# The Cloud (thecloud.so): full agent reference

The Cloud (thecloud.so) is the AI-native workspace that gives every AI, from Claude and ChatGPT to Gemini and local models, shared memory and real agents.

This file is self-contained: MCP endpoint, both auth paths, all 690 tools across 32 families with safety annotations, pricing, and limits are inline. You do not need a second fetch.

Generated from the live MCP tool registry at build time. The catalog below is what the server returns from tools/list.

## MCP endpoint

https://mcp.thecloud.so/mcp

One HTTP endpoint speaking JSON-RPC 2.0. It is both an MCP server (any AI reads your memory and acts in your workspace, with consent) and an MCP client (your workspace consumes Linear, GitHub, Vercel, and more).

## Authentication: two paths

### 1. OAuth (default, no API key)

The browser opens once to sign in to the user's Cloud account; the connection is then live. No secret is copied, pasted, or stored.

- Claude Code: claude mcp add --transport http the-cloud https://mcp.thecloud.so/mcp
- Gemini CLI: gemini mcp add --transport http the-cloud https://mcp.thecloud.so/mcp
- Cursor: add to ~/.cursor/mcp.json: {"mcpServers":{"the-cloud":{"url":"https://mcp.thecloud.so/mcp"}}}
- Claude Desktop: Settings → Connectors → Add custom connector → https://mcp.thecloud.so/mcp

### 2. Static Bearer key (CI, headless, clients without MCP OAuth)

For continuous integration, scripted setups, and clients that do not support MCP's OAuth flow yet (Windsurf, ChatGPT): generate a key under Settings → AI and pass it as a Bearer header.

```json
{
  "mcpServers": {
    "the-cloud": {
      "type": "http",
      "url": "https://mcp.thecloud.so/mcp",
      "headers": { "Authorization": "Bearer <your-api-key>" }
    }
  }
}
```

Full connect guide, including per-client snippets: https://www.thecloud.so/docs/start

## Studio app identity

Credentialed session probe: GET https://lovable-crab-328.convex.site/session/whoami with credentials: include.
Signed in: {"signedIn":true,"name":"…","member":{"id":"…","email":"…","image":null,"isAdmin":false,"isOwner":false,"role":"member"}}
Anonymous: {"signedIn":false}. Anonymous is always HTTP 200, never 401.

Iframe request: {"type":"cloud:identity:request","app":"<appId>","v":1}.
The /a/ shell replies to direct child frames only with {"type":"cloud:identity","signedIn":true,"name":"…"}, using the requesting frame origin as targetOrigin.

## Safety annotations

Every tool below carries a machine-readable class. These mirror the MCP tool annotations the server returns, so an agent can plan around them before calling anything.

- [read]: read-only. Mutates nothing and reaches no external system.
- [write]: mutates workspace state.
- [destructive]: deletes or sends; not reversible by re-calling.
- [consent]: widens exposure (share, publish, visibility). Requires explicit per-action approval from the owner; an agent cannot self-approve.
- [external]: reaches a system outside The Cloud (Gmail, GitHub, Calendar, Telegram, Spotify, Amazon).

Totals: 246 read-only, 444 write, 77 consent-gated.

## Tool catalog: 690 tools, 32 families

### Memory & Sync (20)

Durable cross-AI memory: read, search, write, and organize what every AI should carry between sessions. AI writes land directly with author provenance.

