Stable Baseline

Search available tools by keyword or category. Returns matching tool names and descriptions.

List supported diagram types. Pass `query` to search by name OR intent (keyword + semantic): e.g. 'circuit diagram', 'wiring harness', 'timing waveform', 'network topology', 'database schema'. Use the returned `type` field with getDiagramTypeGuide (DSL instructions + example) and insertDiagramInDocu

Get DSL writing instructions for a diagram type. Call before writing diagramCode.

SOFTWARE & CLOUD architecture icons ONLY (AWS, Azure, GCP, Docker, Kubernetes, databases, message queues, dev tools, etc.). This catalog has NO general/nature/science/people/business icons — so for any NON-technical topic (e.g. photosynthesis, biology, history, marketing), do NOT use this tool; inst

Semantic search over the 276 AntV Infographic templates — call this FIRST when building an `infographic` diagram so you pick the right structure for the content. Describe the intent (e.g. 'compare two options', 'show a process timeline', 'pyramid of priorities', 'org hierarchy', 'flow between system

Get the CDMD markdown language specification. Call before createDocument if unfamiliar with syntax.

Return the calling user's identity (user_id, display_name, full_name, email, avatar_url). Use this when the user says 'me' / 'mine' / 'I' so you can resolve to their UUID before passing it to tools like updateImprovement(owner_id=…) or filtering by owner. Read-only.

Server-side searchable, paginated list of USERS and TEAMS that can be assigned as the owner of an improvement/task in a project — and the canonical source for resolving a person's user_id when @-mentioning them in a document. Returns two arrays — `users` (with user_id, display_name, email, avatar_ur

List teams in an organization, with optional search filter and an `includeMembers` flag that fans out to v_team_members in a single round-trip. Supply EITHER organizationId OR workspaceId (the workspace's parent org is resolved automatically). Use this when the user asks about teams generically (e.g

Get a single team by ID with profile-enriched member list (display_name, email, avatar_url, role, joined_at). Set `includeMembers=false` to skip the member fan-out and just return team metadata. Read-only.

List organisations you have access to. Supports query filtering by name/slug.

List workspaces you have access to. Supports query filtering by name/slug.

List projects in a workspace. Supports query filtering by project name.

List folders in a project. Use parentId for nested folders. For full tree, use getProjectHierarchy instead.

Create a folder in a project. Supports nesting via parentId.

Update a folder (rename/move/reorder). Supports nesting changes via parentId.

Delete a folder recursively, including all nested folders and documents.

Batch-reorder folders within a parent (or project root) by setting sibling positions. Pass [{folderId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. To MOVE a folder to a different parent and set its position there, use updateFolder

List AND grep documents in a project, workspace, or folder. `query` does a full-content search across each document's body (not just the title) and returns the matching lines — like grep across your docs. Each returned document includes `contentMatches: [{line, text, context?}]` and `matchCount`; th

Get the complete folder and document tree for a project in one call. Recommended first call for navigation.

Get the folder and document tree starting from a specific folder. Alias for getProjectHierarchy with folderId.

Read a document's content with line numbers. content.text lines are formatted `NNNNN<TAB>content` (cat -n style); the number+tab prefix is DISPLAY ONLY — never part of the document — so when building editDocument anchor patches, copy only the text AFTER the tab. Reads paginate by lines (offset/limit

Create a document from CDMD markdown (standard Markdown plus SB extensions — call getCdmdLanguageGuide if unfamiliar). The body goes in `cdmd` (`content` is accepted as an alias). Do not include DIAGRAM/IMAGE markers — insert them after with dedicated tools. Returns the new document's id and version

Edit a document: the PREFERRED tool for small targeted changes. Two patch dialects — do NOT mix them in one call. (1) ANCHOR patches {oldText, newText, before?, after?} — RECOMMENDED: replace an exact snippet of existing text with new text. oldText must match the document byte-for-byte AND be unique

Find and replace EXACT substrings in a document (NOT regex: wildcards and patterns are matched literally). Replaces EVERY occurrence and returns the replacement count; best for renames and repeated phrases. For a single targeted change at a known location, prefer editDocument (anchor patches). Case-

Get a diagram's full details including raw DSL source code. Use diagramId from DIAGRAM_OMITTED markers in getDocument output. Returns diagramCode, type, name, nlDescription, renderStatus/renderError, and versionTimestamp — the diagram's optimistic-lock token for updateDiagramInDocument (every diagra

