas
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
create_schema_version | Freeze the current draft into an immutable published version and open a fresh draft. | label?, changeSummary? | Yes | No |
delete_schema_label | Remove a node label and its properties from the draft. | schemaName, name | Yes | Yes |
delete_schema_property | Remove a property from the draft. | ownerKind, ownerName, key | Yes | Yes |
delete_schema_relationship | Remove a relationship type from the draft. | schemaName, name | Yes | Yes |
diff_schema_versions | Structural diff of two versions: added/removed/changed schemas, labels, relationship types, properties. | fromVersionId, toVersionId | No | No |
dispatch_schema_reconcile | Dispatch an async reconciliation job to re-label existing graph nodes and relationships against the pinned schema version. | versionId, prune? | Yes | Yes |
export_schema | Build a ZIP of a version (grouped by schema) via the create_archive plumbing; returns access-controlled serveUrl. | versionId? | Yes | No |
get_reconcile_status | Poll the status of a schema reconciliation job. | jobId | No | No |
get_registry_config | Set enforcement_mode and conformance_floor for the workspace registry. | enforcementMode?, conformanceFloor? | Yes | Yes |
get_schema_registry | Resolve a workspace's registry: pinned version, draft version, enforcement mode, per-schema enabled state, label/relationship/property tree. | versionId? | Yes | No |
list_schema_versions | List versions (number, label, status, published_at, change_summary). | limit?, offset? | Yes | No |
list_schemas | List the workspace's schemas with per-schema enabled state. | None | Yes | No |
pin_schema_version | Point the workspace at a published version; returns whether a pin downgrade occurred. | versionId | Yes | Yes |
recommend_schema | AI onboarding: read existing graph (get_graph_stats + graph_observed_labels ClickHouse telemetry + sampled query_ontology) and the workspace's enabled schemas → propose a starter schema or additions. | sampleLimit? | No | No |
setup_schema | Interactive LLM-assisted registry walkthrough: recommend → intent Q&A (run_schema_chat) → apply → activate. | sampleLimit?, enforcement?, noInteractive?, json? | Yes | No |
toggle_schema | Enable/disable a schema. | schemaName, enabled | Yes | Yes |
upsert_schema_label | Create/update a node label on a schema within the draft version. | schemaName, name, displayName, description?, naturalKeyProps?, properties? | Yes | No |
upsert_schema_property | Create/update a property on a node label or relationship type in the draft. | ownerKind, ownerName, key, dataType, required?, description?, enumValues?, itemType?, constraints?, example? | Yes | No |
upsert_schema_relationship | Create/update a relationship type on a schema within the draft version. | schemaName, name, displayName, startLabel?, endLabel?, cardinality?, description?, properties? | Yes | No |
validate_schema_node | Validate a node's properties against the workspace schema. | label, properties, versionId? | No | No |
validate_schema_relationship | Validate a relationship's type and properties against the workspace schema. | type, startLabel, endLabel, properties, versionId? | No | No |
Installation
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_install_instructions | Return step-by-step MCP/CLI installation instructions for a given AI client (claude-code, cursor, claude-desktop, codex, vscode). | client, workspaceSlug?, enrollmentToken? | No | No |
Integrations
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
configure_integration | Update plugin instance configuration: filters and sync cadence. | integrationId, displayName?, config?, syncCadence? | Yes | No |
delete_integration | Remove a plugin instance and optionally purge its graph data from Neo4j. | integrationId, purgeData? | Yes | Yes |
get_integration | Get full details of a single plugin instance including schema and configuration. | integrationId | No | No |
get_integration_metrics | Get sync statistics and metrics for a plugin instance. | integrationId | No | No |
install_integration | Install a plugin instance from catalog or custom URL. | pluginId, version?, schemaUrl?, config, displayName | Yes | Yes |
list_integrations | Browse installed plugin instances with status, config summary, and sync metrics. | status?, pluginId?, limit?, offset? | No | No |
sync_integration | Trigger synchronization of a plugin instance. | integrationId, mode? | Yes | No |
Knowledge graph
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
author_graph_rule | Ask the in-app agent to author a relationship rule between nodes from two sources, as one assistant turn judged against a goal built from the rule: a query_ontology traversal over the relationship type, from a node of the first source, returns a node of the second. | rule, note?, conversationId?, turnId? | Yes | No |
get_graph_stats | Customer-context workspace graph statistics: node count, edge count, inferred edge count, and breakdown by type. | includeByType?, includeGrowth? | No | No |
get_node | Retrieve a customer-context graph node by its publicId. | nodeId | No | No |
list_nodes | Paginated browse of customer-context nodes in the workspace graph. | labels?, sourceId?, limit?, offset?, query? | No | No |
search_graph | Natural-language semantic (vector) search across customer-context entities in the shared workspace graph, ranked by embedding similarity. | query, limit?, labels? | No | No |
search_nodes | Fuzzy search customer-context graph nodes by displayName and description, optionally filtered by label. | query, labels?, limit? | No | No |
Mandates
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_mandate | Read one mandate: the grant, remaining authority by measure from the ledger, and the ledger rows (reservations, settlements, releases) newest first. | mandateId, ledgerLimit? | No | No |
grant_mandate | Grant an agent bounded, expiring authority for a consequence: limits over the tool's declared measures, allowed targets, tool patterns, the mandate's own approval rule, a purpose and a validity window. | agentId, impacts, limits, targets?, tools, approval?, purpose, validFrom, validTo, requestId? | Yes | Yes |
list_mandates | List the workspace's mandates with remaining authority by measure, newest first, optionally narrowed to one agent or one status. | agentId?, status?, limit? | No | No |
request_mandate | Ask for a mandate on behalf of an agent: the same shape as grant_mandate, recorded as a draft for the role accountable for the consequence to grant or decline. | agentId, impacts, limits, targets?, tools, approval?, purpose, validFrom, validTo | Yes | No |
revoke_mandate | Revoke a mandate with a reason. | mandateId, reason | Yes | Yes |
update_mandate_limits | Change an active mandate's limits, targets, approval rule or validity end. | mandateId, limits?, limitChanges?, targets?, approval?, validTo? | Yes | Yes |
Models
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_model_capabilities | List the provider capability posture matrix: per vendor, how its prompt cache is engaged (explicit opt-in vs implicit), how its reasoning budget is controlled, how structured output is obtained, and which attachment kinds it accepts. | vendor?, model? | No | No |
Navigation
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_nav_counts | The sidebar's counts for this workspace: work items in the inbox, pending approvals, open agent questions, open steering suggestions and open critical incidents, each null when its read answered nothing. | None | No | No |
Notifications
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_notifications | List the calling user's in-app notifications, newest first, up to a limit. | unreadOnly?, limit? | No | No |
mark_notification | Mark a notification as read and/or archived for the calling user. | id, read?, archived? | Yes | No |
mark_notifications_read | Mark every unread notification of the calling user read, in the organization and the open workspace, up to an optional time. | before? | Yes | No |
Off switches
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_kill_switches | List the kill switches reaching this workspace (org-wide class and organisation switches, and the workspace's own), newest first, with the current deny generation. | onlyOn?, limit? | No | No |