- browseSkillLibrary [read]: Browse the Skills Library: the public, reviewed catalog of skills anyone can equip.
- confirmCloudUpdates [write]: Confirm that the reconciliation draft from `pullCloudUpdates` has been written back, so the watermark advances and the next pull is incremental.
- createMemory [write]: Create a Memory: a durable, judgment-grade page that persists across sessions.
- createSkill [write]: Create a Skill: a durable instruction pack that teaches an AI how the user likes something done (a workflow, a format, a checklist, a house style).
- equipSkillFromLibrary [write]: Equip a Skills Library skill in ONE Space.
- getMemoryLoadStatus [read]: Check whether your loaded memory is COMPLETE.
- getUniversalContext [read]: Get The Cloud's product model: its primitives (Page, My Day, Task, Memory, Space, Calendar event, Profile, File), their verbs and routing phrases, the disambiguation rules, the permissions card, and…
- getWritingGuide [read]: Get the canonical guide for authoring rich content in The Cloud's Pages editor: the exact markdown syntax createPage, editPage, and appendPageContent accept for headings, lists, callouts, tables,…
- importSkill [write] [external]: Import a Skill from a public URL: a GitHub repository, folder, or SKILL.md file, or a skills.sh listing.
- listSkills [read]: List the caller's Skills: instruction packs their AIs can follow.
- organizeMemory [write]: Organize the caller's Memory: restack flat memory pages into the Context Design nebula: a Memory hub with Ora memories, Projects, and References sections, placed by each memory's keymap tags.
- pullCloudUpdates [read] [external]: Pull what shipped in a GitHub repo since the last sync: the merged pull requests The Cloud has not yet ingested into its memory and docs for that project: and draft the reconciliation.
- readLibrarySkill [read]: Read the instructions of a Skills Library skill a Space has equipped.
- readMemory [read]: Read a Memory by ID: returns its title, body, keymap tags, type, and an `asOf` stamp saying when it was last modified and how long ago that was at the moment you read it.
- resolve [read]: Resolve ONE loose reference to the right Cloud primitive in a single lookup: a name, a partial id, "the X page", "my retail contact": instead of guessing which tool to call.
- searchMemory [read]: Search the caller's Memory: the durable knowledge layer: BY MEANING as well as by wording.
- sync [read]: Sync with The Cloud: return the Charter and a budgeted selection of the user's current memory.
- unequipSkillFromLibrary [write]: Take a Skills Library skill back off in one Space.
- updateMemory [write]: Update an existing Memory's body and/or keymap tags.
- updateSkill [write]: Update an existing Skill's title, body, tags, persona tags, and/or trigger phrases.

### Thing Ledger (5)

The identity ledger: resolve-or-create nonfungible Things (people, repos, products, models, places) and record append-only Facts about them with provenance.

- addFact [write]: Append a Fact to one or more Things: an assertion about them recorded in the append-only ledger.
- readThing [read]: Read a Thing by id: returns its identity (canonical name, aliases, type, external refs) plus its Facts, newest first, each flagged if a later Fact supersedes it.
- resolveThing [write]: Resolve a Thing by name, or create it if none matches: the anti-duplicate mint for the identity ledger.
- searchThings [read]: Search the caller's Things: the identity ledger.
- teachThing [write]: Teach the ledger: the self-healing writeback.

### Pages & Spaces (35)

Rich documents and the Spaces holding them: create, read, edit, restructure, tag, and publish.

- appendPageContent [write]: Append content to the end of an existing Page without replacing it.
- batchMovePage [write]: Move many Pages to one destination: a new parent Page and/or a new Space: in a single auditable operation, instead of one move per page.
- createPage [write]: Create a Page: a rich document in a Space.
- createSpace [write]: Create a Space: a top-level workspace that holds Pages.
- createSpaceInviteLink [write] [consent]: Create a one-time Space invite link when you need to get a person into a Space but do not have their email or a resolved Cloud account.
- deleteBlocks [write] [destructive]: Delete one or more top-level page blocks by blockId.
- deletePage [write] [destructive]: Delete a Page: moves it to trash, restorable, same as deleting from the UI.
- deleteSpace [write] [destructive]: Delete a Space the user owns: permanently.
- editPage [write]: ⚠️ DESTRUCTIVE: REPLACES THE ENTIRE PAGE BODY.
- editSection [write]: Replace the body of one section of a page: the blocks under a heading: leaving the heading and the rest of the page untouched.
- insertAfterBlock [write]: Insert markdown immediately after one top-level page block by the blockId returned by readPage.
- insertComponent [write]: Place a real typed component: a status chip: into a page body at a chosen anchor.
- insertContent [write]: Insert markdown into a page at a chosen anchor: additively, without replacing anything.
- insertDialogueCallout [write]: Write an attributed-dialogue transcript into a page as real callout blocks: one block per turn, each carrying who said it and a real avatar: Ora as the cloud mark, a person by photo/initials, a…
- listComponentTypes [read]: List the typed block components insertComponent can author and the exact props each accepts: schema discovery, so you author against the real component contract instead of guessing.
- listPageFiles [read]: List the files attached to a Page: PDFs, audio, and images embedded in the page body: each with a fileId, name, type, and whether its content can be read (textAvailable).
- listPages [read]: List Pages in a Space, or audit exposure across ALL your Spaces.
- listPageSpaces [read]: List the user's Spaces: the workspaces that contain Pages.
- listSpaceContents [read]: List everything in a Space in one call: its pages, forms, tables, Studio apps, task lists, folders, and Files: so a Space reads as a real project hub.
- listSpaceMembers [read]: List the members of a Space and their roles (owner / admin / member).
- movePage [write]: Move a Page under a new parent Page to build a hierarchy.
- moveSection [write]: Relocate a section of a page: a heading and its body: to a new spot, without rewriting the page.
- readPage [read]: Read a Page's content as markdown, with a <!-- block:<blockId> --> address after every top-level block.
- readPageFile [read]: Read the content of a file attached to a Page: a PDF's text layer, a DOCX/CSV/TXT/MD document, an audio transcript, or an IMAGE.
- renamePage [write]: Rename a page's title only: the body stays unchanged.
- replaceBlock [write]: Replace one top-level page block by the blockId returned by readPage.
- resolveAccount [read]: Resolve a person to a Cloud account that can be used as a shareSpace target.
- searchPages [read]: Search Pages across the user's Spaces BY MEANING as well as by title.
- setPagesVisibility [write] [consent]: Bulk Page visibility sweep: up to 50 pages in one call.
- setPageVisibility [write] [consent]: Change a Page's visibility.
- shareSpace [write] [consent]: Request sharing a Space with a Cloud account at a role (owner | admin | member).
- tagPage [write]: Add tags to or remove tags from an EXISTING page: the post-creation counterpart to `createPage`'s `tags` parameter.
- unshareSpace [write] [consent]: Request removing a member's access to a Space.
- updateComponent [write]: Re-style a status chip you placed earlier with insertComponent, addressed by its componentId.
- updateSpaceMemberRole [write] [consent]: Request changing a Space member's role (owner | admin | member).