Insert a new diagram into a document. Call listDiagramTypes to find your type, then getDiagramTypeGuide for DSL syntax before writing diagramCode. The diagramCode is COMPILE-CHECKED BY RENDERING at write time: broken DSL is rejected with the renderer's error (fix and retry), and valid DSL is rendere

Update a diagram's code, description, or properties. Call getDiagramTypeGuide for DSL syntax. New diagramCode is COMPILE-CHECKED BY RENDERING at write time — broken DSL is rejected with the renderer's error — and a valid change is re-rendered + re-thumbnailed immediately (response diagram.renderStat

Delete a diagram: removes the database record AND every reference to it in the document body — the current marker format plus legacy forms (markers without an embedded diagramId, and old plain-text `[Diagram: name]` placeholders). The response's removedFromBody says whether a marker was actually fou

Delete a document.

Get the Stable Baseline whiteboarding guide (Markdown): when to use stencils vs architecture icons vs code/BPMN diagrams vs plain shapes vs real images vs frames/presentations, how to lay out and verify a board, and how to edit a large board safely (patch by id, never replace). Call before authoring

Auto-design a complete, visually polished whiteboard from a natural-language goal using the PREMIUM multi-agent pipeline (the same one the in-app assistant uses): it browses the stencil/icon library, composes the WHOLE board, renders it, critiques the rendered image, and refines — far better than ha

Design ONE reusable, on-brand SLIDE COMPONENT and add it to the org's component library so every future branded deck (autoDesignWhiteboard designProfile:'branded-executive') can use it. This is the self-improving design loop: an agent AUTHORS the component as a declarative template (a gradient/shado

Mask-edit (inpaint) one region of an image element on a whiteboard. Given the target image element id and a paint MASK (a PNG where WHITE marks the area to regenerate and BLACK is kept), it regenerates only the masked region using the prompt and replaces the image IN PLACE (same position + size). Th

Create or refine a slide deck INSIDE an existing whiteboard by conversing with the AI design agent. Send a brief for a NEW deck, a change to an EXISTING one, or an answer to the agent's question. The agent builds a polished, on-brand deck and places it on the board; if the brief is ambiguous it asks

Create or refine a standalone ILLUSTRATION INSIDE an existing whiteboard by conversing with the AI design agent. This is the illustration sibling of designDeckInWhiteboard: same conversation, same follow-up flow, but it makes ONE on-brand illustration placed on the board (not a slide deck). Send a b

Get the design agent's reply after calling designDeckInWhiteboard OR designIllustrationInWhiteboard: the status (thinking/building/ready) and EITHER the finished result (a deck's slide count + preview, or the placed illustration) OR a clarifying question to answer (call the SAME tool you started wit

Export a design that lives in a whiteboard to an editable PowerPoint (PPTX), PDF, PNG images, or raw HTML. Give it the whiteboard documentId and the designId (the deck). kind:'deck' (default) renders the finished deck via the export worker: 'pptx' = native, fully-editable PowerPoint (real shapes and

Invite the Stable Baseline Meeting Scribe bot to a LIVE meeting (Zoom, Google Meet, Microsoft Teams, or Webex) so it paints a live, editable whiteboard of the conversation as it happens: sticky notes and topic clusters, an agenda that ticks itself off, and decisions and actions pinned to rails, on a

Get a meeting scribe's status after startMeetingScribe: the session state (joining, in the waiting room, live in the call, paused, ending, ended, or failed), the live activity feed of what the scribe has painted, and the board it is painting. Give it the sessionId returned by startMeetingScribe. Pol

Stop a running meeting scribe: the bot leaves the meeting and the board is finalised (tidy pass plus a summary frame). Give it the sessionId returned by startMeetingScribe. Billing stops at the current block; the user can also stop the scribe simply by removing the bot from the meeting.

Create a whiteboard — an infinite Excalidraw canvas. A whiteboard is a hidden document (it won't appear in listDocuments) that hosts a single freeform canvas, and opens in the immersive whiteboard editor in the app. Returns documentId + diagramId. Author shapes afterwards with addWhiteboardElements

List the whiteboards in a project (hidden whiteboard-kind documents). Returns documentId, diagramId, title and timestamps for each.

Read a whiteboard: its metadata plus a summary of the canvas (element count, element types, and text labels on the board). Pass includeElements=true to also return the full Excalidraw scene ({elements, appState, files}) — needed if you intend to modify it and send it back via updateWhiteboardScene.

