MCP Tools Reference

A regular customer session exposes 131 MCP tools. Every name below is checked against the generated public count. Use the standard MCP tools/list request for current input schemas. The catalog is grouped by domain.

Connect

STACK's MCP server speaks Streamable HTTP. Use MCP Setup for client commands and OAuth steps.

Live schema discovery

For parameter shapes, return values, and descriptions, query the server directly. The MCP handshake returns every tool's JSON-schema input definition, so your client (or the LLM driving it) receives the current schema.

// MCP JSON-RPC request
{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }

// Response (abridged) - one entry per tool
{
  "tools": [
    {
      "name": "stack_issue_passport",
      "description": "Issue a signed JWT Passport for one live Mission.",
      "inputSchema": {
        "type": "object",
        "properties": {
          "agent_id": { "type": "string" },
          "mission_ids": { "type": "array", "items": { "type": "string" } },
          "intent_summary": { "type": "string" },
          "intent_services": { "type": "array" },
          "ttl_seconds": { "type": "number" }
        },
        "required": ["agent_id", "mission_ids"]
      }
    }
    // …
  ]
}

Tool annotations

Every tool in tools/list carries a human-readable title and three explicit boolean hints, so a client can decide which calls need confirmation.

• readOnlyHint is true only when the tool changes nothing. Tools that meter, persist or create state are not read-only, including stack_scan, stack_verify_connection, stack_simulate_intent and stack_fleet_enrollment_challenge.
• destructiveHint is true when the tool revokes, deletes, disconnects, expires, collects, suspends, blocks or ends something, or overwrites or resets existing configuration.
• openWorldHint is true when the tool reaches a party outside your STACK account: a provider API, an email, SMS or webhook recipient, an identity provider, or the shared skills marketplace.

Directory endpoint

https://mcp.getstack.run/directory serves the tool set listed in the Claude and ChatGPT connector directories. It is the catalog above without the tools that execute arbitrary provider requests, move wallet funds, handle credentials or verification codes, take or return Passport tokens, or require an agent or platform-staff session:

• Provider execution: stack_proxy_request, stack_get_proxy_operation.
• Wallet and paid skill invocation: stack_invoke_skill, stack_check_invocation, stack_list_pending_invocations, stack_complete_invocation, stack_fail_invocation.
• Credentials and one-time codes: stack_connect_service, stack_list_credential_templates, stack_send_verification_code, stack_verify_delivery_method.
• Scopes withheld from directory sign-in because they also authorize unapproved administration: team (stack_invite_member, stack_update_member, stack_revoke_member), identity configuration (stack_start_identity_verification, stack_revoke_identity_claim), authority (stack_request_authority), marketplace publishing (stack_publish_skill, stack_suspend_skill, stack_activate_skill) and partner administration (stack_partner_create_tenant, stack_partner_revoke_tenant, stack_partner_create_tenant_webhook, stack_partner_revoke_connection).
• Passport tokens as input or output: stack_issue_passport, stack_start_mission, stack_partner_issue_tenant_passport, stack_verify_passport, stack_refresh_passport, stack_delegate_passport, stack_simulate_intent, stack_submit_intent.
• Agent-session only: stack_renew_mission, stack_fleet_enrollment_challenge, stack_enroll_fleet_agent.

Directory tool schemas omit the optional passport_token parameter. A directory sign-in requests every scope these tools need, so no directory tool needs a second authorization. stack_add_delivery_method returns a masked hint of a webhook signing secret, never the secret. The full catalog remains at https://mcp.getstack.run/mcp.

Common flows

These examples cover common calls. They assume an authenticated OAuth session or a valid headless API key.

Issue a passport with declared intent

Every Passport is issued for exactly one live Mission. Open the Mission for the agent with stack_open_mission, then pass its ID in mission_ids. stack_start_mission does both in one call. Declaring intent is required for enforced and logged agents; omitting it throws ACCOUNTABILITY_REQUIRED.

{
  "method": "tools/call",
  "params": {
    "name": "stack_open_mission",
    "arguments": {
      "agent_id": "agt_support_bot",
      "intent_summary": "Answer one customer ticket and post a resolution",
      "intent_services": ["slack", "github"]
    }
  }
}

// Returns { "mission_id": "ms_...", "claim_id": "...", "expires_at": "..." }

{
  "method": "tools/call",
  "params": {
    "name": "stack_issue_passport",
    "arguments": {
      "agent_id": "agt_support_bot",
      "mission_ids": ["ms_..."],
      "intent_summary": "Answer one customer ticket and post a resolution",
      "intent_services": ["slack", "github"],
      "will_delegate": false,
      "checkpoint_interval": "5m"
    }
  }
}

Completing or revoking the Mission revokes every Passport bound to it.