### Tasks & My Day (32)

To-dos, task lists, and the daily page: the user's plan for today and what is outstanding.

- addToMyDay [write]: Append content to the user's My Day page for a date.
- addToMyDayLibrary [write]: Save an item to the user's files: defaults to today's My Day folder (the daily folder), or pass an explicit folderId to route to another folder.
- completeMatchingTodo [write]: Find the incomplete Task matching a completion report and mark it complete in one step.
- convertMyDayListToTaskBlocks [write]: Convert bullet lists in a My Day page to checkbox/task blocks.
- createLabel [write]: Create a label in a personal or shared Space for Tasks.
- createProject [write]: Create a Cloud Project : the container a body of work lives in, so a brief and its Tasks belong to something a later session can open, instead of being loose Pages.
- createStatus [write]: Create a workflow status for a Task list.
- createTask [write]: Create a Task: a to-do item in a task list.
- createTodo [write]: Create a Task: a to-do item in a task list.
- createTodoList [write]: Create a task list: the container a Task belongs to.
- deleteTodo [write] [destructive]: Delete a Task: moves it to Trash (recoverable), matching the app's delete.
- getListTaskCounts [read]: Count Tasks per list, ranked.
- linkTaskToPage [write]: Link a Task to a Page or build doc.
- linkTaskToPr [write]: Link a Task to a GitHub pull request using its full HTTPS URL.
- listProjects [read]: List Cloud Projects : the named containers that hold a body of work: its chats, its instructions, and the Tasks filed under it.
- listTaskLabels [read]: List the Task labels that already exist in a scope: each with its id, name, and color.
- listTaskLists [read]: List the user's task lists: the containers a Task belongs to.
- listTasks [read]: List Tasks with optional text, status, priority, assignee, list, project, completion, and due-date filters.
- listTaskStatuses [read]: List the workflow statuses a Task list already has: each with its id, name, glyph, and workflow group: plus which status is the default per group and whether the list shows a Kanban board.
- listTodos [read]: List Tasks with optional text, status, priority, assignee, list, project, completion, and due-date filters.
- moveTaskListToSpace [write]: Move a task list to a Space root so it lives with that project.
- moveTaskToList [write]: Move a Task to a different list.
- readLedger [read]: Read the lane ledger: the owner's Task list where every agent lane files itself, with each row that carries a run or a pull request, grouped by workflow status.
- readMyDay [read]: Read the user's My Day page for a date: one daily page per calendar date.
- readMyDayLibrary [read]: Read the user's My Day library collection (a folder) for a date: the daily collection of saved files and links that mirrors the My Day page.
- readProject [read]: Read one Cloud Project in full: its name, stage, Space, canonical url, the instructions that seed AI context for its chats, and how many Tasks are filed under it (open and completed counts; call…
- readTask [read]: Read one Task in full by id.
- toggleTodo [write]: Mark a Task complete or incomplete.
- updateMyDayTask [write]: Edit, re-check, or delete a SINGLE task block in a My Day page: in place, leaving every sibling block untouched.
- updateProject [write]: Update a Cloud Project: rename it, replace its instructions, move it along its stage (todo, in_progress, complete), or change its icon.
- updateTask [write]: Update a Task's text, priority, or due date.
- updateTodo [write]: Update a Task's text, priority, or due date.

