Platform MCP server

VisIQ exposes an authenticated Model Context Protocol (MCP) server so an AI agent or MCP-capable client can operate the product with tool calls instead of raw REST. It is the same management surface as the web app and the automation API — every tool enforces the identical RBAC permission its web route requires.

There are two VisIQ MCP servers, both listed in /.well-known/mcp/server-cards.json:

Public MCP — https://visiqlabs.com/mcp — read-only discovery, no credentials. Public information about VisIQ only.
Platform MCP (this page) — https://app.visiqlabs.com/api/mcp — authenticated; operates your tenant.

Endpoint & transport


URL	`https://app.visiqlabs.com/api/mcp`
Transport	Streamable HTTP (stateless)
Auth	`Authorization: Bearer <management-key>`, required for `tools/call`
Protocol	MCP `2025-06-18` (also `2025-03-26`)

You need a management-audience API key. Get one from Connectors → API Keys in the dashboard, or have your agent self-register with "requested_key_type": "management". A harness key is confined to the SDK operational surface and is not accepted here.

What needs a key

Request	Credential
`initialize`, `ping`, `tools/list`	None. Discovery is open, so a client can list the tools before it has a key.
`tools/call` for `describe_chat`	A bearer must be present; the tool reads nothing about it.
Every other `tools/call`	A valid management key, checked before the tool runs.

Tool calls are fail-closed. A missing key is a JSON-RPC error; an unknown, revoked or expired key, or a harness key, is refused before any tool runs; and a tool whose permission the key does not hold returns an error naming the missing permission, never a partial result.

Connect a client

Every client needs the URL and an Authorization: Bearer header carrying a management key. Keep the key in an environment variable (VISIQ_API_KEY below), not in a file you commit. The Claude Code, Cursor and Claude Desktop shapes follow those clients’ own documentation at the time of writing; the curl call is tested against this server. Claude Code

claude mcp add --transport http visiq https://app.visiqlabs.com/api/mcp --header "Authorization: Bearer $VISIQ_API_KEY"

Cursor (.cursor/mcp.json)

{
  "mcpServers": {
    "visiq": {
      "url": "https://app.visiqlabs.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:VISIQ_API_KEY}"
      }
    }
  }
}

Claude Desktop has no field for a custom header on a remote server, so connect it through the community-maintained mcp-remote bridge (not a VisIQ project; check its current flags). The header value is passed through env because the bridge splits arguments on spaces:

{
  "mcpServers": {
    "visiq": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://app.visiqlabs.com/api/mcp",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer <your management key>"
      }
    }
  }
}

Any HTTP client (check a key without an MCP client):

curl -s https://app.visiqlabs.com/api/mcp \
  -H "Authorization: Bearer $VISIQ_API_KEY" \
  -H "Content-Type: application/json" \
  -H "MCP-Protocol-Version: 2025-06-18" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}}'

Then start with whoami to confirm which vendor, role and permissions your key resolves to. Every other tool is gated by those permissions.

Retries and audit

Retries. Read-only tools are always safe to repeat. create_rule, create_recall_rule and compile_rule take an optional idempotency_key: repeat the call with the same key and the same arguments (in any key order) and you get the first result back instead of a second write. Without a key, a repeated create_rule or create_recall_rule with the same name is refused with 409 A rule with this name already exists, but a repeated compile_rule can create a second rule under another name. update_rule, delete_rule, register_agent, update_agent, respond_hitl, update_allow_settings and revoke_self are safe to repeat: a second call changes nothing further or is refused. Key-order tolerance applies to calls made through this server; the REST API hashes the body exactly as sent.
Audit. Tool calls your key makes are recorded in Settings → Activity with the tool, the outcome and the key that made it. The record holds the size of the arguments, never their content. A write is recorded before it runs and is not attempted if that record cannot be written; a read is recorded after it answers, on a best-effort basis. Not recorded: describe_chat, which reads nothing about your key; calls refused before a key resolves (no key, or an unknown, revoked or expired one); calls naming an unknown tool or sending invalid arguments.

Tool catalog

Arguments are checked against each tool’s inputSchema before the tool runs: an argument the schema does not list, a missing required one, or a value of the wrong type is refused with -32602. The server advertises 26 tools through tools/list. Each one is gated by the same permission as its web API route; call whoami to see which your key holds.

