Stable Baseline

Per-item: apply a successor's suggested_start_date/suggested_end_date to its real dates and clear needs_dependency_review. For a whole-plan cascade use applyTaskDependencyCascade.

Add a comment or activity entry to an improvement.

Add evidence to an improvement. Types: document_section, diagram_node, incident_note, feedback, free_text.

Add a comment or activity entry to a plan.

Add a user to a team as a regular member. Idempotent — returns already_member=true if already on the team. User must be an active organisation member.

Author shapes onto a whiteboard from high-level specs (you do NOT need the full Excalidraw element schema). Appends to the canvas. PLACEMENT ON AN EXISTING BOARD (critical): NEVER guess x/y onto a board that already has content — guessed coordinates land ON TOP of existing shapes and create an unreadable pile. Either (a) OMIT x/y entirely and the server auto-places the new elements together in clear space BELOW the current content, or (b) FIRST call getWhiteboard({ includeElements:true }) to see where existing shapes already are and choose a genuinely EMPTY region. Pass explicit x/y only for a deliberate layout in space you have confirmed is empty. PREFER THE RICHEST FORM THAT FITS, not plain rectangles: for a sticky/post-it note use { type:'sticky', text, backgroundColor } (a first-class note with an auto-fitting bound label — there is NO sticky-note stencil; OMIT x/y and it is auto-placed in clear space below existing content, so it doesn't land on top of the current drawing); for kanban/scrum/story boards, flowcharts, UML/ER, BPMN, org charts, wireframes/mockups, charts or people use a LIBRARY STENCIL in ONE call — { type:'stencil', stencil:'<name e.g. decision>', x, y } fuzzy-matches by name with no prior listWhiteboardStencils call (pass width/height to SCALE the whole stencil and text to fill its single label); for cloud/software-architecture use ICONS — { type:'image', iconPath:'dev/docker.svg', x, y } (paths from listArchitectureIcons); reserve raw rectangles/ellipses for when no standard form fits. Expressive enough to reproduce real Excalidraw templates (sticky-note brainstorm grids, sketchy mind maps, flowcharts). Each spec: { type: 'rectangle'|'ellipse'|'diamond'|'sticky'|'text'|'arrow'|'line'|'freedraw'|'frame'|'image'|'stencil', id?, x, y, width, height, text? (STRONGLY PREFER setting a shape's label via its own text — it becomes a centered, auto-WRAPPED bound label fitted to the shape; do NOT drop a separate type:'text' element on top of a shape as its label. Standalone type:'text' is for free-floating titles/notes and now also wraps to its width; Yes/No label on an arrow — emojis are fine, e.g. 'Risks ⚠️'), fontSize?, fontFamily? (1=hand-drawn default, 2=normal, 3=code), textAlign?, backgroundColor? (name 'blue'/'green'/'yellow'/'pink'/'violet'/'orange'/'teal'/… or hex), strokeColor?, fillStyle? ('solid'|'hachure'|'cross-hatch'), strokeStyle? ('solid'|'dashed'|'dotted' — use 'dashed' for grid/category borders), strokeWidth? (1 thin/2 bold/4 extra), roughness? (0 clean, 1 default, 2 very sketchy/hand-drawn — use 2 for organic mind maps), roundness? (number type or null for sharp), opacity?, name? (frame title), frameId? (put a shape inside a frame), start?:{id}, end?:{id} (connect arrows/lines to shapes by id — connectors AUTO-CLIP to the shape edges, never overrun to the centre, AUTO-ROUTE around any shapes in between so a decision's No/loop-back branch never cuts straight through the boxes between source and target, and bound text auto-wraps + centres), routing? ('straight' default | 'elbow' for clean right-angle flowchart/org-chart connectors | 'curved'), startArrowhead?/endArrowhead? (arrowheads are SOLID filled triangles by default — just OMIT them. Pass null for a plain mind-map spoke with no head. Do NOT pass 'arrow': that is Excalidraw's open 'V' and is auto-upgraded to a solid triangle anyway), points? ([[0,0],[dx,dy]] relative, only for manual geometry — almost never needed; binding by id is better), props? (escape hatch: any other Excalidraw field) }. ARCHITECTURE ICONS: to place a software-architecture icon (AWS/Azure/GCP/Docker/Kubernetes/databases/etc.), first call listArchitectureIcons to find one, then add a spec { type:'image', iconPath:'<relative_url e.g. dev/docker.svg>', x, y, width:96, height:96, text?:'<caption shown below>' } — the icon is stored as a URL reference (never base64). Use imageUrl instead of iconPath for any other public image. Combine icons with labelled boxes + elbow arrows for clean architecture diagrams. LIBRARY STENCILS: for hand-drawn, on-brand elements (scrum/kanban columns, flowchart symbols, UML/ER, BPMN, org-chart nodes, wireframe widgets, stick figures), FIRST call listWhiteboardStencils to find one, then add { type:'stencil', stencilKey:'<key from listWhiteboardStencils>', x, y } (or { type:'stencil', stencil:'<name e.g. decision>', pack?:'<pack>', x, y } to fuzzy-match by name). A stencil is a mini-whiteboard (a collection of elements) of kind 'symbol' or 'template' (listWhiteboardStencils returns the kind + its embedded labels). For a SYMBOL (one atomic labelled node — flowchart box, BPMN task, org node), pass id + text + width/height: the label auto-fits its single slot and arrows bind to it via start/end {id}. For a TEMPLATE (a multi-component layout — Alerts, Forms, Tables, Charts), place it WHOLE (no single text); the result returns its children (id + text + colour + position) so you retext, recolour, or DELETE specific parts by id via updateWhiteboardScene (cluster children by y to act on a whole row/variant). STRONGLY prefer stencils over plain rectangles for wireframes/mockups, kanban/scrum boards, UML/BPMN, org charts; for dense flowcharts, plain shapes with bound text + elbow arrows are equally reliable. (For a plain sticky/post-it note use type:'sticky', NOT a stencil — there is no sticky-note stencil.) FRAMES: a frame is a NON-DESTRUCTIVE, ANY-SIZE container. To enclose shapes that ALREADY exist, add ONE type:'frame' sized to cover them (Excalidraw auto-captures elements inside a frame's bounds) or set those shapes' frameId — never recreate or delete-and-redraw content just to frame it. If a frame doesn't fully cover its content, just RESIZE the frame (patch its width/height). Deleting a frame (deleteIds:[frameId]) leaves all its contents intact on the canvas — it only removes the frame border + title. PRESENTATION/SLIDES: when the user wants a presentation or slide deck, create type:'frame' slides sized width:1280,height:720 (16:9), laid out LEFT-TO-RIGHT at the same y (x: 0, then 1440, 2880, 4320, …), each with a name (the slide title). Put every slide's shapes/text/images INSIDE its frame by setting their frameId to that frame's id (give the frame an id and reference it). Slides play in order (left-to-right, then top-to-bottom) in the board's Present mode and export to PPTX, so one frame = one slide. FLOWCHART recipe: rectangles (roundness null for sharp process boxes), diamonds for decisions, arrows with routing:'elbow' and Yes/No as the arrow's text. Use type 'sticky' for sticky/post-it notes (a solid-fill note with an auto-fitting bound label — set text + backgroundColor); type 'line' with no arrowheads + roughness:2 for sketchy mind-map spokes. FREEHAND DOODLES: to actually draw/doodle/sketch freehand, use { type:'freedraw', points } where points is a RELATIVE [[x,y],…] path of the stroke (e.g. a squiggle, circling or annotating something, a hand-drawn star/heart/smiley/arrow, an organic blob) — it renders as one smooth freehand stroke. x/y is the origin; omit x/y to auto-place. Chain several freedraw specs for a multi-stroke doodle. NOTE: freehand is always SOLID (Excalidraw ignores strokeStyle on freedraw) — colour, strokeWidth and opacity DO apply; a freedraw with strokeStyle:'dashed' or 'dotted' is automatically rendered as a smooth dashed/dotted line so the dashes actually show. Give shapes ids and reference them from connectors. Connectors may also bind to shapes ALREADY on the board by their id (get them via getWhiteboard includeElements:true) — you do NOT need to resend existing shapes; the server reads the live scene to bind the arrow and route it around the other boxes. Great for brainstorms, mind maps, flowcharts, org charts, SWOT, retros. PROCESS: for any non-trivial board call getWhiteboardGuide FIRST to plan it; then after adding, ALWAYS call getWhiteboardImage to SEE the result and check layout, labels, spacing, overlaps and how shapes connect — if anything looks off, fix it with updateWhiteboardScene (patch by id) and render again, iterating until it looks right. RESULT: returns added (count), placement (bounding box {x,y,width,height} of what you just added) and autoPlaced (true when you omitted x/y so it was placed in clear space below existing content) — use placement/autoPlaced to tell the user WHERE the new elements landed, never invent a location.

