Platform MCP tools
Reference for the tools exposed by Yodu's workspace-scoped Platform MCP server.
Platform tools derive the workspace from the verified API-key or OAuth request. Onboarding tools never accept an organization, user or actor ID. OAuth additionally exposes list_workspaces and set_active_workspace; the latter selects the workspace for the next HTTP request, not concurrent batch peers already admitted in this request. Use tools/list for the current registered inventory.
Guided onboarding
All these tools use the same actor-bound operations and optimistic versions as the website. Every read requires workspace:read and live owner/admin membership. Every mutation also requires workspace:write. Existing subscription admission is unchanged. A stale version/revision requires a fresh read and explicit user decision; writes are not silently merged or replayed.
| Tool | Purpose and additional boundary |
|---|---|
get_onboarding_guide | Read deterministic next actions, explicit consent prerequisites, the selected job and secure website model/account/HUMAN review handoffs |
get_onboarding_status | Read approved brief, revision, original task/artifact IDs and separate readiness/proof facts |
get_onboarding_draft | Read unapproved partial edits and draft version |
save_onboarding_draft | Save a bounded patch with expectedVersion; does not approve a job |
save_onboarding_brief | Save the complete agreed brief with expectedRevision; started job scope stays immutable |
get_onboarding_accounts | Read only accounts required by the selected job |
get_onboarding_vercel_resources | Explicit authorized team/project read probe; may refresh the stored provider authorization internally |
verify_onboarding_account_resource | Explicitly select/verify the exact resource with expectedRevision; does not grant employee or deployment access |
prepare_onboarding | Owner-only bounded preparation with literal consent: true; hosted preview requires separate selected-connection restriction consent |
cancel_onboarding_preparation | Owner-only cancellation with expectedRevision |
start_onboarding_first_job | Explicit start/retry of the original job with existing readiness/work grants; preparation retries remain owner-only and uncertain delivery cannot replay |
No accept_onboarding_result tool exists. The guide returns an authenticated website handoff for independent HUMAN review. Existing task mutations cannot manufacture its required review receipt. A saved model key is not observed model output; an observed response is not final acceptance or publication permission. Employee/runtime MCP is a separate principal and receives none of these owner onboarding tools.
Public onboarding results field-pick workspace identity, schema-bounded company/job text, optimistic versions, known phases and proof flags. They omit arbitrary task evidence/external URLs, provider errors, native connection URL labels/revisions, raw runtime payload/results and owner/command/hash internals. New tools accept no raw credentials and offer no stored-secret reads.
Read workspace state
Requires workspace:read and current workspace membership.
| Tool | Purpose |
|---|---|
get_workspace | Return the workspace identity bound to the connection |
get_workspace_overview | Summarize employees, work, and needs-attention activity for up to 90 days |
get_workspace_settings | Read model routing and runtime resource limits (owner or admin) |
get_workspace_coding_limits | Read cloud coding limits in force and the platform defaults |
list_agents | List workspace employees, status, runtime identity, and channel |
list_agent_configs | List one employee's bounded, versioned operating-document bodies (owner or admin) |
list_models | List model references runnable in the workspace (owner or admin) |
get_agent_skills | Read one employee's defaults, overrides, and effective skill loadout (owner or admin) |
list_connected_tools | List safe connected-app metadata, grants, and cloud-coding state for one employee (owner/admin) |
list_agent_files | List bounded, versioned custom-file metadata; content is never returned (owner or admin) |
list_secrets | List secret names, scope, and whether each reaches the agents' sandbox; never their values |
list_role_templates | List role templates available when creating an employee |
list_memory | List shared memory, or one employee's local memory with owner/admin access |
read_memory | Read shared memory or, with owner/admin access, an employee-local document by ID |
list_tasks | List work with optional employee, status, priority, label, and search filters |
read_task | Read a bounded contract and recent discussion, or one paginated history section |
read_task_text | Read a field or comment body by revision and Unicode code-point offset |
get_runtime_health | Read an allowlisted runtime health summary and successful file-sync time |
get_runtime_state | Read safe current connection, container, queue, backup, and sync state without host internals |
