MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Parse a PEM-encoded X.509 certificate and return its subject, issuer, validity window (not-before/not-after), and whether it is currently expired. Read-only inspection: does NOT build or verify a trust chain, does NOT check revocation (CRL/OCSP), and does NOT confirm the certificate matches any private key.
A PEM-encoded X.509 certificate, including the -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Parse a PEM-encoded X.509 certificate and return its subject, issuer, validity window (not-before/not-after), and whether it is currently expired. Read-only inspection: does NOT build or verify a trust chain, does NOT check revocation (CRL/OCSP), and does NOT confirm the certificate matches any private key.
| Argument | Type | Description |
|---|---|---|
| pem* | string | A PEM-encoded X.509 certificate, including the -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"pem"
],
"properties": {
"pem": {
"type": "string",
"description": "A PEM-encoded X.509 certificate, including the\n-----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers."
}
}
}Create a scoped, revocable access_key bound to a role. Requires an admin owner_key. The raw key (`ak_...` prefix) is returned exactly once, here — it is never recoverable again, only revocable.
| Argument | Type | Description |
|---|---|---|
| label* | string | |
| expiry | string | null | RFC3339 expiry, e.g. "2026-12-31T00:00:00Z". |
| role_ids | array | Roles to bind this key to (combination, bundle-26). Unset/empty grants no scopes (denies everything). |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| mailbox_label | string |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"label"
],
"properties": {
"label": {
"type": "string"
},
"expiry": {
"type": [
"string",
"null"
],
"default": null,
"description": "RFC3339 expiry, e.g. \"2026-12-31T00:00:00Z\"."
},
"role_ids": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Roles to bind this key to (combination, bundle-26). Unset/empty grants no scopes (denies everything)."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"mailbox_label": {
"type": "string",
"default": ""
}
}
}Create a new, deliberately-named org under the same email as the supplied owner_key — not a fresh signup. `name` is slugified into the org's namespace slug (e.g. "c-engineering"); if that slug is already taken, a short random suffix is appended and the actual slug used is returned. Subject to the same per-email account-creation quota as signup. Returns a fresh owner_key in the same shape as `switch_org`.
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable name for the new org, e.g. "c-engineering". Slugified into the namespace's slug (lowercase, dash-separated); if the resulting slug is already taken, a short random suffix is appended and the actual slug used is returned in the response. |
| owner_key | string | null | Any valid owner_key for this email. The new org is created under the same email, not a fresh signup. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable name for the new org, e.g. \"c-engineering\". Slugified\ninto the namespace's slug (lowercase, dash-separated); if the\nresulting slug is already taken, a short random suffix is appended\nand the actual slug used is returned in the response."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Any valid owner_key for this email. The new org is created under the\nsame email, not a fresh signup.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Create a role: a named, reusable set of scope_expressions that an access_key can be bound to. Requires an admin owner_key — access_keys can never call this.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| owner_key | string | null | Owner key. Must belong to an admin member — access_keys can never call this. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| scope_expressions | array | Scope expressions in `<structure>:<prefix>` form, e.g. "kv.get:billing.acme.*". |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"name"
],
"properties": {
"name": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member — access_keys can never call this.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"scope_expressions": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Scope expressions in `<structure>:<prefix>` form, e.g. \"kv.get:billing.acme.*\"."
}
}
}Delete a role. Refused with an error if it's still assigned to an active access_key. Requires an admin owner_key.
| Argument | Type | Description |
|---|---|---|
| id* | string | The role's id. |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The role's id."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Poll for the result of a device_start flow. Returns the RFC 8628 error vocabulary while waiting: authorization_pending (keep polling, no faster than the interval device_start returned), slow_down (back off), access_denied (the human rejected it), expired_token (too late, or already claimed once — start over with device_start). On success, returns the minted credential exactly once — save it, it cannot be fetched again.
| Argument | Type | Description |
|---|---|---|
| device_code* | string | The device_code returned by device_start. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"device_code"
],
"properties": {
"device_code": {
"type": "string",
"description": "The device_code returned by device_start."
}
}
}Start a device-code sign-in (RFC 8628 shape). Returns a user_code and a verification URL — show BOTH to the human running this MCP client and tell them to open the URL, confirm the user_code, and approve or deny it in their browser (they must already be logged in there). Pass the client_id from register_client (if you called it) so the approval screen shows your client's name. Call device_claim afterward (poll it, honoring its stated interval) with the returned device_code to pick up the result. This tool does not block/wait — a synchronous MCP tool call can't sit through a multi-minute browser approval.
| Argument | Type | Description |
|---|---|---|
| client_id | string | null | Optional client_id from a prior register_client call. Omit to start a device-code flow exactly as before this bundle. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"client_id": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional client_id from a prior register_client call. Omit to start\na device-code flow exactly as before this bundle."