Edit elements on a whiteboard's canvas WITHOUT dropping the rest of the scene. A board may hold many diagrams/elements, so prefer surgical edits: mode='patch' (DEFAULT) shallow-merges each incoming object into the existing element with the same `id` (send just {id, backgroundColor:'blue'} to recolou

Author shapes onto a whiteboard from high-level specs (you do NOT need the full Excalidraw element schema). Appends to the canvas. PLACEMENT ON AN EXISTING BOARD (critical): NEVER guess x/y onto a board that already has content — guessed coordinates land ON TOP of existing shapes and create an unrea

Copy-paste existing whiteboard elements — the MCP equivalent of selecting a group and pressing Ctrl/Cmd+D. Clones the given elements (plus their group peers + bound text/labels) with FRESH ids, offsets the copy by dx/dy, and by default groups it into ONE new unit so it moves together. Use it to buil

Insert a real IMAGE (photo, screenshot, logo, picture) into a whiteboard — the storage-backed equivalent of insertImageInDocument. Provide the image as imageUrl (fetched and re-hosted), imageBase64, or imageBinary; for large files call createImageUploadSession(documentId) first then pass the returne

Insert (or re-render in place) a real DIAGRAM (BPMN, Diagrams-as-Code / any DSL: mermaid, d2, plantuml, graphviz, …) on a whiteboard as an editable SB diagram element. Provide documentId, diagramType (call listDiagramTypes / getDiagramTypeGuide), and source (the DSL). The diagram is rendered to an i

Turn a raster image into hand-drawn freedraw strokes on a whiteboard, deterministically. Pass an image (imageUrl OR imageBase64) plus a style; the server fetches and vectorises it server-side and draws the strokes, so you do NOT emit any coordinates yourself (LLMs are poor at that and it wastes toke

Render tabular data as an aligned grid of labelled cells on a whiteboard, deterministically. Pass rows (an array of arrays) OR data (an array of objects), with optional headers; the server lays out evenly-spaced cells so you do NOT place each cell by hand. Use this to turn data, CSV, or JSON into a

Search the built-in library of structural whiteboard stencils — ready-made hand-drawn graphics: flowchart/UML/ER/BPMN symbols, scrum columns, org-chart nodes, gantt, lo-fi/UX wireframe widgets (buttons, forms, tables, alerts, navs), charts, device frames, stick figures. A stencil is a MINI-WHITEBOAR

Render a whiteboard to a raster IMAGE so you can SEE it and confirm your edits look right, then iterate — like taking a screenshot. Returns the rendered board as a viewable image attached to the result (always raster: a JPEG light variant and/or a PNG dark variant; there is no vector/SVG output, so

Delete a whiteboard (the host document and its canvas).

Generate a diagram from its DSL/code and get the IMAGE back — WITHOUT inserting it into any document or whiteboard. For acting as a pure diagram generator. Provide diagramType (e.g. 'mermaid', 'd2', 'plantuml', 'graphviz', 'bpmn', 'vegalite'; call listDiagramTypes for the full set) and source (the d

Render a diagram that ALREADY exists in a document to an IMAGE (svg/png/jpeg @1x/2x/3x) and return it — a temporary signed URL (expires in 1 hour) plus, for png/jpeg, the image inline so you can see it. Pass the diagramId (from getDocument's DIAGRAM markers or getDiagramInDocument). Reuses the diagr

Internal maintenance (requires write). Syncs gte-small (384-dim) vector embeddings for every platform catalog (MCP tools, whiteboard stencils, architecture icons, infographic templates, whiteboard design components, and open-design skills) into platform_catalog_embeddings, so the semantic search beh

Batch-reorder documents within a folder (or project root) by setting sibling positions. Pass [{documentId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. Position-only update — does not bump version or create a snapshot. To MOVE a do

List version history for a document. Returns timestamps, creator, change summary, and content.

Get image details including a fresh signed URL (expires after 1 hour). Use storagePath from IMAGE_OMITTED markers in getDocument output.

Create a PUT upload URL for a document image (max 10MB). Use the returned assetUrl with insertImageInDocument.

Insert an image into a document (max 10MB). Provide imageBase64, imageBinary, or imageUrl. For large files, call createImageUploadSession first then use the returned assetUrl.

Update image metadata (alt, caption, dimensions, alignment). Requires the document's versionTimestamp (from getDocument or any mutating tool's response) for optimistic locking.