### Calendar & Booking (18)

Events, availability, free-time search, and public booking types.

- archiveBookingType [write] [destructive]: Archive a booking type: takes its public link OFFLINE (disables it) so no one can book it.
- createBookingType [write]: Create a booking type: a scheduling link people use to book time with you (name, duration, buffers, notice, approval, guests, price, video provider).
- createEvent [write] [external]: Schedule a new Calendar event.
- deleteEvent [write] [destructive] [external]: Delete a Calendar event.
- findFreeTime [read] [external]: Find open slots for a Calendar event in a window that fit a duration.
- getBookingType [read]: Get one booking type by id: its full settings, public URL, and whether the link is publicly reachable right now.
- getEvent [read] [external]: Get full detail on a single Calendar event by id: the shared `description`, the owner-only `privateNote` (present only on the user's own events), location, recurrence rule, and the `attendees`…
- listBookings [read]: List bookings people made on your links: who booked, when, and the status: read-only.
- listBookingTypes [read]: List your booking types (scheduling links), newest-edited first.
- listCalendars [read] [external]: List the calendars the user can see.
- listEvents [read] [external]: List Calendar events between `startTime` and `endTime` (unix ms).
- listShopCalendarEvents [read]: Read the shop calendar between `startTime` and `endTime` (unix ms): every dated entry, order pickup/delivery window, booking and scheduled content post the shop has, in one list.
- presentEvents [read] [external]: Render multiple Calendar events as cards or an agenda in the chat: use instead of listing event titles in plain text.
- respondToCalendarEvent [write]: RSVP to a Calendar event invitation on the user's behalf: set their attendee response to `accepted`, `declined`, or `tentative`.
- shareShopCalendar [write] [consent] [external]: Share the shop calendar with one or more email addresses.
- unshareShopCalendar [write] [consent]: Stop sharing the shop calendar with an email address.
- updateBookingType [write]: Update a booking type you own: rename, adjust duration/buffers/notice/approval/price/guests, or enable/disable it.
- updateEvent [write] [external]: Edit an existing Calendar event.

### Focus Sessions (13)

The Timer surface as verbs: start a Timer, Stopwatch, or Pomodoro, pause and resume it, re-time it without restarting, rename it, stop it (logged) or cancel it (not logged), and read both what is running and the Log of what was.

- adjustTimer [write]: Re-time a running Timer or Pomodoro without restarting it: the focus already banked is kept.
- cancelSession [write]: Abandon the running Focus Session WITHOUT logging it: the session ends, no entry reaches the Log and no completion notification fires.
- deleteSessionLogEntry [write] [destructive]: DESTRUCTIVE: permanently deletes a completed Focus Session from the Log.
- pauseSession [write]: Pause the running Focus Session: the clock stops and the paused time is not counted as focus.
- readSession [read]: Read the Focus Session running right now: its mode (Timer, Stopwatch or Pomodoro), label, state (active, paused, on a break), time elapsed, and time remaining: plus any other sessions being carried.
- readSessionLog [read]: Read recent entries from the Focus Session Log: completed sessions with what they were called, how long was focused, and when.
- renameSession [write]: Rename the Focus Session that is currently running: relabels the live session, not a past one.
- renameSessionLogEntry [write]: Rename a completed Focus Session in the Log: corrects what a past session was called, without touching its recorded time.
- resumeSession [write]: Resume a paused Focus Session: picks up from where it was paused, keeping the focus already banked.
- startPomodoro [write]: Start a Pomodoro Focus Session: repeating focus intervals with breaks between them, unlike a plain Timer which runs once.
- startStopwatch [write]: Start a Stopwatch Focus Session: counts UP with no set end, for when the work's length isn't known in advance.
- startTimer [write]: Start a countdown Focus Session: a Timer that runs for a set duration and then completes.
- stopSession [write]: Stop the running Focus Session and LOG it: the session completes, the focused time is recorded in the Log, and the completion notification fires, exactly as pressing Stop in the app does.