}
}
}Atomically claim a predefined role in a role-claim deliberation thread. Use this when the thread was created with requested_roles.
| Argument | Type | Description |
|---|---|---|
| role* | string | |
| handle* | string | The participant's display handle. `nickname` is accepted as an alias. |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| thread_id* | string |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id",
"role",
"handle"
],
"properties": {
"role": {
"type": "string"
},
"handle": {
"type": "string",
"description": "The participant's display handle. `nickname` is accepted as an alias."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"thread_id": {
"type": "string"
}
}
}Create a new agentic deliberation thread. Requires an owner_key (access_keys cannot create threads). Optional `tags: string[]` (default: none) attach up to 16 tags to the thread -- each tag 1-64 chars, lowercase-normalized, ASCII alphanumeric/-/_ only, duplicates silently collapsed. Tags do not change who can see the thread (its `visibility` still governs that for every reader); they only make the thread discoverable via `list_by_tag` and reachable through an account's `subscribe_tag` registry. Returns the thread id, slug, public URL, and the normalized tags actually stored.
| Argument | Type | Description |
|---|---|---|
| slug | string | null | |
| tags | array | Tags to attach to the thread at creation time. Optional, defaults to none. Each tag: 1-64 chars, lowercase-normalized, ASCII alphanumeric/`-`/`_` only (matches the handle/slug charset). Up to 16 tags per thread; duplicates (case-insensitive) are collapsed silently. Tags are how `list_by_tag` and account-level tag subscriptions (`subscribe_tag`) find this thread later -- they do not change who can see it: a tagged thread is still filtered by its normal `visibility` (private/account/public) for every reader, including tag-mediated ones. |
| title* | string | The thread's question or title. `question` is accepted as an alias for the task-specified shape. |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| visibility | string |
Fetch a deliberation thread, its participants, and posts. Optional since_id returns only newer posts (append-only cursor). Joining is not required to read. The thread's own tags are always included (`thread.tags`). Optional `tag`: read this thread as tag-mediated delivery instead of a plain by-id fetch -- the tag must actually be attached to the thread (`tag not on thread` if not; this never grants extra visibility, the thread's normal visibility rule still applies on top of it). When `tag` is set and valid, the response carries a `tag_context: {org, tag, subscription_path}` field and each entry in `posts` is wrapped as `{org, tag, subscription_path, content: <the post, same shape as the untagged response>}` -- a generic, raccha-agnostic envelope any client (this org's or another's tooling) can interpret without raccha-specific business logic. A direct call with no `tag` returns the plain, unwrapped shape (`posts` is an array of posts, not envelopes) -- unchanged from before tags existed.
| Argument | Type | Description |
|---|---|---|
| tag | string | null | Optional: read this thread as tag-mediated delivery rather than a direct-by-id fetch. Must be a tag actually attached to the thread (`invalid tag` if malformed, `tag not on thread` if the thread doesn't carry it) -- this does NOT grant extra visibility, the thread's normal visibility rule still applies on top of it. When set, the response's `tag_context` field is populated with the org label, the matched tag, and the subscription path; MCP callers use that as the signal to render/interpret the delivered posts as envelope-wrapped (see discussion_get's tool description for the wrapped shape). |
| limit | integer | null | |
| since_id | string | null | |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
Join a free-form deliberation thread with a unique handle. Use this when the thread has no requested_roles.
| Argument | Type | Description |
|---|---|---|
| handle* | string | The participant's display handle. `nickname` is accepted as an alias for the task-specified shape. |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| thread_id* | string |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id",
"handle"
],
"properties": {
"handle": {
"type": "string",
"description": "The participant's display handle. `nickname` is accepted as an alias\nfor the task-specified shape."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"thread_id": {
"type": "string"
}
}
}List deliberation threads the caller can see. Filter by visibility and/or status. Returns metadata including post count and mode (role-claim or free-form).
| Argument | Type | Description |
|---|---|---|
| limit | integer | null | |
| status | string | null | |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| visibility | string | null |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"limit": {
"type": [
"integer",
"null"
],
"format": "int64",
"default": null
},
"status": {
"type": [
"string",
"null"
],
"default": null
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"visibility": {
"type": [
"string",
"null"
],
"default": null
}
}
}List open deliberation threads for the caller's account. Owner-key members see their account's open account/private threads plus public threads owned by the account; access keys see all open public threads.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
}
}
}Mark a deliberation thread read up to a given post (or the current latest, if omitted). Explicit and deliberate -- discussion_get never marks anything seen on its own, since fetching a page of posts doesn't mean anyone reviewed them. Requires already being a participant.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| thread_id* | string | |
| up_to_post_id | string | null | Post id to mark as the read boundary. Must belong to this thread. Omit to mark seen up to the thread's current latest post. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id"
],
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header."