Discovery

`whoami`

Return the vendor, role and effective permissions of the management key you authenticated with, exactly as every other tool resolves them.


Access	Read-only
Permission	`any (a valid management key; reports what it holds)`
Safe to retry	Yes (read-only)

Takes no arguments.

`describe_chat`

Discover the in-product AI chat surface: which chat_* tools exist, how to read the NlChatResult widgets (previews/final/clarify/navigate), and the catalog of pages a navigation proposal can point at.


Access	Read-only
Permission	`none (static discovery; a bearer must be present)`
Safe to retry	Yes (read-only)

Takes no arguments.

Governance rules (unified: action and retrieval)

`list_rules`

List the tenant’s unified governance rules (action and retrieval), paginated. Filter by facet with operations.


Access	Read-only
Permission	`allow_rules:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`operations`	`string`	no	Optional comma-separated facet filter, e.g. ‘action’ or ‘action,retrieval’.
`page`	`integer`	no	1-based page number. At least 1.
`limit`	`integer`	no	Page size. 1 to 200.

`get_rule`

Fetch a single governance rule (action or retrieval) by id, including its Rego and applies_to facets.


Access	Read-only
Permission	`allow_rules:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`id`	`string`	yes	Rule id (uuid).

`create_rule`

Create a governance rule. Author the logic in Rego and declare which operation facets it governs. Pass idempotency_key to make a retry safe.


Access	Write (creates)
Permission	`allow_rules:create`
Safe to retry	Only with `idempotency_key`

Argument	Type	Required	Notes
`operations`	`string[]`	yes	Which operation facets the rule applies to (must include ‘action’ or ‘retrieval’). One of `action`, `retrieval`, `delegation`. 1 to 3 items.
`name`	`string`	yes	Human-readable rule name (unique per tenant). 1 to 255 characters.
`description`	`string`	no	Optional human description. At most 1000 characters.
`rego_source`	`string`	yes	The rule body, authored in Rego (not blank). At least 1 characters.
`natural_language`	`string`	no	Optional natural-language summary of the rule intent. At most 2000 characters.
`priority`	`integer`	no	Evaluation priority (higher wins ties). Default 0.
`enabled`	`boolean`	no	Whether the rule is active. Default true on create.
`target_app`	`string or null`	no	Action facet: the target application the rule is scoped to. At most 255 characters.
`action_pattern`	`string or null`	no	Action facet: the action pattern the rule is scoped to. At most 255 characters.
`trust_tier`	`string or null`	no	Retrieval facet: the trust tier the rule applies to. At most 64 characters.
`surface`	`string or null`	no	Retrieval facet: the surface the rule applies to. At most 128 characters.
`principal_exclusions`	`string[] or null`	no	Retrieval facet: principals the rule never applies to.
`redaction_spec`	`object or null`	no	Retrieval facet: the stored redaction specification (see the rules API reference).
`fail_closed_on_empty_spec`	`boolean`	no	Retrieval facet: deny when the redaction spec resolves to nothing.
`alert_spec`	`object or null`	no	Alert side-effect that rides the rule’s decision; null clears it.
`idempotency_key`	`string`	no	Optional retry key (1-256 of A-Z a-z 0-9 _ -). Retrying with the same key and the same arguments within 24 hours returns the first result instead of creating another rule; the same key with different arguments is refused.

`update_rule`

Update an existing governance rule. Send any subset of its fields; omitted fields are unchanged.