Delete an image from a document and storage.

Create a PUT upload URL for a Vega/Vega-Lite data file. Use returned assetUrl in your Vega spec.

Delete a data file attachment from a document.

Step 1 of file ingest. Mint a single-use PUT upload URL for a large file (PDF, DOCX, plain text, or markdown — up to 150 MB). Returns { sessionId, uploadUrl, expiresAt, maxBytes }. Upload the raw bytes to uploadUrl with PUT, then call createDocumentFromUpload({ sessionId, projectId }) to start the c

Step 2 of file ingest. After the file is uploaded via the PUT URL from createDocumentIngestSession, call this to start the async conversion. Returns { jobId, documentId } immediately — the document is created as a draft and progressively populated as the worker processes the file. Poll getDocumentIn

Read the current status of an ingest job. Returns { status, stage, processedImages, totalImages, documentId, error?, lastHeartbeatAt }. Stages: pending → downloaded → extracted → draft_saved → images_processing → finalized → cleaned_up. Status: queued, running, succeeded, failed, cancelled. The asso

List AND grep improvements in a project. `query` searches the title, friendlyId and problem statement, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status, type, priority. For ranked semantic + text sea

Get full details for an improvement item including evidence, activity log, compliance context, and the `checklist` array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp — pass it to updateImprovement for optimistic locking. (For tasks specific

Create an improvement item in a project. Requires projectId and title. Auto-assigns friendly ID.

Update an improvement (or a task — tasks share this row, but prefer the symmetric updateTask alias when working from getTask). Supports the full field set including `checklist` (tick-boxes with due dates + completion attribution) and `acceptance_criteria` (objects with per-row updated_by/at attribut

Delete an improvement and all associated evidence and activity.

List improvement categories for a project. Returns tree and flat list.

Create an improvement category or sub-category. Max two levels.

Update an improvement category. Cannot modify system categories.

Delete an improvement category. Cannot delete system categories.

Reorder improvement categories by setting sort_order values.

Add evidence to an improvement. Types: document_section, diagram_node, incident_note, feedback, free_text.

Add a comment or activity entry to an improvement.

Update a comment on an improvement. Requires the comment's updated_at as versionTimestamp.

Delete a comment from an improvement.

Locate any artefact (document / whiteboard / diagram / plan / task / improvement / compliance) by name or friendly id — AND ranked semantic search over improvements. • CROSS-ARTEFACT FINDER MODE (pass `types`): matches title + friendly id (e.g. "DOC-123", "WBD-9", "PLN-4", "TAS-7", "IMP-2") + descr

List AND grep plans in a project. `query` searches the title, friendlyId and description, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status and priority.

Get full plan details including phases, items, and activity. Returns versionTimestamp — pass it to updatePlan for optimistic locking. Items include percent_complete for progress tracking.

Create a plan in a project. Requires projectId and title.

Update a plan. Requires versionTimestamp from getPlan.

Delete a plan, all its phases, and all tasks/improvements within it. This is a destructive operation that cannot be undone.

List phases for a plan ordered by position.

Get a plan phase by ID with full details. Returns versionTimestamp — pass it to updatePlanPhase for optimistic locking.

Create a phase in a plan. Position and wbs_code are auto-computed.

Update a plan phase. Requires versionTimestamp from getPlanPhase (not getPlan).

Delete a plan phase and all tasks/improvements within it. This is a destructive operation that cannot be undone.

Reorder plan phases by setting position values. WBS codes are recalculated.

Add a comment or activity entry to a plan.

Update a comment on a plan. Requires the comment's updated_at as versionTimestamp.

Delete a comment from a plan.

Create a task in a plan. Requires planId and title.

List AND grep tasks in a plan. `query` searches the title, friendlyId and description, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status, priority and phaseId.

Get a task by ID with full details, evidence, activity, and the `checklist` array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp; pass it to updateTask to modify. Includes percent_complete for progress tracking.

Update a task. Tasks share a row with improvements (`improvement_items` with `is_task=true`), so this is a thin alias over updateImprovement — every field on updateImprovement is supported, including `checklist`, `acceptance_criteria`, status transitions (blocked/rejected/done need their respective

Get the complete plan hierarchy (phases, tasks, improvements) in one call. Recommended first call for plan navigation.

Set or clear the WBS parent-child nesting of a task/improvement (outline hierarchy, no scheduling effect). Same plan and phase required. Max depth: 5.