Add an existing organisation member to a workspace with a workspace-level role. Idempotent — returns the existing membership if already a member. Caller must be a workspace owner or admin.

Apply a previously previewed KG scope change. Atomically writes kg_scope rows and dispatches a re-ingest batch (batch_id = token). Idempotent. Rate limit 5/h.

Auto-schedule every item in a plan so all FS/SS/FF task-dependencies are respected (topological pass, durations preserved). Returns the before/after diff and logs a comment on every item that moves. Use forwardOnly: true to only shift items currently in violation (never pull already-valid items earlier). Use pinnedItemIds to keep specific items at their current dates. Pairs with previewTaskDependencyCascade (same inputs, dry-run).

Emergency stop for KG ingestion: cancels queued/running build runs, queued/running rebuild batches, demotes still-eager unfinished chunks. Optionally narrowed to one project. Requires can_manage_kg + (project write if project_id supplied). Rate limit 5/min.

Cancel a pending invitation by id. Sets status='revoked'. Server resolves the organisation_id from the invitation row; the credential must match that org AND hold can_manage_members. Idempotent. Rate limit 30/min. Use when the user asks to cancel, revoke, or undo a pending invitation — for example to correct a typo'd email address before re-inviting.

Cancel a single KG rebuild batch. Queued runs flip to 'cancelled' immediately; running runs finish naturally. Requires can_manage_kg. Rate limit 5/min.

Create a document from CDMD markdown. Call getCdmdLanguageGuide first if unfamiliar with syntax. Do not include DIAGRAM/IMAGE markers — insert them after with dedicated tools. Supports @-mentioning people: embed <!-- REFERENCE: {"type":"user","id":"<user_uuid>","label":"Name"} --> to notify a teammate. Use listAssignablePrincipals to look up the user_id from a name; mentions of users outside the project are silently dropped.

Step 2 of file ingest. After the file is uploaded via the PUT URL from createDocumentIngestSession, call this to start the async conversion. Returns { jobId, documentId } immediately — the document is created as a draft and progressively populated as the worker processes the file. Poll getDocumentIngestJob({ jobId }) to track progress. Idempotent: calling twice with the same sessionId returns the same job/document.

Step 1 of file ingest. Mint a single-use PUT upload URL for a large file (PDF, DOCX, plain text, or markdown — up to 150 MB). Returns { sessionId, uploadUrl, expiresAt, maxBytes }. Upload the raw bytes to uploadUrl with PUT, then call createDocumentFromUpload({ sessionId, projectId }) to start the conversion. The file is auto-deleted once the document is created.

Create a folder in a project. Supports nesting via parentId.

Create a PUT upload URL for a document image (max 10MB). Use the returned assetUrl with insertImageInDocument.

Create an improvement item in a project. Requires projectId and title. Auto-assigns friendly ID.

Create an improvement category or sub-category. Max two levels.

Create a new organisation owned by the calling credential's user. Auth: server-side eligibility gate via can_user_create_organization (free-tier users may only have one org). Per-credential rate limit 3/day. Slug auto-generated. The new org is OUTSIDE the credential's current scope (credentials are bound to one org); to use the new org from MCP, mint a fresh credential.

Create a plan in a project. Requires projectId and title.

Create a phase in a plan. Position and wbs_code are auto-computed.