Access	Write (changes or removes existing state)
Permission	`allow_rules:update`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`id`	`string`	yes	Rule id (uuid).
`operations`	`string[]`	no	Which operation facets the rule applies to (must include ‘action’ or ‘retrieval’). One of `action`, `retrieval`, `delegation`. 1 to 3 items.
`name`	`string`	no	Human-readable rule name (unique per tenant). 1 to 255 characters.
`description`	`string`	no	Optional human description. At most 1000 characters.
`rego_source`	`string`	no	The rule body, authored in Rego (not blank). At least 1 characters.
`natural_language`	`string`	no	Optional natural-language summary of the rule intent. At most 2000 characters.
`priority`	`integer`	no	Evaluation priority (higher wins ties). Default 0.
`enabled`	`boolean`	no	Whether the rule is active. Default true on create.
`target_app`	`string or null`	no	Action facet: the target application the rule is scoped to. At most 255 characters.
`action_pattern`	`string or null`	no	Action facet: the action pattern the rule is scoped to. At most 255 characters.
`trust_tier`	`string or null`	no	Retrieval facet: the trust tier the rule applies to. At most 64 characters.
`surface`	`string or null`	no	Retrieval facet: the surface the rule applies to. At most 128 characters.
`principal_exclusions`	`string[] or null`	no	Retrieval facet: principals the rule never applies to.
`redaction_spec`	`object or null`	no	Retrieval facet: the stored redaction specification (see the rules API reference).
`fail_closed_on_empty_spec`	`boolean`	no	Retrieval facet: deny when the redaction spec resolves to nothing.
`alert_spec`	`object or null`	no	Alert side-effect that rides the rule’s decision; null clears it.

`delete_rule`

Delete a governance rule by id.


Access	Write (changes or removes existing state)
Permission	`allow_rules:delete`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`id`	`string`	yes	Rule id (uuid).

`compile_rule`

Author a governance rule from a natural-language description via the in-product Rule Builder assistant. The assistant compiles the intent to Rego, simulates its impact, and PERSISTS the rule (write). An ACTION rule needs allow_rules:create, a RETRIEVAL rule needs recall_rules:create (whichever facet the assistant persists is enforced). Returns the compiled rule graph + related rules. Pass idempotency_key to make a retry safe: without it, a retried call can create a second rule.


Access	Write (creates)
Permission	`allow_rules:create OR recall_rules:create`
Safe to retry	Only with `idempotency_key`

Argument	Type	Required	Notes
`prompt`	`string`	yes	Natural-language description of the rule to create (e.g. ‘block agents from emailing external domains without approval’). 1 to 5000 characters.
`surface`	`string`	no	Surface hint. Default auto (the assistant detects it). One of `allow`, `recall`, `auto`.
`mode`	`string`	no	generate (default) returns a full rule; edit returns changes to currentGraph. One of `generate`, `edit`.
`currentGraph`	`object`	no	The serialized rule graph being edited; needed for mode=edit.
`nodeRef`	`string`	no	The rule the edit concerns. At most 255 characters.
`selectedNodeId`	`string`	no	The graph node the edit is focused on. At most 128 characters.
`idempotency_key`	`string`	no	Optional retry key (1-256 of A-Z a-z 0-9 _ -). Retrying with the same key and the same arguments within 24 hours returns the first result instead of creating another rule; the same key with different arguments is refused.

Retrieval-only rule aliases

`list_recall_rules`

List the tenant’s retrieval-governance rules only, paginated. list_rules returns both facets.


Access	Read-only
Permission	`recall_rules:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`page`	`integer`	no	1-based page number. At least 1.
`limit`	`integer`	no	Page size. 1 to 100.

`create_recall_rule`

Create a retrieval-governance rule, authored in Rego (the retrieval facet is set for you). Pass idempotency_key to make a retry safe.


Access	Write (creates)
Permission	`recall_rules:create`
Safe to retry	Only with `idempotency_key`

Argument	Type	Required	Notes
`name`	`string`	yes	Human-readable rule name (unique per tenant). 1 to 255 characters.
`description`	`string`	no	Optional human description. At most 1000 characters.
`rego_source`	`string`	yes	The rule body, authored in Rego (not blank). At least 1 characters.
`natural_language`	`string`	no	Optional natural-language summary of the rule intent. At most 2000 characters.
`priority`	`integer`	no	Evaluation priority (higher wins ties). Default 0.
`enabled`	`boolean`	no	Whether the rule is active. Default true on create.
`target_app`	`string or null`	no	Action facet: the target application the rule is scoped to. At most 255 characters.
`action_pattern`	`string or null`	no	Action facet: the action pattern the rule is scoped to. At most 255 characters.
`trust_tier`	`string or null`	no	Retrieval facet: the trust tier the rule applies to. At most 64 characters.
`surface`	`string or null`	no	Retrieval facet: the surface the rule applies to. At most 128 characters.
`principal_exclusions`	`string[] or null`	no	Retrieval facet: principals the rule never applies to.
`redaction_spec`	`object or null`	no	Retrieval facet: the stored redaction specification (see the rules API reference).
`fail_closed_on_empty_spec`	`boolean`	no	Retrieval facet: deny when the redaction spec resolves to nothing.
`alert_spec`	`object or null`	no	Alert side-effect that rides the rule’s decision; null clears it.
`idempotency_key`	`string`	no	Optional retry key (1-256 of A-Z a-z 0-9 _ -). Retrying with the same key and the same arguments within 24 hours returns the first result instead of creating another rule; the same key with different arguments is refused.

