Skip to main content
This page is the complete capability catalog of the hosted MCP server: all 22 tools and 90+ operations an enterprise admin can drive, each with a runnable request. It is generated against the same operation registry the portal’s sidebar assistant uses, so the two surfaces cannot drift. Two ways to use everything below:
  • Ask your agent. With the server connected (Claude Code, Codex, Cursor, a Claude custom connector, …), say the thing — “revoke the CI key that hasn’t been used in 30 days” — and the agent picks the operation, resolves the ids, and walks the consent flow. Every section lists example asks.
  • Call it yourself. Every operation is one JSON-RPC tools/call POST. Copy any snippet below.

The call, once

All snippets share this exact shape — only the JSON body changes:
Reads go through a domain’s *-query tool as {"query": {"action": …, "input": {…}}}; writes go through *-action as {"proposal": {"action": …, "input": {…}}}. Replace <…-uuid> placeholders with real ids — always resolved from a query tool first, never guessed. How each operation runs (the Runs column below): Who sees what. The tool list is computed per request from the connected user’s live role: members get the fixed tools plus personal-*; team leads add their subtree’s membership and budget actions; enterprise admins get everything on this page. Ids in parentheses after each heading are the exact tool names (they surface in Claude Code as mcp__aireserve__<tool>).

Identity & catalog (whoami, list-models, get-model, get-connection-guide)

Fixed read tools, available to every role with mcp:read.
“Who is this connection signed in as?” · “Which models can we use right now, and what do they cost?” · “Is deepseek-v3.2 blocked for our org?” · “Give me the base URLs and rate limits for pointing our SDK at the gateway.”
Each list-models entry looks like:

One-shot inference (send-message)

Requires the mcp:messages scope. Sends one prompt through the gateway as the connected user — billed, rate-limited, and visible in usage analytics exactly like their own traffic. Respects the org’s model policy (blocked models are refused; omitted modelId uses the org default).
“Ask kimi-k2 to summarize this changelog.” · “Run this prompt against the org default model.”
send-message
Returns { "model", "text", "finishReason", "usage": { "inputTokens", "outputTokens" } }. Budget refusals are relayed in plain language (spend cap reached, wallet balance too low).

Personal (personal-query, personal-action)

Every role. The caller’s own usage, budget, keys, and preferences.
“How much have I spent this week, and on which models?” · “List my API keys with 30-day usage and revoke the one I stopped using.” · “Make gemini-3-flash my default model.”

Organization API keys (api-keys-query, api-keys-action)

Enterprise admins. The org’s gateway credentials: listing, usage, minting, revocation, compaction, and live self-tests.
“List all our API keys and flag the ones idle for 30 days.” · “Mint an org key named ‘ETL prod’ bound to Priya for attribution.” · “Revoke key 4354cccc — verify the id against the list first.” · “Run a test ping through the new key.”
Key minting is always a portal link — the fresh secret renders once in the signed-in portal and never crosses the API. The two-step flow exists so an LLM-driven channel can never exfiltrate a live credential.

Members (members-query, members-action)

Enterprise admins (invite_user also team leads, restricted to regular users on a team in their subtree). Account directory, per-member usage, invitations, roles, lifecycle.
“Invite ada@acme.com to the Data team and send her the onboarding email.” · “Who are our top spenders this month, by model?” · “Deactivate Sam’s account.” · “Promote Priya to enterprise admin.” · “Send Marco a password reset.”
Guard rails the server enforces on every transport: you cannot deactivate or delete yourself, you cannot change your own role, and the last enterprise admin can never be demoted or locked out.

Teams & budgets (teams-budgets-query, teams-budgets-action)

Enterprise admins; team leads can move members within their own subtree, allocate budget to teams strictly below their own node, and grant/revoke manager status inside their org. The envelope model: org cap → team allocations → Unassigned pool → per-user caps.
“Create a Research sub-team under Engineering and give it $2,000."* · *"Show the allocation table — who has headroom?"* · *"Cap Anna at $150 with 60 requests a minute.” · “Move these five people to Platform.” · “Make Jordan a manager.”

Analytics (analytics-query)

Enterprise admins, read-only (there is no analytics-action). Compact aggregates by design — top-5 lists, one 20-row log page, capped vocabularies — with request metadata only: prompt and response content never crosses this surface.
“What did we spend last month, split input/output/cached?” · “Show failed gateway requests from yesterday.” · “Which business functions drive our AI spend?” · “Give me a usage summary for June 1 to June 30.”