get_runtime_command_status | Read one org-scoped command's status and retry timing without payloads, errors, or worker details |
list_custom_mcp_servers | List the workspace's custom MCP servers with header names only, never values (owner or admin) |
list_scheduled_jobs | List scheduled jobs and run status; raw provider error text is never returned |
Task reads are capped at 16 KiB of UTF-8 serialized text. Before acting, read all partial contract fields and full newest relevant comments with read_task_text; join JSON-encoded acceptance-criteria chunks before parsing. Every field and page reports completeness. Unsupported historical fields require owner clarification, and changed revisions require a fresh read. Section cursors bind the workspace, task and section; each page is newest first (default 5, maximum 20). Cursors page changing history, not an immutable snapshot; fetch a fresh first page to discover newly appended comments. Omitted sections are not complete history. Quality-review notes use their exact comment ID, so later comments cannot hide the current review. These tools do not expose raw review, attachment, activity or task-evidence JSON. File content and review/approval decisions retain their existing tools and permissions.
Create work and context
Requires workspace:write and current workspace membership.
| Tool | Purpose |
|---|---|
create_memory | Create shared or owner/admin employee-local memory in Markdown |
update_memory | Update shared or owner/admin employee-local memory |
create_task | Add a task to the board and dispatch the assignment workflow |
update_task | Update task content, priority, due date, link, assignee, or status and wake the employee when needed |
move_task | Move or reorder a board task; status transitions wake the assignee |
comment_task | Add an authenticated user comment or reply and wake the task's employee |
Configure employees
Requires workspace:write and an owner or admin role.
| Tool | Purpose |
|---|---|
create_agent | Create a recruitment draft from a role template |
provision_agent | Provision a drafted employee into the managed runtime |
repair_workspace_runtime | Force-rebuild the workspace runtime from Yodu's saved config (safety backup first); disruptive while the stack restarts |
activate_memory | Publish a sourced memory draft as live runtime context |
set_memory_status | Move memory to draft, superseded, or archived without deleting history |
set_workspace_model_routing | Set primary and cross-provider fallback models |
set_workspace_runtime_resources | Set gateway memory/CPU limits |
set_workspace_cost_guardrail | Set or clear the work-admission cost ceiling (USD). Agents stop creating new tasks past it; work in flight is never suppressed |
set_workspace_coding_limits | Set how many automated cloud coding turns employees may run per 24 hours (0 turns autonomous coding off) and how many sessions may run at once |
set_agent_autonomy | Set an employee's overall permission mode (how strictly the approval gate applies). The fully ungated mode is intentionally not settable via API. Per-tool switches live in set_agent_tool_access |
write_agent_config | Write any of the seven versioned employee operating-document kinds |
set_agent_model | Select an available workspace model for an employee |
set_agent_role | Reassign an employee to a different workspace role (by roleId) |
set_agent_skills | Add or remove skill overrides relative to the employee's role baseline |
set_agent_cloud_coding | Enable or disable Claude Code or Codex for one employee; disabling cancels that provider's live sessions |
set_agent_tool_access | Enable or disable one connected app or custom MCP server for one employee |
create_scheduled_job | Create a recurring job that delivers a prompt to an employee on a cron schedule (evaluated in the job's timezone) |
update_scheduled_job | Update a scheduled job's schedule, timezone, prompt, assignment, or status (the next run is recomputed on change) |
delete_scheduled_job | Delete a scheduled job by ID |
run_scheduled_job | Run a scheduled job immediately without changing its cadence |
activate_scheduled_job | Activate a paused or draft schedule so its cron fires again; refused when the assigned employee fails the latest runtime parity check |
write_agent_file | Provision a safe custom file beneath an employee's skills/ or scripts/ path |
list_management_grants | Read who currently holds which management authority (WORK_TRANSITION, REVIEW_DECIDE, ...), with the employee or member each grant belongs to |
update_management_grant | Issue or withdraw one management authority; grant WORK_TRANSITION so a teammate can accept a peer's submitted work and drain a paused review queue |
Schedule timezones
The scheduler evaluates every cron expression against the job's timezone, an IANA name such as America/New_York. A missing or invalid timezone falls back to UTC. Changing a job's cron expression or timezone through create_scheduled_job or update_scheduled_job recomputes the next run immediately, so the schedule matches the declared wall clock from the first fire.