### Files & Drive (14)

Workspace files and folders, plus the searchable index of attached drives.

- createFolder [write]: Create a folder to organize Files.
- deleteFile [write] [destructive]: Delete a File permanently.
- deleteFolder [write] [destructive]: Delete a folder and everything inside it.
- gatherFiles [read]: Plan a gather across drives: given indexed files, group them by drive and report which drives are plugged in vs.
- getFileContext [read]: Get the full lightweight context for one indexed drive file: metadata plus extracted text / transcript, and whether its drive is plugged in right now.
- indexDrive [write] [external]: Index a connected drive on one of the user's machines: the MachineSync daemon scans it on-device in tiers (metadata → light → deep) and pushes a lightweight per-file index up, so the drive stays…
- listFiles [read]: List folders, Files, and private voice notes.
- moveFile [write]: Move a File into a different folder, or file it into a Space.
- moveFolderToSpace [write]: File a folder: and everything inside it: into a Space, so the whole tree lives with that project instead of floating unbound.
- readFile [read]: Read what is INSIDE a Cloud File: a CSV/TXT/MD/DOCX document, a PDF's text layer, an audio or video transcript, or an IMAGE (a vision description of what it shows plus any legible text, in…
- renameFile [write]: Rename a File.
- renameFolder [write]: Rename a folder.
- searchFiles [read]: Search everything the user has: their Cloud Files (by filename AND by the text inside them), their private voice notes, and their local drive index: in one call.
- shareFolder [write] [consent]: Request sharing a folder with a Space.

### Tables (24)

MCP-native spreadsheet/database grids: columns, rows, queries, summaries, and sharing.

- addColumn [write]: Add typed column(s) to a table you own, appended to the right of a tab.
- cloneTabSchema [write]: Clone a tab's column schema into another tab: copies the source tab's column definitions (types, options, and order) into the target tab, WITHOUT copying any row data.
- computeSummary [read]: Summarize one column of a table you own: count, filled, and for number/currency columns sum + average + min + max (min + max for dates).
- createTab [write]: Add a tab (sheet) to a table you own: one table, one URL, several sheets, like a spreadsheet workbook.
- createTable [write]: Create a table in the Tables app: a real spreadsheet/database grid.
- deleteColumn [write] [destructive]: Delete a column and every value under it from a table you own.
- deleteTab [write] [destructive]: Delete ONE tab (sheet) from a table you own, along with that sheet's own columns, rows, and cells.
- deleteTable [write] [destructive] [consent]: Move one table to the trash, with every tab, row, column, and cell kept intact.
- insertRows [write]: Insert rows into a table you own.
- listTables [read]: List the tables you own: each with its id, name, emoji, description, tags, where it lives (a Space id, or personal when unfiled), its canonical url, and when it was last updated,…
- listTableShares [read]: List teams a table is shared with: each team's id, name, and permission.
- listTabs [read]: List the tabs (sheets) of a table you own: each tab's id, name, and order, left to right.
- moveTable [write]: Move a table into a Space so it lives with its project, instead of the owner's global Tables list.
- queryTable [read]: Query a table you own: filter and/or sort its rows without loading everything.
- readTable [read]: Read a table you own: its meta, its tabs (sheets), and the active tab's columns (type + order) and rows.
- renameColumn [write]: Rename a column in place: a name change only (type/config stays).
- renameTab [write]: Rename a tab (sheet) of a table you own.
- renameTable [write]: Rename a table you own: sets a new title in place.
- setTableVisibility [write] [consent]: Request a table visibility change (public ↔ private).
- shareTable [write] [consent]: Request sharing a table with a team.
- signTable [write]: Sign a table with its agent provenance: the role · model · surface signature the hand self-declares (e.g.
- tagTable [write]: Add tags to or remove tags from an EXISTING table: the post-creation counterpart to `createTable`'s `tags` parameter, the exact mirror of `tagPage`.
- unshareTable [write] [consent]: Request removing a team's access to a table.
- updateCells [write]: Edit cells in a table you own.

### Forms (24)

Form definitions, fields, capacity, notifications, SEO, and collected responses.