set_kill_switch | Flip a kill switch on or off: an emergency deny against a tool version, a tool server, a connection, an agent, an operator, a workspace, the organisation or a consequence class. | target, on, reason | Yes | Yes |
Onboarding
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_first_frame | For one registered agent: the host enrolled for it, what that host last reported, and the first frame ingested from it, long-polled for up to waitMs. | agentId, waitMs? | No | No |
get_onboarding_state | Where the signed-in person is in the onboarding gate: the current step, the gate's workspace, and the first frame once one arrived. | None | No | No |
Ontology
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_ontology_neighbors | Return the one-hop neighborhood of a node: directly connected nodes, optionally filtered by relationship type and direction. | nodeId, edgeTypes?, direction?, limit?, asOf?, asKnownAt? | No | No |
query_ontology | Multi-hop traversal FROM a known start node over named relationship type(s) to a given depth (1–5); returns the reachable customer-context subgraph (nodes + edges), org + workspace scoped, read-only, no Cypher required. | startNodeId, edgeTypes?, direction?, maxDepth?, limit?, asOf?, asKnownAt? | No | No |
Organization
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
accept_member_invite | Accept a pending org invitation. | invitationPublicId | Yes | No |
add_org_member | Invite a user to join the org by email. | email, role | Yes | Yes |
archive_model_tier | Archive a model tier so triage and dispatch stop offering it. | tier | Yes | Yes |
change_member_role | Change a member's org role. | targetUserId, newRole | Yes | Yes |
create_model_tier | Add a model tier to this organization: its name, the guidance that says when to choose it, its rank among the tiers of its kind (1 is the lightest; the tiers at that rank and above move up one), and optionally the model each harness runs for it. | name, slug?, kind?, guidance, rank?, models? | Yes | Yes |
create_org | Create a new organization with a globally-unique slug, its owner membership, IAM bootstrap and first workspace | name, slug, namespace?, planSlug?, type?, website?, industry?, employeeSize?, workspace? | Yes | Yes |
create_sso_provider | Register an SSO identity provider (OIDC or SAML) for one email domain. | providerId, displayName, domain, groupsClaim?, config | Yes | No |
decline_member_invite | Decline a pending org invitation. | invitationPublicId | Yes | No |
delete_model_credential | Remove the organisation's stored model-vendor API key. | purpose?, workspaceId?, space?, credentialId? | Yes | No |
delete_sso_provider | Delete an SSO provider and its group-to-role mappings. | providerId | Yes | No |
get_data_plane | Read the organisation's data-plane binding for one store (postgres, neo4j, or clickhouse): shared or dedicated, its health status, endpoint host and database name, applied schema version, and the last verification/rotation timestamps. | kind | No | Yes |
get_model_credential | Read whether the organisation has stored its own model-vendor API key, and if so which provider, its status, the last four characters of the key, and when it was last verified and last rotated. | None | No | No |
get_org_settings | Read the active organization's profile settings: name, slug, avatar, website, industry, employee size, and type. | None | No | No |
list_members | List the members of the organization with its pending invitations, or the members of the current workspace. | scope? | No | No |
list_model_credentials | List your own model credentials in the order the gateway uses them, with each one's provider, type, name, last four characters, status, and when its usage resets if it ran out. | None | No | No |
list_model_tiers | List this organization's model tiers in rank order, lightest first, each with the guidance that says when to choose it and the model each harness (claude-code, codex, cursor, stella) runs for it. | kind?, includeArchived? | No | No |
list_orgs | List the organizations (tenants) the authenticated user belongs to, with the caller's role in each. | None | No | No |
list_sso_providers | List the organisation's SSO identity providers (OIDC or SAML) with their domain verification record, callback URL, group-to-role mappings, whether SSO is required, and whether the organisation's plan includes SSO (the Enterprise plan). | None | No | No |
remove_model_credential | Remove one of your own model credentials. | credentialId | Yes | No |
remove_org_member | Remove a member from the org. | targetUserId | Yes | Yes |
resend_member_invite | Resend a pending invitation in the calling organization. | invitationPublicId | Yes | Yes |
revoke_member_invite | Revoke a pending invitation in the calling organization. | invitationPublicId | Yes | Yes |
revoke_scim_token | Revoke the organization's SCIM bearer token so the identity provider can no longer push users or groups. | None | Yes | No |
set_data_plane | Bind one of the organisation's stores (postgres, neo4j, or clickhouse) to a dedicated customer-controlled endpoint, or return it to the shared platform plane. | kind, mode, config? | Yes | Yes |
set_model_credential | Store the organisation's own model-vendor API key: OpenRouter, Vercel AI Gateway, OpenAI, Anthropic, or any OpenAI-compatible endpoint given by base URL. | provider, apiKey, baseUrl?, modelMap?, purpose?, workspaceId?, embedding? | Yes | No |
set_model_tier_model | Set the model one harness (claude-code, codex, cursor or stella) runs for a model tier, or clear it with null. | tier, harness, model | Yes | Yes |
set_sso_group_roles | Replace an SSO provider's mappings from identity-provider group to organisation role (compliance_billing or member), and optionally its grants from group to a custom role or to a workspace role in a named workspace. | providerId, mappings, grants? | Yes | No |
set_sso_policy | Require SSO for the organisation, or stop requiring it. | ssoRequired | Yes | No |
update_model_credential | Rename, pause or resume one of your own model credentials. | credentialId, label?, paused? | Yes | No |
update_model_tier | Rename a model tier, rewrite the guidance that says when to choose it, move it to another rank among the tiers of its kind (1 is the lightest), make it the default stella runs on when a turn names no tier, or choose whether Oxagen's shared key or the organization's own model key pays for its stella turns. | tier, name?, guidance?, rank?, isDefault?, usesSharedKey? | Yes | Yes |
update_org_settings | Update the active organization's profile settings (partial): name, slug, avatar, website, industry, and employee size. | name?, slug?, avatarUrl?, website?, industry?, employeeSize? | Yes | No |
update_sso_provider | Change an SSO provider's display name, groups claim, or OIDC or SAML settings. | providerId, displayName?, groupsClaim?, config? | Yes | No |
verify_model_credential | Check a model-vendor API key against the vendor. | provider?, apiKey?, baseUrl?, toolProbeModel?, modelMap? | Yes | No |
verify_sso_domain | Check the DNS TXT record that proves the organisation owns an SSO provider's email domain, and mark the domain verified when the record matches. | providerId | Yes | No |
Plugins
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
add_plugin_registry | Add an MCP registry source for the workspace (any registry implementing the MCP Registry OpenAPI). | name, baseUrl | Yes | Yes |
browse_plugin_catalog | Search and filter the plugin marketplace by type, text, transport, and auth kind. | pluginType?, search?, categories?, transportTypes?, authKind?, installed?, limit?, offset? | Yes | No |
get_auth_alerts | Read the org MCP auth-alert notification setting: which org roles receive alerts and whether email is sent. | None | No | No |
get_catalog_plugin | Get full detail for one catalog server by name+version, fetched live from the workspace's enabled registries. | name, version? | No | No |
get_plugin_schema | Fetch the typed config schema for a connector plugin, used to drive dynamic form rendering during install and configure flows. | pluginId | Yes | No |
install_plugin | Install a plugin into this workspace. | pluginType?, pluginId?, custom? | Yes | Yes |
install_plugins_bulk | Bulk install catalog or custom plugin servers to the org allow-list. | items | Yes | Yes |
list_plugin_registries | List MCP registries for the workspace. | None | No | No |