Create a new project inside a workspace. Mirrors the UI Create Project dialog. Auth: write on workspace + credential's can_lifecycle capability. Validates name (1..200) and description (0..2000); icon defaults to '📁' if omitted. Server-side limit gate via can_create_project_in_workspace. Rate limit 30/min.

Create a task in a plan. Requires planId and title.

Create an FS/SS/FF scheduling edge with lag/lead between two items in the same plan (rendered as a Gantt arrow). FS = Finish-to-Start, SS = Start-to-Start, FF = Finish-to-Finish. lagDays: positive = lag, negative = lead/overlap. Rejects self-loops, duplicate (pred+succ+type) edges, cross-plan edges, and cycles.

Create a new team inside an organisation. Caller is added as the team's lead. Subject to plan team limit. Rate limit 30/min.

Create a PUT upload URL for a Vega/Vega-Lite data file. Use returned assetUrl in your Vega spec.

Create a whiteboard — an infinite Excalidraw canvas. A whiteboard is a hidden document (it won't appear in listDocuments) that hosts a single freeform canvas, and opens in the immersive whiteboard editor in the app. Returns documentId + diagramId. Author shapes afterwards with addWhiteboardElements (high-level specs) or updateWhiteboardScene. For anything beyond a blank board, call getWhiteboardGuide first to plan the layout (stencils vs architecture icons vs code/BPMN diagrams vs plain shapes), and render with getWhiteboardImage to verify as you go.

Create a new workspace inside the organisation. Auth: ceiling — credential must hold can_lifecycle AND user must be org owner/admin. Rate limit 30/min. Slug auto-generated. Caller becomes workspace owner. Plan limits surface as WORKSPACE_LIMIT_REACHED errors.

Render tabular data as an aligned grid of labelled cells on a whiteboard, deterministically. Pass rows (an array of arrays) OR data (an array of objects), with optional headers; the server lays out evenly-spaced cells so you do NOT place each cell by hand. Use this to turn data, CSV, or JSON into a readable table on the board. Returns a compact summary. Auto-places below existing content unless x/y are given.

Delete a diagram from a document.

Delete a document.

Delete a folder recursively, including all nested folders and documents.

Delete an image from a document and storage.

Delete an improvement and all associated evidence and activity.

Delete an improvement category. Cannot delete system categories.

Delete a comment from an improvement.

Delete a plan, all its phases, and all tasks/improvements within it. This is a destructive operation that cannot be undone.

Delete a comment from a plan.

Delete a plan phase and all tasks/improvements within it. This is a destructive operation that cannot be undone.

Delete a resource_permissions row. Refuses if the row is the LAST admin grant on the resource. Rate limit 30/min. Use when the user asks to revoke access, remove access, take away access, unshare, or delete a permission grant on a specific resource.

Remove a task-dependency edge. Neither item's dates are changed.

Delete a team. Cascades: team members and team-granted resource permissions are removed automatically. Destructive; rate limit 5/min.

Delete a data file attachment from a document.

Delete a whiteboard (the host document and its canvas).

Design a complete, visually polished whiteboard from a natural-language goal using the PREMIUM multi-agent pipeline (the same one the in-app assistant uses): it browses the stencil/icon library, composes the board, renders it, critiques the rendered image, and refines — far better than hand-placing shapes. COST + APPROVAL: this costs 50 credits per board and requires the user's explicit approval. Call it FIRST without confirm to get the exact cost + the workspace credit balance; show that to the user and only call again with confirm: true once they agree. If they decline (or lack credits), build the board directly with the standard whiteboard tools (addWhiteboardElements / insertWhiteboardDiagram / listWhiteboardStencils) at no extra charge. It runs in the BACKGROUND and returns immediately with a sessionId; the board fills in over 1-3 minutes. The 50 credits are refunded automatically if the design fails on our side.

Per-item: clear needs_dependency_review without changing dates — keeps the edge, ignores the suggestion. Use when the successor should stay put despite the predecessor shifting.

Copy-paste existing whiteboard elements — the MCP equivalent of selecting a group and pressing Ctrl/Cmd+D. Clones the given elements (plus their group peers + bound text/labels) with FRESH ids, offsets the copy by dx/dy, and by default groups it into ONE new unit so it moves together. Use it to build something once (a labelled stencil frame, a kanban card, a UML class) then stamp out consistent repeats fast — then retext/recolour each copy by its new id (via the returned idMap) with updateWhiteboardScene. Pass groupId to copy a whole group as a unit (e.g. a placed stencil's groupId from its placement result) and/or ids for specific elements. Internal references (group membership, bound text containerId, arrow start/end bindings) are remapped within the copied set; a binding to an element you did NOT copy is dropped. Returns { duplicated, idMap (old id → new id), groupId (the copy's new unit group), elementCount }. Render with getWhiteboardImage afterwards to verify.

Edit a document with line-based patches. Call getDocument first for line numbers and versionTimestamp. Call getCdmdLanguageGuide if unfamiliar with CDMD syntax. Do not edit DIAGRAM/IMAGE markers manually — use dedicated diagram/image tools. To @-mention a person in your patch, insert <!-- REFERENCE: {"type":"user","id":"<user_uuid>","label":"Name"} -->; look up the user_id via listAssignablePrincipals. Mentioned users are notified automatically.

Find and replace text in a document. Searches for all occurrences and replaces them. Case-sensitive by default. Diagrams/images are automatically protected — only document text is affected. Note: when the replace value contains a <!-- REFERENCE: {...} --> marker (e.g. inserting a user mention), it round-trips losslessly through the editor and triggers notifications if it adds a new user mention.

Get the CDMD markdown language specification. Call before createDocument if unfamiliar with syntax.

Read the plan entitlements (limits + capability flags) that apply to the caller's organisation. Returns { tier, display_name, limits, features }. The Enterprise row is filtered for non-admin callers by the underlying view. Read-only.

Return the calling user's identity (user_id, display_name, full_name, email, avatar_url). Use this when the user says 'me' / 'mine' / 'I' so you can resolve to their UUID before passing it to tools like updateImprovement(owner_id=…) or filtering by owner. Read-only.