List FS/SS/FF task-dependency edges in a plan (the Gantt arrows). Scope by planId, projectId, or itemId. `direction`: 'predecessors' | 'successors' | 'both' (default, only with itemId).

Create an FS/SS/FF scheduling edge with lag/lead between two items in the same plan (rendered as a Gantt arrow). FS = Finish-to-Start, SS = Start-to-Start, FF = Finish-to-Finish. `lagDays`: positive = lag, negative = lead/overlap. Rejects self-loops, duplicate (pred+succ+type) edges, cross-plan edge

Change the type (FS/SS/FF) or lag/lead of an existing task-dependency. Doesn't move dates directly; flags the successor with `needs_dependency_review=true` and fills `suggested_start_date`/`suggested_end_date` if the change implies a different schedule.

Remove a task-dependency edge. Neither item's dates are changed.

Per-item: apply a successor's `suggested_start_date`/`suggested_end_date` to its real dates and clear `needs_dependency_review`. For a whole-plan cascade use `applyTaskDependencyCascade`.

Per-item: clear `needs_dependency_review` without changing dates — keeps the edge, ignores the suggestion. Use when the successor should stay put despite the predecessor shifting.

Auto-schedule every item in a plan so all FS/SS/FF task-dependencies are respected (topological pass, durations preserved). Returns the before/after diff and logs a comment on every item that moves. Use `forwardOnly: true` to only shift items currently in violation (never pull already-valid items ea

Dry-run of `applyTaskDependencyCascade` — returns the diff without writing. Empty items array means the plan is already consistent. Accepts the same `pinnedItemIds` and `forwardOnly` params.

Unified Knowledge Graph KNOWLEDGE retrieval — facts, themes and relationships from INSIDE document CONTENT. This is NOT an artefact finder: do NOT use it to locate a document / whiteboard / diagram / plan / task / improvement by its TITLE or friendly id (e.g. "DOC-123", "find the GTM plan"). For loc

Phase 5 / E3 — Provenance-aware assessor for a set of chunk_ids returned by kg_search. Returns per-chunk bucket (authored-grounded | extracted-high-conf | extracted-low-conf | no-support), overall distribution, dominant_bucket, and recommend_refusal. Pure metadata read - no LLM cost. Used by the age

Fetch a KG entity by id or name, with 1-hop neighbours.

Find other sources that share entities with the given source.

Check whether Knowledge Graph is in-scope for a given target.

Linked-mentions rail: every edge whose dst matches the named entity.

List Louvain communities for an org (optionally scoped by project).

Fetch a community wiki page (LLM-curated CDMD).

3 template + 3 LLM-generated sample questions for the knowledge-graph playground.

Read a single organisation by id. Returns id, name, slug, description, settings (jsonb), created_at, member_count (active members) and plan_tier (subscription_tier). The organisation must match the calling credential's organisation. Read-only.

Read a single workspace by id. Auth via the standard workspace-access ladder (credential org match + workspace scope + per-resource read permission). Returns the full v_workspaces row. Read-only.

Read a single project by id. Auth via the standard project-access ladder. Returns the full v_projects row (id, workspace_id, name, description, icon, created_by/at, updated_by/at). Read-only.

List members of an organisation, enriched with email + display name. Auth: org id must match the credential's organisation. Returns paginated list, default limit 50 / max 200.

Fetch a single organisation member by user_id, enriched with profile (email + display name). Auth: org id must match the credential's organisation.

List organisation invitations. Auth: org id must match the credential's organisation AND the credential must hold the can_manage_members capability. Status defaults to 'pending'. Pass 'all' to disable filtering.

Read the subscription state for an organisation. Returns tier, status, current billing period, seat count, member count, cancellation flag, trial end. Stripe IDs are stripped. Pair with listPaymentMethods/listInvoices for the full billing dashboard. Use when the user asks 'what plan am I on', 'how m

List invoices for an organisation, newest first. Returns hosted Stripe invoice URLs and PDF links. Stripe IDs are stripped.

List saved payment methods for an organisation. Returns masked card metadata only (brand, last4, exp month/year, default flag). NEVER returns full card numbers, CVCs, or any Stripe IDs.

Composite credit balance for an organisation: plan_credits (recurring monthly bucket), top_up_credits (purchased one-offs, gross), bonus_credits (admin grants), total, and period_end (next plan reset).

