Agent door · Reference

Tools reference

The 14 tools the agent door exposes today. Generated from the server's tool registry and drift-checked in CI on every change, so this table stays in lockstep with what the door serves.

Each tool gates on a capability the calling grant must hold. A parameter marked * is required. Write tools are held for human approval by default — see Write approvals.

Tool	Capability	Kind	Parameters	Description
`list_diagnostics`	`diagnostic.list`	read	`client_id` `since` `limit` `cursor`	List diagnostic reports in this workspace (newest first), with cursor pagination. Each item carries its derived status. Optional filters: client_id, since (created-at floor, RFC 3339).
`get_diagnostic`	`diagnostic.read`	read	`id*`	Fetch a single diagnostic report by id, including its derived status and report_id when complete.
`get_report`	`report.read`	read	`id*`	Fetch the forensic report payload for a completed diagnostic by id. raw_signals and internal columns are never exposed. Returns report_not_ready until the diagnostic completes.
`list_action_items`	`action_item.list`	read	`client_id` `source_id` `status` `limit` `cursor`	List action items in this workspace (newest first), with cursor pagination. Optional filters: client_id, source_id, status.
`get_action_item`	`action_item.read`	read	`id*`	Fetch a single action item by id.
`get_usage`	`usage.read`	read	`client_id`	Read this workspace's monthly diagnostic quota + consumption (optionally for one client). Mirrors GET /v1/usage.
`list_strategic_assessments`	`strategic_assessment.list`	read	`client_id` `diagnostic_report_id` `limit` `cursor`	List PUBLISHED strategic assessment deliverables in this workspace (newest first), with cursor pagination. Optional filters: client_id, diagnostic_report_id.
`get_strategic_assessment`	`strategic_assessment.read`	read	`id*`	Fetch a single PUBLISHED strategic assessment deliverable by id.
`list_infrastructure_audits`	`infrastructure_audit.list`	read	`client_id` `diagnostic_report_id` `limit` `cursor`	List PUBLISHED infrastructure audit deliverables in this workspace (newest first), with cursor pagination. Optional filters: client_id, diagnostic_report_id.
`get_infrastructure_audit`	`infrastructure_audit.read`	read	`id*`	Fetch a single PUBLISHED infrastructure audit deliverable by id.
`get_approval_status`	`action_item.update`	read	`approval_id*`	Poll a held write by approval_id (returned by a write tool). Status is one of: pending_approval, applying, applied, denied, expired, failed.
`update_action_item`	`action_item.update`	write	`id*` `status` `assigned_to` `due_date` `resolution_notes`	Request an update to an action item's lifecycle fields (status, assigned_to, due_date, resolution_notes). By default the write is HELD for human approval: the call returns {status: 'pending_approval', approval_id} and nothing is changed until an org admin approves it (poll with get_approval_status). Grants with auto-approve enabled apply directly. Status transitions follow the same rules as the dashboard; suggested/verified are system-set and not settable.
`add_action_item_comment`	`action_item.comment`	write	`id` `body`	Add a comment to an action item's activity timeline — what you did, what you found, what you need from a human. By default the comment is HELD for human approval: the call returns {status: 'pending_approval', approval_id} and nothing is posted until an org admin approves it (poll with get_approval_status). Grants with auto-approve enabled post directly. Comments are append-only — this tool cannot edit or delete anything, and cannot change the item's status.
`run_diagnostic`	`diagnostic.run`	write	`prior_diagnostic_id*` `side_a_scores` `budget` `advertising_budget` `advertising_budget_digital` `advertising_platform_fees` `digital_share_pct`	Request a fresh Diagnostic run against the same target as an earlier one, replaying that run's stored intake. Required argument: the prior diagnostic's id. The TARGET IS FIXED — the business, website URL and account are always the prior run's and cannot be supplied or changed here. You may optionally override the run's numeric inputs: side_a_scores (per-pillar self-assessment, 1–10) and the spend figures budget, advertising_budget, advertising_budget_digital, advertising_platform_fees, digital_share_pct. Overrides merge over the replayed intake — a field or pillar you omit keeps the prior run's value, and any override you send is shown to the approver alongside that prior value. This run is BILLED, so it is ALWAYS held for human approval regardless of any auto-approve setting. It is billed exactly as a person's run would be: it uses one of the organization's included monthly Diagnostics if any remain, and only if that monthly allowance is already used up does it cost the organization's wallet a per-run overage fee. Which of the two applies is decided when you request the run, shown to the approver, and checked again when they approve — if the allowance ran out in between, the run is refused rather than silently charged, and you may request it again. The new diagnostic then takes roughly 5–10 minutes to complete. The call returns {status: 'pending_approval', approval_id}; poll get_approval_status, then poll get_diagnostic on the id the approval returns. Availability is limited to organizations explicitly enabled for agent-initiated runs; other grants cannot hold this capability.

Tools are advertised over MCP via tools/list and invoked via tools/call. The advertised set is static per deployment; authority is checked at call time, so a grant with fewer capabilities simply cannot invoke the tools it does not hold.