Render a diagram that ALREADY exists in a document to an IMAGE (svg/png/jpeg @1x/2x/3x) and return it — a temporary signed URL (expires in 1 hour) plus, for png/jpeg, the image inline so you can see it. Pass the diagramId (from getDocument's DIAGRAM markers or getDiagramInDocument). Reuses the diagram's cached server render when available (pixel-identical to the editor). Use renderDiagram instead to generate from raw DSL without an existing diagram.

Get a diagram's full details including raw DSL source code. Use diagramId from DIAGRAM_OMITTED markers in getDocument output. Returns diagramCode, type, name, nlDescription, and versionTimestamp.

Get DSL writing instructions for a diagram type. Call before writing diagramCode.

Read a document's content with line numbers. Returns numbered lines for use with editDocument. Diagrams/images appear as OMITTED markers with metadata (type, diagramId, nlDescription) — use getDiagramInDocument(diagramId) for full DSL code, or dedicated diagram/image tools to manage them.

Read the current status of an ingest job. Returns { status, stage, processedImages, totalImages, documentId, error?, lastHeartbeatAt }. Stages: pending → downloaded → extracted → draft_saved → images_processing → finalized → cleaned_up. Status: queued, running, succeeded, failed, cancelled. The associated document_id is populated immediately and progressively filled in as images are processed.

Compute a user's effective permission level on a resource (taking team grants, inheritance, and 3-state overrides into account) and the source. Asking about another user requires can_manage_perms on the org. Use when the user asks 'can X access this', 'what level of access does X have', 'why can X see this', or to debug an unexpected permission outcome.

Get the folder and document tree starting from a specific folder. Alias for getProjectHierarchy with folderId.

Get image details including a fresh signed URL (expires after 1 hour). Use storagePath from IMAGE_OMITTED markers in getDocument output.

Get full details for an improvement item including evidence, activity log, compliance context, and the checklist array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp — pass it to updateImprovement for optimistic locking. (For tasks specifically, use getTask + updateTask which are symmetric aliases.)

List every kg_scope row for the caller's organisation, optionally narrowed to a workspace or project subtree. Each row carries scope_type, scope_id, state (on|off|inherit), settings, and is augmented with scope_name + parent_id for tree rendering. Capped at 500 rows.

Fetch a single organisation member by user_id, enriched with profile (email + display name). Auth: org id must match the credential's organisation.

Read a single organisation by id. Returns id, name, slug, description, settings (jsonb), created_at, member_count (active members) and plan_tier (subscription_tier). The organisation must match the calling credential's organisation. Read-only.

Read an organisation's settings JSON and the derived enabled-features map (plans, documents, improvements, compliance, knowledge_graph — all booleans). The organisation must match the calling credential's organisation. Read-only.

Get full plan details including phases, items, and activity. Returns versionTimestamp — pass it to updatePlan for optimistic locking. Items include percent_complete for progress tracking.

Get the complete plan hierarchy (phases, tasks, improvements) in one call. Recommended first call for plan navigation.

Get a plan phase by ID with full details. Returns versionTimestamp — pass it to updatePlanPhase for optimistic locking.

Read a single project by id. Auth via the standard project-access ladder. Returns the full v_projects row (id, workspace_id, name, description, icon, created_by/at, updated_by/at). Read-only.

Get the complete folder and document tree for a project in one call. Recommended first call for navigation.

Get a task by ID with full details, evidence, activity, and the checklist array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp; pass it to updateTask to modify. Includes percent_complete for progress tracking.

Get a single team by ID with profile-enriched member list (display_name, email, avatar_url, role, joined_at). Set includeMembers=false to skip the member fan-out and just return team metadata. Read-only.

Read the calling user's preferences. Self-only — no params required. Returns { notifications, grids } where notifications is the single notification-preferences row and grids is an array of per-grid view rows. Read-only.

Read a whiteboard: its metadata plus a summary of the canvas (element count, element types, and text labels on the board). Pass includeElements=true to also return the full Excalidraw scene ({elements, appState, files}) — needed if you intend to modify it and send it back via updateWhiteboardScene. FOR BEST RESULTS, also call getWhiteboardImage to render the board to an image and actually SEE it: the visual layout (positions, spacing, overlaps, colours, how shapes connect) is far easier to understand from the rendered picture than from the element list, so view it first to truly understand the board and to propose or verify edits accurately.

Get the Stable Baseline whiteboarding guide (Markdown): when to use stencils vs architecture icons vs code/BPMN diagrams vs plain shapes vs real images vs frames/presentations, how to lay out and verify a board, and how to edit a large board safely (patch by id, never replace). Call before authoring a non-trivial whiteboard.

Render a whiteboard to an IMAGE so you can SEE it and confirm your edits look right, then iterate — like taking a screenshot. Returns the rendered board as a viewable PNG (default) attached to the result. Pass elementIds to render only specific shapes (e.g. to inspect one section/slide), format:'svg' for vector markup instead of a raster, or background to set the canvas colour. Call this after addWhiteboardElements/updateWhiteboardScene to check layout, overlaps, labels and alignment before continuing.

Read a single workspace by id. Auth via the standard workspace-access ladder (credential org match + workspace scope + per-resource read permission). Returns the full v_workspaces row. Read-only.

Grant a team read/write/admin access to a workspace. Idempotent. Team and workspace must be in the same organisation.

Insert a new diagram into a document. Call listDiagramTypes to find your type, then getDiagramTypeGuide for DSL syntax before writing diagramCode. Always set prompt + nlDescription to describe what the diagram shows (they are its saved description) and keep them accurate. After inserting, VERIFY the render — set returnImage:true (or call getDiagramImage) to actually SEE it — and if it is wrong or ugly, correct it with updateDiagramInDocument (provide the full updated diagramCode).

Insert an image into a document (max 10MB). Provide imageBase64, imageBinary, or imageUrl. For large files, call createImageUploadSession first then use the returned assetUrl.

