Skip to main content
This page is the complete capability catalog of the hosted MCP server: all 22 tools and 90+ operations an enterprise admin can drive, each with a runnable request. It is generated against the same operation registry the portal’s sidebar assistant uses, so the two surfaces cannot drift. Two ways to use everything below:
  • Ask your agent. With the server connected (Claude Code, Codex, Cursor, a Claude custom connector, …), say the thing — “revoke the CI key that hasn’t been used in 30 days” — and the agent picks the operation, resolves the ids, and walks the consent flow. Every section lists example asks.
  • Call it yourself. Every operation is one JSON-RPC tools/call POST. Copy any snippet below.

The call, once

All snippets share this exact shape — only the JSON body changes:
Reads go through a domain’s *-query tool as {"query": {"action": …, "input": {…}}}; writes go through *-action as {"proposal": {"action": …, "input": {…}}}. Replace <…-uuid> placeholders with real ids — always resolved from a query tool first, never guessed. How each operation runs (the Runs column below): Who sees what. The tool list is computed per request from the connected user’s live role: members get the fixed tools plus personal-*; team leads add their subtree’s membership and budget actions; enterprise admins get everything on this page. Ids in parentheses after each heading are the exact tool names (they surface in Claude Code as mcp__aireserve__<tool>).

Identity & catalog (whoami, list-models, get-model, get-connection-guide)

Fixed read tools, available to every role with mcp:read.
“Who is this connection signed in as?” · “Which models can we use right now, and what do they cost?” · “Is deepseek-v3.2 blocked for our org?” · “Give me the base URLs and rate limits for pointing our SDK at the gateway.”
Each list-models entry looks like:

One-shot inference (send-message)

Requires the mcp:messages scope. Sends one prompt through the gateway as the connected user — billed, rate-limited, and visible in usage analytics exactly like their own traffic. Respects the org’s model policy (blocked models are refused; omitted modelId uses the org default).
“Ask kimi-k2 to summarize this changelog.” · “Run this prompt against the org default model.”
send-message
Returns { "model", "text", "finishReason", "usage": { "inputTokens", "outputTokens" } }. Budget refusals are relayed in plain language (spend cap reached, wallet balance too low).

Personal (personal-query, personal-action)

Every role. The caller’s own usage, budget, keys, and preferences.
“How much have I spent this week, and on which models?” · “List my API keys with 30-day usage and revoke the one I stopped using.” · “Make gemini-3-flash my default model.”

Organization API keys (api-keys-query, api-keys-action)

Enterprise admins. The org’s gateway credentials: listing, usage, minting, revocation, compaction, and live self-tests.
“List all our API keys and flag the ones idle for 30 days.” · “Mint an org key named ‘ETL prod’ bound to Priya for attribution.” · “Revoke key 4354cccc — verify the id against the list first.” · “Run a test ping through the new key.”
Key minting is always a portal link — the fresh secret renders once in the signed-in portal and never crosses the API. The two-step flow exists so an LLM-driven channel can never exfiltrate a live credential.

Members (members-query, members-action)

Enterprise admins (invite_user also team leads, restricted to regular users on a team in their subtree). Account directory, per-member usage, invitations, roles, lifecycle.
“Invite ada@acme.com to the Data team and send her the onboarding email.” · “Who are our top spenders this month, by model?” · “Deactivate Sam’s account.” · “Promote Priya to enterprise admin.” · “Send Marco a password reset.”
Guard rails the server enforces on every transport: you cannot deactivate or delete yourself, you cannot change your own role, and the last enterprise admin can never be demoted or locked out.

Teams & budgets (teams-budgets-query, teams-budgets-action)

Enterprise admins; team leads can move members within their own subtree, allocate budget to teams strictly below their own node, and grant/revoke manager status inside their org. The envelope model: org cap → team allocations → Unassigned pool → per-user caps.
“Create a Research sub-team under Engineering and give it 2,000.""Showtheallocationtablewhohasheadroom?""CapAnnaat2,000."* · *"Show the allocation table — who has headroom?"* · *"Cap Anna at 150 with 60 requests a minute.” · “Move these five people to Platform.” · “Make Jordan a manager.”

Analytics (analytics-query)

Enterprise admins, read-only (there is no analytics-action). Compact aggregates by design — top-5 lists, one 20-row log page, capped vocabularies — with request metadata only: prompt and response content never crosses this surface.
“What did we spend last month, split input/output/cached?” · “Show failed gateway requests from yesterday.” · “Which business functions drive our AI spend?” · “Give me a usage summary for June 1 to June 30.”

Models & routing (models-routing-query, models-routing-action)

Enterprise admins. The org’s model policy (default model, selection lock, blocklist) and the Auto-router (enrollment, tuning, bring-your-own endpoint).
“Set the org default to Auto routing.” · “Block the models that train on inputs.” · “Rebalance the router 60% smarter / 30% cheaper / 10% faster.” · “Which providers serve Kimi K2 right now, and at what price and uptime?”

Org settings (org-settings-query, org-settings-action)

Enterprise admins. Org-wide chat text, privacy controls, branding, sign-in access, and business-function classification review.
“Turn off storage of prompt and response text.” · “Set content retention to 30 days.” · “Open self-serve sign-up for acme.com.” · “What classification questions are waiting on me?” · “What needs my attention today?”

Files (files-query, files-action)

Enterprise admins. The organization’s stored files. Uploads stay in the portal (an API can’t supply file bytes through a consent card); everything else is here.
“List our shared files — anything named ‘onboarding’?” · “Get me a download link for the Q2 board deck.” · “Delete the stale export from May.”

Billing (billing-query, billing-action)

Enterprise admins. The yield-to-compute wallet, the immutable ledger mirror, and CARR reporting. Money movements are the most conservative operations on the surface — every one confirms, and none can be undone.
“What’s our wallet balance and last epoch’s yield?” · “List the credits into the wallet this quarter.” · “Close the July ledger period and generate the CARR summary.”

Completing a confirmation

Any operation marked after confirm returns a confirmToken on the first call. After a human approves the returned summary, repeat the identical call with the token added alongside the proposal:
confirm-retry
The token binds the exact operation, input, and caller the human saw; it expires after 10 minutes, and if the target row changed in between, execution refuses with a fresh summary to re-approve.

Not on this surface

By design, the MCP server never exposes:
  • Platform (cross-tenant) operations — funding client wallets, wallet enforcement toggles, ledger syncs, sign-in-domain registration, cross-org lookups. Super admins are de-escalated to their own tenant here; platform work stays in the portal.
  • Secrets in responses — key material and signed download URLs only ever render in the signed-in portal via redemption links.
  • Impersonation and file-byte uploads — both remain portal page flows.
  • Prompt/response content — analytics reads return request metadata only.