Models & routing (models-routing-query, models-routing-action)

Enterprise admins. The org’s model policy (default model, selection lock, blocklist) and the Auto-router (enrollment, tuning, bring-your-own endpoint).
“Set the org default to Auto routing.” · “Block the models that train on inputs.” · “Rebalance the router 60% smarter / 30% cheaper / 10% faster.” · “Which providers serve Kimi K2 right now, and at what price and uptime?”

Org settings (org-settings-query, org-settings-action)

Enterprise admins. Org-wide chat text, privacy controls, branding, sign-in access, and business-function classification review.
“Turn off storage of prompt and response text.” · “Set content retention to 30 days.” · “Open self-serve sign-up for acme.com.” · “What classification questions are waiting on me?” · “What needs my attention today?”

Files (files-query, files-action)

Enterprise admins. The organization’s stored files. Uploads stay in the portal (an API can’t supply file bytes through a consent card); everything else is here.
“List our shared files — anything named ‘onboarding’?” · “Get me a download link for the Q2 board deck.” · “Delete the stale export from May.”

Billing (billing-query, billing-action)

Enterprise admins. The yield-to-compute wallet, the immutable ledger mirror, and CARR reporting. Money movements are the most conservative operations on the surface — every one confirms, and none can be undone.
“What’s our wallet balance and last epoch’s yield?” · “List the credits into the wallet this quarter.” · “Close the July ledger period and generate the CARR summary.”

GPU compute (compute-query, compute-action)

Enterprise admins. The provider-hidden GPU flow from the Compute › GPUs page: price a machine, launch it with persistent storage, see how to connect, stop it when done. The same placement check and wallet spend gate as the portal run on every call; no provider, data-center or tenancy identifier ever enters or leaves these tools. Quote first, then launch with the quoteId — the user approves the exact all-in price they were shown.
“Quote one H100 with 200 GB of persistent storage in Europe, then launch it under $4/hour.” · “List my GPU machines and stop anything idle.” · “How do I SSH into train-7?”
A launch_gpu_instance with a persistent storage block creates the volume in the GPU’s location inside the same transaction as the machine; pass an existing volumeId instead to pin placement to where that volume already lives. A no_capacity refusal carries the reason (price_ceiling, volume_location, no_persistent_storage, no_stock), the cheapest eligible price and alternatives, so the agent can propose what would work.

Containers (containers-query, containers-action)

Enterprise admins. Containers & Orchestration › Elastic Container Service, end to end: enable the organization’s own AWS account behind the ECS passthrough, mint an ECS credential (a real AWS access key pair — it renders in the portal, never to the agent), get the exact ~/.aws/config lines that repoint ECS and CloudWatch Logs at the gateway, deploy an image to an HTTPS URL, scale, redeploy, read logs, clean up. Web holds no AWS credential on any path; the gateway signs each call in the organization’s account.
“Enable Containers, create an ECS credential and set up an aireserve AWS profile so aws ecs list-clusters works.” · “Deploy ghcr.io/acme/api:1.4 as a public service in us-east-1 and tail its logs.” · “Scale the worker service to zero overnight.”
The agent’s happy path for a new organization: enable_containers → create_ecs_credential (hand the user the portal link; they paste the pair into ~/.aws/credentials) → get_containers_connection_guide (write the [profile aireserve] block into ~/.aws/config) → aws ecs list-clusters --profile aireserve → deploy_container_service.

Completing a confirmation

Any operation marked after confirm returns a confirmToken on the first call. After a human approves the returned summary, repeat the identical call with the token added alongside the proposal:
confirm-retry
The token binds the exact operation, input, and caller the human saw; it expires after 10 minutes, and if the target row changed in between, execution refuses with a fresh summary to re-approve.

Not on this surface

By design, the MCP server never exposes:
  • Platform (cross-tenant) operations — funding client wallets, wallet enforcement toggles, ledger syncs, sign-in-domain registration, cross-org lookups. Super admins are de-escalated to their own tenant here; platform work stays in the portal.
  • Secrets in responses — key material and signed download URLs only ever render in the signed-in portal via redemption links.
  • Impersonation and file-byte uploads — both remain portal page flows.
  • Prompt/response content — analytics reads return request metadata only.