Insert a real DIAGRAM (BPMN, Diagrams-as-Code / any DSL: mermaid, d2, plantuml, graphviz, …) into a whiteboard as an editable SB diagram element. Provide documentId, diagramType (call listDiagramTypes / getDiagramTypeGuide), and source (the DSL). The diagram is rendered to an image stored like a pasted image, and its editable source is kept in a sidecar so it stays a live, re-openable diagram on the board (double-click on the canvas opens the BPMN / code / AI editor). Options: caption (label beneath it), width/height to size it, and x/y or align ('left'|'center'|'right') to place it (defaults to the right of existing content). After inserting, call getWhiteboardImage to see it and verify it rendered correctly (fix the source and re-insert if it is wrong). For a plain picture (not a diagram) use insertWhiteboardImage; to generate a diagram image WITHOUT inserting use renderDiagram.

Insert a real IMAGE (photo, screenshot, logo, picture) into a whiteboard — the storage-backed equivalent of insertImageInDocument. Provide the image as imageUrl (fetched and re-hosted), imageBase64, or imageBinary; for large files call createImageUploadSession(documentId) first then pass the returned assetUrl as imageUrl. The bytes are stored in the document-images bucket and the scene only holds a reference (never base64), exactly like pasted images. Options: caption (a text label placed + grouped beneath the image), width/height in px to RESIZE (if only one is given the other follows a 4:3 ratio; ~360px wide if neither), and placement via x/y (top-left) OR align ('left'|'center'|'right', positioned just below existing content) — omit both to auto-place to the right of the current content. After inserting, call getWhiteboardImage to verify. To move or resize the image later, patch its element via updateWhiteboardScene (mode:'patch' with {id, x, y, width, height}). For curated software-architecture ICONS (AWS/Docker/etc.) use addWhiteboardElements with an {type:'image', iconPath} spec instead.

Invite a person by email to the credential's organisation. Auth: org id must match the credential AND credential must hold can_manage_members. Rate limit 10/h. Returns invitation_id, expiry, and a seat-billing-impact summary. Email-existence is opaque: the response shape never reveals whether the email is already a member, already invited, or new. Use when the user asks to invite a teammate, friend, colleague, or new user to their organisation, or to onboard someone.

Linked-mentions rail: every edge whose dst matches the named entity.

Phase 5 / E3 — Provenance-aware assessor for a set of chunk_ids returned by kg_search. Returns per-chunk bucket (authored-grounded | extracted-high-conf | extracted-low-conf | no-support), overall distribution, dominant_bucket, and recommend_refusal. Pure metadata read - no LLM cost. Used by the agent's response policy to decide whether to answer confidently, caveat, or refuse.

Fetch a KG entity by id or name, with 1-hop neighbours.

Fetch a community wiki page (LLM-curated CDMD).

List Louvain communities for an org (optionally scoped by project).

Find other sources that share entities with the given source.

Check whether Knowledge Graph is in-scope for a given target.

Unified Knowledge Graph retrieval. PICK THE MODE THAT FITS THE QUERY:

• mode='local' (default) — for SPECIFIC factual questions ("what does §15 say about deposits?", "who is the Chief Counsel?"). FTS+vector RRF over individual document chunks. Returns precise excerpts with citations.

• mode='global' — for THEMATIC / OVERVIEW / SUMMARY questions ("what are the main themes", "give me an overview of the project", "what topics does this cover"). Returns Louvain community summaries + curated wiki pages — far better than 'local' for big-picture queries because community summaries already aggregate across many chunks. ALWAYS PREFER over 'local' when the user asks for themes / summary / overview / topic landscape.

• mode='graph' — for RELATIONSHIP questions ("what's connected to entity X?", "who cites Section 5?"). 1-hop entity-neighbourhood walk. Pass query OR srcEntityId.

• mode='path' — for CONNECTION questions ("how does X relate to Y?"). Shortest path between two entities. Pass srcEntityId AND dstEntityId.

• mode='ppr' — for MULTI-HOP discovery ("what's relevant to X, even indirectly?"). Personalised PageRank over AUTHORED-vs-EXTRACTED weighted edges, seeded by query-similar entities. Best when 'local' returns too few results and the answer requires walking through several entity hops.

Quick decision tree:

• User asks for an overview/summary/themes → 'global'
• User asks a specific question with a clear answer → 'local'
• User asks 'how is X connected to Y' → 'path' (with both entity IDs)
• User asks 'what's near entity X' → 'graph' (with srcEntityId)
• 'local' returned nothing useful and the question is broad → retry with 'ppr'

3 template + 3 LLM-generated sample questions for the knowledge-graph playground.

SOFTWARE & CLOUD architecture icons ONLY (AWS, Azure, GCP, Docker, Kubernetes, databases, message queues, dev tools, etc.). This catalog has NO general/nature/science/people/business icons — so for any NON-technical topic (e.g. photosynthesis, biology, history, marketing), do NOT use this tool; instead put a relevant emoji directly in the element's label (e.g. ☀️ Sunlight, 💧 Water, 🌿 Leaf). It returns nothing for off-domain queries by design — never force an unrelated tech logo onto a non-tech concept. Each result has an iconPath (e.g. 'dev/docker.svg'). TWO ways to use it: (1) on a WHITEBOARD, drop it via addWhiteboardElements({ type:'image', iconPath:'dev/docker.svg', x, y, width:96, height:96, text:'Docker' }); (2) in a D2 systems-architecture diagram, use the iconPath as-is in D2 code (e.g. icon: dev/docker.svg).

Server-side searchable, paginated list of USERS and TEAMS that can be assigned as the owner of an improvement/task in a project — and the canonical source for resolving a person's user_id when @-mentioning them in a document. Returns two arrays — users (with user_id, display_name, email, avatar_url, has_explicit_permission) and teams (with team_id, name, member_count, has_explicit_permission). Sources: project-level grants + workspace members + organization members + members of teams granted access. Use BEFORE: (1) updateImprovement/updateTask when you need an owner_id (kind='user') or owner_team_id (kind='team'); (2) inserting a <!-- REFERENCE: {"type":"user","id":"…","label":"…"} --> mention in document content via createDocument / editDocument / findAndReplaceTextInDocument. Supports q for ILIKE search on names/emails (users) or team names. Pass kind='user' or kind='team' to scope to a single section, or 'all' (default) for both. Pagination via limit (1-100, default 20) + offset.