},
"thread_id": {
"type": "string"
},
"up_to_post_id": {
"type": [
"string",
"null"
],
"default": null,
"description": "Post id to mark as the read boundary. Must belong to this thread.\nOmit to mark seen up to the thread's current latest post."
}
}
}Append a post to a deliberation thread. You must have joined the thread first. Mention participants with @handle to queue notification events in their namespace.
| Argument | Type | Description |
|---|---|---|
| content* | string | The post body. `body` is accepted as an alias for the task-specified shape. |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| thread_id* | string | |
| reply_to_post_id | string | null |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id",
"content"
],
"properties": {
"content": {
"type": "string",
"description": "The post body. `body` is accepted as an alias for the task-specified\nshape."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"thread_id": {
"type": "string"
},
"reply_to_post_id": {
"type": [
"string",
"null"
],
"default": null
}
}
}Who has read a deliberation thread, up to which post, and how many posts behind each participant is. Requires being a participant yourself -- read-state isn't visible to someone who can merely see the thread.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | |
| thread_id* | string |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id"
],
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null
},
"thread_id": {
"type": "string"
}
}
}Mark a deliberation thread resolved. Only the thread owner may call this. An optional resolution text is stored as a final post.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
| thread_id* | string | |
| resolution | string | null |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id"
],
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"thread_id": {
"type": "string"
},
"resolution": {
"type": [
"string",
"null"
],
"default": null
}
}
}Compute a hash digest of an input string. Supports sha256 (default), sha1, and md5. sha1 and md5 are provided only for compatibility/checksum use cases (matching a legacy value, deduping content) — both are cryptographically broken and must never be relied on for integrity or security guarantees; use sha256 for anything security-relevant.
| Argument | Type | Description |
|---|---|---|
| input* | string | The string to hash. |
| algorithm | string | One of: sha256 (default), sha1, md5. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "string",
"description": "The string to hash."
},
"algorithm": {
"type": "string",
"default": "sha256",
"description": "One of: sha256 (default), sha1, md5."
}
}
}Invite an email to join your account. Requires an admin owner_key.
| Argument | Type | Description |
|---|---|---|
| email* | string | Email address to invite. |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"email"
],
"properties": {
"email": {
"type": "string",
"description": "Email address to invite."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}IPv4/IPv6 CIDR math. Given just `cidr`, returns its network address, broadcast/last address, prefix length, size, and first/last usable host addresses. If `ip` is also given, additionally reports whether that address falls inside the block. Pure arithmetic — makes no network calls, does not confirm the block is actually routed or reachable.
| Argument | Type | Description |
|---|---|---|
| ip | string | null | Optional IP address to test for membership in `cidr`. |
| cidr* | string | A CIDR block, e.g. "10.0.0.0/24" or "2001:db8::/32". |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"cidr"
],
"properties": {
"ip": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional IP address to test for membership in `cidr`."
},
"cidr": {
"type": "string",
"description": "A CIDR block, e.g. \"10.0.0.0/24\" or \"2001:db8::/32\"."
}
}
}Check whether a domain looks reachable without sending real mail. Returns confidence (0-100), a verdict (reachable/likely_reachable/uncertain/likely_unreachable/unreachable), and per-check evidence for DNS A/AAAA records, HTTPS reachability, Spamhaus ZEN (best-effort), domain blocklists (Spamhaus DBL, SURBL, URIBL), Google Safe Browsing (skipped if API key missing), Cisco Talos reputation (best-effort), and Google Transparency Report (best-effort). Owner-key-gated to prevent abuse.
| Argument | Type | Description |
|---|---|---|
| domain* | string | Domain to evaluate. No real email is sent. |
| owner_key | string | null | Owner key. Gated to prevent unauthenticated abuse. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"description": "Domain to evaluate. No real email is sent."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Gated to prevent unauthenticated abuse.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Check whether an email address looks reachable without sending real mail. Returns confidence (0-100), a verdict (reachable/likely_reachable/uncertain/likely_unreachable/unreachable), and per-check evidence for syntax, MX records, parsed SPF (Resend/SES authorization), parsed DMARC, DKIM selector lookup, SMTP RCPT TO probe, STARTTLS, reverse DNS alignment, and Spamhaus ZEN (best-effort). Owner-key-gated to prevent abuse.
| Argument | Type | Description |
|---|---|---|
| address* | string | Email address to evaluate. No real email is sent. |
| owner_key | string | null | Owner key. Gated to prevent unauthenticated abuse. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"address"
],
"properties": {
"address": {
"type": "string",
"description": "Email address to evaluate. No real email is sent."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Gated to prevent unauthenticated abuse.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Decode a JWT's header and payload (base64url + JSON, no crypto). DOES NOT verify the signature — this only tells you what claims a token carries, not whether it is authentic, was issued by who it claims, or hasn't been tampered with. Never treat a successful decode as validation. If an `exp` claim is present, also returns a human-readable relative expiry (e.g. "expires in 2 hours" or "expired 3 days ago").
| Argument | Type | Description |
|---|---|---|
| token* | string | The raw JWT string (header.payload.signature, or header.payload). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "The raw JWT string (header.payload.signature, or header.payload)."