Agents

`list_agents`

List the tenant’s registered AI agents (across all connected frameworks) with governance metadata.


Access	Read-only
Permission	`allow_agents:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`page`	`integer`	no	1-based page number. At least 1.
`limit`	`integer`	no	Page size. 1 to 100.
`sort`	`string`	no	Sort column. One of `name`, `created_at`, `request_count_24h`, `deny_rate_1h`.
`dir`	`string`	no	Sort direction. Default desc. One of `asc`, `desc`.

`get_agent`

Fetch a single agent by id with its full governance profile.


Access	Read-only
Permission	`allow_agents:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`id`	`string`	yes	Agent row id (uuid).

`register_agent`

Register/connect an AI agent from a supported framework (LangChain, OpenAI Agents SDK, LlamaIndex, Vercel AI SDK, Mastra, VoltAgent, Semantic Kernel, Pydantic AI, OpenClaw, CrewAI, AutoGen, LangGraph, Google ADK, Strands Agents, …). agent_id is the natural key: registering the same agent_id again is refused (409), never duplicated.


Access	Write (creates)
Permission	`allow_agents:create`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`agent_id`	`string`	yes	Stable external agent identifier (the natural key). 1 to 255 characters.
`name`	`string`	yes	Display name. 1 to 255 characters.
`description`	`string`	no	At most 1000 characters.
`agent_type`	`string`	no	The framework/runtime this agent runs on. One of `langchain`, `openai_agents`, `llamaindex`, `vercel_ai`, `mastra`, `voltagent`, `semantic_kernel`, `pydantic_ai`, `openclaw`, `crewai`, `autogen`, `langgraph`, `google_adk`, `strands`, `unknown`.
`kind`	`string`	no	sdk (default) or cli_harness. One of `sdk`, `cli_harness`.
`mode`	`string or null`	no	Governance mode. Omit or null to inherit the org default. One of `enforce`, `monitor`, `audit`, `off`.
`mode_by_operation`	`object or null`	no	Per-operation mode override; each key is optional. null clears it.
`owner_email`	`string`	no	The owning human’s email. At most 320 characters.
`hitl_pathway`	`string`	no	Channel the owner is asked on. One of `slack`, `teams`, `email`.
`trust_tier`	`string`	no	One of `tier1`, `tier2`, `tier3`.
`categories`	`string[]`	no	One of `read_only`, `transactional`, `data_processor`, `external_comms`, `code_exec`, `privileged`, `internal`, `customer_facing`, `experimental`, `third_party`. At most 10 items.
`no_coverage`	`string or null`	no	Fail-safe when no rule governs an event; null inherits the tenant default. One of `open`, `closed`.

`update_agent`

Update an agent’s governance settings (mode, trust tier, categories, business function, owner, HITL pathway, shutdown, …). Unknown fields are refused.


Access	Write (changes or removes existing state)
Permission	`allow_agents:update`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`id`	`string`	yes	Agent row id (uuid).
`name`	`string`	no	1 to 255 characters.
`description`	`string`	no	At most 1000 characters.
`mode`	`string or null`	no	null clears the override (inherit). One of `enforce`, `monitor`, `audit`, `off`.
`mode_by_operation`	`object or null`	no	Per-operation mode override; each key is optional. null clears it.
`owner_email`	`string`	no	At most 320 characters.
`hitl_pathway`	`string or null`	no	One of `slack`, `teams`, `email`.
`trust_tier`	`string or null`	no	One of `tier1`, `tier2`, `tier3`.
`categories`	`string[]`	no	Replaces the whole set. One of `read_only`, `transactional`, `data_processor`, `external_comms`, `code_exec`, `privileged`, `internal`, `customer_facing`, `experimental`, `third_party`. At most 10 items.
`business_function`	`string or null`	no	Pins a single business function (snake_case id). At most 48 characters.
`business_functions`	`string[]`	no	Pins the full business-function set (wins over business_function). At most 64 items.
`business_function_source`	`string`	no	’ai’ releases a human pin; ‘user’ pins without changing the set. One of `ai`, `user`.
`no_coverage`	`string or null`	no	One of `open`, `closed`.
`fail_mode`	`string or null`	no	One of `open`, `closed`.
`shutdown`	`boolean`	no	true shuts the agent down (fail-closed); false reactivates it.

