MCP tools reference

95 tools (measured on 29.10.2026 against the running server code). Every tool carries a title and annotations: 46 are marked read-only (readOnlyHint), 18 as destructive (destructiveHint), so a client such as Claude can run the read-only ones without asking and asks before the destructive ones. Every tool calls exactly one Core REST route — no tool has its own business logic or its own invariants; a 409/422 from the Core comes back to the calling model as a structured ToolError, never swallowed. See Connect Claude Code, Cursor, and Codex for how a client authenticates.

Two read tools treat a documented empty result as a valid answer, not an error: gilt returns {"gilt": false, ...} on the Core's 404, and prozess_bild returns {"bild_url": null, ...} on its 404. Every other tool passes a non-2xx response through as an error.

Reading a Sache

Writing a Sache or statement

Processes

Personas, memory, and templates

persona_put and from_vorlage are deliberately not MCP tools — task, boundaries, style, and rules change only through a human with a rw key on the Web UI. Writing memory about oneself is the one exception agents get.

Agents: presence and inbox

Module mcp/agents_tools.py.

Hall of Lessons

Module mcp/lehren_tools.py.

Beurteilung (personnel file)

Module mcp/beurteilung_tools.py.

Hall of Fame

Module mcp/hall_of_fame_tools.py. Read-only — scoring itself happens in the Core at the moment the underlying event occurs; no agent tool awards points or thumbs.

Statistik

Module mcp/statistik_tools.py.

Export

Module mcp/export_tools.py — "your data is yours".

Documents and evidence

Company, areas, personas and setup

Further tools

Visibility (sichtfeld)

gilt, gilt_am, suche, and memory_search (as lesende_persona) take the calling persona's own slug and filter the answer to its sichtfeld (visibility — a list of areas). sache_list does the same thing but under a different parameter (persona_slug, since persona= on /sachen already means "owned by") — the same reasoning behind gehoert_persona being a second, independent filter. alle=True deliberately lifts the filter and is logged as an event. A 403 ("outside the visibility") from these tools is a real error, not an empty result — unlike the documented 404 from gilt.

What is not an MCP tool, on purpose

• persona_put / from_vorlage — task, boundaries, style, and rules change only through a human on the Web UI with an rw key.
• aussage_beenden — ending one statement is the same kind of human decision as writing persona_put; only prozess_beenden gets an exception, because ending a process is part of an agent's routine upkeep of the rule book.
• A thumbs-up tool — "stage one: only the human hands them out."

Deviation found while writing this page

mcp/beurteilung_tools.py's rollen_vorschlag calls CoreClient.request(..., json=body), but CoreClient.request() takes json_body, not json — as written this raises a TypeError before the Core is ever called, and the call also omits rw=True despite writing. Reported here, not fixed — out of scope for this documentation change.

Requests across project boundaries

An agent in one project writes to the intake of another — for example a customer to the operator. It sees only the status and answer of its own requests, never anything from the other project. No path, no request: a person with the owner or manager role in the operator project sets a path up. There is no tool for it.

A request is not an instruction. For the intake its text is foreign text and never triggers a task, a rule or a write on its own. Answers are text only.