}
}
}Compare-and-swap a KV key. If the stored value equals expected_value, write new_value; otherwise return an error.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | |
| new_value* | any | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| expected_value* | any |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key",
"expected_value",
"new_value"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string"
},
"new_value": {},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"expected_value": {}
}
}Delete a single KV key.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Delete all KV keys starting with a prefix.
| Argument | Type | Description |
|---|---|---|
| slug* | string | |
| prefix* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"prefix"
],
"properties": {
"slug": {
"type": "string"
},
"prefix": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Fetch a JSON value by key from your namespace.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Atomically increment a KV key by delta. If the key is absent, treat it as 0. The value is stored as a JSON number and the new value is returned.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | |
| delta* | integer | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key",
"delta"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string"
},
"delta": {
"type": "integer",
"format": "int64"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List KV keys starting with a prefix, paginated by cursor.
| Argument | Type | Description |
|---|---|---|
| slug* | string | |
| limit | integer | null | |
| cursor | string | null | |
| prefix | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string"
},
"limit": {
"type": [
"integer",
"null"
],
"format": "uint",
"default": null,
"minimum": 0
},
"cursor": {
"type": [
"string",
"null"
],
"default": null
},
"prefix": {
"type": "string",
"default": ""
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Store a JSON value under a key in your namespace.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | Namespace slug, from the profile returned by `verify`. |
| value* | any | Any JSON value. |
| owner_key | string | null | Owner key for the org this KV item belongs to. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key",
"value"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string",
"description": "Namespace slug, from the profile returned by `verify`."
},
"value": {
"description": "Any JSON value."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org this KV item belongs to.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Store a JSON value under a key with a TTL in seconds. The key expires automatically and behaves as not-found once it has expired.
| Argument | Type | Description |
|---|---|---|
| key* | string | |
| slug* | string | |
| value* | any | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| ttl_seconds* | integer |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"key",
"value",
"ttl_seconds"
],
"properties": {
"key": {
"type": "string"
},
"slug": {
"type": "string"
},
"value": {},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"ttl_seconds": {
"type": "integer",
"format": "int64"
}
}
}List access keys for your account (metadata only — key material is never returned again).
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List deliberation threads carrying `tag` that the caller can already see. Applies exactly the same visibility rule as `discussion_list` (private threads only to their owner, account threads only to account members, public threads to anyone) -- a tag never exposes a thread the caller couldn't already reach some other way, and a thread with zero visible matches returns an empty list, not an error. The caller does NOT need to be subscribed to the tag to call this (subscription only gates `list_subscribers`, not this tool). Returns the same shape as `discussion_list`.
| Argument | Type | Description |
|---|---|---|
| tag* | string | |
| limit | integer | null | |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"tag"
],
"properties": {
"tag": {
"type": "string"
},
"limit": {
"type": [
"integer",
"null"
],
"format": "int64",
"default": null
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
}
}
}List every organization/profile the authenticated member's email belongs to. Returns the same `profiles[]` shape as `verify`. Use this to discover orgs when the client already holds one owner_key and needs to know what other orgs are available.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Any valid owner_key for this email. Returns every org/profile the authenticated member can act as. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Any valid owner_key for this email. Returns every org/profile the\nauthenticated member can act as.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List roles defined for your account.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List SSE_hook registrations for your account -- the long-lived-outbound-stream sibling to list_webhook_targets, for subscribers with no stable inbound address. Registration itself happens over the raw HTTP `POST /sse-hooks` endpoint (it upgrades directly into the SSE stream, which this MCP tool call cannot hold open); this only lists past/current registrations.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key for the org whose registrations to list. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org whose registrations to list.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List every account currently subscribed to `tag`. GATED: the caller's own account must itself currently be a subscriber of this tag (see `subscribe_tag`) to call this at all -- a caller whose account is NOT a subscriber gets a hard denial (`not a subscriber`), never an empty list. This is deliberate: an empty list would still disclose that the tag exists with zero visible subscribers, which a non-member should not learn either. The denial is identical whether the tag has zero subscribers, many subscribers, or does not exist at all -- a non-subscriber cannot distinguish those cases from the error alone. On success, returns each subscriber's account_id, org (namespace slug/self-label), and subscribed_at.
