Skip to content

Tool Reference

Full signatures for the MCP tools across the 12 server classes. This is the exhaustive form of the §07 — MCP Architecture catalog, which gives one-line purposes; here every parameter, return shape, tier, and server group is enumerated from code.

Tools are grouped by capability domain across four pages, mirroring §07's map:

How to read a signature

Every tool method shares two parameters that do not appear in the schema the LLM sees and are not agent-supplied:

  • First parameter IServiceProvider serviceProvider — injected from DI; tools resolve their dependencies at call time (the server classes have no constructor injection).
  • Last parameter CancellationToken cancellationToken = default — supplied by the host.

The signatures on the domain pages list only the agent-facing parameters — the ones the model populates. Every tool returns Task<string>; the string is human-readable prose/Markdown unless noted as JSON (a JSON-encoded string the orchestrator or worker parses).

The catalog at a glance

All 44 tools, their server group, and their security tier. Group and tier are both fixed in static maps in McpToolRouter — code, not configuration.

Tool Class Group Tier
read_file WorkspaceTools workspace Standard
write_file WorkspaceTools workspace Standard
edit_file WorkspaceTools workspace Standard
list_files WorkspaceTools workspace Standard
revert_file WorkspaceTools workspace Standard
search_files WorkspaceTools workspace Standard
run_shell ShellTools shell Elevated
read_logs ShellTools shell Elevated
web_search ResearchTools research Elevated
web_fetch ResearchTools research Elevated
http_request ResearchTools research Elevated
http_health_check ResearchTools research Elevated
download_pdf ResearchTools research Restricted
capture_reference ResearchTools research Elevated
search_knowledge KnowledgeTools knowledge Standard
write_knowledge KnowledgeTools knowledge Standard
analyze_code QualityTools quality Standard
code_review QualityTools quality Standard
run_tests QualityTools quality Standard
validate_web_app QualityTools quality Standard
capture_api_schema QualityTools quality Standard
record_style QualityTools quality Standard
check_finishing QualityTools quality Standard
play_test QualityTools quality Standard
create_plan PlanningTools planning Standard
read_plan PlanningTools planning Standard
update_plan PlanningTools planning Standard
todo PlanningTools planning Standard
notify_user CommunicationTools comms Standard
report_progress CommunicationTools comms Standard
delegate OrchestrationTools orchestration Standard
reply OrchestrationTools orchestration Standard
spawn_subagents OrchestrationTools orchestration Elevated
send_message_to TeamMessagingTools team Standard
comfyui_generate ComfyUITools comfyui Standard
comfyui_status ComfyUITools comfyui Standard
finish_image ComfyUITools comfyui Standard
comfyui_video ComfyUITools video Standard
tts_render AudioTools audio Standard
tts_status AudioTools audio Standard
frame_status DeviceTools device Standard
frame_install DeviceTools device Restricted
frame_run DeviceTools device Restricted
frame_grab DeviceTools device Restricted

Tally: 32 Standard · 8 Elevated · 4 Restricted. The tier is resolved by lookup with a default of Standard — any tool absent from the tier map is Standard, which is why adding a tool without touching the map silently makes it Standard.

Security tiers

Tier Behavior Tools
Standard Executes immediately; basic audit record The 32 not listed below
Elevated Executes with enhanced audit (full args + result captured) web_search, web_fetch, http_request, http_health_check, capture_reference, run_shell, read_logs, spawn_subagents
Restricted Blocks for human approval before executing download_pdf, frame_install, frame_run, frame_grab

Two tools carry a second gate beyond their tier, independent of the map:

  • download_pdf is Restricted and the method runs its own approval request with supervisor fallback disabled — gated twice.
  • run_shell is Elevated, but if the command matches a destructive pattern (systemctl, docker restart/rm/stop, dotnet publish, appsettings, rm -rf, chmod, chown, sudo) the method forces human approval with no supervisor fallback.

Trust the map, not the class comments

Several server-class XML doc comments misstate tiers — OrchestrationTools claims "Restricted," ComfyUITools claims "Elevated," and QualityTools claims validate_web_app/capture_api_schema are Elevated. All are wrong. The authoritative tiers are the table above, taken from the ToolSecurityLevels map. Where this reference and a class comment disagree, the map wins.

Argument coercion at the router

A few parameters are normalized by the router before the tool sees them — relevant because the agent-facing contract is looser than the C# signature suggests:

Tool · parameter Coercion
http_request.headers Accepts a JSON string or a JSON object
validate_web_app.checks, capture_api_schema.endpoints, create_plan.steps, spawn_subagents.subagents Accept a real JSON array or a stringified array
update_plan Accepts step_number or step_id; a legacy step_index alias stands in for step_id when it is absent
comfyui_generate.wait Defaults to true at the router (matches the method default)
comfyui_generate.save_dir Defaults to images at the router when the agent omits it
comfyui_generate.filename Passed through when given; absent means the image keeps ComfyUI's own file name
comfyui_generate.ratio, .transparent, .reference_images Passed through; transparent defaults to false; reference_images accepts a comma-separated string or an array
finish_image.images Accepts a comma-separated string or an array

The connection layer

A tool is only visible to an agent whose mcp_servers allowlist includes the tool's group. When a node omits mcp_servers, it is derived from the node's tools by mapping each tool through the group map and taking the distinct set (Schema · mcp_servers derivation). The composition resolver settles the tools list on every creation path — profiles expand, a hierarchical or sequential supervisor gains delegate and reply (and the planner tools when it has create_plan), workers gain reply — and logs each addition (Schema · the tools list). At run time, a call to a tool outside the node's list is refused unless the team's tool_requests policy and the profile's expansion set allow the tool-request gate to grant it for the run. The mechanism is in §07.

Where to go next