Knowledge and MCP

Knowledge Management

Tool	Description	Permission
`query_knowledge_sources`	Search the organization's indexed knowledge — documents, files, images, photos, and records synced from its connected sources.	`knowledgeSource:query`
`create_knowledge_base`	Create a new knowledge base for organizing knowledge connectors.	`knowledgeSource:create`
`get_knowledge_bases`	List all knowledge bases in the organization.	`knowledgeSource:read`
`get_knowledge_base`	Get details of a specific knowledge base by ID.	`knowledgeSource:read`
`update_knowledge_base`	Update an existing knowledge base.	`knowledgeSource:update`
`delete_knowledge_base`	Delete a knowledge base by ID.	`knowledgeSource:delete`
`create_knowledge_connector`	Create a new knowledge connector for ingesting data from external sources.	`knowledgeSource:create`
`get_knowledge_connectors`	List all knowledge connectors in the organization.	`knowledgeSource:read`
`get_knowledge_connector`	Get details of a specific knowledge connector by ID.	`knowledgeSource:read`
`update_knowledge_connector`	Update an existing knowledge connector.	`knowledgeSource:update`
`delete_knowledge_connector`	Delete a knowledge connector by ID.	`knowledgeSource:delete`
`assign_knowledge_connector_to_knowledge_base`	Assign a knowledge connector to a knowledge base.	`knowledgeSource:update`
`unassign_knowledge_connector_from_knowledge_base`	Remove a knowledge connector from a knowledge base.	`knowledgeSource:update`
`assign_knowledge_base_to_agent`	Assign a knowledge base to an agent.	`knowledgeSource:update`
`unassign_knowledge_base_from_agent`	Remove a knowledge base from an agent.	`knowledgeSource:update`
`assign_knowledge_connector_to_agent`	Directly assign a knowledge connector to an agent (bypassing knowledge base).	`knowledgeSource:update`
`unassign_knowledge_connector_from_agent`	Remove a directly-assigned knowledge connector from an agent.	`knowledgeSource:update`

query_knowledge_sources

Required RBAC permission: knowledgeSource:query

Input

Parameter	Type	Required	Description
`query`	`string`	Yes	The user's original query, passed verbatim without rephrasing or expansion.
`documentFilter`	`object`	No	Optional. Narrows the search to a subset of the indexed documents by their source metadata — for example {"spaceKey": "DEV"} or {"labels": ["release-2.0"]}. Keys are ANDed; a list of values for one key is ORed. Matches both single values and list-valued metadata. Only use this when the user's request explicitly names a subset to search; do NOT infer one from the topic of the question, and do NOT guess key or value names. If a filter matches nothing, the response lists the values that actually exist so the call can be retried with a real one.

Output

Field	Type	Required	Description
`results`	`any[]`	Yes	Retrieved knowledge results.
`totalChunks`	`number`	Yes	The number of result chunks returned.
`citationInstruction`	`string`	No	How to cite these results: back each claim with a verbatim quote tagged with the source chunk's ref.
`filterDiagnostic`	`string`	No	Present only when documentFilter matched no documents. Names the values that do exist for the keys that were filtered on, so the search can be retried.

create_knowledge_base

Required RBAC permission: knowledgeSource:create

Input

Parameter	Type	Required	Description
`initialGrants`	`object[]`	No
`initialGrants[].subject`	`object`	Yes
`initialGrants[].subject.type`	`"user" \| "team" \| "serviceAccount" \| "role" \| "organization"`	Yes
`initialGrants[].subject.id`	`string \| "*"`	Yes
`initialGrants[].actions`	`string[]`	Yes
`name`	`string`	Yes	Name of the knowledge base.
`description`	`string \| null`	No	Description of the knowledge base.

Output

Field	Type	Required	Description
`knowledgeBase`	`object`	Yes	The requested knowledge base.
`knowledgeBase.id`	`string`	Yes	The knowledge base ID.
`knowledgeBase.organizationId`	`string`	Yes	The organization ID.
`knowledgeBase.name`	`string`	Yes	The knowledge base name.
`knowledgeBase.description`	`string \| null`	Yes	The knowledge base description, if any.
`knowledgeBase.status`	`string`	Yes	The knowledge base status.

get_knowledge_bases

Required RBAC permission: knowledgeSource:read

Input

Parameter	Type	Required	Description
`access`	`string[]`	No	Only return items the caller reaches in one of these ways: mine (created by the caller), shared (shared with the caller or one of their teams), org (shared with the whole organization), others (not shared with the caller; visible only through admin access). Omit for everything the caller can read. Use ["mine"] for "my knowledge bases".
`shared_with`	`string[]`	No	Only return items whose own permissions grant read to one of these subjects: org (the whole organization), role:, team:, user:, serviceAccount:. Omit for no filtering.
`owner_ids`	`string[]`	No	Only return items created by one of these user IDs. Omit for no filtering.