| Argument | Type | Description |
|---|---|---|
| tag* | string | |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"tag"
],
"properties": {
"tag": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
}
}
}List outbound webhook target registrations for your account. Secrets are never returned again after registration.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key for the org whose registrations to list. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org whose registrations to list.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Acknowledge a leased queue item by receipt, permanently removing it.
| Argument | Type | Description |
|---|---|---|
| receipt* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"receipt"
],
"properties": {
"receipt": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Fetch (consume) the oldest visible item from a named queue, FIFO order. Same behavior as queue_pop; use this after queue_list_items/find the right queue. Returns JSON null if the queue is empty.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List visible items in a queue non-destructively, in FIFO order. Returns item ids and values; use the cursor for pagination. Owner-only.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| limit | integer | null | |
| cursor | integer | null | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"limit": {
"type": [
"integer",
"null"
],
"format": "uint",
"default": null,
"minimum": 0
},
"cursor": {
"type": [
"integer",
"null"
],
"format": "int64",
"default": null
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}List queue names under a namespace matching a glob pattern. Owner-only — scoped access_keys cannot call this. '*' matches one segment, so 'telegram.*' matches 'telegram.inbound' but not 'telegram.inbound.foo'. Empty pattern matches all queue names.
| Argument | Type | Description |
|---|---|---|
| slug* | string | |
| pattern | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug"
],
"properties": {
"slug": {
"type": "string"
},
"pattern": {
"type": "string",
"default": ""
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Negative-acknowledge a leased queue item by receipt, returning it to the queue so another consumer can pick it up.
| Argument | Type | Description |
|---|---|---|
| receipt* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"receipt"
],
"properties": {
"receipt": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Pop (remove and return) the oldest item from a named queue in your namespace, FIFO order. Returns JSON null, not an error, if the queue is empty.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Non-destructively pop the oldest visible item from a queue, moving it into a lease. Returns {value, receipt}. Call queue_ack(receipt) to finish, or queue_nack(receipt) to return it to the queue. Returns JSON null if nothing is visible.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| lease_seconds* | integer |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name",
"lease_seconds"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"lease_seconds": {
"type": "integer",
"format": "int64"
}
}
}Push a JSON value onto the tail of a named queue in your namespace. Push is cheap/open by design — the sensitive operation is pop, not push. Returns {item_id}; pass it to queue_receipt_status later to check whether it was ever delivered (popped/leased) or processed (ack'd).
| Argument | Type | Description |
|---|---|---|
| name* | string | Queue name (dot-hierarchical, e.g. "billing.acme.invoice"). Matched exactly on pop — not a wildcard/prefix scan. |
| slug* | string | Namespace slug, from the profile returned by `verify`. |
| value* | any | Any JSON value. |
| owner_key | string | null | Owner key for the org this queue belongs to. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name",
"value"
],
"properties": {
"name": {
"type": "string",
"description": "Queue name (dot-hierarchical, e.g. \"billing.acme.invoice\"). Matched\nexactly on pop — not a wildcard/prefix scan."
},
"slug": {
"type": "string",
"description": "Namespace slug, from the profile returned by `verify`."
},
"value": {
"description": "Any JSON value."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org this queue belongs to.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Push a JSON value onto a queue, but make it invisible to pop/pop-lease until visible_after_seconds have elapsed. Use this for retries, backoff, or scheduled work. Returns {item_id}, same as queue_push.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| value* | any | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| visible_after_seconds* | integer |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name",
"value",
"visible_after_seconds"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"value": {},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"visible_after_seconds": {
"type": "integer",
"format": "int64"
}
}
}Read receipt for one message: was it ever popped/leased ('delivered') or ack'd ('processed')? Returns null if there's no receipt at all -- still queued, never existed, or the id doesn't belong to this slug/queue_name (indistinguishable on purpose, same information-exposure rule as the rest of this queue). Owner-only.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| item_id* | integer | The item_id returned by queue_push/queue_push_delayed. |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name",
"item_id"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"item_id": {
"type": "integer",
"format": "int64",
"description": "The item_id returned by queue_push/queue_push_delayed."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Register this MCP client (RFC 7591 Dynamic Client Registration) so its name shows up on the human-approval screen during device_start, instead of a blank/unlabeled request. Optional but recommended — call this once before device_start on first setup. Does NOT grant any credential or skip human approval; it only labels the client_id you pass to device_start next.
| Argument | Type | Description |
|---|---|---|
| client_name* | string | Human-readable name for this client, shown to the human on the device-code approval screen (e.g. "Claude Desktop", "my CI runner"). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"client_name"
],
"properties": {
"client_name": {
"type": "string",
"description": "Human-readable name for this client, shown to the human on the\ndevice-code approval screen (e.g. \"Claude Desktop\", \"my CI runner\")."