List active credit packages available for purchase (name, credits, bonus_credits, price in cents AUD). Catalog read — visible to any MCP credential. Pair with createCreditPurchaseLink (Phase 6) to start a checkout.

List credit-purchase history for an organisation, newest first. Status, credits purchased, bonus, amount paid in AUD cents, completion timestamp. Stripe IDs stripped.

Read the public catalog entry for a single subscription tier (free, pro, enterprise). Pro/Free pricing is publicly advertised; Enterprise pricing is custom — pricing fields are nullified for non-admin callers.

List explicit permission grants on a resource (workspace/project/folder/document/improvement/plan), including principal type (user|team), level (none|read|write|admin), and 3-state overrides for documents/improvements/plans. Read-only. Use when the user asks 'who can see this', 'who has access', 'wh

Compute a user's effective permission level on a resource (taking team grants, inheritance, and 3-state overrides into account) and the source. Asking about another user requires can_manage_perms on the org. Use when the user asks 'can X access this', 'what level of access does X have', 'why can X s

List every kg_scope row for the caller's organisation, optionally narrowed to a workspace or project subtree. Each row carries scope_type, scope_id, state (on|off|inherit), settings, and is augmented with scope_name + parent_id for tree rendering. Capped at 500 rows.

Read an organisation's settings JSON and the derived enabled-features map (plans, documents, improvements, compliance, knowledge_graph — all booleans). The organisation must match the calling credential's organisation. Read-only.

Read the plan entitlements (limits + capability flags) that apply to the caller's organisation. Returns { tier, display_name, limits, features }. The Enterprise row is filtered for non-admin callers by the underlying view. Read-only.

Read the calling user's preferences. Self-only — no params required. Returns { notifications, grids } where `notifications` is the single notification-preferences row and `grids` is an array of per-grid view rows. Read-only.

Create a new organisation owned by the calling credential's user. Auth: server-side eligibility gate via `can_user_create_organization` (free-tier users may only have one org). Per-credential rate limit 3/day. Slug auto-generated. The new org is OUTSIDE the credential's current scope (credentials ar

Update an organisation's name and/or description. Auth: ceiling — credential must hold `can_admin_org` capability AND user must be org owner/admin. Rate limit 30/min. At least one of name/description required. Returns updated row.

Create a new workspace inside the organisation. Auth: ceiling — credential must hold `can_lifecycle` AND user must be org owner/admin. Rate limit 30/min. Slug auto-generated. Caller becomes workspace owner. Plan limits surface as WORKSPACE_LIMIT_REACHED errors.

Update a workspace's name. Auth: standard workspace-write ladder + user must be workspace owner or admin. Slug is intentionally not editable (URL-embedded). Rate limit 60/min.

Create a new project inside a workspace. Mirrors the UI Create Project dialog. Auth: write on workspace + credential's `can_lifecycle` capability. Validates name (1..200) and description (0..2000); icon defaults to '📁' if omitted. Server-side limit gate via `can_create_project_in_workspace`. Rate li

Update a project's name, description, and/or icon. Mirrors the UI Project General Settings page. Auth: admin on the project (cascades from workspace owner/admin and org admin). Partial updates; at least one of name/description/icon must be supplied. Rate limit 60/min.

Invite a person by email to the credential's organisation. Auth: org id must match the credential AND credential must hold can_manage_members. Rate limit 10/h. Returns invitation_id, expiry, and a seat-billing-impact summary. Email-existence is opaque: the response shape never reveals whether the em

Cancel a pending invitation by id. Sets status='revoked'. Server resolves the organisation_id from the invitation row; the credential must match that org AND hold can_manage_members. Idempotent. Rate limit 30/min. Use when the user asks to cancel, revoke, or undo a pending invitation — for example t

Resend a pending invitation: extends expires_at by 7 days and re-triggers the invitation email. Server resolves the organisation_id from the invitation row. Rate limit 6/h per invitation_id. Use when the user asks to resend, re-send, or re-trigger an invitation email — typically because the recipien

Update an organisation member's role (admin or member). Owners cannot be changed via this tool. Refuses self-promotion. Rate limit 30/min. Use when the user asks to promote someone to admin, demote an admin to member, or change a teammate's role.

Soft-deactivate or reactivate an organisation member. Refuses self-deactivation, last-admin/owner deactivation, and deactivation of an owner. Rate limit 30/min. Use when the user asks to deactivate, suspend, freeze, reactivate, or unfreeze a member without fully removing them.