List supported diagram types. Use the returned type field when calling insertDiagramInDocument.

List documents in a project, workspace, or folder. Supports query search and date filtering.

List version history for a document. Returns timestamps, creator, change summary, and content.

List folders in a project. Use parentId for nested folders. For full tree, use getProjectHierarchy instead.

List improvement categories for a project. Returns tree and flat list.

List improvements in a project. Supports filtering by status, type, priority, and query.

List organisation invitations. Auth: org id must match the credential's organisation AND the credential must hold the can_manage_members capability. Status defaults to 'pending'. Pass 'all' to disable filtering.

List members of an organisation, enriched with email + display name. Auth: org id must match the credential's organisation. Returns paginated list, default limit 50 / max 200.

List organisations you have access to. Supports query filtering by name/slug.

List phases for a plan ordered by position.

List plans in a project. Supports filtering by status, priority, and query.

List projects in a workspace. Supports query filtering by project name.

List explicit permission grants on a resource (workspace/project/folder/document/improvement/plan), including principal type (user|team), level (none|read|write|admin), and 3-state overrides for documents/improvements/plans. Read-only. Use when the user asks 'who can see this', 'who has access', 'what permissions are set on this', or to audit existing access on a resource.

List FS/SS/FF task-dependency edges in a plan (the Gantt arrows). Scope by planId, projectId, or itemId. direction: 'predecessors' | 'successors' | 'both' (default, only with itemId).

List tasks in a plan. Supports filtering by status, priority, phaseId, and query.

List teams in an organization, with optional search filter and an includeMembers flag that fans out to v_team_members in a single round-trip. Supply EITHER organizationId OR workspaceId (the workspace's parent org is resolved automatically). Use this when the user asks about teams generically (e.g. 'show me my teams') or before assigning a team via updateImprovement(owner_team_id=…). Read-only.

List the whiteboards in a project (hidden whiteboard-kind documents). Returns documentId, diagramId, title and timestamps for each.

Search the built-in library of structural whiteboard stencils — ready-made hand-drawn graphics: flowchart/UML/ER/BPMN symbols, scrum columns, org-chart nodes, gantt, lo-fi/UX wireframe widgets (buttons, forms, tables, alerts, navs), charts, device frames, stick figures. A stencil is a MINI-WHITEBOARD (a collection of elements), NOT a single shape. Each result returns: key, title (a real human name e.g. 'Alerts', not an index), kind ('symbol' | 'template'), labels (the TEXT it actually contains — its real content, e.g. an Alerts template's variant messages), size ({w,h} px), summary, pack, category; plus the full pack/category lists. The two kinds are used DIFFERENTLY: • SYMBOL = one atomic labelled node (flowchart Process/Decision, BPMN task, org node). Place + label + connect: addWhiteboardElements({type:'stencil', stencilKey, id:'n1', text:'Review', width, height}) — the text auto-fits its single slot and an arrow's start/end {id:'n1'} binds to it like any shape. A few symbols are text-less FRAMES (e.g. a UML class box = rectangle + divider line): place create-only, then use the placement result's children (shapes + x/y/w/h) and groupId to add type:'text' specs INTO the regions — pass that groupId so the text is one unit with the frame. • TEMPLATE = a multi-component layout (Alerts, Forms, Tables, Charts, device frames). Place the WHOLE thing: addWhiteboardElements({type:'stencil', stencilKey, x, y, width?, height?}); the placement RESULT returns stencils[].children (each child's id + text + colour + position x/y/w/h, so you can group children into rows/sections) so you then keep / retext / recolour / DELETE specific parts via updateWhiteboardScene (e.g. delete the info + error rows to keep only the green success alert). Do NOT pass a single text to a template — read its labels to see its parts, then edit them by id. To make several similar items, build one then duplicateWhiteboardElements({groupId, dx}) to stamp consistent copies (like copy-paste in the UI). SEARCH TIPS: prefer BROAD single words ('decision','alert','form','phone','process'); content words match the embedded labels too (searching 'success' finds the Alerts template). If nothing exact matches, results auto-broaden (broadened:true); pass pack/category to browse. For cloud/architecture ICONS (AWS/Azure/GCP/Docker/Kubernetes/databases) use listArchitectureIcons; for a sticky/post-it use addWhiteboardElements({type:'sticky'}), not a stencil.

List workspaces you have access to. Supports query filtering by name/slug.

Poll the status of a signup begun via startSignup. Anonymous-callable. Possible status values: pending (user has not yet authorized — keep polling), authorized (success — response includes api_key, organization_id, user_id, user_email; the api_key is returned ONCE), consumed (already returned the api_key on a previous poll — stop polling), denied (user clicked Deny), expired (10-minute TTL exceeded — call startSignup again), not_found (invalid device_code), slow_down (you're polling faster than the interval — back off).

Preview the cost / coverage / ETA of a full KG rebuild for the org (optionally narrowed to a workspace or project). Returns confirmation_token (10-min TTL). Rate limit 20/h.

Preview the credit cost, source counts, and ETA of including or excluding KG scope rows. Returns confirmation_token (10-min TTL) plus delta of newly-in-scope vs newly-out-of-scope sources. Rate limit 20/h.

Dry-run of applyTaskDependencyCascade — returns the diff without writing. Empty items array means the plan is already consistent. Accepts the same pinnedItemIds and forwardOnly params.

Internal maintenance (requires write). Syncs gte-small (384-dim) vector embeddings for the MCP tool, whiteboard stencil, and architecture icon catalogs into platform_catalog_embeddings, so searchTools, listWhiteboardStencils, and listArchitectureIcons can do semantic search. Incremental: scans every catalog, diffs by content hash, and re-embeds ONLY changed rows (cheap no-op when nothing changed). This normally runs automatically every hour (the platform-catalog-sync cron), so manual calls are rarely needed — use it to force an immediate sync after changing tools/stencils/icons. Embeds up to ~120 changed rows per call; if more changed, call again until allDone is true. Not part of normal authoring flows.

