- Ask your agent. With the server connected (Claude Code, Codex, Cursor, a Claude custom connector, …), say the thing — “revoke the CI key that hasn’t been used in 30 days” — and the agent picks the operation, resolves the ids, and walks the consent flow. Every section lists example asks.
- Call it yourself. Every operation is one JSON-RPC
tools/callPOST. Copy any snippet below.
The call, once
All snippets share this exact shape — only the JSON body changes:*-query tool as {"query": {"action": …, "input": {…}}};
writes go through *-action as {"proposal": {"action": …, "input": {…}}}. Replace
<…-uuid> placeholders with real ids — always resolved from a query tool first, never
guessed.
How each operation runs (the Runs column below):
Who sees what. The tool list is computed per request from the connected user’s live role:
members get the fixed tools plus
personal-*; team leads add their subtree’s membership and
budget actions; enterprise admins get everything on this page. Ids in parentheses after each
heading are the exact tool names (they surface in Claude Code as mcp__aireserve__<tool>).
Identity & catalog (whoami, list-models, get-model, get-connection-guide)
Fixed read tools, available to every role with mcp:read.
“Who is this connection signed in as?” · “Which models can we use right now, and what do they cost?” · “Is deepseek-v3.2 blocked for our org?” · “Give me the base URLs and rate limits for pointing our SDK at the gateway.”
list-models entry looks like:
One-shot inference (send-message)
Requires the mcp:messages scope. Sends one prompt through the gateway as the connected
user — billed, rate-limited, and visible in usage analytics exactly like their own
traffic. Respects the org’s model policy (blocked models are refused; omitted modelId
uses the org default).
“Ask kimi-k2 to summarize this changelog.” · “Run this prompt against the org default model.”
send-message
{ "model", "text", "finishReason", "usage": { "inputTokens", "outputTokens" } }.
Budget refusals are relayed in plain language (spend cap reached, wallet balance too low).
Personal (personal-query, personal-action)
Every role. The caller’s own usage, budget, keys, and preferences.
“How much have I spent this week, and on which models?” · “List my API keys with 30-day usage and revoke the one I stopped using.” · “Make gemini-3-flash my default model.”
Organization API keys (api-keys-query, api-keys-action)
Enterprise admins. The org’s gateway credentials: listing, usage, minting, revocation,
compaction, and live self-tests.
“List all our API keys and flag the ones idle for 30 days.” · “Mint an org key named ‘ETL prod’ bound to Priya for attribution.” · “Revoke key 4354cccc — verify the id against the list first.” · “Run a test ping through the new key.”
Key minting is always a portal link — the fresh secret renders once in the signed-in
portal and never crosses the API. The two-step flow exists so an LLM-driven channel can
never exfiltrate a live credential.
Members (members-query, members-action)
Enterprise admins (invite_user also team leads, restricted to regular users on a team in
their subtree). Account directory, per-member usage, invitations, roles, lifecycle.
“Invite ada@acme.com to the Data team and send her the onboarding email.” · “Who are our top spenders this month, by model?” · “Deactivate Sam’s account.” · “Promote Priya to enterprise admin.” · “Send Marco a password reset.”
Guard rails the server enforces on every transport: you cannot deactivate or delete
yourself, you cannot change your own role, and the last enterprise admin can never be
demoted or locked out.
Teams & budgets (teams-budgets-query, teams-budgets-action)
Enterprise admins; team leads can move members within their own subtree, allocate budget to
teams strictly below their own node, and grant/revoke manager status inside their org.
The envelope model: org cap → team allocations → Unassigned pool → per-user caps.
“Create a Research sub-team under Engineering and give it $2,000."* · *"Show the allocation table — who has headroom?"* · *"Cap Anna at $150 with 60 requests a minute.” · “Move these five people to Platform.” · “Make Jordan a manager.”
Analytics (analytics-query)
Enterprise admins, read-only (there is no analytics-action). Compact aggregates by
design — top-5 lists, one 20-row log page, capped vocabularies — with request metadata
only: prompt and response content never crosses this surface.
“What did we spend last month, split input/output/cached?” · “Show failed gateway requests from yesterday.” · “Which business functions drive our AI spend?” · “Give me a usage summary for June 1 to June 30.”