Decisions and action schemas

`get_decision_outcomes`

Read governance decision outcomes (the decision audit log): each agent action or retrieval and whether it was permitted, denied, sent to approval, or masked.


Access	Read-only
Permission	`allow_audit_log:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`agent_id`	`string`	no	1 to 255 characters.
`decision`	`string`	no	One of `permit`, `deny`, `approval_required`, `mask`.
`start_date`	`string`	no	ISO date/time lower bound.
`end_date`	`string`	no	ISO date/time upper bound.
`page`	`integer`	no	1-based page number. At least 1.
`limit`	`integer`	no	Page size. 1 to 100.

`list_action_schemas`

List the discovered action/tool schemas and their field mappings for the tenant’s agents.


Access	Read-only
Permission	`allow_rules:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`limit`	`integer`	no	Page size. 1 to 200.
`source_type`	`string`	no	Only action or only retrieval schemas. One of `action`, `retrieval`.

Human-in-the-loop

`list_hitl_queue`

List human-in-the-loop approval requests (actions routed for human review). Defaults to open requests.


Access	Read-only
Permission	`allow_hitl:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`status`	`string`	no	Canonical statuses (open, approved, rejected, timed_out) or a legacy raw status, or all. One of `open`, `approved`, `rejected`, `timed_out`, `pending`, `timeout`, `expired`, `dismissed`, `resolved`, `all`.
`category`	`string`	no	One of `enduser`, `engineer`, `finance`, `security`, `compliance`, `other`.
`page`	`integer`	no	1-based page number. At least 1.
`limit`	`integer`	no	Page size. 1 to 100.

`respond_hitl`

Respond to a human-in-the-loop request. For an end-user approval send decision; for other items send action (dismiss or create_rule). The approver is recorded from the authenticated management key you call with. It cannot be supplied or spoofed.


Access	Write (changes or removes existing state)
Permission	`allow_hitl:respond`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`id`	`string`	yes	HITL queue entry id.
`decision`	`string`	no	The decision on a queued end-user action. machine_decide only when the org enabled it for the agent. One of `approved`, `rejected`, `machine_decide`.
`action`	`string`	no	For non-end-user items. One of `dismiss`, `create_rule`.
`linked_rule_id`	`string`	no	A rule to link the item to (uuid).

Settings

`get_allow_settings`

Read the tenant’s governance settings (no-coverage defaults, autopilot, HITL timeout, default agent mode, fail mode, redaction floor, Context Firewall policy, auto-disable).


Access	Read-only
Permission	`allow_settings:view`
Safe to retry	Yes (read-only)

Takes no arguments.

`update_allow_settings`

Update the tenant’s governance settings. Send any subset of the fields; omitted fields are unchanged.


Access	Write (changes or removes existing state)
Permission	`allow_settings:update`
Safe to retry	Yes (a repeat has no further effect)