list_plugin_versions | List version history for a connector plugin including changelog entries and breaking-change flags. | pluginId, limit?, includeChangelog? | No | No |
list_plugins | List installed plugins for this workspace. | pluginType? | No | No |
reauth_plugin_credential | Return the OAuth authorization URL to initiate re-authentication for a plugin credential that has expired or been revoked. | orgListingId | No | No |
remove_plugin_registry | Remove a workspace MCP registry source (including the default: removing the default promotes the most-recently-created remaining registry, if any). | registryId | Yes | Yes |
revoke_plugin_credential | Revoke and delete the stored credential (OAuth tokens or secret) for an installed plugin server in this workspace, so the workspace must re-authenticate before the server can be used again. | orgListingId | Yes | No |
set_auth_alerts | Update the org MCP auth-alert notification setting (which roles receive alerts and whether email is sent). | sendEmail, roles | Yes | Yes |
set_plugin_enabled | Turn an installed plugin on or off. | scope, orgListingId, enabled | Yes | Yes |
set_plugin_secret | Store or update an encrypted credential (API key or OAuth token) for a plugin server in this workspace. | orgListingId, authKind, secret?, accessToken?, refreshToken?, issuer? | Yes | Yes |
sync_plugin_catalog | Trigger an immediate sync of the MCP registry catalog for the workspace. | fullSync? | Yes | No |
uninstall_plugin | Soft-delete a plugin listing from this workspace and remove all dependent MCP server rows. | orgListingId | Yes | Yes |
validate_plugin_schema | Validate a connector plugin config object against its schema before install or configure. | pluginId, authSchemeId?, config | Yes | No |
Preferences
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_user_preferences | Read the calling user's UI and model preferences, and their email switch per notification event | None | No | No |
get_workspace_user_preferences | Read the calling user's per-workspace coding-agent defaults: preferred default repository connection and its owner/repo slug, default agent, and whether the one-time repo-default prompt has been shown. | None | No | No |
set_preferences | Set the calling user's account preferences (locale, theme, timezone, appearance, input behaviour, default text model and the email switch per notification event) as a partial write, and return the whole set after it. | locale?, theme?, timezone?, fontSize?, density?, enterToSubmit?, pendingPromptBehavior?, defaultTextTier?, defaultTextModel?, notifications? | Yes | No |
Prices
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
list_price_entries | List the price book this organization is priced against: every provider list price effective at an instant and the organization's negotiated rows, in integer micros per million units with the window each is effective over. | at?, includeScheduled?, limit?, offset? | No | No |
list_unpriced_models | List the models this organization has run that the price book cannot price: the model, its vendor, how many calls and tokens it has run in the window, and which token classes are missing a price. | since?, at? | No | No |
remove_price_entry | End this organization's negotiated rate for one model and token class at an instant, so every frame from then on is priced at the provider list price again. | provider, model, tokenClass, region?, at?, scheduledEntryId?, cancellationToken?, confirmUnpriced? | Yes | Yes |
set_price_entry | Set this organization's negotiated rate for one model and token class, in USD per one million units, effective from an instant. | provider, model, tokenClass, region?, modelAliases?, usdPerMillion, additionalRates?, effectiveFrom? | Yes | Yes |
Privacy
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
erase_data | Request erasure of personal or organizational data (GDPR Article 17, the right to erasure). | scope, orgId?, confirm | Yes | Yes |
export_data | Request a machine-readable ZIP export of personal or organizational data (GDPR Article 20, the right to data portability). | scope, orgId? | Yes | Yes |
get_export_status | Read the status of one of the calling user's own data exports. | exportId | No | No |
References
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
search_references | Tenant-scoped autocomplete search across every referenceable platform object: connected repositories and branches, code-graph files/directories, agents, skills, agent tools, MCP servers, capabilities, and knowledge-graph nodes/edges. | query?, types?, slug?, limit? | No | No |
Repositories
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_main_repository | The workspace's main repository, whether a GitHub App installation is attached, and the links that expire for connecting GitHub or changing which repositories the installation reaches. | None | No | No |
get_repository_tree | Read what one of the workspace's repositories holds under .oxagen/ and steering/ on its production branch: the head commit, every path, workspace.toml, the governance file and its mode, and any open init pull request. | bindingId | No | No |
get_steering_repo | Read the workspace's steering repo: its provisioning status and step, the repository, the published version, its settings health, and each setting that differs. | None | No | No |
import_repository_config | Open a steering PR that imports the harness files of a code repository the workspace already links: records, whole skills and Cedar policies from the Import step's selection. | provider?, owner, name, import | Yes | Yes |
import_workspace_steering | Move the workspace's steering from .oxagen/ in the repository it binds to a steering repo, and open the steering PRs a person merges. | ruleKinds?, constraintEffects?, startFresh?, connection?, resetConnection? | Yes | No |
link_repository | Open a steering PR that links a GitHub repository to the workspace. | provider?, owner, name, import? | Yes | Yes |
list_code_repository_findings | List the instruction-file statements in the workspace's linked code repositories that repeat or contradict an active steering record. | None | No | No |
list_forge_pull_requests | List the workspace's stored pull requests with their commits, contributors, and shipped lines. | pullRequestId?, limit?, offset?, state?, view? | No | No |
list_github_installations | The GitHub App installations the workspace's stored GitHub authorization can reach, the set attach_github_installation will accept. | None | No | No |
list_installation_repositories | The repositories the organization's GitHub App installation exposes to this workspace, with the other workspaces that hold each one. | None | No | No |
list_org_installation_repositories | The repositories the organization's GitHub App installation exposes, read at organization scope so a person creating a workspace can pick them. | None | No | No |
list_repositories | List the workspace's repositories (its one main repository and every linked one), with each one's role and approved default ref. | None | No | No |
list_steering_repo_destinations | List the GitHub organizations, personal GitHub accounts, and GitLab groups where Oxagen can create a new workspace's steering repo. | slug? | No | No |
list_working_copies | List the directories the CLI linked to this workspace, with machine, path, repository, branch, head, the state of .oxagen/, the commit last pulled and when each was last seen. | limit? | No | No |
open_init_pr | Add Oxagen to one of the workspace's repositories: open a pull request from oxagen/init that adds the .oxagen/ tree with the reviewed workspace.toml and governance.toml. | bindingId, governanceMode, workspaceToml, governanceToml | Yes | Yes |
parse_repository_config | Read the agent harness files on a code repository's default branch and propose what each becomes: steering records and whole skills scoped to the repository, Cedar policies from settings files, MCP server rows with no key values, and memories from personal files. | provider?, fullName, paths? | No | No |
promote_instruction_to_steering | Propose a new version of the steering record an instruction-file statement contradicts, with the statement as its text, and open the suggestion's steering PR. | finding_id | Yes | Yes |