Models & routing (models-routing-query, models-routing-action)
Enterprise admins. The org’s model policy (default model, selection lock, blocklist) and the
Auto-router (enrollment, tuning, bring-your-own endpoint).
“Set the org default to Auto routing.” · “Block the models that train on inputs.” · “Rebalance the router 60% smarter / 30% cheaper / 10% faster.” · “Which providers serve Kimi K2 right now, and at what price and uptime?”
Org settings (org-settings-query, org-settings-action)
Enterprise admins. Org-wide chat text, privacy controls, branding, sign-in access, and
business-function classification review.
“Turn off storage of prompt and response text.” · “Set content retention to 30 days.” · “Open self-serve sign-up for acme.com.” · “What classification questions are waiting on me?” · “What needs my attention today?”
Files (files-query, files-action)
Enterprise admins. The organization’s stored files. Uploads stay in the portal (an API
can’t supply file bytes through a consent card); everything else is here.
“List our shared files — anything named ‘onboarding’?” · “Get me a download link for the Q2 board deck.” · “Delete the stale export from May.”
Billing (billing-query, billing-action)
Enterprise admins. The yield-to-compute wallet, the immutable ledger mirror, and CARR
reporting. Money movements are the most conservative operations on the surface — every one
confirms, and none can be undone.
“What’s our wallet balance and last epoch’s yield?” · “List the credits into the wallet this quarter.” · “Close the July ledger period and generate the CARR summary.”
GPU compute (compute-query, compute-action)
Enterprise admins. The provider-hidden GPU flow from the Compute › GPUs page: price a
machine, launch it with persistent storage, see how to connect, stop it when done. The
same placement check and wallet spend gate as the portal run on every call; no provider,
data-center or tenancy identifier ever enters or leaves these tools. Quote first, then
launch with the quoteId — the user approves the exact all-in price they were shown.
“Quote one H100 with 200 GB of persistent storage in Europe, then launch it under $4/hour.” · “List my GPU machines and stop anything idle.” · “How do I SSH into train-7?”
launch_gpu_instance with a persistent storage block creates the volume in the GPU’s
location inside the same transaction as the machine; pass an existing volumeId instead to
pin placement to where that volume already lives. A no_capacity refusal carries the
reason (price_ceiling, volume_location, no_persistent_storage, no_stock), the
cheapest eligible price and alternatives, so the agent can propose what would work.
Containers (containers-query, containers-action)
Enterprise admins. Containers & Orchestration › Elastic Container Service, end to end:
enable the organization’s own AWS account behind the ECS passthrough,
mint an ECS credential (a real AWS access key pair — it renders in the portal, never to
the agent), get the exact ~/.aws/config lines that repoint ECS and CloudWatch Logs at the
gateway, deploy an image to an HTTPS URL, scale, redeploy, read logs, clean up. Web holds
no AWS credential on any path; the gateway signs each call in the organization’s account.
“Enable Containers, create an ECS credential and set up anaireserveAWS profile soaws ecs list-clustersworks.” · “Deploy ghcr.io/acme/api:1.4 as a public service in us-east-1 and tail its logs.” · “Scale the worker service to zero overnight.”
enable_containers → create_ecs_credential
(hand the user the portal link; they paste the pair into ~/.aws/credentials) →
get_containers_connection_guide (write the [profile aireserve] block into
~/.aws/config) → aws ecs list-clusters --profile aireserve → deploy_container_service.
Completing a confirmation
Any operation marked after confirm returns aconfirmToken on the first call. After a
human approves the returned summary, repeat the identical call with the token added
alongside the proposal:
confirm-retry
Not on this surface
By design, the MCP server never exposes:- Platform (cross-tenant) operations — funding client wallets, wallet enforcement toggles, ledger syncs, sign-in-domain registration, cross-org lookups. Super admins are de-escalated to their own tenant here; platform work stays in the portal.
- Secrets in responses — key material and signed download URLs only ever render in the signed-in portal via redemption links.
- Impersonation and file-byte uploads — both remain portal page flows.
- Prompt/response content — analytics reads return request metadata only.