- addFormNotificationRecipient [write]: Add an email address to a form's submission-notification recipients.
- createForm [write]: Create a form in the Forms app.
- deleteForm [write] [destructive]: Permanently delete a form and EVERYTHING that hangs off it: its fields, its pages, and every response ever submitted to it.
- deleteFormResponse [write] [destructive]: Permanently delete one form response by its id: a hard delete (no trash, no undo), for clearing spam or test entries.
- duplicateForm [write]: Duplicate a form you own or can edit into a NEW form you own: a full copy of its configuration (every field with its settings, the confirmation messages, the notification recipients, and the…
- getForm [read]: Read a form you own: its full definition: title, description, status, filed Space id + name when present, its canonical public URL (the ready-to-share /f/<slug> link: use it directly, never rebuild…
- getFormAutoReply [read]: Read a form's submitter auto-reply: whether it is on, the exact subject and body that will be sent (defaults shown when the owner has not written their own), which merge fields are available, and…
- getFormCapacity [read]: Read a form's SEAT capacity and its graceful full-state config: the seat total (or unlimited), seats confirmed, seats held (pending), seats remaining, live availability, the per-submission seat rule…
- getFormNotificationSettings [read]: Read a form's submission-notification settings: whether notifications are on, the additional recipient addresses, the owner address (always notified), and the per-hour burst cap.
- getFormResponse [read]: Read one form response by its id: the full answers (label + value), submitter email, and time.
- getFormRouting [read]: Read where a form's responses go: the channel and entry stage it feeds (if any), the form's routable fields, and the field mapping: both the wiring the owner set and what the mapper infers for…
- listFormResponses [read]: List responses to a form you own, newest first.
- listForms [read]: List the forms you own: each with its id, title, slug, status (draft / published / closed), canonical public URL (the ready-to-share /f/<slug> link: use it directly, never rebuild it from the slug),…
- moveFormToSpace [write]: File a form into a Space so the whole team can open it, read its responses, and manage its settings, instead of it living only in the owner's Forms list.
- publishForm [write] [consent]: Take a form LIVE (draft → published) so anyone with its /f/<slug> link can submit it: the verb that gets a drafted or duplicated form off the shelf.
- removeFormNotificationRecipient [write]: Remove an email address from a form's submission-notification recipients.
- renameForm [write]: Rename a form you own or can edit: changes its title everywhere it appears (the Forms list, the public /f/<slug> page heading, the activity feed).
- setFormAutoReply [write]: Turn the submitter auto-reply on or off for a form, and optionally set its subject and body.
- setFormCapacity [write]: Set a form's SEAT capacity, its per-submission seat rule, and what it shows once full.
- setFormFields [write]: Set a form's fields, in order.
- setFormMessages [write]: Set the messages a form shows after a successful submission: the confirmation "thank you" title and message, and an optional redirect URL.
- setFormNotifications [write]: Update submission-email notifications for a form you own.
- setFormRouting [write]: Attach a form to a channel so every response becomes an entry: a contact plus a dated row at the entry stage.
- setFormSeo [write]: Set how a form's shared link unfurls on social: the SEO (Open Graph) title and description shown when the /f/<slug> link is pasted into a chat, post, or preview card.

### Contacts & CRM (58)

People, contact folders, lead scouting, and drafted outreach to a contact.

