DOCS / MCP / TOOL REFERENCE
MCP Tools Reference
A regular customer session exposes 118 MCP tools. Every name below is checked against the generated public count. Use the standard MCP tools/list request for current input schemas. The catalog is grouped by domain.
MCP can request Authority and poll the result, but it cannot approve the request or manage principals, proofs, receivers, bindings, erasure, or presentation payloads. An owner or admin reviews the exact request in the Console and verifies through the configured identity provider. Agent contexts cannot widen Authority and never receive identity-provider evidence.
Connect
STACK's MCP server speaks Streamable HTTP. Use MCP Setup for client commands and OAuth steps.
Live schema discovery
For parameter shapes, return values, and descriptions, query the server directly. The MCP handshake returns every tool's JSON-schema input definition, so your client (or the LLM driving it) receives the current schema.
json
// MCP JSON-RPC request
{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }
// Response (abridged) - one entry per tool
{
"tools": [
{
"name": "stack_issue_passport",
"description": "Issue a signed JWT Passport. Enforced mode uses the checkpoint interval as TTL.",
"inputSchema": {
"type": "object",
"properties": {
"agent_id": { "type": "string" },
"intent": { "type": "object" },
"scopes": { "type": "array" },
"ttl_seconds": { "type": "number" }
},
"required": ["agent_id"]
}
}
// …
]
}Use the server's tools/list response for schemas. Catalog names are stable, but parameters can change.
Common flows
These examples cover common calls. They assume an authenticated OAuth session or a valid headless API key.
Issue a passport with declared intent
Mint a short-lived scoped credential for a mission. Declaringintent is required for enforced and logged agents; omitting it throws ACCOUNTABILITY_REQUIRED.
json
{
"method": "tools/call",
"params": {
"name": "stack_issue_passport",
"arguments": {
"agent_id": "agt_support_bot",
"intent": {
"summary": "Answer one customer ticket and post a resolution",
"services": ["slack", "github"],
"estimated_duration_seconds": 900,
"will_delegate": false
},
"ttl_seconds": 900
}
}
}Grant a service with a named intent
Use an intent shortcut instead of hand-authoring constraints. The server expands the intent to the equivalent constraint array at grant time.
json
{
"method": "tools/call",
"params": {
"name": "stack_grant_agent_access",
"arguments": {
"agent_id": "agt_support_bot",
"service_connection_id": "scon_slack_prod",
"scopes": ["chat:write"],
"intents": [
{ "name": "slack.post_to_channel",
"params": { "channel": ["C0123", "C0456"] } }
]
}
}
}Catalog: call stack_list_intents or read/docs/concepts/intents.
Proxy an outbound HTTP call
Route each outbound call that STACK should govern through stack_proxy_request with the Passport's X-Passport-Token. The proxy verifies, enforces scope + constraints, injects the credential, and returns the upstream response.
json
{
"method": "tools/call",
"params": {
"name": "stack_proxy_request",
"arguments": {
"passport_token": "eyJhbGciOi...",
"service": "slack",
"method": "POST",
"url": "https://slack.com/api/chat.postMessage",
"body": { "channel": "C0123", "text": "Ticket #1234 resolved" }
}
}
}Submit a checkpoint (enforced mode)
The response can include new_expires_at for the stored monitoring deadline. The checkpoint does not change the signed JWT expiry or return a new token.
json
{
"method": "tools/call",
"params": {
"name": "stack_checkpoint",
"arguments": {
"passport_jti": "pp_8f3a",
"services_used": ["slack", "github"],
"actions_count": 7,
"summary": "Replied to ticket #1234; opened PR #502"
}
}
}Check out the Passport and trigger review
Mission completion does not submit this checkout.
json
{
"method": "tools/call",
"params": {
"name": "stack_checkout",
"arguments": {
"passport_jti": "pp_8f3a",
"services_used": ["slack", "github"],
"actions_count": 12,
"summary": "Resolution delivered to customer; PR merged"
}
}
}Revoke a passport and cascade
Single-Passport revocation revokes the JTI and each active delegated child. The next STACK-verified call rejects a revoked Passport. The revocation event channel is internal.
json
{
"method": "tools/call",
"params": {
"name": "stack_revoke_passport",
"arguments": { "jti": "pp_8f3a", "reason": "Rotation" }
}
}Invoke a skill
json
{
"method": "tools/call",
"params": {
"name": "stack_invoke_skill",
"arguments": {
"skill_id": "skl_refund_calculator",
"passport_id": "pp_8f3a",
"input": { "order_id": "ord_123", "customer_tier": "gold" }
}
}
}Sealed skills return synchronously. Open skills return apending status; pollstack_check_invocation until completed.
