Tool catalog
Every MCP tool your agent can call, grouped by the scope that unlocks it. This page is generated from the live scope definitions, so it never drifts from what the server actually exposes.
Scope names follow a <resource>:<action> convention. A key only sees the tools whose scope it carries (plus me_profile, which is scope-free). The human role behind the key is still enforced on top — a member-role key holding users:write still can't invite users. For the persona bundles and the role ceiling above all of this, see Capabilities.
audit:readcategories:readCovers both the FinancialUpdate surface (encrypted HTML reports) and the KPI surface (structured time-series metrics). A single scope for all financial data — matches the capabilities docs at /docs/agents/capabilities.
financials:readfinancials:writeWebhook ingestion for KPI period values. Separate from financials:write because the webhook is a transport channel — narrow it down so a sync agent can push values without inheriting full KPI write rights.
kpis:webhookmeetings:readmeetings:writenotifications:readnotifications:writeresolutions:readresolutions:voteresolutions:writesearch:readBoard updates / reports
updates:readupdates:writeRole check still applies — a MEMBER key can read users but cannot invite, regardless of this scope
users:readusers:writeusers:manageme_profile needs no scope — it's an identity-only call that works on any valid key, so it isn't listed above. And kpis:webhook isn't an MCP tool at all: it unlocks the REST endpoint POST /api/kpis/webhook for KPI-sync connectors. The kpis_webhook_ingest name is just how that scope appears in the catalog.
Each tool validates its inputs strictly (unknown arguments are rejected), and read/list tools return structured, paginated results. Once connected, ask your agent to call me_profile first to confirm the key works. Not connected yet? Start at Quick start.