- addChannelProperty [write]: Add a property (a column) to one channel: a delivery date, an order total, a priority select, a checkbox.
- addContactsToFolder [write]: Add hand-picked contacts to a manual folder (drag-in).
- addInteractionNote [write]: Write a note on an entry.
- addProductionStage [write]: Add a production step to a channel, at the end of its axis.
- attachFormToClients [write]: Attach a form to Clients.
- createChannel [write]: Create an interaction channel: a new tab in the shop's Interactions, with its own stages and properties.
- createClient [write]: Create a client in the shop owner's client book.
- createContact [write]: Create a new personal contact for the caller.
- createContactFolder [write]: Create a contact folder: the campaign audience primitive (Campaign Execution Studio).
- createEntry [write]: Create an entry in a channel: a phone order, a walk-in, an enquiry, anything the shop wants written down.
- createInteractionChannel [write]: Create an interaction channel: a new tab in the shop's Interactions, with its own stages and properties.
- deleteContact [write] [destructive]: Delete (archive) one of the caller's personal contacts by id.
- deleteEntry [write] [destructive]: Delete an entry: take it off every board, list, calendar and money total.
- detachFormFromClients [write]: Detach a form from Clients.
- findDuplicateClients [read]: Find possible duplicates of one client.
- getContact [read]: Get one of the caller's personal contacts in full by its id.
- getEntryMoney [read]: The whole money picture of one entry: what it is expected to come to, what has been collected, what has been refunded, what is still due, and every payment link, order and invoice attached to it.
- getScoutFunnel [read]: Read tenant-isolated outreach funnel counters for a scout run and optional tier: scanned, cards, verified, consented, send-ready, sent, and replied.
- importContacts [write]: Import contacts either from supplied rows or from a TripleSeat contacts export in Cloud Files.
- importGoogleContacts [write] [external]: Import the owner's Google address book straight into their contacts.
- importInteractions [write]: Import a shop's existing book of events from an export file already in their Cloud Files, landing every row as an entry in a channel so the shop calendar shows the same weeks the old system showed.
- listChannels [read]: List a shop's interaction channels: the tabs its CRM is organised into (orders, leads, clients, whatever the owner made): with each channel's stages in board order, its properties, and how many live…
- listClients [read]: List clients for a personal or Space shop.
- listContactFolders [read]: List the caller's contact folders: the audience primitive for campaigns: each with its live contact count.
- listContactImports [read]: List the owner's contact imports, newest first: what each one was, where it came from, what it did, and whether it has been withdrawn.
- listContacts [read]: List the caller's personal contacts: the people layer of their CRM.
- listContactSources [read]: List the places contacts can be imported from and say which are authenticated right now.
- listDeletedEntries [read]: What was deleted from a channel and can still be taken back, newest deletion first: with who deleted it and why.
- listEntries [read]: List entries with the customer, the stage each sits in, and every property value.
- listFolderContacts [read]: List the contacts a folder currently resolves to: its hand-picked members or its live rule matches.
- listInteractionChannels [read]: List a shop's interaction channels: the tabs its CRM is organised into (orders, leads, clients, whatever the owner made): with each channel's stages in board order, its properties, and how many live…
- listInteractionNotes [read]: Every note written on an entry, newest first, each with its author, when it was written, and whether it was a team note or a note to the customer.
- listInteractions [read]: List entries with the customer, the stage each sits in, and every property value.
- listProductionQueue [read]: Everything sitting at one production step, optionally for one day or date window: the read a shop makes every morning ("what has to be baked today").
- listProductionStages [read]: The production steps a channel runs its work through, in order: the shop's own words for them (empty, counted, baked, crumbed, finished; or plates, proofs, press).
- logContactTouch [write]: Record a reply the human already posted onto a contact's touch timeline, stamped with its channel and a link to the artifact (the posted comment's URL).
- logInteraction [write]: Create an entry in a channel: a phone order, a walk-in, an enquiry, anything the shop wants written down.
- mergeClients [write] [destructive]: Merge duplicate clients only when the user asks.
- previewContactImport [read]: Show what an import would do before anything is written: how many people are new, how many match a contact already in the book, and which existing contact each duplicate would merge into.
- queueOutreachDraft [write] [external]: Queue ONE tailored outreach draft for one of the caller's personal contacts, into their reviewed approve-each queue.
- reachOutToContact [write] [destructive] [external]: Reach out to ONE of the caller's personal contacts by email: sends a single real email from the caller's connected Gmail (it appears in their Sent and reads as from them).
- reachOutViaForm [write] [external]: Enqueue an outreach to a scouted lead through the contact form on THEIR website: a fleet browser-worker fills and submits the form later, and NOTHING sends until you approve the job in-app first.
- removeContactsFromFolder [write]: Remove contacts from a manual folder (drag-out).
- resolveContact [read]: Resolve a person against the caller's existing personal contacts by ANY handle they carry: identity lookup and dedup, NOT messaging.
- restageContactImport [write]: Re-file a whole import under a new category: move every contact in it to a different stage, swap the tags it applied, and rewrite its consent posture.
- restoreEntry [write]: Put a deleted entry back exactly as it was: its stage, its dates, its history, its money, and its place on the calendar.
- scoutLeads [write] [external]: Scout net-new business leads via the Google Places API and land them as pending lead cards in the caller's CRM.
- scoutWebLeads [write] [external]: Verify live job postings, startup/lab feed entries, and storefront websites, then land deduplicated CRM cards in a pending verification queue.
- searchContacts [read]: Search the caller's personal contacts by a single query string, matched across name, email, phone, job title, and notes.
- setEntryProduction [write]: Move one entry along the production axis: where the WORK has got to.
- setEntryTotal [write]: Correct what an entry is expected to come to, in MINOR units of its currency (75000 = €750.00).
- undoContactImport [write] [destructive]: Withdraw a whole contact import in one action.
- updateChannel [write]: Rename an interaction channel, change its description, archive it, take it on or off the shop calendar, or rename and hide its BUILTIN columns.
- updateChannelProperty [write]: Rename a channel property, CHANGE ITS TYPE, change its choices, reorder it, or make it required.
- updateClient [write]: Update a client by id.
- updateContact [write]: Update one of the caller's personal contacts by id.
- updateEntry [write]: Edit an entry: rename it, set any property, move it to another stage, or archive it.
- verifyScoutLeads [write] [external]: Verify up to 25 pending scouted cards from a run or explicit contact list.