Output

Field	Type	Required	Description
`knowledgeBases`	`object[]`	Yes	Knowledge bases in the organization.
`knowledgeBases[].id`	`string`	Yes	The knowledge base ID.
`knowledgeBases[].organizationId`	`string`	Yes	The organization ID.
`knowledgeBases[].name`	`string`	Yes	The knowledge base name.
`knowledgeBases[].description`	`string \| null`	Yes	The knowledge base description, if any.
`knowledgeBases[].status`	`string`	Yes	The knowledge base status.

get_knowledge_base

Required RBAC permission: knowledgeSource:read

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge base ID.

Output

Field	Type	Required	Description
`knowledgeBase`	`object`	Yes	The requested knowledge base.
`knowledgeBase.id`	`string`	Yes	The knowledge base ID.
`knowledgeBase.organizationId`	`string`	Yes	The organization ID.
`knowledgeBase.name`	`string`	Yes	The knowledge base name.
`knowledgeBase.description`	`string \| null`	Yes	The knowledge base description, if any.
`knowledgeBase.status`	`string`	Yes	The knowledge base status.

update_knowledge_base

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge base ID.
`uploadedFilesEnvironmentId`	`string \| null`	No	Environment for this knowledge base's indexed uploaded files. Requires uploaded files to have been indexed; omit to leave it unchanged.
`name`	`string`	No	New knowledge base name.
`description`	`string \| null`	No	New knowledge base description.

Output

Field	Type	Required	Description
`knowledgeBase`	`object`	Yes	The requested knowledge base.
`knowledgeBase.id`	`string`	Yes	The knowledge base ID.
`knowledgeBase.organizationId`	`string`	Yes	The organization ID.
`knowledgeBase.name`	`string`	Yes	The knowledge base name.
`knowledgeBase.description`	`string \| null`	Yes	The knowledge base description, if any.
`knowledgeBase.status`	`string`	Yes	The knowledge base status.

delete_knowledge_base

Required RBAC permission: knowledgeSource:delete

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge base ID.

create_knowledge_connector

Required RBAC permission: knowledgeSource:create

Input

Parameter	Type	Required	Description
`initialGrants`	`object[]`	No
`initialGrants[].subject`	`object`	Yes
`initialGrants[].subject.type`	`"user" \| "team" \| "serviceAccount" \| "role" \| "organization"`	Yes
`initialGrants[].subject.id`	`string \| "*"`	Yes
`initialGrants[].actions`	`string[]`	Yes
`name`	`string`	Yes	Name of the knowledge connector.
`connector_type`	`string`	Yes	Type of the knowledge connector (for example jira, confluence, or google_drive).
`config`	`object`	Yes	Provider-specific configuration object.
`description`	`string \| null`	No	Description of the knowledge connector.
`sync_permissions_from_source`	`boolean`	No	Mirror each document's access control from the source, so a query only returns what the caller could open there. Requires an enterprise license and a connector type that supports it.

Output

Field	Type	Required	Description
`knowledgeConnector`	`object`	Yes	The requested knowledge connector.
`knowledgeConnector.id`	`string`	Yes	The knowledge connector ID.
`knowledgeConnector.organizationId`	`string`	Yes	The organization ID.
`knowledgeConnector.knowledgeBaseId`	`string \| null`	No
`knowledgeConnector.name`	`string`	Yes	The connector name.
`knowledgeConnector.connectorType`	`string`	Yes	The connector type.
`knowledgeConnector.description`	`string \| null`	Yes	The connector description, if any.
`knowledgeConnector.enabled`	`boolean`	No
`knowledgeConnector.config`	`any`	Yes	The provider-specific connector configuration.

get_knowledge_connectors

Required RBAC permission: knowledgeSource:read

This tool takes no arguments.

Output

Field	Type	Required	Description
`knowledgeConnectors`	`object[]`	Yes	Knowledge connectors in the organization.
`knowledgeConnectors[].id`	`string`	Yes	The knowledge connector ID.
`knowledgeConnectors[].organizationId`	`string`	Yes	The organization ID.
`knowledgeConnectors[].knowledgeBaseId`	`string \| null`	No
`knowledgeConnectors[].name`	`string`	Yes	The connector name.
`knowledgeConnectors[].connectorType`	`string`	Yes	The connector type.
`knowledgeConnectors[].description`	`string \| null`	Yes	The connector description, if any.
`knowledgeConnectors[].enabled`	`boolean`	No
`knowledgeConnectors[].config`	`any`	Yes	The provider-specific connector configuration.

get_knowledge_connector

Required RBAC permission: knowledgeSource:read

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge connector ID.