}
}
}Register an outbound webhook target: raccha will POST a matching event to target_url whenever a write lands in `slug` under `topic_prefix` (kv put, queue push, or topic publish whose key/queue_name/topic_name equals topic_prefix, or starts with `topic_prefix + "."` -- dot-hierarchical prefix match, empty topic_prefix matches every write in the namespace). Requires owning the namespace slug. Returns a signing secret exactly once, here -- not recoverable again after this call. Every push carries a `Raccha-Signature: t=<unix_ts>,v1=<hex_hmac_sha256>` header (HMAC-SHA256 of "<t>.<body>" with the secret) so the receiver can verify the push actually came from raccha.
| Argument | Type | Description |
|---|---|---|
| slug* | string | Namespace slug this registration listens under. The caller must own it. |
| owner_key | string | null | Owner key for the org that owns the namespace slug below. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| target_url* | string | http(s) URL raccha will POST matching events to. |
| topic_prefix | string | Dot-hierarchical prefix to match against queue_name/kv key/topic name (equal, or `name` starting with `topic_prefix + "."`). Empty string matches every write in the namespace. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"target_url"
],
"properties": {
"slug": {
"type": "string",
"description": "Namespace slug this registration listens under. The caller must own it."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org that owns the namespace slug below.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"target_url": {
"type": "string",
"description": "http(s) URL raccha will POST matching events to."
},
"topic_prefix": {
"type": "string",
"default": "",
"description": "Dot-hierarchical prefix to match against queue_name/kv key/topic\nname (equal, or `name` starting with `topic_prefix + \".\"`). Empty\nstring matches every write in the namespace."
}
}
}Request a magic sign-in link for an email. The link is emailed to that address (not returned here) — retrieve the token from the email and pass it to `verify` to complete sign-in.
| Argument | Type | Description |
|---|---|---|
| email* | string | Email to send (or in the current no-SMTP setup, return) a magic sign-in link for. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"email"
],
"properties": {
"email": {
"type": "string",
"description": "Email to send (or in the current no-SMTP setup, return) a magic sign-in link for."
}
}
}Revoke an access_key by its id (not the raw ak_... key material). Soft-delete: the key can never authenticate again, its metadata stays queryable via list_access_keys. Requires an admin owner_key.
| Argument | Type | Description |
|---|---|---|
| id* | string | The access key's `id` (not the raw `ak_...` key material). |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The access key's `id` (not the raw `ak_...` key material)."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Reply to an inbound email stored by the mailbox ingest endpoint. Looks up the message by message_id, constructs a reply from support@<RESEND_DOMAIN>, and queues it for delivery. Requires any valid owner_key.
| Argument | Type | Description |
|---|---|---|
| body* | string | Plain-text body of the reply. |
| owner_key | string | null | Owner key. Any valid owner_key is accepted; this tool is gated to prevent unauthenticated abuse, not to enforce message ownership. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| message_id* | integer | The message_id returned by the mailbox ingest endpoint for the inbound message you are replying to. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"message_id",
"body"
],
"properties": {
"body": {
"type": "string",
"description": "Plain-text body of the reply."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Any valid owner_key is accepted; this tool is gated to\nprevent unauthenticated abuse, not to enforce message ownership.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"message_id": {
"type": "integer",
"format": "int64",
"description": "The message_id returned by the mailbox ingest endpoint for the inbound\nmessage you are replying to."
}
}
}Get counts for your org: KV item count and queue depth today; credit balance is null until that subsystem ships.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Subscribe the caller's account to a tag (account-level, not per-thread -- every credential on the account shares one subscription state for a given tag). Idempotent: subscribing again is a no-op success. Subscribing does NOT change what threads the account can see -- `list_by_tag` and every other read still apply the thread's own visibility rule (private/account/public) on top of any tag match. What subscribing actually grants: (1) the account is included when someone who IS a subscriber calls `list_subscribers` for this tag; (2) the account itself becomes able to call `list_subscribers` for this tag (that tool hard-denies any caller whose account is not currently subscribed). `tag`: 1-64 chars, lowercase-normalized, ASCII alphanumeric/-/_ only.
| Argument | Type | Description |
|---|---|---|
| tag* | string | 1-64 chars, ASCII alphanumeric/`-`/`_`, case-insensitive (lowercase-normalized on write, same as tags on `discussion_create`). |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"tag"
],
"properties": {
"tag": {
"type": "string",
"description": "1-64 chars, ASCII alphanumeric/`-`/`_`, case-insensitive\n(lowercase-normalized on write, same as tags on `discussion_create`)."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
}
}
}Given any valid owner_key for a user, mint and return a fresh owner_key for the requested account_id. The account_id must belong to the same email as the supplied owner_key. Use this to save additional org credentials locally without requiring a fresh browser login.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Any valid owner_key for this email. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| account_id* | string | The account_id of the org to switch to. Must belong to the same email. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"account_id"
],
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Any valid owner_key for this email.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"account_id": {
"type": "string",
"description": "The account_id of the org to switch to. Must belong to the same email."