Deposit and collect a drop-off
json
// Producer
{ "method": "tools/call", "params": { "name": "stack_create_dropoff",
"arguments": {
"from_agent_id": "agt_producer", "to_agent_id": "agt_consumer",
"schema": { "type": "object", "required": ["summary"] },
"ttl_seconds": 1800
}}}
{ "method": "tools/call", "params": { "name": "stack_deposit",
"arguments": { "dropoff_id": "dof_abc", "agent_id": "agt_producer",
"payload": { "summary": "…" } }}}
// Consumer
{ "method": "tools/call", "params": { "name": "stack_collect",
"arguments": { "dropoff_id": "dof_abc", "agent_id": "agt_consumer" }}}Full tool catalog
Every tool shipped, grouped by domain. Names are stable; calltools/list for the live schema.
Agents
stack_register_agentRegister a new agent with STACK. Returns agent ID and status. Set credential_access (proxy_only = never sees raw secrets) and key_mode (stack_managed default, auto-provisioned).stack_update_agentUpdate an agent's settings after creation: credential_access, accountability_mode, on_warning/on_critical, skill access, or suspend/reactivate. key_mode is immutable.stack_list_agentsList all registered agents for your account.stack_unblock_agentClear an agent's passport_blocked state (after an auto-block from a critical security event) so it can issue passports again. Governance step-up: without governance_approval_id the call returns 403 GOVERNANCE_APPROVAL_REQUIRED with an approval id (gvr_*); a human approves at /governance/approvals, then retry the same call passing governance_approval_id.stack_allow_skillAdd a skill to an agent's allowed_skills list (idempotent). Enforced when agent.skill_access_mode is "custom".stack_disallow_skillRemove a skill from an agent's allowed_skills list (idempotent).Services & Credentials
stack_connect_serviceConnect an external service (Slack, GitHub, Notion, etc.) via OAuth.stack_list_servicesList all available services in the catalog that can be connected (providers, not your connected instances).stack_list_connected_servicesList your connected service instances with each connection's id, provider, status, and stored scopes.stack_disconnect_serviceDisconnect one service connection and revoke dependent Passports.stack_grant_agent_accessGrant an agent access to a connected service with scopes, constraints, and permitted data sources. Adding a new source requires exact human approval before retry.stack_list_intentsList available named intents (e.g. "slack.post_to_channel") that expand to parameter-level constraints in grants and passports.stack_revoke_agent_accessRevoke all service access for an agent.stack_get_agent_permissionsGet all service permissions granted to an agent.stack_list_credential_templatesList available credential templates for manual service connections.stack_verify_connectionVerify a service connection is healthy by testing its credentials.Passports
stack_issue_passportIssue a signed JWT Passport. Enforced mode uses the checkpoint interval as TTL. Other modes default to 15 minutes. The hard maximum is 1 hour.stack_verify_passportVerify a passport token is valid, not expired, and not revoked.stack_refresh_passportRefresh a passport before or after expiry (within 24h). Preserves session and delegation chain.stack_delegate_passportDelegate a Passport to a child agent. Authority and TTL only narrow.stack_list_active_passportsList all active (non-expired, non-revoked) passports. Filter by agent or session.stack_revoke_passportRevoke a specific Passport by JTI. The next STACK-verified call rejects it.stack_revoke_agent_passportsRevoke ALL active passports for a specific agent.stack_revoke_sessionRevoke an entire session chain -- root passport and all delegated passports.stack_revoke_all_passportsEMERGENCY: Revoke ALL active passports across all agents. Requires confirm: true.Accountability
stack_checkpointSubmit a progress checkpoint for an enforced or logged Passport. Reports services used and actions taken.stack_checkoutSubmit the final Passport report. Triggers the review engine. Mission completion is separate.stack_get_passport_reportGet full accountability report: intent, checkpoints, checkout, and review decision.stack_list_pending_reviewsList flagged or blocked passport checkouts pending operator review.stack_decide_reviewApprove or block a flagged passport checkout. Can block agent from future passports. decision=approved requires a governance step-up: the first call returns 403 GOVERNANCE_APPROVAL_REQUIRED with an approval id (gvr_*); after a human approves in the dashboard, retry with governance_approval_id. decision=blocked never steps up.Drop-offs
stack_create_dropoffCreate a point-to-point drop-off between two agents with schema validation and TTL.stack_depositDeposit a package into a drop-off. Validates against declared schema, encrypts at rest.stack_collectCollect a package from a drop-off. Decrypts and returns data, then deletes from storage.stack_get_dropoff_statusGet current status of a drop-off (created, deposited, collected, expired, failed).stack_list_dropoffsList all drop-offs for your account, ordered by creation date.stack_expire_dropoffManually expire a drop-off and permanently delete its package.Skills