Output

Field	Type	Required	Description
`knowledgeConnector`	`object`	Yes	The requested knowledge connector.
`knowledgeConnector.id`	`string`	Yes	The knowledge connector ID.
`knowledgeConnector.organizationId`	`string`	Yes	The organization ID.
`knowledgeConnector.knowledgeBaseId`	`string \| null`	No
`knowledgeConnector.name`	`string`	Yes	The connector name.
`knowledgeConnector.connectorType`	`string`	Yes	The connector type.
`knowledgeConnector.description`	`string \| null`	Yes	The connector description, if any.
`knowledgeConnector.enabled`	`boolean`	No
`knowledgeConnector.config`	`any`	Yes	The provider-specific connector configuration.

update_knowledge_connector

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge connector ID.
`name`	`string`	No	New connector name.
`description`	`string \| null`	No	New connector description.
`enabled`	`boolean`	No	Whether the connector is enabled.
`visibility`	`"org-wide" \| "team-scoped" \| "auto-sync-permissions"`	No	Updated visibility for the connector.
`team_ids`	`string[]`	No	Updated team IDs for a team-scoped connector.
`config`	`object`	No	Updated connector configuration (provider-specific settings).

Output

Field	Type	Required	Description
`knowledgeConnector`	`object`	Yes	The requested knowledge connector.
`knowledgeConnector.id`	`string`	Yes	The knowledge connector ID.
`knowledgeConnector.organizationId`	`string`	Yes	The organization ID.
`knowledgeConnector.knowledgeBaseId`	`string \| null`	No
`knowledgeConnector.name`	`string`	Yes	The connector name.
`knowledgeConnector.connectorType`	`string`	Yes	The connector type.
`knowledgeConnector.description`	`string \| null`	Yes	The connector description, if any.
`knowledgeConnector.enabled`	`boolean`	No
`knowledgeConnector.config`	`any`	Yes	The provider-specific connector configuration.

delete_knowledge_connector

Required RBAC permission: knowledgeSource:delete

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	Knowledge connector ID.

assign_knowledge_connector_to_knowledge_base

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`connector_id`	`string`	Yes	Knowledge connector ID.
`knowledge_base_id`	`string`	Yes	Knowledge base ID.

unassign_knowledge_connector_from_knowledge_base

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`connector_id`	`string`	Yes	Knowledge connector ID.
`knowledge_base_id`	`string`	Yes	Knowledge base ID.

assign_knowledge_base_to_agent

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`knowledge_base_id`	`string`	Yes	Knowledge base ID.
`agent_id`	`string`	Yes	Agent ID.

unassign_knowledge_base_from_agent

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`knowledge_base_id`	`string`	Yes	Knowledge base ID.
`agent_id`	`string`	Yes	Agent ID.

assign_knowledge_connector_to_agent

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`connector_id`	`string`	Yes	Knowledge connector ID.
`agent_id`	`string`	Yes	Agent ID.

unassign_knowledge_connector_from_agent

Required RBAC permission: knowledgeSource:update

Input

Parameter	Type	Required	Description
`connector_id`	`string`	Yes	Knowledge connector ID.
`agent_id`	`string`	Yes	Agent ID.

MCP Servers

Tool	Description	Permission
`search_private_mcp_registry`	Search the private MCP registry for available MCP servers.	`mcpRegistry:read`
`get_mcp_servers`	List all MCP servers from the catalog.	`mcpRegistry:read`
`get_mcp_server_tools`	Get all tools available for a specific MCP server by its catalog ID (from get_mcp_servers).	`mcpRegistry:read`
`edit_mcp_description`	Edit an MCP server's display information and metadata.	`update` on the MCP registry entry (granted per item)
`edit_mcp_config`	Edit an MCP server's technical configuration.	`update` on the MCP registry entry (granted per item)
`create_mcp_server`	Create a new MCP server in the private registry.	`mcpRegistry:create`
`deploy_mcp_server`	Deploy (install) an MCP server from the catalog.	`update` on the MCP registry entry (granted per item)
`list_mcp_server_deployments`	List deployed (installed) MCP server instances the current user can read.	`mcpRegistry:read`
`get_mcp_server_logs`	Get recent container logs from a deployed local (K8s) MCP server.	`mcpRegistry:read`
`reload_mcp_server_tools`	Re-discover a deployed MCP server's tools from the live server and refresh Archestra's tool catalog for it — picks up added, removed, and changed tools (names, descriptions, and input schemas) with...	`mcpServerInstallation:create`

search_private_mcp_registry

Required RBAC permission: mcpRegistry:read

Input

Parameter	Type	Required	Description
`query`	`string`	No	Optional search query to filter MCP servers by name or description.
`access`	`string[]`	No	Only return items the caller reaches in one of these ways: mine (created by the caller), shared (shared with the caller or one of their teams), org (shared with the whole organization), others (not shared with the caller; visible only through admin access). Omit for everything the caller can read. Use ["mine"] for "my MCP servers".
`shared_with`	`string[]`	No	Only return items whose own permissions grant read to one of these subjects: org (the whole organization), role:, team:, user:, serviceAccount:. Omit for no filtering.
`owner_ids`	`string[]`	No	Only return items created by one of these user IDs. Omit for no filtering.