repair_steering_repo | Put every prescribed setting back on the workspace's steering repo, then read the settings again and answer the health that read finds. | None | Yes | Yes |
scan_repository_config | List the agent harness files on a code repository's default branch: instruction and rule files, skills, commands, subagent files, settings files and MCP configs, each with its harnesses, kind, blob sha, size and a fixture flag. | provider?, fullName | No | No |
set_production_branch | Confirm or change the production branch of one of the workspace's repositories. | bindingId, branch | Yes | Yes |
set_workspace_repositories | Replace the workspace's repository set with the repositories named. | repositories | Yes | Yes |
unlink_repository | Unlink a linked repository from the workspace. | bindingId | Yes | Yes |
Repository sync
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
configure_repo | Set repo-specific filters, sync cadence, and field mappings. | repoId, recordTypes?, pathFilters?, labelFilters?, syncCadence?, pollingIntervalSeconds?, fieldMappings? | Yes | No |
get_ci_status | Read CI check-run and commit-status results for a ref in a GitHub repository. | owner, repo, ref | No | No |
get_pr | Read a GitHub pull request's summary, diff stats, comments, and CI status. | owner, repo, number | No | No |
get_pr_diff | Read the per-file unified-diff patches for a GitHub pull request. | owner, repo, number | No | No |
get_repo_metrics | Get sync statistics and metrics for a repository connection. | repoId | No | No |
list_branches | List branches in a GitHub repository, including each branch's SHA, protection status, and which one is the repository's default branch. | owner, repo | No | No |
pause_repo | Pause automatic syncing for a repository connection. | repoId | Yes | No |
resume_repo | Resume automatic syncing for a paused repository connection. | repoId | Yes | No |
sync_repo | Trigger incremental or full re-index of a repository connection. | repoId, mode?, recordTypes? | Yes | No |
Roles
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
assign_member_role | Give a person a custom IAM role: an organization role across the organization, or a workspace role in one workspace (workspaceId, or the call's workspace). | roleId, userId, workspaceId? | Yes | Yes |
create_role | Create a custom IAM role from area levels (none, read, write, write_with_approval per catalog area, plus spend authority on an organization role) or from catalog permission ids. | name, scopeKind, description?, permissions?, levels?, spendAuthority?, home? | Yes | Yes |
delete_role | Delete a custom IAM role and its grants. | roleId | Yes | Yes |
list_iam_roles | List the org's IAM roles with their capability grants (allow/deny/require_approval) and the number of principals assigned to each. | scopeKind?, includeGrants?, includeHolders?, limit?, offset? | No | No |
set_role_grants | Replace a custom IAM role's grants with area levels (none, read, write, write_with_approval per catalog area) or a set of catalog permission ids, and optionally set spend authority on an organization role. | roleId, permissions?, levels?, spendAuthority?, description? | Yes | Yes |
unassign_member_role | Take a custom IAM role from a person: an organization role, or a workspace role in one workspace (workspaceId, or the call's workspace). | roleId, userId, workspaceId? | Yes | Yes |
Router
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_routing_policy | Read the effective market-router policy for the current scope (mode, verified-success threshold, min samples, window, tier-escalation) plus its provenance (workspace / org / default). | None | No | No |
preview_routing_decision | Dry-run the market router for a prompt: derive its task class, read observed outcomes, and return the full decision (chosen model + tier, rationale, source, and the ranked audit trail of the models it weighed) under the effective policy plus any overrides. | prompt, fileCount?, crossPackage?, taskClass?, mode?, successThreshold?, minSamples?, windowDays?, escalateOnRejection? | No | No |
set_routing_policy | Set the market-router policy for this org or workspace (partial update). | scope?, mode?, successThreshold?, minSamples?, windowDays?, escalateOnRejection? | Yes | Yes |
Run control
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
dispatch_command | Queue a pause, resume, cancel, steer or message command for one run, an agent's live runs, or every live run in the workspace, with a delivery mode on steer and message. | target, command, payload?, reason?, expiresInMs?, batchId? | Yes | Yes |
list_commands | The delivery report for one run, or for the commands one broadcast queued: every command, newest first, with its run (or its agent, for a steer held for an idle agent's next run), its issuer, its text, its status, the requested and achieved delivery mode, and the frame an applied command landed on. | runId?, commandIds?, limit? | No | No |
pause_workspace_runs | Queue a pause for every live wrapped run in the workspace that its host can reach, as one governed decision with one audit event, and answer which runs took it and which were skipped and why. | reason | Yes | Yes |
Runs
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
edit_run | Set or clear the name and summary a person gives a run. | runId, name?, summary? | Yes | No |
get_change_set | Get the pull requests a run, a work order, a work item, or an issue produced, each with its latest stored revision, files, and the runs credited with its lines, and their change rolled up by repository. | scope, id | No | No |
get_commit_diff | Get one commit's own diff from Oxagen's store, split into files and checked against the hash recorded when it was captured. | provider, repository, sha, paths? | No | No |
get_revision_diff | Get one pull request revision's diff from Oxagen's own store, split into files, checked against the hash recorded when it was captured. | revisionId, paths? | No | No |
get_run | Read one run's header and one page of its frames, each with its body reference, from an opaque cursor, optionally waiting for a new frame. | runId, framesAfter?, sessionUuid?, chainsAfter?, frameLimit?, waitMs? | No | No |
get_run_chain | Read what makes one run's record tamper-evident: the hash rule, the Merkle root, each point where the agent's computer locked the record, the sequence and body gaps the recording shows, the run's final lock, and the replay-grade ladder with the reason each rung is or is not reached. | runId | No | No |
get_run_context | Read what one run's model requests carried: each request's window as system, steering, tools, context and conversation blocks with their bytes and their share of the prompt tokens the vendor reported, each block's tokens summed over every window the run recorded, the model calls recorded with no window, and the steering assembler's budget, spend, and included and cut counts. | runId | No | No |
get_run_cost | Read one run's cost rollup: total cost with its basis, tokens by class, cache hit rate, turns, steps and how many of them advanced the run, model and tool calls, and the per-model breakdown (cost by token class, cache saving, whether any call went unpriced, and the calls, tokens and cost of the cache keep-alives the model proxy sent) and per-tool breakdown with each tool's result tokens and their estimated cost, the standing context each call after the first re-sent by source (tool definitions, steering, context frames) with its estimated cost, the tokens each of those three sources took over every call, marked as an estimate while the run is still open; null until the rollup has rebuilt the run from its frames, with provisional per-model figures for a wrapped run in the meantime. | runId | No | No |
get_run_export | Read one run export: its status, the bundle's hash and size once it is built, the error if the job failed, and a download URL that expires. | exportId | No | No |
get_run_frame_body | Read the redacted body of one frame of a run by its sequence, and by its chain for a subagent's frame: the content type and bytes when the workspace retained bodies, the hash and no bytes under digest_only. | runId, seq, sessionUuid? | No | No |
get_run_issues | Read the issues one run worked on: the task it was admitted for, the issues its pull requests close, and the issues its frames name, each with its state as the forge reads it now, whether that state could be read, what the run did to it, and the frames that show it. | runId | No | No |