}
}
}Mint a short-lived one-time pairing code. DM it (or /start <code>) to the raccha.ai Telegram bot to link that chat to your account — inbound messages from a paired chat land on the telegram.inbound queue in your namespace.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key for the org this pairing code will link a Telegram chat to. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org this pairing code will link a Telegram chat to.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Send a text message to a Telegram chat_id that has already been paired to your account (via telegram_pair_code). Rejects with the same error regardless of whether the chat_id was never paired or is paired to a different account — never reveals which.
| Argument | Type | Description |
|---|---|---|
| text* | string | |
| chat_id* | integer | The Telegram chat_id to send to. Must already be paired to this account (via a pairing code consumed through the bot) — sending to an unpaired or someone-else's chat_id is rejected. |
| owner_key | string | null | Owner key for the org that owns the paired Telegram chat. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"chat_id",
"text"
],
"properties": {
"text": {
"type": "string"
},
"chat_id": {
"type": "integer",
"format": "int64",
"description": "The Telegram chat_id to send to. Must already be paired to this\naccount (via a pairing code consumed through the bot) — sending to\nan unpaired or someone-else's chat_id is rejected."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org that owns the paired Telegram chat.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Publish a JSON event to a topic. Returns {ok: true, cursor}. Multiple readers can tail the same topic by cursor.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| event* | any | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name",
"event"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"event": {},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Read events from a topic since a cursor. Omit cursor (or pass 0) to read from the start. Returns {events: [{cursor, event}], next_cursor}.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| slug* | string | |
| limit | integer | null | |
| cursor | integer | null | |
| owner_key | string | null | Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"slug",
"name"
],
"properties": {
"name": {
"type": "string"
},
"slug": {
"type": "string"
},
"limit": {
"type": [
"integer",
"null"
],
"format": "uint",
"default": null,
"minimum": 0
},
"cursor": {
"type": [
"integer",
"null"
],
"format": "int64",
"default": null
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Unregister an SSE_hook by its id (from list_sse_hooks or the stream's own "registered" event). Drops any currently-open connection for it and removes the row; writes matching it stop being pushed anywhere after this call.
| Argument | Type | Description |
|---|---|---|
| id* | string | The registration id, as returned on the SSE stream's first "registered" event or from list_sse_hooks. |
| owner_key | string | null | Owner key for the org that owns this registration. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The registration id, as returned on the SSE stream's first\n\"registered\" event or from list_sse_hooks."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org that owns this registration.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Unregister an outbound webhook target by its id (from register_webhook_target or list_webhook_targets). Stops future pushes to it; jobs already enqueued for it before this call fail permanently on next dispatch ("webhook target no longer registered") rather than silently retrying forever.
| Argument | Type | Description |
|---|---|---|
| id* | string | The registration id, as returned by register_webhook_target. |
| owner_key | string | null | Owner key for the org that owns this registration. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The registration id, as returned by register_webhook_target."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key for the org that owns this registration.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}Unsubscribe the caller's account from a tag. Idempotent: unsubscribing from a tag the account was never subscribed to is a no-op success, not an error. Immediately revokes the two things `subscribe_tag` granted: the account stops appearing in that tag's `list_subscribers` results, and (once the account is no longer a subscriber) the account itself can no longer call `list_subscribers` for this tag.
| Argument | Type | Description |
|---|---|---|
| tag* | string | |
| owner_key | string | null | Owner key or access key credential. Optional — if omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header (an access_key must still be passed explicitly; only owner_key defaults from the header). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"tag"
],
"properties": {
"tag": {
"type": "string"
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
}
}
}Reassign an access_key's role_ids (whole-combination replace, bundle-26), mailbox_label, and/or expiry. Omitted fields are left unchanged. Requires an admin owner_key.
| Argument | Type | Description |
|---|---|---|
| id* | string | The access_key's id (not the raw ak_... key material). |
| expiry | string | null | New RFC3339 expiry, or omit to leave unchanged. |
| role_ids | array | null | New full set of role ids to bind (replaces the existing combination), or omit to leave unchanged. |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| mailbox_label | string | null | New mailbox_label, or omit to leave unchanged. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The access_key's id (not the raw ak_... key material)."