Write protected configuration
Requires secrets:write and an owner or admin role. Values are encrypted and never returned by a tool response.
| Tool | Purpose |
|---|---|
add_custom_mcp_server | Register an HTTPS MCP server with optional encrypted request headers |
remove_custom_mcp_server | Remove a custom MCP server and its encrypted headers, then update every agent's runtime |
set_model_provider_key | Store supported model-provider access for the workspace |
connect_cloud_agent | Connect a Claude Code routine (from claude.ai/code/routines) so employees can delegate coding tasks to cloud sessions; the trigger token is encrypted and write-only |
set_workspace_secret | Store a named workspace-wide or employee-scoped tool secret; exposeToAgents also projects it into the agents' sandbox environment |
Cloud coding agents
| Tool | Purpose | Requires |
|---|---|---|
connect_cloud_agent | Connect a Claude Code routine; the trigger token is encrypted and write-only | secrets:write, owner or admin |
list_connected_github_for_coding | List workspace-scoped GitHub integrations and repository metadata without returning provider account identifiers, credentials, or tokens | workspace:read, owner or admin |
connect_cloud_coding_repo | Connect a GitHub repo for interactive coding. Private repositories require an existing owner-verified Yodu GitHub App binding; no routine or token is accepted | secrets:write, owner or admin |
list_cloud_agent_connections | List connected cloud coding agents (id, label, repo, trigger id, status); tokens are never included | workspace:read |
update_cloud_agent_connection | Revoke one organization-fenced cloud-agent or cloud-coding connection while preserving its audit record; credentials are never returned | secrets:write, owner or admin |
get_cloud_agent_setup_guide | Return the canonical routine prompt template and the numbered claude.ai setup steps (plan, GitHub, routine, Environment, API trigger); read-only | workspace:read |
Deliberate exclusions
There is no tool to read a stored secret value, select a different workspace, manage billing, impersonate a user, change members, delete the workspace, decide an approval, create an OAuth app connection, or invoke the raw runtime bootstrap. read_task returns only an allowlisted task DTO with approval summaries and evidence-file metadata; raw evidence JSON, activity data, and attachment properties are excluded. list_agent_files returns metadata only, never file bodies. Runtime health and scheduled-run responses omit arbitrary diagnostic payloads and raw provider error text. Destructive reach is limited to configuration entries the same connection created: a custom MCP server registration (remove_custom_mcp_server), a scheduled job (delete_scheduled_job), and a cloud-agent connection (update_cloud_agent_connection revokes it while retaining audit history); employee and workspace deletion stay in the app. Workspace repair is exposed through repair_workspace_runtime (owner/admin only, safety backup first); the underlying bootstrap fetch and container lifecycle stay internal. list_secrets deliberately returns names and safe metadata so clients can detect existing configuration before a rotation; it never returns credential material. Its reachesAgentSandbox field answers a different question from "is it configured": a secret is consumed by the platform on the employees' behalf unless it was stored with exposeToAgents, in which case its value is also placed in their sandbox environment for their own scripts to read. Names the agent runtime deletes (anything ending in API_KEY, TOKEN, PASSWORD, PRIVATE_KEY or SECRET) are refused at write time rather than stored and dropped later, so a credential of that shape belongs in a single connection URL. Platform MCP is a curated operator surface, not a mirror of Yodu's private application API.