get_run_transcript | Read one run as a transcript at a zoom level (turns, steps or everything), derived on the server from its frames and retained bodies: each step one entry carrying the request and the result it was made with, the decision folded into it, and its own and the run's cumulative cost. | runId, zoom, kinds?, after?, before?, from?, text?, seqs?, query?, limit?, chains?, subagent? | No | No |
get_run_turns | Read one run's per-turn ledger over every frame it recorded: each turn's model and tool steps, frames, cost and the cost so far, and the input tokens its model calls reported, uncached and read from the cache. | runId | No | No |
list_recent_runs | The newest runs of this workspace for the command menu: id, agent key, status and start time, the in-app agent's own turns excluded. | limit? | No | No |
list_run_commits | List the commits a run made, newest first, from Oxagen's own store: each commit's subject, kind, written lines, how Oxagen knows the run made it, and the pull requests that hold it. | runId, limit? | No | No |
list_runs | List the runs recorded in this workspace, newest first: root sessions in one cursor-paged list, with the operator, the model, the machine, status, counts and metered cost each row recorded. | limit?, cursor?, pullRequests?, status?, tier?, replayGrade?, query?, agentKey?, own?, sort?, offset?, count?, countLive? | No | No |
post_run_checkpoint | Post a short progress update, as the agent working a send, after each step of the plan: the step, what changed, what passed, what comes next, and an optional ask. | work_order_id, step, changed, passed, next, ask? | Yes | No |
seal_run | End a live or idle-closed wrapped run now and lock its record, and queue a kill for its agent on the host it runs on when that host can collect a command. | runId, reason? | Yes | Yes |
Runtimes and sandboxes
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
check_sandbox_template | Start a short sandbox from a sandbox runtime's ready template, with the runtime's size, egress allowlist and environment and no agent, to check that each service starts and which toolchains are on the PATH. | runtimeId | Yes | No |
connect_modal_account | Connect this workspace's own Modal account for agent sandboxes: the Modal workspace, the environment, and a service user token. | modalWorkspace, environment, tokenId, tokenSecret | Yes | No |
create_runtime | Name a runtime in this workspace: a laptop, a VM or a cloud workspace agents run on. | name, slug?, containmentRequired? | Yes | Yes |
create_sandbox_runtime | Set up a sandbox runtime in this workspace for agent sandboxes on the workspace's own Modal account: the Modal environment, the template, the egress allowlist, the environment, and the sandbox size and limits. | name, slug?, hostOperator, hostCredentialId?, modalEnvironment?, gpu?, region?, template, environmentId?, egressAllow?, vcpu?, memoryMib?, diskGib?, maxRunSeconds? | Yes | No |
delete_runtime | Delete a runtime for good. | runtimeId | Yes | Yes |
disconnect_modal_account | Disconnect this workspace's Modal account and delete its token from the vault. | None | Yes | No |
generate_sandbox_template | Generate a sandbox template from the workspace's linked repositories, or from a starter template: a Dockerfile, a start script per service, and a README under sandbox/ in the steering repo. | preview, starter? | Yes | No |
get_modal_account | Read this workspace's Modal account for agent sandboxes: whether the token connected at its last check, the Modal workspace, the environment and the token id. | None | No | No |
get_sandbox_run | Read one sandbox run by its sandbox id or its run id: its state, the runtime and host that run its sandbox, the Modal workspace and environment, the provider's sandbox id, how many times it continued in a new sandbox, and its estimated cost. | sandboxId?, runId? | No | No |
get_sandbox_template_test | Read a template test that check_sandbox_template started: running with the output so far, then passed or failed with each service and toolchain and the log. | runtimeId, testId | No | No |
launch_sandbox_run | Start a run on your own agent in its own sandbox on a sandbox runtime. | harness, workspace, repo?, repoProvider?, branch?, runtime?, prompt?, workOrderId?, launchedVia? | Yes | No |
list_runtimes | List the runtimes named in this workspace, each with its kind (local or sandbox), the live agents on it and their harness, the live host enrollments bound to it, when a host last reported, and whether it requires the contained launcher. | id? | No | No |
list_sandbox_runs | List your own agents on this workspace's sandbox runtimes, each with its live runs, and your own sandbox runs, live first and then the newest. | limit? | No | No |
list_sandbox_runtimes | List the sandbox runtimes in this workspace, each with its host operator, region, template builds, egress allowlist, environment, and sandbox size and limits. | id? | No | No |
stop_sandbox_run | Stop one of your sandbox runs and free its sandbox. | sandboxId?, runId? | Yes | No |
update_runtime | Rename a runtime, change its slug, or change whether every agent on it must run under the contained launcher. | runtimeId, name?, slug?, containmentRequired? | Yes | Yes |
update_sandbox_runtime | Change a sandbox runtime's name, template, egress allowlist, environment, sandbox size or limits. | runtimeId, name?, hostCredentialId?, modalEnvironment?, gpu?, template?, environmentId?, egressAllow?, vcpu?, memoryMib?, diskGib?, maxRunSeconds? | Yes | No |
Secrets
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
delete_secret_key | Soft-delete a vault secret key and hard-remove all of its per-environment overrides. | keyId | Yes | Yes |
export_secrets | Export the resolved secret set for an environment as decrypted key/value pairs and rendered .env text. | environmentId?, keyIds? | No | Yes |
import_env_secrets | Parse pasted .env text and (optionally) upsert keys + set values for the workspace defaults or a chosen environment. | text, environmentId?, commit? | Yes | Yes |
list_secret_keys | List vault secret keys for the workspace with masked metadata (which environments override each key). | None | No | No |
reveal_secret | Reveal a single secret's plaintext value (override ?? default) for an environment. | keyId, environmentId? | No | Yes |
set_secret_value | Set a secret's value override for a specific environment. | keyId, environmentId, value | Yes | Yes |
unset_secret_value | Remove a secret's per-environment override so it falls back to the key's default value. | keyId, environmentId | Yes | Yes |
upsert_secret_key | Create or update a vault secret key (workspace root). | key, sensitive?, memo?, defaultValue? | Yes | Yes |
Skills
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
get_skill_config | Read the published skill resolution configuration and one page of its immutable version history, newest first. | version?, limit?, cursor? | No | No |
list_skills | List the skills this workspace's harness sessions reported when they started, over a window of session start times: each name with the sessions that reported it, their harnesses and when it was first and last seen, plus the window's session count and how many sessions reported no inventory. | windowDays?, cursor?, limit? | No | No |
summarize_skill_search | Summarize approved skill resolution at a published configuration version. | version, query | No | No |
update_skill_config | Propose skill configuration in a pull request, import the existing approved repository configuration once, or publish a merged configuration pull request after reading back its commit. | action, text?, pullRequestNumber? | Yes | Yes |
Spend
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
create_cost_center | Add a cost-center label to this organization's list, so agents and workspaces can be charged back to it. | label, description? | Yes | No |
delete_cost_center | Delete a cost-center label from this organization's list. | label | Yes | Yes |
dismiss_finding | Dismiss an open finding without applying its fix (org Owner); later passes cite only runs that start after the dismissal. | findingId | Yes | No |