stack_publish_skillPublish a skill to the marketplace. Supports open, sealed, and source execution modes.stack_browse_skillsBrowse the skills marketplace with filters for trust level, tags, and search.stack_get_skillGet details of a specific skill including input/output schemas.stack_suspend_skillSuspend one of your published skills.stack_activate_skillReturn one of your suspended skills to active status.stack_invoke_skillInvoke a skill with input data. Paid skills debit the caller's STACK wallet. Poll stack_check_invocation for result.stack_check_invocationCheck invocation status. Returns decrypted output when completed.stack_list_pending_invocationsList pending invocations for skills you provide. Poll this for work.stack_complete_invocationComplete a skill invocation by submitting schema-validated, encrypted output.stack_fail_invocationMark a claimed open-skill invocation as failed and release its reserved payment.stack_check_trust_levelCheck if your trust level meets a skill's requirements. Returns upgrade guidance.stack_list_favorite_skillsList your saved/favorite skills for quick access.stack_post_skill_requestPost a request for a skill capability you need. Other operators can discover it and build matching skills.stack_list_skill_requestsBrowse open skill requests from other operators.stack_find_matching_skillsFind skills that match a specific skill request.stack_suggest_skill_compositionGet suggestions for combining multiple skills to fulfill a complex request. Returns chain suggestions.Team
stack_invite_memberInvite a team member by email with a role and optional connection restrictions.stack_list_membersList all team members and their statuses.stack_revoke_memberRevoke a team member and end their access.stack_update_memberUpdate a member's role or allowed connections.Identity Settings
stack_get_identity_settingsGet identity security settings: claim TTL, inheritance mode, auto-revoke.stack_list_identity_providersList identity providers and their configured status.stack_start_identity_verificationStart a configured identity-provider flow. Returns only the session reference, provider URL or QR data, and expiry; identity documents and proof material stay outside MCP.stack_list_identity_claimsList the operator identity claims visible to this session.stack_revoke_identity_claimRevoke one identity claim and cascade to Passports that carry it.Missions
stack_open_missionOpen a bounded Mission with purpose, service scope, counterparties, and optional caps.stack_complete_missionComplete a Mission and attach its terminal output.stack_revoke_missionRevoke a Mission and apply its configured Passport cascade.stack_get_missionGet one Mission with current cap usage.stack_list_missionsList Missions for the operator.Authority Requests
stack_request_authorityCreate a pending request for one exact agent job and return the human approval URL. This does not grant access.stack_get_authority_requestCheck whether the request is pending, rejected, expired, or completed. Completed requests return the opaque binding reference.Proxy
stack_proxy_requestSend a request through STACK's credential proxy. Agent never sees the secret. Available on every tier; one recorded action per call. Threads approval_id when the passport is enforced.stack_proxy_usageCheck monthly proxy usage and remaining quota.Usage & Billing
stack_usageOne-call rollup: all audit activity, the metered action subset against the plan, detail coverage, spend by bucket, wallet balance, and publisher earnings. All money is in cents. Defaults to the billing period; pass since/until (ISO-8601 or unix-ms) to scope the flow metrics to a window.Intents
stack_simulate_intentDry-run an Intent against a passport. Returns allowed + denial_reasons + diagnostics. Emits a signed intent_simulation claim.stack_submit_intentSubmit an Intent for operator approval. Required before enforced-mode producer calls. Returns approval_id; pair with stack_get_intent_approval to poll.stack_get_intent_approvalFetch an intent approval row by id. Returns terminal status (pending|approved|rejected|expired|consumed). Poll after stack_submit_intent.Content Scan
stack_scanScan retrieved content (email/document/webpage/API response) for prompt-injection markers BEFORE feeding to the LLM. Two-layer detector: L1 regex catalog + L2 encoding-aware normalization (base64/URL/hex/leetspeak/homoglyphs/zero-width/ROT13/reverse). Returns verdict + match details.stack_scan_usageCheck monthly /v1/scan usage and remaining quota.Security Events
stack_list_security_eventsList unresolved security events (credential misuse, delegation violations, etc.).stack_get_security_eventGet one security event by ID.PII Redaction Config
stack_get_pii_configThreshold and country scope in force for the LLM gateway. Never 404s.stack_set_pii_configTune the confidence needed to redact, and which countries’ identifier schemes to run. Higher threshold redacts less.stack_reset_pii_configBack to built-in defaults. Always needs a human governance approval.Detector Customization