Hard-remove a member from an organisation, cascading to workspace and team memberships and resource permissions. Refuses self-removal and last-owner removal. Stripe seat downgrade is NOT performed here — pair with a Phase 6 billing tool. Rate limit 5/min. Use when the user asks to remove, kick out,

Update a user's profile name and/or display email. Self-updates do not require organisation_id; updates to other users require organisation_id and the can_manage_members capability. Self login-email changes must be done via the UI (verification round-trip).

Add an existing organisation member to a workspace with a workspace-level role. Idempotent — returns the existing membership if already a member. Caller must be a workspace owner or admin.

Change an existing workspace member's role. Caller must be a workspace owner or admin. Cannot self-demote from owner/admin to editor/viewer — transfer the role first.

Remove a member from a workspace. Caller must be a workspace owner or admin. Refuses to remove the last remaining workspace owner.

Create a new team inside an organisation. Caller is added as the team's lead. Subject to plan team limit. Rate limit 30/min.

Update a team's name, description, and/or colour. At least one field required. Slug is intentionally not editable. Rate limit 60/min.

Delete a team. Cascades: team members and team-granted resource permissions are removed automatically. Destructive; rate limit 5/min.

Add a user to a team as a regular member. Idempotent — returns already_member=true if already on the team. User must be an active organisation member.

Remove a user from a team. Idempotent — returns removed=false if not on the team.

Grant a team read/write/admin access to a workspace. Idempotent. Team and workspace must be in the same organisation.

Update an existing team's workspace access level. Refuses if no grant exists — call grantTeamWorkspaceAccess first. No-op when level matches.

Revoke a team's workspace access. Idempotent — returns revoked=false if no grant exists.

Insert or update a resource_permissions row for a user OR team on a workspace/project/folder/document/improvement/plan. Refuses self-escalation. Rate limit 30/min. Use when the user asks to give access to, share with, grant access, add a permission, make accessible, or invite someone to a specific w

Update the access level on an existing permission row. Override flags are NOT touched — use setResourcePermissionOverride for those. Refuses self-escalation. Rate limit 30/min.

Delete a resource_permissions row. Refuses if the row is the LAST admin grant on the resource. Rate limit 30/min. Use when the user asks to revoke access, remove access, take away access, unshare, or delete a permission grant on a specific resource.

Set a single 3-state override on a permission row: null=inherit, true=allow, false=deny. Per-axis (read/write/delete) and per-kind (documents/improvements/plans), matching the OverrideAccessSection UI. Rate limit 30/min.

Preview a subscription tier or seat change. Returns confirmation_token (10-min TTL) plus proration and next-invoice math. Cross-tier upgrades from Free return requires_checkout=true; the apply step creates a hosted Stripe Checkout session. Rate limit 30/h. Use when the user asks to upgrade their pla

Apply a previously previewed subscription change. Same-tier seat changes update Stripe in place; cross-tier upgrades from Free return a hosted Checkout URL. Refuses target=free (use cancelSubscription) and target=enterprise (sales-led). Rate limit 5/h. Use only AFTER previewSubscriptionChange and af

Preview the consequences of cancelling. Returns confirmation_token plus summary {remaining_credits, prepaid_days, prepaid_value_aud, feature_loss[], at_risk_seats}. Soft cancel only. Rate limit 30/h. Use when the user asks to cancel, end, or stop their subscription — ALWAYS call this first to show t

Apply a previewed soft cancellation (cancel_at_period_end=true). Customer keeps full access until period end. Rate limit 5/h. Use only AFTER previewSubscriptionCancellation and after the user confirms — never cancel without showing the preview first.

Quote a credit-package purchase (first half of the human-in-the-loop ritual). Returns quote_token (10-min TTL) plus package + total_aud. Caller must invoke purchaseCreditPackage(quote_token) within the TTL. Use when the user asks to buy credits, purchase credits, top up credits, or add more credits

Apply a credit-package quote by creating a hosted Stripe Checkout session. Returns checkout_url + session_id. Refuses if catalogued price has drifted. Rate limit 5/h. Use only AFTER quoteCreditPackage and after the user confirms — never start a checkout without the quote step first.

Reactivate a subscription that was scheduled to cancel at period end (clears cancel_at_period_end). Rate limit 5/h. Use when the user asks to reactivate, uncancel, restore, or keep their subscription after they previously cancelled but before the period ends.