export_cost_center_statement | Export this organization's monthly chargeback statement as CSV: one line per cost center, and one for spend with no cost center, with runs, cost in micros and in cents, the basis, and the run ids that make up each line, plus the organization total they sum to. | month, format? | No | No |
export_statement | Export this workspace's monthly spend statement as CSV: one line per operator, agent, model, tool, task and cost center (spend with no cost center on its own line) with runs, calls, cost in micros and in cents rounded half to even once, the basis, and accepted spend. | month, format?, rows? | No | No |
get_finding_evidence | Get the evidence behind one finding: the calls it cites and how many the counterfactual covers, the tokens and money they cost against the counterfactual, and the cited runs with the largest saving. | findingId | No | No |
get_model_class_replay | Get the replay of one model class fit finding: its latest replay with each sampled run, the estimate it was approved at (each sampled run's recorded first turn priced on the smaller model) and what the replay of those first turns cost once every run finished, the names of the people who may approve a replay (the workspace's Admins and the organization's Owners), and, for a caller who may approve, the plan an approval would start now with its sample size and estimated cost. | findingId | No | No |
get_no_progress_limit | Read this workspace's no-progress limit: the identical calls in a row that stop a run counting as progress and its mode, whether it is the default, the steering PR that waits to change it, and the loops that reached it over a day range, newest first. | period | No | No |
get_sandbox_spend | Read what sandbox runs on the workspace's Modal account cost over a day range, by sandbox runtime. | from, to | No | No |
get_spend | Read this workspace's spend over a day range, rolled up by operator, agent, model, tool, task, cost center or MCP server, with every figure in micros and the basis that says who observed it, the period total with accepted spend, the spend by day, each row's costliest runs, and on a row of whole runs the tokens those runs spent on tool definitions, context frames, steering and tool results, and their request windows summed block by block, conversation and system included, and on an agent or operator row the lines its runs' own commits shipped, their rework, and the spend per shipped line, and the period's cache keep-alives (the calls the model proxy sent to keep a prompt cache warm) with their cost and the runs that sent them. | period, groupBy | No | No |
get_spend_drill | Read one operator, agent or tool's spend over a trailing window in this workspace: the daily series, the average per call and per run, its share of the workspace's spend, its tokens by class with the cache hit rate, the tools its runs called, and its spend split by agent, operator and model, every figure in micros with its basis. | kind, key?, own?, days? | No | No |
list_cost_centers | List this organization's cost-center labels, the labels spend is charged back to, with how many agents and workspaces name each. | None | No | No |
list_findings | List this workspace's costed findings ranked by the money at stake (open by default; applied or dismissed most recent first), each with its saving measured minus counterfactual over the runs it cites, its confidence, why and the fix, plus the total saving, its share of the priced spend over the findings' window and that saving annualised. | status?, runId?, level?, subject?, kind?, own?, cursor? | No | No |
list_waste | List this workspace's wasted spend over a day range by cause, with the runs that prove each cause: the requests open findings waste whole and the measured wasted part of other requests, which sum to the wasted spend headline. | period | No | No |
record_finding_fix | Record that the fix an open finding names was applied (org Owner): the finding becomes applied with the request id of this call, and later passes cite only runs that start after it. | findingId | Yes | Yes |
request_model_class_replay | Approve a replay of a sample of one model class fit finding's runs on the smaller model, at the estimated cost get_model_class_replay showed (workspace Admin or org Owner). | findingId, planDigest, plannedAt, estimated | Yes | No |
set_cost_center | Charge a workspace, named by its public id or else the active one, or one agent in the active workspace, back to a cost-center label from the organization's list, or clear the label. | target, workspaceId?, agent?, costCenter | Yes | No |
set_no_progress_limit | Change this workspace's no-progress limit: the identical calls in a row that stop a run counting as progress, and whether reaching it only records the run (observe) or also pauses it (enforced). | repeats?, mode?, clear? | Yes | Yes |
Steering and memory
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
append_record | Append one steering record to the workspace (an observation, memory, knowledge claim, evidence, context-use record or record suggestion), content-addressed by record_hash. | kind, lineageId, statement, sharingScope?, sourceRefs?, evidenceLinks?, proposal? | Yes | No |
commit_markdown_import | Open one steering PR on steering/import-<date> with the Markdown import's records and Cedar policies marked add, and store its memories marked add as waiting memories with capture import. | records?, policies?, memories? | Yes | Yes |
dismiss_memories | Dismiss workspace memories so the curator does not propose their statements again, or restore dismissed memories with restore: true. | memory_ids, restore?, reason? | Yes | No |
drop_memory_record | Drop one proposed steering record from an open memory PR: pushes a commit to the PR's branch that deletes the record's file. | number, path | Yes | No |
get_published_steering | Read the published .oxagen/ tree of the workspace's main repository (or a named one) at its production branch head, with every file's text, so a machine can write the steering in force. | bindingId? | No | No |
get_record | Get one steering record: a published record by ctr_ id or by record ID (such as ctx.release.notes-format) with its versions and publishing PR, or an appended record by cta_ id with its provenance | recordId | No | No |
get_steering_deliveries | Read included and cut steering records from the latest verified manifest of recent runs. | days?, limit? | No | No |
get_steering_freshness | The workspace's steering version, the commit its newest record was published at, its production branch, and whether the workspace requires agents to auto-sync .oxagen/ or refuses prompts on stale steering. | None | No | No |
get_steering_layout | Which of the two repository layouts the workspace's bound repository uses: steering (steering/governance.toml on its production branch) or main-repo (.oxagen/rules/). | None | No | No |
get_steering_pr | Get a suggestion's steering PR: state, branch, checks with their outcomes, the managed blocks the latest check run found drifted, the approvals given in Oxagen at the checked head, what merge will do, and the promotion event once merged | proposalId | No | No |
get_steering_pr_diff | Get the files a suggestion's steering PR changes, each as it is on the production branch and on the pull request's head, read from GitHub or GitLab now. | proposalId | No | No |
get_workspace_memory | Read one workspace memory with its full text, its source, the runs that used it, and the memory PR that last cited it. | memory_id | No | No |
list_memory_pr_records | List the records one memory PR proposes or archives, each with the memories it cites, and which proposed records were dropped from the PR's branch. | number | No | No |
list_proposals | List the workspace's record suggestions with their support and steering PR state, newest first, optionally narrowed to one status, one state (open, merged or closed) or one record ID | status?, state?, lineageId?, limit?, offset? | No | No |
list_records | List the workspace's published steering records with kind, force, constraint effect, scope, record ID, commit, path, token count and weekly price, filtered by kind, scope, status or record ID | kind?, sharingScope?, status?, lineageId?, limit?, offset?, priced? | No | No |
list_steering_records | List the steering records registered in the active workspace, each with its lifecycle status and pinned active version | status?, limit?, offset? | No | No |