Output

Field	Type	Required	Description
`items`	`object[]`	Yes	Catalog items matching the search.
`items[].id`	`string`	Yes	The catalog item ID.
`items[].name`	`string`	Yes	The MCP server name.
`items[].version`	`string \| null`	Yes	The version, if provided.
`items[].description`	`string \| null`	Yes	The server description, if any.
`items[].serverType`	`"local" \| "remote" \| "builtin" \| "app"`	Yes	Server type: local, remote, builtin, or app (user-generated App).
`items[].serverUrl`	`string \| null`	Yes	The remote server URL, if applicable.
`items[].repository`	`string \| null`	Yes	The repository URL, if available.

get_mcp_servers

Required RBAC permission: mcpRegistry:read

Input

Parameter	Type	Required	Description
`access`	`string[]`	No	Only return items the caller reaches in one of these ways: mine (created by the caller), shared (shared with the caller or one of their teams), org (shared with the whole organization), others (not shared with the caller; visible only through admin access). Omit for everything the caller can read. Use ["mine"] for "my MCP servers".
`shared_with`	`string[]`	No	Only return items whose own permissions grant read to one of these subjects: org (the whole organization), role:, team:, user:, serviceAccount:. Omit for no filtering.
`owner_ids`	`string[]`	No	Only return items created by one of these user IDs. Omit for no filtering.

Output

Field	Type	Required	Description
`items`	`object[]`	Yes	Available MCP servers.
`items[].id`	`string`	Yes	The catalog item ID.
`items[].name`	`string`	Yes	The MCP server name.
`items[].icon`	`string \| null`	Yes	The emoji icon, if any.
`items[].description`	`string \| null`	Yes	The server description, if any.
`items[].scope`	`"personal" \| "team" \| "org"`	No	The visibility scope of the server.
`items[].teams`	`object[]`	Yes	Teams attached to a team-scoped server.
`items[].teams[].id`	`string`	Yes	The team ID.
`items[].teams[].name`	`string`	Yes	The team name.

get_mcp_server_tools

Required RBAC permission: mcpRegistry:read

Input

Parameter	Type	Required	Description
`mcpServerId`	`string`	Yes	The catalog ID of the MCP server.
`view`	`"full" \| "picker"`	No	Picker metadata excludes parameter bodies and assigned-agent lists; defaults to full.

Output

Field	Type	Required	Description
`tools`	`object[]`	Yes	Tools exposed by the selected MCP server.
`tools[].id`	`string`	Yes	The tool ID.
`tools[].name`	`string`	Yes	The tool name.
`tools[].description`	`string \| null`	No	The tool description, if any.
`tools[].catalogId`	`string \| null`	No	The MCP catalog ID this tool belongs to.

edit_mcp_description

Required RBAC permission: update on the MCP registry entry (granted per item)

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	The catalog ID of the MCP server to edit. Use get_mcp_servers to look it up by name.
`name`	`string`	No	Display name for the MCP server.
`description`	`string \| null`	No	Description of the MCP server.
`icon`	`string \| null`	No	Emoji icon for the MCP server.
`docsUrl`	`string \| null`	No	Documentation URL.
`repository`	`string \| null`	No	Source code repository URL.
`version`	`string \| null`	No	Version string.
`instructions`	`string \| null`	No	Setup or usage instructions.
`labels`	`object[]`	No	Key-value labels for organization/categorization.
`labels[].key`	`string`	Yes	Label key.
`labels[].value`	`string`	Yes	Label value.

edit_mcp_config

Required RBAC permission: update on the MCP registry entry (granted per item)