Argument	Type	Required	Notes
`no_coverage_defaults`	`object`	no	What an uncovered event gets: any of {read, write, delete, admin} each approve\|deny\|ask, and retrieval approve\|deny.
`autopilot_enabled`	`boolean`	no
`hitl_timeout_seconds`	`integer`	no	30 to 120.
`notification_channels`	`object[]`	no	[{type, config}] notification targets.
`enduser_hitl_enabled`	`boolean`	no
`auto_create_proposed_rules`	`boolean`	no
`recall_retain_masked_original`	`boolean`	no
`firewall_store_masked_values`	`boolean or null`	no	null inherits (on for sandbox/demo orgs).
`firewall_egress_proxy_enabled`	`boolean`	no
`firewall_browsers_behind_sensor`	`boolean`	no
`firewall_record_clean_sends`	`boolean`	no	Store Context Firewall decisions no rule acted on. Default false: only masked, blocked or observe-mode would-have decisions are stored.
`firewall_mode`	`string`	no	One of `enforce`, `observe`.
`firewall_mask_text`	`string or null`	no	1 to 32 characters.
`firewall_masked_value_ttl_days`	`integer or null`	no	1 to 3650.
`firewall_governed_hosts`	`string[]`	no	Bare lowercase host names whose traffic the firewall governs. At most 50 items.
`auto_disable_high_interference`	`boolean`	no
`system_prompt_leak_protection`	`boolean`	no
`default_agent_mode`	`string`	no	One of `enforce`, `monitor`, `off`.
`fail_mode`	`string`	no	One of `open`, `closed`.
`recall_floor_disabled_detectors`	`string[]`	no	Legacy opt-out list, kept for compatibility. One of `private_key`, `jwt`, `aws_access_key`, `github_token`, `slack_token`, `stripe_secret`, `google_api_key`, `llm_api_key`, `bearer_token`, `connection_string`, `pan`, `iban`, `aba_routing`, `us_ein`, `swift_bic`, `ssn`, `uk_nino`, `in_aadhaar`, `in_pan_tax`, `br_cpf`, `es_dni_nie`, `ca_sin`, `uk_nhs_number`, `au_tfn`, `email`, `us_phone`, `date_of_birth`, `person_name`, `ipv4`, `mac_address`. At most 30 items.
`recall_floor_enabled_optin`	`string[]`	no	The masking-floor detectors the org enables (empty: the floor masks nothing). One of `private_key`, `jwt`, `aws_access_key`, `github_token`, `slack_token`, `stripe_secret`, `google_api_key`, `llm_api_key`, `bearer_token`, `connection_string`, `pan`, `iban`, `aba_routing`, `us_ein`, `swift_bic`, `ssn`, `uk_nino`, `in_aadhaar`, `in_pan_tax`, `br_cpf`, `es_dni_nie`, `ca_sin`, `uk_nhs_number`, `au_tfn`, `email`, `us_phone`, `date_of_birth`, `person_name`, `ipv4`, `mac_address`. At most 30 items.

Natural-language queries

`chat_rules_table`

Ask the in-product AI assistant about the governance RULES table in natural language (‘which enabled rules block writes to external APIs?’). Returns a machine-friendly NlChatResult (previews/final query/clarify/navigate). Does not mutate. It resolves a query the Rules table would apply.


Access	Read-only
Permission	`recall_rules:view + allow_rules:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`prompt`	`string`	yes	The natural-language question or request, as a user would type it in the chat dock. 1 to 2000 characters.
`history`	`object[]`	no	Prior conversation turns for multi-turn (e.g. to answer a previous `clarify`). Append {role:‘assistant’,content:<question>} then {role:‘user’,content:<your choice>}. At most 40 items.
`currentRoute`	`string`	no	Optional route the chat is ‘on’; lets the assistant propose navigating to another page for off-table requests. 1 to 256 characters.

`chat_events_log`

Ask the in-product AI assistant about the EVENT LOG (governance decision outcomes) in natural language (‘show denies on stripe in the last hour’). Returns a machine-friendly NlChatResult. Read-only query resolution.


Access	Read-only
Permission	`events:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`prompt`	`string`	yes	The natural-language question or request, as a user would type it in the chat dock. 1 to 2000 characters.
`history`	`object[]`	no	Prior conversation turns for multi-turn (e.g. to answer a previous `clarify`). Append {role:‘assistant’,content:<question>} then {role:‘user’,content:<your choice>}. At most 40 items.
`currentRoute`	`string`	no	Optional route the chat is ‘on’; lets the assistant propose navigating to another page for off-table requests. 1 to 256 characters.
`agentId`	`string`	no	Optional allow_agents UUID to hard-scope the query to one agent (Agent Dossier). At least 1 characters.

`chat_agents_inventory`

Ask the in-product AI assistant about the AGENTS inventory in natural language (‘which discovered agents are ungoverned shadow AI?’). Returns a machine-friendly NlChatResult. Read-only query resolution.