Update the org's billing email. Validates format, writes private.organizations.billing_email, syncs to Stripe customer. Rate limit 30/h.

Mint a single-use Stripe Customer Portal URL for self-serve billing changes. return_url defaults to https://app.stablebaseline.io/settings/billing and must be on a stablebaseline.* host.

Toggle whether a workspace is in the Knowledge Graph (on/off/inherit). 'on' enables the workspace as a gate for indexing its projects; 'off' excludes everything under it; 'inherit' removes the explicit override. No re-ingest happens here. Requires can_manage_kg + workspace write. Rate limit 30/min.

Set the KG visibility mode for a project: 'strict' (multi-source rows hidden unless user can read every source), 'permissive' (one source suffices), or 'open' (any org member). Controls WHO can see the project's KG rows. Requires can_manage_kg + project write. Rate limit 30/min.

Toggle KG-scope override for a folder (on/off/inherit). Folders default to inheriting their project's scope. Requires can_manage_kg + folder write. Rate limit 30/min.

Toggle KG-scope override for a single document (on/off/inherit). Documents default to inheriting their folder/project gate. Requires can_manage_kg + document write. Rate limit 30/min.

Cancel a single KG rebuild batch. Queued runs flip to 'cancelled' immediately; running runs finish naturally. Requires can_manage_kg. Rate limit 5/min.

Emergency stop for KG ingestion: cancels queued/running build runs, queued/running rebuild batches, demotes still-eager unfinished chunks. Optionally narrowed to one project. Requires can_manage_kg + (project write if project_id supplied). Rate limit 5/min.

Wipe + re-ingest a single document in the KG. Drops chunks/mentions/entities, clears pending lazy-extraction, and enqueues a fresh extract pass. Requires can_manage_kg + document write. Rate limit 30/min.

Preview the credit cost, source counts, and ETA of including or excluding KG scope rows. Returns confirmation_token (10-min TTL) plus delta of newly-in-scope vs newly-out-of-scope sources. Rate limit 20/h.

Apply a previously previewed KG scope change. Atomically writes kg_scope rows and dispatches a re-ingest batch (batch_id = token). Idempotent. Rate limit 5/h.

Preview the cost / coverage / ETA of a full KG rebuild for the org (optionally narrowed to a workspace or project). Returns confirmation_token (10-min TTL). Rate limit 20/h.

Apply a previously previewed KG rebuild. Dispatches the build batch via kg-rebuild and returns batch_id. Rate limit 5/h.

Update an organisation's `settings` JSONB via deep merge. Auth: ceiling — credential must hold can_admin_org AND user must be org owner/admin. Rate limit 30/min. Patches that touch `enabledFeatures` are rejected — use updateOrgFeatureFlags instead.

Create a per-org BRAND KIT so Stable Baseline outputs come out fully on-brand. Upload your branding and it is auto-applied: pass a `logoUrl` (as little as your logo, and the vision model AUTO-EXTRACTS your palette and fonts), or an `officeUrl` (an existing .pptx/.docx, from which it extracts theme c

List an organisation's BRAND KITS (palette/fonts/logo), newest first. Use a returned `id` as brandKitId for a design call or setDefaultBrandKit. Auth: can_admin_org.

Set or clear the default BRAND KIT at a scope: organization, workspace, or project. Defaults cascade most-specific-first (a per-board/document override beats project beats workspace beats organization). Pass brandKitId:null to clear. Auth: org owner/admin.

Toggle feature flags on settings.enabledFeatures (plans, improvements, compliance, knowledge_graph, documents). Auth: can_admin_org + org admin. Rate limit 30/min. Plan-tier gated: enabling knowledge_graph requires Pro/Enterprise.

Update the calling user's preferences. Self-only. Rate limit 60/min. Partial: only fields supplied are updated. notifications upserts a single row; grids upserts per-row keyed by (user_id, project_id, grid_key, view_name).

Begin an agent-driven sign-up to Stable Baseline. Anonymous-callable. Returns a `verification_url` and a 6-character `user_code` that the agent must show to the user. The user opens the URL in their browser, signs in or signs up if necessary, enters the code, and clicks Authorize. The agent meanwhil

Poll the status of a signup begun via `startSignup`. Anonymous-callable. Possible status values: `pending` (user has not yet authorized — keep polling), `authorized` (success — response includes `api_key`, `organization_id`, `user_id`, `user_email`; the api_key is returned ONCE), `consumed` (already