list_steering_skills | List the skills in the workspace's published steering with each one's source (imported skill, command or subagent, proposed, from a run, or written in Oxagen), the repositories it applies to, whether it runs as a subagent, and the built-in actions its Cedar tool policy permits | None | No | No |
list_workspace_memories | List the workspace's memories ranked by uses, then the newest use, then the newest capture, with memories that say the same thing grouped. | states?, harness?, agent?, repository?, type?, limit?, offset? | No | No |
parse_markdown_import | Read up to 25 Markdown files and propose steering records, Cedar policies, and memories from them. | documents | No | No |
promote_memories | Promote waiting workspace memories into draft steering records. | drafts, same_text? | Yes | No |
propose_record | Open a suggestion for a record ID: the record it should become (kind, force, constraint effect, scope, statement), the rationale and the supporting runs, agents, records and evidence. | record, rationale, source?, support?, createOnly? | Yes | No |
propose_steering | Open a steering PR on the workspace's steering repo from files, a title, your rationale, and frames of this run as evidence. | title, rationale, evidence?, files | Yes | No |
read_steering | Read one steering record or skill file. | runId?, lineage, file? | No | No |
restore_managed_block | Restore the Oxagen managed block in AGENTS.md, CLAUDE.md, or README.md on an open steering PR's branch, as one commit, from the production branch, keeping every line outside the block. | proposalId, path | Yes | Yes |
revert_steering_pr | Open a steering PR that undoes a merged one: each path the merge changed goes back to what the production branch held before it, and the ledger is left as it is. | proposalId | Yes | Yes |
search_steering | Find steering records and skills by words, kinds, or code repository. | runId?, query?, kind?, kinds?, repository?, limit? | No | No |
suggest_memory_drafts | Suggest a kind, a force, and a constraint's effect for each memory a person is about to promote, with the classifier parse_markdown_import uses. | memory_ids, statements? | No | No |
Tool registry and Studio
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
draft_studio_description | Draft a description for one tool in a Studio server folder with the in-app agent. | server, tool | No | No |
get_studio_discovery | Read one server folder's latest tool discovery: its status, what asked for it, when it ran, its outcome, the sync steering PR, and the tools the gateway withholds until that PR merges. | server | No | No |
get_studio_draft | Read Studio's draft for one server folder: the staged edits, server.toml, a summary of the source, the revision, and the steering PR Review opened from it. | server | No | No |
get_studio_listing | Read the tool listing of one Studio draft for a server that runs on machines: whether a machine has listed its tools yet, which machine answered, the tools it listed with the classification Studio suggests for each, and why a listing failed. | server | No | No |
get_studio_server | Read one server folder on the steering repo's production branch: its source, auth mode, environments, exposure, sync schedule and last discovery, each tools.toml key's shaping, the tool catalog list_studio_tools returns, and each key's agent feedback over the last 30 days: calls, schema rejections, error results, retries, and reflection notes. | server | No | No |
import_tools | Import a registered MCP server's pinned tools into the workspace registry, or publish hand-authored declarations against it: one immutable tool version per changed manifest, idempotent on an unchanged one; stamps the server's last import. | serverId, tools?, declarations? | Yes | Yes |
list_studio_findings | List the tool checks' findings on one server folder: the saved draft, or the production folder when there is no draft. | server | No | No |
list_studio_tools | List one server folder's tools: each tools.toml key with its confirmed classification, then each tool the last discovery found that no key imports, with a suggested classification. | server | No | No |
list_tool_declarations | List the tool declarations registered in the active workspace, each with its pinned active version's schema facts (read-only flag, risk grade, policy group, checksum) | source?, limit?, offset? | No | No |
list_tool_versions | List the workspace registry's active tool versions with their safety classification, schema origin and hash, the kill switch that stops each one today, and 30-day call counts; cursor-paged, optionally filtered by impact, by the server the tools were imported from, or both. | category?, serverId?, limit?, cursor? | No | No |
migrate_tools_to_steering | Move the workspace's connected MCP servers into its steering repo by opening the migration steering PR. | None | Yes | No |
open_studio_review | Open one steering PR from Studio's draft for a server folder: server.toml, tools.toml, tools.lock.json, the vendored definition, and saved tests on the branch tools/<server>. | server, revision? | Yes | Yes |
revoke_relay | Revoke a relay by name in this workspace. | name | Yes | Yes |
run_studio_selection | Run a server folder's selection tests: ask the workspace's model to pick one of the server's tools for each task in tests/selection.jsonl, and count the hits and misses. | server | No | No |
save_studio_draft | Save Studio's staged edits to one server folder as a draft: tools to import or remove, their classification, description, result cap, and paging, saved tests, the server's exposure mode, server.toml, and the definition or tool list they import from. | server, serverId?, ops, serverToml?, source?, revision? | Yes | No |
set_mcp_credential | Create or replace a named credential in this workspace: a service secret, or an OAuth client's id and secret. | name, kind, secret?, clientId?, issuer?, clientSecret? | Yes | Yes |
set_tool_classification | Set a tool version's safety classification (risk grade, side-effect class, egress class, impacts, measures and data classes), recording who reclassified it and why. | toolVersionId, riskGrade, classification, reason | Yes | Yes |
set_tool_state | Make tools available to toolbelts or take them out of every belt, and set whether each starts active in the All tools belt. | toolIds?, serverId?, available?, defaultActive? | Yes | Yes |
start_studio_discovery | Ask for one server folder's tool discovery now, whatever its sync schedule says. | server | Yes | No |
start_studio_listing | Ask one machine in a Studio draft's source.machines to start the draft's server, pinned, and list its tools. | server, revision, pin? | Yes | Yes |
try_studio_tool | Send one call to one tool in a Studio server folder, against one of its environments, after the workspace's policies and kill switches allow it. | server, tool, environment, arguments, agent? | Yes | No |
Tool search
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
load_tools | Return the full definitions of capabilities the in-app agent may call, by name: description, input schema and the governance facts a caller plans by. | names | No | No |
search_tools | Rank-search the capabilities the in-app agent may call and the workspace's runs, agents and pending approvals from one index; at most eight rows with ids the caller navigates from. | query?, kinds? | No | No |
Toolbelts
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
clone_toolbelt | Copy a toolbelt into a new belt you can edit: every tool the source holds, each active as it is in the source. | toolbeltId, name, slug?, description? | Yes | Yes |
delete_toolbelt | Delete a custom toolbelt that no live agent carries. | toolbeltId | Yes | Yes |
get_toolbelt | Read one toolbelt with every tool in the workspace grouped by server: whether the belt holds each server and tool, whether each tool is active in the belt, and whether an owner or admin made it available. | toolbeltId | No | No |
list_toolbelts | List the workspace's toolbelts, its All tools belt first, with each belt's tool, active tool, server and agent counts, and how many tools the workspace has made available. | None | No | No |
update_toolbelt | Rename a custom toolbelt and edit its tools: remove or add a server, or turn a server or a single tool on or off in the belt. | toolbeltId, name?, description?, changes? | Yes | Yes |
Work items