Access	Read-only
Permission	`events:view + allow_agents:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`prompt`	`string`	yes	The natural-language question or request, as a user would type it in the chat dock. 1 to 2000 characters.
`history`	`object[]`	no	Prior conversation turns for multi-turn (e.g. to answer a previous `clarify`). Append {role:‘assistant’,content:<question>} then {role:‘user’,content:<your choice>}. At most 40 items.
`currentRoute`	`string`	no	Optional route the chat is ‘on’; lets the assistant propose navigating to another page for off-table requests. 1 to 256 characters.

`chat_hitl_queue`

Ask the in-product AI assistant about the HUMAN-IN-THE-LOOP approval queue in natural language (‘pending refunds over $500 from the fraud bot’). Returns a machine-friendly NlChatResult. Read-only query resolution (use respond_hitl to act on an entry).


Access	Read-only
Permission	`allow_hitl:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`prompt`	`string`	yes	The natural-language question or request, as a user would type it in the chat dock. 1 to 2000 characters.
`history`	`object[]`	no	Prior conversation turns for multi-turn (e.g. to answer a previous `clarify`). Append {role:‘assistant’,content:<question>} then {role:‘user’,content:<your choice>}. At most 40 items.
`currentRoute`	`string`	no	Optional route the chat is ‘on’; lets the assistant propose navigating to another page for off-table requests. 1 to 256 characters.

`chat_data_table`

Ask the in-product AI assistant about ANY other data table by supplying that table’s field schema (the generic dock every StandardTablePage carries). Returns a machine-friendly NlChatResult with the resolved query or a navigation proposal.


Access	Read-only
Permission	`dashboard:view`
Safe to retry	Yes (read-only)

Argument	Type	Required	Notes
`prompt`	`string`	yes	The natural-language question or request, as a user would type it in the chat dock. 1 to 2000 characters.
`fields`	`object[]`	yes	The table’s canonical column vocabulary the query may filter on. 1 to 60 items.
`surface`	`string`	no	Optional human label for the table. 1 to 64 characters.
`currentRoute`	`string`	no	Optional route the chat is ‘on’; lets the assistant propose navigating to another page for off-table requests. 1 to 256 characters.
`history`	`object[]`	no	Prior conversation turns for multi-turn (e.g. to answer a previous `clarify`). Append {role:‘assistant’,content:<question>} then {role:‘user’,content:<your choice>}. At most 40 items.

Key lifecycle

`revoke_self`

Revoke THIS API key: the exact management key you are authenticated with (RFC 7009 self-revocation). No special permission is required, and no other key can be targeted: the credential is identified from the request’s own bearer token. After this succeeds the key immediately stops authenticating, so it MUST be your final call with it. Irreversible.


Access	Write (changes or removes existing state)
Permission	`none (self-authenticated by the presenting key)`
Safe to retry	Yes (a repeat has no further effect)

Takes no arguments.

Errors and limits

Errors

A failure is reported in one of two places. A problem with the request itself is a JSON-RPC error. A tool that ran and was refused, or failed, is a normal result with isError: true, and its text carries the HTTP status and the route’s error body.

JSON-RPC code	When
`-32700`	The body is not valid JSON (HTTP 400).
`-32600`	Not a JSON-RPC 2.0 message; a batch (batching is not supported, HTTP 400); an unsupported `MCP-Protocol-Version` (HTTP 400); a browser `Origin` that is not allowed (HTTP 403).
`-32601`	An unknown method.
`-32602`	`tools/call` without a tool name, an unknown tool, or arguments that do not match the tool’s `inputSchema` (unknown, missing or ill-typed, at any depth). `error.data.issues` lists each problem as `{path, code}` and never repeats a value.
`-32001`	`tools/call` without a management key. A session token (a three-part JWT) is not a management key.
`-32000`	Rate limited by this endpoint (HTTP 429 with `Retry-After`).

