Agent door · Reference

Tools reference

The 12 tools the agent door exposes today. Generated from the server's tool registry and drift-checked in CI on every change, so this table stays in lockstep with what the door serves.

Each tool gates on a capability the calling grant must hold. A parameter marked * is required. Write tools are held for human approval by default — see Write approvals.

Tool	Capability	Kind	Parameters	Description
`list_diagnostics`	`diagnostic.list`	read	`client_id` `since` `limit` `cursor`	List diagnostic reports in this workspace (newest first), with cursor pagination. Each item carries its derived status. Optional filters: client_id, since (created-at floor, RFC 3339).
`get_diagnostic`	`diagnostic.read`	read	`id*`	Fetch a single diagnostic report by id, including its derived status and report_id when complete.
`get_report`	`report.read`	read	`id*`	Fetch the forensic report payload for a completed diagnostic by id. raw_signals and internal columns are never exposed. Returns report_not_ready until the diagnostic completes.
`list_action_items`	`action_item.list`	read	`client_id` `source_id` `status` `limit` `cursor`	List action items in this workspace (newest first), with cursor pagination. Optional filters: client_id, source_id, status.
`get_action_item`	`action_item.read`	read	`id*`	Fetch a single action item by id.
`get_usage`	`usage.read`	read	`client_id`	Read this workspace's monthly diagnostic quota + consumption (optionally for one client). Mirrors GET /v1/usage.
`list_strategic_assessments`	`strategic_assessment.list`	read	`client_id` `diagnostic_report_id` `limit` `cursor`	List PUBLISHED strategic assessment deliverables in this workspace (newest first), with cursor pagination. Optional filters: client_id, diagnostic_report_id.
`get_strategic_assessment`	`strategic_assessment.read`	read	`id*`	Fetch a single PUBLISHED strategic assessment deliverable by id.
`list_infrastructure_audits`	`infrastructure_audit.list`	read	`client_id` `diagnostic_report_id` `limit` `cursor`	List PUBLISHED infrastructure audit deliverables in this workspace (newest first), with cursor pagination. Optional filters: client_id, diagnostic_report_id.
`get_infrastructure_audit`	`infrastructure_audit.read`	read	`id*`	Fetch a single PUBLISHED infrastructure audit deliverable by id.
`get_approval_status`	`action_item.update`	read	`approval_id*`	Poll a held write by approval_id (returned by a write tool). Status is one of: pending_approval, applying, applied, denied, expired, failed.
`update_action_item`	`action_item.update`	write	`id*` `status` `assigned_to` `due_date` `resolution_notes`	Request an update to an action item's lifecycle fields (status, assigned_to, due_date, resolution_notes). By default the write is HELD for human approval: the call returns {status: 'pending_approval', approval_id} and nothing is changed until an org admin approves it (poll with get_approval_status). Grants with auto-approve enabled apply directly. Status transitions follow the same rules as the dashboard; suggested/verified are system-set and not settable.

Tools are advertised over MCP via tools/list and invoked via tools/call. The advertised set is static per deployment; authority is checked at call time, so a grant with fewer capabilities simply cannot invoke the tools it does not hold.