Hard-remove a member from an organisation, cascading to workspace and team memberships and resource permissions. Refuses self-removal and last-owner removal. Stripe seat downgrade is NOT performed here — pair with a Phase 6 billing tool. Rate limit 5/min. Use when the user asks to remove, kick out, fire, offboard, or fully terminate a member's access to the organisation.

Remove a user from a team. Idempotent — returns removed=false if not on the team.

Remove a member from a workspace. Caller must be a workspace owner or admin. Refuses to remove the last remaining workspace owner.

Generate a diagram from its DSL/code and get the IMAGE back — WITHOUT inserting it into any document or whiteboard. For acting as a pure diagram generator. Provide diagramType (e.g. 'mermaid', 'd2', 'plantuml', 'graphviz', 'bpmn', 'vegalite'; call listDiagramTypes for the full set) and source (the diagram code). Choose format 'png' (default), 'jpeg', or 'svg'; for raster choose scale 1/2/3 for 1x/2x/3x; optional background (png only). Returns a TEMPORARY signed imageUrl that expires in 1 hour (then auto-deleted), and for png/jpeg the image inline so you can see it. To render a diagram that already lives in a document/whiteboard use getDiagramImage; to persist a new one use insertDiagramInDocument or insertWhiteboardDiagram.

Batch-reorder documents within a folder (or project root) by setting sibling positions. Pass [{documentId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. Position-only update — does not bump version or create a snapshot. To MOVE a document to a different folder, use editDocument({folderId, position}) instead.

Batch-reorder folders within a parent (or project root) by setting sibling positions. Pass [{folderId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. To MOVE a folder to a different parent and set its position there, use updateFolder({parentId, position}) instead.

Reorder improvement categories by setting sort_order values.

Reorder plan phases by setting position values. WBS codes are recalculated.

Resend a pending invitation: extends expires_at by 7 days and re-triggers the invitation email. Server resolves the organisation_id from the invitation row. Rate limit 6/h per invitation_id. Use when the user asks to resend, re-send, or re-trigger an invitation email — typically because the recipient lost it or the original expired.

Wipe + re-ingest a single document in the KG. Drops chunks/mentions/entities, clears pending lazy-extraction, and enqueues a fresh extract pass. Requires can_manage_kg + document write. Rate limit 30/min.

Revoke a team's workspace access. Idempotent — returns revoked=false if no grant exists.

Search improvements using hybrid text + semantic search. Returns ranked results.

Semantic search over the 276 AntV Infographic templates — call this FIRST when building an infographic diagram so you pick the right structure for the content. Describe the intent (e.g. 'compare two options', 'show a process timeline', 'pyramid of priorities', 'org hierarchy', 'flow between systems', 'parts of a whole'); results are vector-ranked. Each result has key (use as line 1 infographic <key>), name, family (list|sequence|compare|relation|chart|hierarchy|quadrant), and description. The result's usage explains the family→data-field mapping for writing the DSL.

Search available tools by keyword or category. Returns matching tool names and descriptions.

Toggle KG-scope override for a single document (on/off/inherit). Documents default to inheriting their folder/project gate. Requires can_manage_kg + document write. Rate limit 30/min.

Toggle KG-scope override for a folder (on/off/inherit). Folders default to inheriting their project's scope. Requires can_manage_kg + folder write. Rate limit 30/min.

Set the KG visibility mode for a project: 'strict' (multi-source rows hidden unless user can read every source), 'permissive' (one source suffices), or 'open' (any org member). Controls WHO can see the project's KG rows. Requires can_manage_kg + project write. Rate limit 30/min.

Toggle whether a workspace is in the Knowledge Graph (on/off/inherit). 'on' enables the workspace as a gate for indexing its projects; 'off' excludes everything under it; 'inherit' removes the explicit override. No re-ingest happens here. Requires can_manage_kg + workspace write. Rate limit 30/min.

Soft-deactivate or reactivate an organisation member. Refuses self-deactivation, last-admin/owner deactivation, and deactivation of an owner. Rate limit 30/min. Use when the user asks to deactivate, suspend, freeze, reactivate, or unfreeze a member without fully removing them.

Set or clear the WBS parent-child nesting of a task/improvement (outline hierarchy, no scheduling effect). Same plan and phase required. Max depth: 5.

Set a single 3-state override on a permission row: null=inherit, true=allow, false=deny. Per-axis (read/write/delete) and per-kind (documents/improvements/plans), matching the OverrideAccessSection UI. Rate limit 30/min.

Begin an agent-driven sign-up to Stable Baseline. Anonymous-callable. Returns a verification_url and a 6-character user_code that the agent must show to the user. The user opens the URL in their browser, signs in or signs up if necessary, enters the code, and clicks Authorize. The agent meanwhile polls pollSignupStatus({device_code}) every poll_interval_seconds until the status changes to authorized, at which point it receives an api_key it can use for subsequent MCP calls. The whole flow has a 10-minute TTL.

Turn a raster image into hand-drawn freedraw strokes on a whiteboard, deterministically. Pass an image (imageUrl OR imageBase64) plus a style; the server fetches and vectorises it server-side and draws the strokes, so you do NOT emit any coordinates yourself (LLMs are poor at that and it wastes tokens). Use this for requests like 'sketch this image onto the board', portraits, or turning a logo into line art. style: 'sketch' (~3 colors, clean line art; default), 'color' (~8 colors), 'poster' (~12 colors). Returns a compact summary (stroke count), never the raw coordinates. Auto-places to the right of existing content unless x/y are given.

Apply a previously previewed KG rebuild. Dispatches the build batch via kg-rebuild and returns batch_id. Rate limit 5/h.

Update a diagram's code, description, or properties. Call getDiagramTypeGuide for DSL syntax. Requires documentVersionTimestamp from getDocument. IMPORTANT: To change what the diagram visually shows, you MUST provide diagramCode with the full updated DSL source. The prompt and nlDescription fields are metadata only and do NOT change the rendered diagram. After updating, re-render with getDiagramImage to confirm it now looks right (iterate if not), and keep prompt/nlDescription in step with what the diagram now shows.

Update a folder (rename/move/reorder). Supports nesting changes via parentId.