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	The catalog ID of the MCP server to edit. Use get_mcp_servers to look it up by name.
`serverType`	`"local" \| "remote" \| "builtin"`	No	Server type: local, remote, or builtin.
`serverUrl`	`string \| null`	No	[Remote] The URL of the remote MCP server.
`requiresAuth`	`boolean`	No	[Remote] Whether the server requires authentication.
`authDescription`	`string \| null`	No	[Remote] How to set up authentication.
`authFields`	`object[]`	No	[Remote] Authentication field definitions.
`authFields[].name`	`string`	Yes	Auth field name.
`authFields[].label`	`string`	Yes	Human-readable auth field label.
`authFields[].type`	`"header" \| "query" \| "cookie"`	Yes	Where to send this auth field.
`authFields[].secret`	`boolean`	Yes	Whether this field contains secret data.
`oauthConfig`	`object`	No	[Remote] OAuth configuration for the server.
`command`	`string`	No	[Local] Command to run (for example npx, uvx, or node).
`arguments`	`string[]`	No	[Local] Command-line arguments.
`environment`	`object[]`	No	[Local] Environment variables for the server process.
`environment[].key`	`string`	Yes	Environment variable name.
`environment[].type`	`"plain_text" \| "secret" \| "boolean" \| "number"`	Yes	Environment variable value type.
`environment[].value`	`string`	No	Literal environment variable value.
`environment[].promptOnInstallation`	`boolean`	Yes	Whether to prompt for this value during installation.
`environment[].required`	`boolean`	No	Whether the value is required.
`environment[].description`	`string`	No	Description shown to users.
`environment[].default`	`any`	No	Default value.
`environment[].mounted`	`boolean`	No	For secret values, mount as a file instead of an env var.
`envFrom`	`object[]`	No	[Local] Import env vars from Kubernetes Secrets or ConfigMaps.
`envFrom[].type`	`"secret" \| "configMap"`	Yes	Import source type.
`envFrom[].name`	`string`	Yes	Secret or ConfigMap name.
`envFrom[].prefix`	`string`	No	Optional environment variable prefix.
`dockerImage`	`string`	No	[Local] Custom Docker image.
`serviceAccount`	`string`	No	[Local] Kubernetes ServiceAccount name.
`transportType`	`"stdio" \| "streamable-http"`	No	[Local] Transport type. Omit it for remote servers: streamable-http is ignored and stdio is rejected.
`httpPort`	`number`	No	[Local] HTTP port for streamable-http transport.
`httpPath`	`string`	No	[Local] HTTP path for streamable-http transport.
`nodePort`	`number`	No	[Local] Kubernetes NodePort for local development.
`imagePullSecrets`	`object[]`	No	[Local] Image pull secrets for private registries.
`imagePullSecrets[].source`	`"existing"`	Yes	Image pull secret source.
`imagePullSecrets[].name`	`string`	Yes	Existing Kubernetes secret name.
`imagePullPolicy`	`"Always" \| "IfNotPresent" \| "Never"`	No	[Local] Kubernetes imagePullPolicy for the server container. Unset uses Always for :latest or untagged images and IfNotPresent otherwise.
`deploymentSpecYaml`	`string`	No	[Local] Custom Kubernetes deployment YAML override.
`installationCommand`	`string`	No	[Local] Command to install the MCP server package.
`userConfig`	`object`	No	User-configurable fields shown during installation.

create_mcp_server

Required RBAC permission: mcpRegistry:create

Input

Parameter	Type	Required	Description
`name`	`string`	Yes	Display name for the MCP server.
`description`	`string \| null`	No	Description of the MCP server.
`icon`	`string \| null`	No	Emoji icon for the MCP server.
`docsUrl`	`string \| null`	No	Documentation URL.
`repository`	`string \| null`	No	Source code repository URL.
`version`	`string \| null`	No	Version string.
`instructions`	`string \| null`	No	Setup or usage instructions.
`labels`	`object[]`	No	Key-value labels for organization/categorization.
`labels[].key`	`string`	Yes	Label key.
`labels[].value`	`string`	Yes	Label value.
`environmentId`	`string \| null`	No	ID of the environment this server belongs to. Pass null for the default environment. Omit it to use your own environment, or the organization's landing environment for new MCP servers when you have none.
`initialGrants`	`object[]`	No
`initialGrants[].subject`	`object`	Yes
`initialGrants[].subject.type`	`"user" \| "team" \| "serviceAccount" \| "role" \| "organization"`	Yes
`initialGrants[].subject.id`	`string \| "*"`	Yes
`initialGrants[].actions`	`string[]`	Yes
`serverType`	`"local" \| "remote" \| "builtin"`	No	Server type: local, remote, or builtin.
`serverUrl`	`string \| null`	No	[Remote] The URL of the remote MCP server.
`requiresAuth`	`boolean`	No	[Remote] Whether the server requires authentication.
`authDescription`	`string \| null`	No	[Remote] How to set up authentication.
`authFields`	`object[]`	No	[Remote] Authentication field definitions.
`authFields[].name`	`string`	Yes	Auth field name.
`authFields[].label`	`string`	Yes	Human-readable auth field label.
`authFields[].type`	`"header" \| "query" \| "cookie"`	Yes	Where to send this auth field.
`authFields[].secret`	`boolean`	Yes	Whether this field contains secret data.
`oauthConfig`	`object`	No	[Remote] OAuth configuration for the server.
`command`	`string`	No	[Local] Command to run (for example npx, uvx, or node).
`arguments`	`string[]`	No	[Local] Command-line arguments.
`environment`	`object[]`	No	[Local] Environment variables for the server process.
`environment[].key`	`string`	Yes	Environment variable name.
`environment[].type`	`"plain_text" \| "secret" \| "boolean" \| "number"`	Yes	Environment variable value type.
`environment[].value`	`string`	No	Literal environment variable value.
`environment[].promptOnInstallation`	`boolean`	Yes	Whether to prompt for this value during installation.
`environment[].required`	`boolean`	No	Whether the value is required.
`environment[].description`	`string`	No	Description shown to users.
`environment[].default`	`any`	No	Default value.
`environment[].mounted`	`boolean`	No	For secret values, mount as a file instead of an env var.
`envFrom`	`object[]`	No	[Local] Import env vars from Kubernetes Secrets or ConfigMaps.
`envFrom[].type`	`"secret" \| "configMap"`	Yes	Import source type.
`envFrom[].name`	`string`	Yes	Secret or ConfigMap name.
`envFrom[].prefix`	`string`	No	Optional environment variable prefix.
`dockerImage`	`string`	No	[Local] Custom Docker image.
`serviceAccount`	`string`	No	[Local] Kubernetes ServiceAccount name.
`transportType`	`"stdio" \| "streamable-http"`	No	[Local] Transport type. Omit it for remote servers: streamable-http is ignored and stdio is rejected.
`httpPort`	`number`	No	[Local] HTTP port for streamable-http transport.
`httpPath`	`string`	No	[Local] HTTP path for streamable-http transport.
`nodePort`	`number`	No	[Local] Kubernetes NodePort for local development.
`imagePullSecrets`	`object[]`	No	[Local] Image pull secrets for private registries.
`imagePullSecrets[].source`	`"existing"`	Yes	Image pull secret source.
`imagePullSecrets[].name`	`string`	Yes	Existing Kubernetes secret name.
`imagePullPolicy`	`"Always" \| "IfNotPresent" \| "Never"`	No	[Local] Kubernetes imagePullPolicy for the server container. Unset uses Always for :latest or untagged images and IfNotPresent otherwise.
`deploymentSpecYaml`	`string`	No	[Local] Custom Kubernetes deployment YAML override.
`installationCommand`	`string`	No	[Local] Command to install the MCP server package.
`userConfig`	`object`	No	User-configurable fields shown during installation.