stack_list_detector_configsList every per-detector customization this operator has set. Empty list means defaults.stack_get_detector_configGet a single detector's config. 404 means defaults.stack_upsert_detector_configCustomize a detector for your traffic — custom regex, whitelist suppression, severity overrides, master switch. Pro and above. Writes are direction-classified: tightening applies immediately; a LOOSENING or MIXED delta returns 403 GOVERNANCE_APPROVAL_REQUIRED with an approval id (gvr_*) — a human approves at /governance/approvals, then retry with governance_approval_id.stack_reset_detector_configReset a detector to built-in defaults — deletes the customization row. Pro and above. Always requires a governance step-up (reset direction is unknowable): first call returns 403 with an approval id, retry with governance_approval_id after a human approves in the dashboard.Audit
stack_audit_listTail recent audit log entries — newest-first. Filter by agent_id or passport_jti; pass since (epoch ms) for incremental polling. Cascade revokes show as one passport.revoke + one passport.revoke_cascade per child.stack_audit_chain_headReturn the latest entry hash + total entry count. Anchor externally to prove later that no row was rewritten.stack_audit_verify_chainWalk the chain and verify cryptographic integrity. Reports first_break with reason on failure.Mission Evidence
stack_view_mission_activityView the current recorded mission events in time order. This is a live view and not a stored file.stack_list_mission_operator_reviewsList signed Operator review revisions. Old dossier claims remain readable.stack_export_signed_recordCreate one immutable Signed record with the mission claims and verification material available at export time.stack_list_signed_recordsList Signed records, with an optional mission, session, incident, or period scope.stack_get_signed_recordGet one Signed record receipt and its parsed signed claim.Partner — Connect with STACK
stack_partner_list_connectionsList every Connect-with-STACK grant your partner operator holds (all statuses). Never returns tokens.stack_partner_get_connectionGet one grant by grant_id (pgr_*). Returns status, scopes, allowed_providers, timestamps - never the token.stack_partner_revoke_connectionRevoke a grant. Grant-created agents' Passports revoke, webhooks return 404, connections disconnect, and the token fails on its next request. Returns cascade counts.stack_partner_create_tenantCreates an isolated child operator and returns its operator ID. Credentials and signing setup use authenticated REST or SDK calls outside assistant conversations.stack_partner_list_tenantsLegacy tenant operation. Lists tenant metadata and aggregate counters without tenant audit content.stack_partner_get_tenantLegacy tenant operation. Returns one tenant's metadata, status, and counters.stack_partner_revoke_tenantLegacy tenant operation. Revokes a tenant and cascades revocation to its webhooks and Passports.stack_partner_create_tenant_webhookLegacy tenant operation. Returns a webhook URL and metadata. A partner owner/admin configures signing through REST or SDK; MCP never returns signing secrets.stack_partner_issue_tenant_passportLegacy tenant operation. Issues a Passport for outbound MIME stamping. New integrations issue through POST /v1/passports/issue under a grant.LLM Usage
stack_llm_usage_listList cursor-paginated LLM calls with provider, payer, token, cost, fee, hold, and Mission fields.stack_llm_usage_summarySummarize LLM use by day, surface, payer, provider, and optional model.Inbound Webhooks
stack_create_inbound_webhookCreate a signed inbound endpoint. Agent-bearing contexts cannot nominate a forward URL.stack_list_inbound_webhooksList inbound webhook endpoints for this operator or grant.stack_get_inbound_webhookGet one inbound endpoint, its signing setup status and counters. Provider secrets are configured through the owner/admin API or SDK.stack_revoke_inbound_webhookRevoke an inbound endpoint.Notifications
stack_add_delivery_methodAdd a notification delivery method (email, SMS, or webhook).stack_list_delivery_methodsList all configured notification delivery methods.stack_delete_delivery_methodDelete a delivery method. Cascades to associated rules.stack_send_verification_codeSend a verification code to a pending delivery method.stack_verify_delivery_methodVerify a delivery method with a 6-digit code.stack_test_delivery_methodSend a test notification to a verified delivery method.stack_create_notification_ruleCreate a rule targeting delivery methods for specific event types and severities.stack_list_notification_rulesList all notification rules with their associated delivery methods.stack_update_notification_ruleUpdate a notification rule -- change delivery methods, events, or severity.stack_delete_notification_ruleDelete a notification rule.Related
- /docs/concepts/passports - what a passport carries and how it verifies
- /docs/concepts/intents - named permission shortcuts used in grant and issue
- /docs/concepts/constraints - parameter-level scope enforced at the proxy
- /docs/concepts/revocation - single/bulk revoke and cascade behavior
- /docs/api/audit - audit export, chain-head, verify-chain
- /docs/api/billing - wallet, tier, overage