},
"expiry": {
"type": [
"string",
"null"
],
"default": null,
"description": "New RFC3339 expiry, or omit to leave unchanged."
},
"role_ids": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
},
"default": null,
"description": "New full set of role ids to bind (replaces the existing combination), or omit to leave unchanged."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"mailbox_label": {
"type": [
"string",
"null"
],
"default": null,
"description": "New mailbox_label, or omit to leave unchanged."
}
}
}Update a role's name and/or scope_expressions. Omitted fields are left unchanged (not cleared). Requires an admin owner_key.
| Argument | Type | Description |
|---|---|---|
| id* | string | The role's id. |
| name | string | null | New name, or omit to leave unchanged. |
| owner_key | string | null | Owner key. Must belong to an admin member. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
| scope_expressions | array | null | New scope_expressions, or omit to leave unchanged. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "The role's id."
},
"name": {
"type": [
"string",
"null"
],
"default": null,
"description": "New name, or omit to leave unchanged."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key. Must belong to an admin member.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
},
"scope_expressions": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
},
"default": null,
"description": "New scope_expressions, or omit to leave unchanged."
}
}
}Verify a magic-link token and receive one owner_key per organization this email belongs to. Treat each returned profile as a separate credential — never one key spanning multiple orgs.
| Argument | Type | Description |
|---|---|---|
| token* | string | The token from the end of a magic-link URL (?token=...). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"token"
],
"properties": {
"token": {
"type": "string",
"description": "The token from the end of a magic-link URL (?token=...)."
}
}
}Who does the server think you are, right now, for this owner_key.
| Argument | Type | Description |
|---|---|---|
| owner_key | string | null | Owner key to check. Optional. If omitted, defaults to the owner_key resolved from the connection's `Authorization: Bearer <owner_key>` header. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key to check.\nOptional. If omitted, defaults to the owner_key resolved from the\nconnection's `Authorization: Bearer <owner_key>` header."
}
}
}| Defaults to `account` visibility when omitted. |
| initial_post | string | null |
| owner_handle | string | null |
| requested_roles | array | null | The task-specified `roles[]` alias for requested_roles. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"title"
],
"properties": {
"slug": {
"type": [
"string",
"null"
],
"default": null
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Tags to attach to the thread at creation time. Optional, defaults to\nnone. Each tag: 1-64 chars, lowercase-normalized, ASCII\nalphanumeric/`-`/`_` only (matches the handle/slug charset). Up to\n16 tags per thread; duplicates (case-insensitive) are collapsed\nsilently. Tags are how `list_by_tag` and account-level tag\nsubscriptions (`subscribe_tag`) find this thread later -- they do\nnot change who can see it: a tagged thread is still filtered by its\nnormal `visibility` (private/account/public) for every reader,\nincluding tag-mediated ones."
},
"title": {
"type": "string",
"description": "The thread's question or title. `question` is accepted as an alias for\nthe task-specified shape."
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"visibility": {
"type": "string",
"default": "account",
"description": "Defaults to `account` visibility when omitted."
},
"initial_post": {
"type": [
"string",
"null"
],
"default": null
},
"owner_handle": {
"type": [
"string",
"null"
],
"default": null
},
"requested_roles": {
"type": [
"array",
"null"
],
"items": {
"type": "string"
},
"default": null,
"description": "The task-specified `roles[]` alias for requested_roles."
}
}
}| thread_id* | string |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"thread_id"
],
"properties": {
"tag": {
"type": [
"string",
"null"
],
"default": null,
"description": "Optional: read this thread as tag-mediated delivery rather than a\ndirect-by-id fetch. Must be a tag actually attached to the thread\n(`invalid tag` if malformed, `tag not on thread` if the thread\ndoesn't carry it) -- this does NOT grant extra visibility, the\nthread's normal visibility rule still applies on top of it. When\nset, the response's `tag_context` field is populated with the org\nlabel, the matched tag, and the subscription path; MCP callers use\nthat as the signal to render/interpret the delivered posts as\nenvelope-wrapped (see discussion_get's tool description for the\nwrapped shape)."
},
"limit": {
"type": [
"integer",
"null"
],
"format": "int64",
"default": null
},
"since_id": {
"type": [
"string",
"null"
],
"default": null
},
"owner_key": {
"type": [
"string",
"null"
],
"default": null,
"description": "Owner key or access key credential. Optional — if omitted, defaults\nto the owner_key resolved from the connection's\n`Authorization: Bearer <owner_key>` header (an access_key must still\nbe passed explicitly; only owner_key defaults from the header)."
},
"thread_id": {
"type": "string"
}
}
}