deploy_mcp_server

Required RBAC permission: update on the MCP registry entry (granted per item)

Input

Parameter	Type	Required	Description
`catalogId`	`string`	Yes	The catalog ID of the MCP server to deploy.
`scope`	`"personal" \| "team" \| "org"`	No	Visibility scope for the deployment: 'personal' (default), 'team' (requires teamId), or 'org' (admins only, visible to all org members).
`teamId`	`string`	No	Optional team ID for a team-scoped deployment (required when scope='team').
`agentIds`	`string[]`	No	Optional agent IDs to assign the server's tools to after deployment.

list_mcp_server_deployments

Required RBAC permission: mcpRegistry:read

This tool takes no arguments.

get_mcp_server_logs

Required RBAC permission: mcpRegistry:read

Input

Parameter	Type	Required	Description
`serverId`	`string`	Yes	The deployment ID of the MCP server.
`lines`	`integer`	No	Number of log lines to retrieve.

reload_mcp_server_tools

Required RBAC permission: mcpServerInstallation:create

Input

Parameter	Type	Required	Description
`serverId`	`string`	Yes	The deployment ID of the MCP server whose tools should be refreshed. Use list_mcp_server_deployments to find it.

MCP Gateways

Tool	Description	Permission
`create_mcp_gateway`	Create a new MCP gateway with the specified name, optional labels, and optional assigned knowledge bases or knowledge connectors.	`mcpGateway:create`
`get_mcp_gateway`	Get a specific MCP gateway by ID or name.	`mcpGateway:read`
`edit_mcp_gateway`	Edit an existing MCP gateway.	`update` on the MCP gateway (granted per item)

create_mcp_gateway

Required RBAC permission: mcpGateway:create

Input

Parameter	Type	Required	Description
`initialGrants`	`object[]`	No
`initialGrants[].subject`	`object`	Yes
`initialGrants[].subject.type`	`"user" \| "team" \| "serviceAccount" \| "role" \| "organization"`	Yes
`initialGrants[].subject.id`	`string \| "*"`	Yes
`initialGrants[].actions`	`string[]`	Yes
`name`	`string`	Yes	Name for the new resource.
`labels`	`object[]`	No	Optional key-value labels for organization and categorization.
`labels[].key`	`string`	Yes
`labels[].value`	`string`	Yes
`toolExposureMode`	`"full" \| "search_and_run_only"`	No	How tools should be loaded for MCP clients and models.
`accessAllTools`	`boolean`	No	Allow dynamic tool access: search_tools/run_tool may discover and run any tool the calling user can access (MCP catalog tools and knowledge sources) without assigning it to the agent. Enabling this forces toolExposureMode to 'search_and_run_only', since dynamic access only works through the search/run dispatch surface. Defaults to false. Also gated by the organization's security settings.
`accessAllSubagents`	`boolean`	No	Allow dynamic subagent delegation: the agent may delegate to any internal agent the calling user can access, beyond explicitly-configured delegation targets (minus subagent exclusions). Defaults to false.
`knowledgeBaseIds`	`string[]`	No	Knowledge base IDs to assign to the agent. Use get_knowledge_bases first when you need to look up IDs by name.
`connectorIds`	`string[]`	No	Knowledge connector IDs to assign directly to the agent. Use get_knowledge_connectors first when you need to look up IDs by name.
`subAgentIds`	`string[]`	No	Optional list of agent IDs that this MCP gateway can delegate to as subagents.

get_mcp_gateway

Required RBAC permission: mcpGateway:read

Input

Parameter	Type	Required	Description
`id`	`string`	No	The ID of the MCP gateway to fetch. Prefer the ID when you already have it.
`name`	`string`	No	The exact name of the MCP gateway to fetch when you do not already have the ID.