Update image metadata (alt, caption, dimensions, alignment). Requires documentVersionTimestamp from getDocument for optimistic locking.

Update an improvement (or a task — tasks share this row, but prefer the symmetric updateTask alias when working from getTask). Supports the full field set including checklist (tick-boxes with due dates + completion attribution) and acceptance_criteria (objects with per-row updated_by/at attribution). Requires versionTimestamp from getImprovement for optimistic locking. Status transitions: blocked needs blocked_comment, rejected needs rejection_comment, done needs completion_comment. Assignment: pass owner_id=<uuid> to assign to a user, owner_team_id=<uuid> to assign to a team (mutually exclusive — a DB CHECK constraint enforces this). To unassign, pass owner_id=null AND owner_team_id=null. To switch from a user owner to a team owner, send owner_id=null, owner_team_id=<uuid> in the SAME call (sending only one side leaves the stale value and triggers the XOR check). Use listAssignablePrincipals or listTeams to discover valid IDs.

Update an improvement category. Cannot modify system categories.

Update a comment on an improvement. Requires the comment's updated_at as versionTimestamp.

Update an organisation member's role (admin or member). Owners cannot be changed via this tool. Refuses self-promotion. Rate limit 30/min. Use when the user asks to promote someone to admin, demote an admin to member, or change a teammate's role.

Update an organisation's name and/or description. Auth: ceiling — credential must hold can_admin_org capability AND user must be org owner/admin. Rate limit 30/min. At least one of name/description required. Returns updated row.

Toggle feature flags on settings.enabledFeatures (plans, improvements, compliance, knowledge_graph, documents). Auth: can_admin_org + org admin. Rate limit 30/min. Plan-tier gated: enabling knowledge_graph requires Pro/Enterprise.

Update an organisation's settings JSONB via deep merge. Auth: ceiling — credential must hold can_admin_org AND user must be org owner/admin. Rate limit 30/min. Patches that touch enabledFeatures are rejected — use updateOrgFeatureFlags instead.

Update a plan. Requires versionTimestamp from getPlan.

Update a comment on a plan. Requires the comment's updated_at as versionTimestamp.

Update a plan phase. Requires versionTimestamp from getPlanPhase (not getPlan).

Update a user's profile name and/or display email. Self-updates do not require organisation_id; updates to other users require organisation_id and the can_manage_members capability. Self login-email changes must be done via the UI (verification round-trip).

Update a project's name, description, and/or icon. Mirrors the UI Project General Settings page. Auth: admin on the project (cascades from workspace owner/admin and org admin). Partial updates; at least one of name/description/icon must be supplied. Rate limit 60/min.

Update the access level on an existing permission row. Override flags are NOT touched — use setResourcePermissionOverride for those. Refuses self-escalation. Rate limit 30/min.

Update a task. Tasks share a row with improvements (improvement_items with is_task=true), so this is a thin alias over updateImprovement — every field on updateImprovement is supported, including checklist, acceptance_criteria, status transitions (blocked/rejected/done need their respective comments), dates, owner, percent_complete, etc. Requires versionTimestamp from getTask for optimistic locking. To edit checklist items: call getTask, modify the checklist array (preserving each row's id to keep its attribution stamps), and pass the full array back here — array order is the sort order. Assignment: pass owner_id=<uuid> to assign to a user, owner_team_id=<uuid> to assign to a team (mutually exclusive — the DB enforces with a CHECK constraint). To unassign, pass owner_id=null AND owner_team_id=null. To switch owner kind, send the new value AND null the old one in the SAME call.

Change the type (FS/SS/FF) or lag/lead of an existing task-dependency. Doesn't move dates directly; flags the successor with needs_dependency_review=true and fills suggested_start_date/suggested_end_date if the change implies a different schedule.

Update a team's name, description, and/or colour. At least one field required. Slug is intentionally not editable. Rate limit 60/min.

Update an existing team's workspace access level. Refuses if no grant exists — call grantTeamWorkspaceAccess first. No-op when level matches.

Update the calling user's preferences. Self-only. Rate limit 60/min. Partial: only fields supplied are updated. notifications upserts a single row; grids upserts per-row keyed by (user_id, project_id, grid_key, view_name).

Edit elements on a whiteboard's canvas WITHOUT dropping the rest of the scene. A board may hold many diagrams/elements, so prefer surgical edits: mode='patch' (DEFAULT) shallow-merges each incoming object into the existing element with the same id (send just {id, backgroundColor:'blue'} to recolour one box, or {id, x, y} to move one) and appends any elements whose id is new/absent — everything else is left untouched. deleteIds removes specific elements by id. mode='append' only adds. mode='replace' overwrites the ENTIRE scene — to rebuild or edit only PART of a board, still use 'patch', because replace DELETES every element you don't resend (of ANY type). As a safeguard, a replace that would drop ANY existing element not in your payload is REJECTED unless you pass confirmReplace:true (or include those ids); diagrams/images/frames are flagged specially since they're inserted separately and costliest to lose. To author NEW shapes/connectors from a high-level spec, prefer addWhiteboardElements — and prefer library stencils / sticky notes / architecture icons over plain rectangles wherever a standard form fits (sticky notes, kanban/scrum, flowcharts, UML/ER, BPMN, org charts, wireframes). Optional appState/files are merged in. PROCESS: for a non-trivial edit call getWhiteboardGuide FIRST; after editing, ALWAYS call getWhiteboardImage to confirm the board still looks right (layout, labels, overlaps), and patch again if it doesn't.

Update a workspace's name. Auth: standard workspace-write ladder + user must be workspace owner or admin. Slug is intentionally not editable (URL-embedded). Rate limit 60/min.

Change an existing workspace member's role. Caller must be a workspace owner or admin. Cannot self-demote from owner/admin to editor/viewer — transfer the role first.

Insert or update a resource_permissions row for a user OR team on a workspace/project/folder/document/improvement/plan. Refuses self-escalation. Rate limit 30/min. Use when the user asks to give access to, share with, grant access, add a permission, make accessible, or invite someone to a specific workspace/project/folder/document — i.e. resource-level access (not org-level membership; that's inviteMember).