Tool result (`isError: true`)	Carries	Meaning
`400`	`Invalid request body`	The route refused the arguments after they passed the schema check (for example a blank or unsafe rule body).
`401`	`Invalid API key`	The key is not known.
`401`	`API key has been revoked`	The key was revoked.
`403`	`insufficient_permission`	The key lacks the tool’s permission. A key holding no permission at all is told so, and can still call `revoke_self`.
`403`	`harness_key_not_permitted`	A harness (agent) key was used; this server needs a management key.
`403`	`exemplar_read_only`	A sandbox-reader key tried to write.
`403`	`experience_not_entitled`	The workspace’s plan does not include that part of VisIQ.
`409`	`A rule with this name already exists`	A rule with that name exists. An un-keyed retry of `create_rule` or `create_recall_rule` ends here rather than creating a duplicate.
`409`	`idempotency_in_progress`	A request with the same `idempotency_key` is still running; retry shortly.
`422`	`idempotency_key_reused`	The `idempotency_key` was already used with different arguments.
`429`	`rate_limited`	The key’s own request budget is spent (shared with the REST API); wait `retryAfter` seconds.
`503`	`Authentication unavailable`	Authentication is temporarily unavailable. Nothing was changed.
`503`	`idempotency_unavailable`	The retry-key store is unavailable, so a keyed write was not attempted.
no status	`The audit trail is unavailable`	A write was not attempted because it could not be recorded first.
no status	`failed with an internal error`	The tool failed unexpectedly. Quote the incident id in the message to support; no internal detail is returned.

Limits and transport


Requests per client IP	300 per minute by default
`tools/call` per key	120 per minute by default
AI tools (`chat_*`, `compile_rule`)	also 60 per 60 seconds for the workspace’s API keys together, and 240 for the whole workspace
Rate-limited response	HTTP 429, `Retry-After: 60`
Protocol versions	`2025-06-18`, `2025-03-26`. `initialize` answers with the version you ask for when it is supported, otherwise the newest. Later requests should send `MCP-Protocol-Version`; an absent header is read as `2025-03-26`.
Transport	Stateless Streamable HTTP: one JSON-RPC message per `POST`, a JSON response, no session id, no server-sent events (`GET` is 405), no batching.
Browser clients	A request without an `Origin` header (a server-side client) is accepted. A browser `Origin` must be the app’s own or on the server’s allowlist; others get 403.
Retry keys	`idempotency_key` is remembered for 24 hours per key and tool.

The first two limits are per-deployment settings (MCP_RATE_LIMIT_IP_PER_MIN and MCP_RATE_LIMIT_KEY_PER_MIN) and are enforced on each server instance, as a guard against a single runaway client rather than as a billing quota. Every call also spends the key’s own request budget, which it shares with the REST API.

Agent authentication — the agent-facing auth guide (device flow + self-revoke).
Managing API keys — key lifecycle, formats, errors.
Agent self-registration — obtain a key without a pre-provisioned credential.

​Endpoint & transport

​What needs a key

​Connect a client

​Retries and audit

​Tool catalog

​Discovery

​whoami

​describe_chat

​Governance rules (unified: action and retrieval)

​list_rules

​get_rule

​create_rule

​update_rule

​delete_rule

​compile_rule

​Retrieval-only rule aliases

​list_recall_rules

​create_recall_rule

​Agents

​list_agents

​get_agent

​register_agent

​update_agent

​Decisions and action schemas

​get_decision_outcomes

​list_action_schemas

​Human-in-the-loop

​list_hitl_queue

​respond_hitl

​Settings

​get_allow_settings

​update_allow_settings

​Natural-language queries

​chat_rules_table

​chat_events_log

​chat_agents_inventory

​chat_hitl_queue

​chat_data_table

​Key lifecycle

​revoke_self

​Errors and limits

​Errors

​Limits and transport

​Related

Endpoint & transport

What needs a key

Connect a client

Retries and audit

Tool catalog

Discovery

`whoami`

`describe_chat`

Governance rules (unified: action and retrieval)

`list_rules`

`get_rule`

`create_rule`

`update_rule`

`delete_rule`

`compile_rule`

Retrieval-only rule aliases

`list_recall_rules`

`create_recall_rule`

Agents

`list_agents`

`get_agent`

`register_agent`

`update_agent`

Decisions and action schemas

`get_decision_outcomes`

`list_action_schemas`

Human-in-the-loop

`list_hitl_queue`

`respond_hitl`

Settings

`get_allow_settings`

`update_allow_settings`

Natural-language queries

`chat_rules_table`

`chat_events_log`

`chat_agents_inventory`

`chat_hitl_queue`

`chat_data_table`

Key lifecycle

`revoke_self`

Errors and limits

Errors

Limits and transport

Related