Output

Field	Type	Required	Description
`id`	`string`	Yes	The resource ID.
`name`	`string`	Yes	The resource name.
`description`	`string \| null`	Yes	The resource description, if any.
`icon`	`string \| null`	Yes	The emoji icon, if configured.
`scope`	`"personal" \| "team" \| "org"`	Yes	The visibility scope.
`toolExposureMode`	`"full" \| "search_and_run_only"`	Yes	How tools are loaded for MCP clients and models.
`accessAllTools`	`boolean`	Yes	Whether search_tools/run_tool may dynamically access every tool the calling user can access.
`accessAllSubagents`	`boolean`	Yes	Whether the agent may delegate to every internal agent the calling user can access.
`agentType`	`"agent" \| "llm_proxy" \| "mcp_gateway" \| "profile"`	Yes	The resource type.
`systemPrompt`	`string \| null`	No
`teams`	`object[]`	Yes	The teams attached to it.
`teams[].id`	`string`	Yes	The team ID.
`teams[].name`	`string`	Yes	The team name.
`labels`	`object[]`	Yes	Assigned labels.
`labels[].key`	`string`	Yes	The label key.
`labels[].value`	`string`	Yes	The label value.
`tools`	`object[]`	Yes	Assigned tools.
`tools[].id`	`string`	Yes	The assigned tool ID.
`tools[].name`	`string`	Yes	The tool name.
`tools[].description`	`string \| null`	Yes	The tool description, if any.
`tools[].catalogId`	`string \| null`	Yes	The MCP catalog ID the tool comes from, if any.
`knowledgeBaseIds`	`string[]`	Yes	Assigned knowledge base IDs.
`connectorIds`	`string[]`	Yes	Assigned knowledge connector IDs.
`suggestedPrompts`	`object[]`	Yes	Configured suggested prompts.
`suggestedPrompts[].summaryTitle`	`string`	Yes	The short title shown in the chat UI.
`suggestedPrompts[].prompt`	`string`	Yes	The suggested prompt text.

edit_mcp_gateway

Required RBAC permission: update on the MCP gateway (granted per item)

Input

Parameter	Type	Required	Description
`id`	`string`	Yes	The ID of the MCP gateway to edit. Use get_mcp_gateway to look it up by name first if needed.
`description`	`string \| null`	No	New description for the MCP gateway.
`icon`	`string \| null`	No	New emoji icon for the MCP gateway.
`labels`	`object[]`	No	Replace the MCP gateway's labels with this set.
`labels[].key`	`string`	Yes
`labels[].value`	`string`	Yes
`name`	`string`	No	New name for the MCP gateway.
`toolExposureMode`	`"full" \| "search_and_run_only"`	No	How tools should be loaded for MCP clients and models.
`accessAllTools`	`boolean`	No	Allow dynamic tool access: search_tools/run_tool may discover and run any tool the calling user can access (MCP catalog tools and knowledge sources) without assigning it to the agent. Enabling this forces toolExposureMode to 'search_and_run_only', since dynamic access only works through the search/run dispatch surface. Defaults to false. Also gated by the organization's security settings.
`accessAllSubagents`	`boolean`	No	Allow dynamic subagent delegation: the agent may delegate to any internal agent the calling user can access, beyond explicitly-configured delegation targets (minus subagent exclusions). Defaults to false.
`knowledgeBaseIds`	`string[]`	No	Replace the MCP gateway's assigned knowledge bases with this set.
`connectorIds`	`string[]`	No	Replace the MCP gateway's directly assigned knowledge connectors with this set.
`subAgentIds`	`string[]`	No	Optional list of agent IDs that this MCP gateway can delegate to as subagents.

Tool Assignment

Tool	Description	Permission
`bulk_assign_tools_to_agents`	Assign multiple tools to multiple agents in bulk with validation and error handling	`update` on the agent (granted per item)
`bulk_remove_tools_from_agents`	Remove multiple tools from multiple agents in bulk.	`update` on the agent (granted per item)
`bulk_assign_tools_to_mcp_gateways`	Assign multiple tools to multiple MCP gateways in bulk with validation and error handling	`update` on the MCP gateway (granted per item)

bulk_assign_tools_to_agents

Required RBAC permission: update on the agent (granted per item)

Input

Parameter	Type	Required	Description
`assignments`	`object[]`	Yes	Assignments to create or update for agents.
`assignments[].toolId`	`string`	Yes	The ID of the tool to assign.
`assignments[].resolveAtCallTime`	`boolean`	No	When true, resolve credentials and execution target at tool call time. Prefer this for builder flows.
`assignments[].credentialResolutionMode`	`"static" \| "dynamic" \| "enterprise_managed"`	No
`assignments[].mcpServerId`	`string \| null`	No	Optional MCP server installation to pin the tool to when using static credential resolution.
`assignments[].agentId`	`string`	Yes	The agent ID to assign the tool to.