Grant a service with a named intent

Use an intent shortcut instead of hand-authoring constraints. The server expands the intent to the equivalent constraint array at grant time.

{
  "method": "tools/call",
  "params": {
    "name": "stack_grant_agent_access",
    "arguments": {
      "agent_id": "agt_support_bot",
      "service_connection_id": "scon_slack_prod",
      "scopes": ["chat:write"],
      "intents": [
        { "name": "slack.post_to_channel",
          "params": { "channel": ["C0123", "C0456"] } }
      ]
    }
  }
}

Catalog: call stack_list_intents or read/docs/concepts/intents.

Proxy an outbound HTTP call

Route each outbound call that STACK should govern through stack_proxy_request with the Passport's X-Passport-Token. The proxy verifies, enforces scope + constraints, injects the credential, and returns the final screened response. For a write, create and persist a stable authority_request_id before the tool call.

{
  "method": "tools/call",
  "params": {
    "name": "stack_proxy_request",
    "arguments": {
      "passport_token": "eyJhbGciOi...",
      "authority_request_id": "op_job_4821_slack_0001",
      "service": "slack",
      "method": "POST",
      "url": "https://slack.com/api/chat.postMessage",
      "body": { "channel": "C0123", "text": "Ticket #1234 resolved" }
    }
  }
}

Reuse that operation ID only when every request field is unchanged. If the caller loses the response, use stack_get_proxy_operation to read its state or the stored permitted response. A generic unknown outcome is not sent again automatically. Full contract: Proxy operation recovery.

Submit a checkpoint (enforced mode)

The response can include new_expires_at for the stored monitoring deadline. The checkpoint does not change the signed JWT expiry or return a new token.

{
  "method": "tools/call",
  "params": {
    "name": "stack_checkpoint",
    "arguments": {
      "passport_jti": "pp_8f3a",
      "services_used": ["slack", "github"],
      "actions_count": 7,
      "summary": "Replied to ticket #1234; opened PR #502"
    }
  }
}

Check out the Passport and trigger review

Mission completion does not submit this checkout.

{
  "method": "tools/call",
  "params": {
    "name": "stack_checkout",
    "arguments": {
      "passport_jti": "pp_8f3a",
      "services_used": ["slack", "github"],
      "actions_count": 12,
      "summary": "Resolution delivered to customer; PR merged"
    }
  }
}

Revoke a passport and cascade

Single-Passport revocation revokes the JTI and each active delegated child. The next STACK-verified call rejects a revoked Passport. The revocation event channel is internal.

{
  "method": "tools/call",
  "params": {
    "name": "stack_revoke_passport",
    "arguments": { "jti": "pp_8f3a", "reason": "Rotation" }
  }
}

Invoke a skill

{
  "method": "tools/call",
  "params": {
    "name": "stack_invoke_skill",
    "arguments": {
      "skill_id": "skl_refund_calculator",
      "passport_id": "pp_8f3a",
      "input": { "order_id": "ord_123", "customer_tier": "gold" }
    }
  }
}

Sealed skills return synchronously. Open skills return apending status; pollstack_check_invocation until completed.

Deposit and collect a drop-off

// Producer
{ "method": "tools/call", "params": { "name": "stack_create_dropoff",
  "arguments": {
    "from_agent": "agt_producer", "to_agent": "agt_consumer",
    "schema": { "type": "object", "required": ["summary"] },
    "ttl_seconds": 1800
  }}}

{ "method": "tools/call", "params": { "name": "stack_deposit",
  "arguments": { "dropoff_id": "dof_abc", "agent_id": "agt_producer",
    "payload": { "summary": "…" } }}}

// Consumer
{ "method": "tools/call", "params": { "name": "stack_collect",
  "arguments": { "dropoff_id": "dof_abc", "agent_id": "agt_consumer" }}}

Full tool catalog

Every tool shipped, grouped by domain. Names are stable; calltools/list for the live schema.

Related

• /docs/concepts/passports - what a passport carries and how it verifies
• /docs/concepts/intents - named permission shortcuts used in grant and issue
• /docs/concepts/constraints - parameter-level scope enforced at the proxy
• /docs/concepts/revocation - single/bulk revoke and cascade behavior
• /docs/api/audit - audit export, chain-head, verify-chain
• /docs/api/billing - wallet, tier, overage