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
claim_work_criterion | Claim, as the agent working a send, that one criterion of the brief is met on the pull request's head commit. | item_id, work_order_id, criterion_id, head_sha, text | Yes | No |
create_work_item | Enter a work item by hand: a subject, an optional description, labels and kind, and the repository it belongs to. | subject, description?, labels?, repository?, workstream?, idempotency_key?, kind?, assignee_member_id?, status?, priority?, mention_lineages?, attachment_ids? | Yes | Yes |
get_work_autonomy | Read the workspace's autonomy scopes from work/work.toml, each with its level, operator, daily limit, and sample rate. | None | No | No |
get_work_fields | Read the statuses, resolutions, and Priority and Type labels a work item takes, with the GitHub value and each other tracker's value the workspace maps to each one. | None | No | No |
get_work_item | Read one work item with its source revisions, triage, brief revisions, sends, pull request checks, acceptance, cost, and history. | item | No | No |
get_work_priorities | Read the priorities record triage ranks work by: its record ID, version, hash, and numbered rules, with triage's suggestions, corrections, and failures in the last 30 days. | None | No | No |
link_run_work_items | Link the run making this call to work items after asking its operator. | items, primary?, confirmed?, via? | Yes | No |
list_run_link_suggestions | List the run and work item links waiting for a person, newest first: open suggestions, and links a rule made that nobody has kept or rejected. | run_id?, item?, operator_id?, evidence?, automatic?, limit?, cursor? | No | No |
list_work_collectors | List the workspace's work collectors with their repositories, health, last good read, failed reconciles in a row, and next check. | None | No | No |
list_work_items | List the workspace's work items with each one's state, what it waits for, its latest send and required checks, and what its runs cost. | status?, limit?, excerpt?, query?, assignee? | No | No |
recommend_staffing | Recommend the model tier and effort for one work item from the record: the pair similar runs in the last 30 days ran on, why, the median recorded cost, and a lighter choice with how often runs on it met their checks. | item | No | No |
review_run_link | Confirm, reject, or remove one run's link to one work item. | run_id, item, verdict, note? | Yes | No |
revise_work_triage | Correct a work item's triage suggestion (priority, estimate, labels, predicted paths, acceptance criteria, model tier, effort) or its outcome. | item_id, expected_version, reason, priority?, estimate_minutes?, labels?, claims?, criteria?, model_tier?, effort?, outcome?, duplicate_of? | Yes | No |
search_work_items | Search the workspace's work items by meaning and by words, best match first, with each item's score and the query words it holds. | query, states?, repository?, limit? | No | No |
update_work_item | Edit a work item a person entered in Oxagen: its subject, description, labels, kind, repository, assignee or priority. | item_id, expected_version, subject?, description?, labels?, kind?, repository?, assignee_member_id?, priority?, mention_lineages?, attachment_ids? | Yes | Yes |
Workspaces
| Tool | What it does | Inputs | Writes | Approval |
|---|---|---|---|---|
add_workspace_member | Add a member of the organization to this workspace as Admin or Member. | userId, role? | Yes | Yes |
answer_join_request | Approve a request to join this workspace as Member or Admin, or decline it with an optional reason. | requestId, answer, role?, reason? | Yes | Yes |
archive_workspace | Archive a workspace: it leaves the workspace lists, its slug stays taken and everything recorded in it stays readable. | workspaceId | Yes | Yes |
create_workspace | Create a workspace within the active tenant and start provisioning its private steering repo. | name, slug, mainRepo?, repositories?, steeringRepo? | Yes | Yes |
get_gateway_settings | Read the active workspace's agent gateway settings: the collection level, the policy mode its hosts run and how many run Enforce, the minimum containment tier, whether oxagen must hold the model keys, prompt redaction, the sensitive data screen, the trace drain collector, the budget breach action, the longest pause a replay plays, and how long run logs and audit records are kept. | None | No | No |
get_model_settings | Read the workspace-level model defaults (text tier and model) | None | No | No |
get_my_join_request | Read your own request to join a workspace: the open one, or the latest decline while you wait to ask again. | workspaceId | No | No |
get_prompt_settings | Read the workspace prompt configuration: appended instructions and content-prompt overrides. | None | No | No |
get_steering_settings | Read a workspace's steering settings that save at once (the volatile steering budget, the workspace instructions, and the promotion threshold), and the open steering PRs that change its governance.toml settings. | None | No | No |
get_workspace_settings | Read the active workspace's general settings: name, slug, description, avatar, the effective consequence-role map for mandates, the two steering-freshness gates, the run summaries mode, the command reasons mode, the daily model budgets, and the run link thresholds. | None | No | No |
list_join_requests | List the open requests to join this workspace, oldest first, with each person and their note. | None | No | No |
list_workspaces | List the workspaces inside an organization the authenticated user belongs to. | orgSlug, includeArchived? | No | No |
remove_workspace_member | Remove a person from this workspace. | userId | Yes | Yes |
request_to_join_workspace | Ask to join a workspace you hold no role in, with an optional note. | workspaceId, note? | Yes | No |
send_workspace_invite | Invite a person by email to the organization, or, with a workspace role, to this workspace. | email, role?, message?, workspace_role? | Yes | Yes |
set_governance_mode | Set the steering governance mode of a workspace by writing its governance file: the mode key of steering/governance.toml in a steering repository, or .oxagen/rules/governance.toml in a legacy one. | workspaceId?, mode, applyImmediately? | Yes | Yes |
set_steering_settings | Change a workspace's steering settings. | reviewers?, alwaysOnTokens?, memoryBatchSize?, memoryRetireAfterDays?, memoryHalfLifeDays?, unreviewedPromotionMerges?, ledgerRotation?, volatileSteeringTokens?, instructions?, promotionThresholdRuns? | Yes | Yes |
set_workspace_member_role | Change a person's role in this workspace to Admin or Member. | userId, role | Yes | Yes |
update_gateway_settings | Update the active workspace's agent gateway settings (partial): the collection level, the policy mode every host in the workspace runs, the minimum containment tier, whether oxagen must hold the model keys, prompt redaction, the sensitive data screen, the trace drain collector, the budget breach action, and the longest pause a replay plays. | collectionLevel?, enforceMode?, minTier?, keysHeld?, promptRedaction?, sensitiveScreen?, traceDrainEndpoint?, breachAction?, replayIdleSeconds? | Yes | Yes |
update_model_settings | Update the workspace-level model defaults (partial update: only the fields you provide change). | defaultTextTier?, defaultTextModel? | Yes | No |
update_prompt_settings | Update the workspace prompt configuration (partial). | additionalInstructions?, overrides? | Yes | No |
update_workspace_settings | Update a workspace's general settings (partial): name, slug, description, avatar, the consequence-role overrides for mandates, the two steering-freshness gates, the run summaries mode, the command reasons mode, the daily model budgets, and the run link thresholds. | workspaceId?, name?, slug?, description?, avatarUrl?, consequenceRoles?, steering?, runSummaries?, runEnrichmentEnabled?, commandReasons?, dailyBudgetUsd?, runLinks? | Yes | No |
withdraw_join_request | Withdraw your own open request to join a workspace. | requestId | Yes | No |
Connecting to the MCP server
How to connect Claude Code, Cursor, Claude Desktop, and other MCP clients to the Oxagen MCP server.
External MCP servers
Add external MCP servers and APIs to a workspace, such as GitHub, Linear, and internal tools, so its agents can call their tools and a rule answers each call.