Output

Field	Type	Required	Description
`succeeded`	`object[]`	Yes	Assignments that succeeded.
`succeeded[].agentId`	`string`	Yes	The target agent ID.
`succeeded[].toolId`	`string`	Yes	The tool ID.
`succeeded[].error`	`string`	No	Validation or assignment error.
`succeeded[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`succeeded[].errorType`	`string`	No	Structured assignment error type.
`failed`	`object[]`	Yes	Assignments that failed.
`failed[].agentId`	`string`	Yes	The target agent ID.
`failed[].toolId`	`string`	Yes	The tool ID.
`failed[].error`	`string`	No	Validation or assignment error.
`failed[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`failed[].errorType`	`string`	No	Structured assignment error type.
`duplicates`	`object[]`	Yes	Assignments skipped because they already existed.
`duplicates[].agentId`	`string`	Yes	The target agent ID.
`duplicates[].toolId`	`string`	Yes	The tool ID.
`duplicates[].error`	`string`	No	Validation or assignment error.
`duplicates[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`duplicates[].errorType`	`string`	No	Structured assignment error type.

bulk_remove_tools_from_agents

Required RBAC permission: update on the agent (granted per item)

Input

Parameter	Type	Required	Description
`removals`	`object[]`	Yes	Tool removals to apply to agents.
`removals[].agentId`	`string`	Yes	The agent ID to remove the tool from.
`removals[].toolId`	`string`	Yes	The ID of the tool to remove.

Output

Field	Type	Required	Description
`succeeded`	`object[]`	Yes	Removals that took effect.
`succeeded[].agentId`	`string`	Yes	The target agent ID.
`succeeded[].toolId`	`string`	Yes	The tool ID.
`succeeded[].error`	`string`	No	Permission or removal error.
`notAssigned`	`object[]`	Yes	Removals skipped because the tool was not assigned to the agent (Custom mode).
`notAssigned[].agentId`	`string`	Yes	The target agent ID.
`notAssigned[].toolId`	`string`	Yes	The tool ID.
`notAssigned[].error`	`string`	No	Permission or removal error.
`failed`	`object[]`	Yes	Removals that failed (e.g. no permission, agent not found, or a tool that cannot be excluded).
`failed[].agentId`	`string`	Yes	The target agent ID.
`failed[].toolId`	`string`	Yes	The tool ID.
`failed[].error`	`string`	No	Permission or removal error.

bulk_assign_tools_to_mcp_gateways

Required RBAC permission: update on the MCP gateway (granted per item)

Input

Parameter	Type	Required	Description
`assignments`	`object[]`	Yes	Assignments to create or update for MCP gateways.
`assignments[].toolId`	`string`	Yes	The ID of the tool to assign.
`assignments[].resolveAtCallTime`	`boolean`	No	When true, resolve credentials and execution target at tool call time. Prefer this for builder flows.
`assignments[].credentialResolutionMode`	`"static" \| "dynamic" \| "enterprise_managed"`	No
`assignments[].mcpServerId`	`string \| null`	No	Optional MCP server installation to pin the tool to when using static credential resolution.
`assignments[].mcpGatewayId`	`string`	Yes	The MCP gateway ID to assign the tool to.

Output

Field	Type	Required	Description
`succeeded`	`object[]`	Yes	Assignments that succeeded.
`succeeded[].mcpGatewayId`	`string`	Yes	The target MCP gateway ID.
`succeeded[].toolId`	`string`	Yes	The tool ID.
`succeeded[].error`	`string`	No	Validation or assignment error.
`succeeded[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`succeeded[].errorType`	`string`	No	Structured assignment error type.
`failed`	`object[]`	Yes	Assignments that failed.
`failed[].mcpGatewayId`	`string`	Yes	The target MCP gateway ID.
`failed[].toolId`	`string`	Yes	The tool ID.
`failed[].error`	`string`	No	Validation or assignment error.
`failed[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`failed[].errorType`	`string`	No	Structured assignment error type.
`duplicates`	`object[]`	Yes	Assignments skipped because they already existed.
`duplicates[].mcpGatewayId`	`string`	Yes	The target MCP gateway ID.
`duplicates[].toolId`	`string`	Yes	The tool ID.
`duplicates[].error`	`string`	No	Validation or assignment error.
`duplicates[].errorCode`	`"not_found" \| "validation_error" \| "forbidden"`	No	Structured assignment error code.
`duplicates[].errorType`	`string`	No	Structured assignment error type.