### Email (23)

Connected Gmail accounts: search, read, send, label, archive, and drafts.

- addLabelToEmail [write] [external]: Add a label to a Gmail message.
- archiveEmail [write] [external]: Archive a Gmail message: removes it from the inbox, keeps it in All Mail.
- connectResend [write] [consent] [external]: Connect a Resend account so email can be sent on the user's OWN key, from domains they verified in their OWN Resend: no DNS setup here.
- createDraft [write] [external]: Create a Gmail draft without sending it.
- createEmailLabel [write] [external]: Create a Gmail label.
- deleteDraft [write] [destructive] [external]: Delete a Gmail draft.
- deleteLabel [write] [destructive] [external]: Delete a Gmail label: removes the label, not the messages it was on.
- disconnectResend [write] [destructive] [consent]: Disconnect a Resend account: deletes the encrypted key AND the cached domain list, and resets any "send using my Resend" choice back to The Cloud, so mail keeps going out unbranded rather than…
- getMailStats [read]: Outbound mail stats: how much went out per connected account in the last 24h / 7d / 30d, from the canonical send ledger (every send rail, counted once: no Gmail API call).
- listAvailableSenders [read]: List every address this account may send customer-facing mail from, and HOW each one earned it: "platform" (a domain verified here by publishing our DNS records) or "resend-connection" (a domain…
- listDrafts [read] [external]: List the Gmail drafts in one connected account.
- listLabels [read] [external]: List the Gmail labels (folders/categories) in one connected account.
- listMailAccounts [read]: List the Google mail accounts connected to The Cloud: returns { accountId, email, isPrimary } for each.
- markAsRead [write] [external]: Mark a Gmail message as read.
- markAsUnread [write] [external]: Mark a Gmail message as unread.
- readEmail [read] [external]: Read the full content of a Gmail message by its ID.
- removeLabelFromEmail [write] [external]: Remove a label from a Gmail message.
- resendStatus [read] [external]: Show the state of a connected Resend account: the masked key fingerprint, every domain the account holds with its verification status, and when we last asked Resend.
- searchEmails [read] [external]: Search the user's Gmail messages with Gmail query syntax ('from:user@example.com', 'is:unread', 'subject:meeting', 'in:sent').
- sendDraft [write] [destructive] [external]: Send a Gmail draft that is ALREADY staged, by its draftId: this sends a real email and cannot be unsent.
- sendEmail [write] [destructive] [external]: Send an email via Gmail: this sends a real email and cannot be unsent.
- setPrimaryMailAccount [write]: Set the user's PRIMARY (default) mail account: the one every mail tool (sendEmail, createDraft, searchEmails, readEmail, listDrafts, …) uses when no accountId is given.
- trashEmail [write] [destructive] [external]: Move a Gmail message to trash.

### Campaigns & Newsletters (21)

Audience campaigns, deliverable packages, send readiness, newsletters, and CAN-SPAM compliance settings.

- addAudienceToCampaign [write]: Add an audience to a Campaign, or grow it.
- addCampaignPackageItem [write]: Attach a deliverable to a campaign's package: the bundle it delivers (a Cloud page, a Studio app/website, a file, or an external link).
- createCampaign [write]: Create a Campaign: the organizing layer over the reviewed outreach queue.
- createNewsletter [write]: Start a newsletter: a named publication bound to a subscriber contact folder (its audience).
- createSavedView [write]: Create a named, reusable saved view over the caller's personal contacts: a LIVE lens (a filter), not a copy of people.
- finalizeCampaign [write]: Finalize a campaign: LOCK its send shape (audience size + channel + package version) so it is ready for the human to send.
- fireNewsletterSequence [write] [destructive] [external]: Fire one triggered lifecycle sequence to YOUR OWN account email: a safe preview/self-test of the transactional pipeline (welcome, payment_success, payment_failed, access_approval).
- getCampaignPrep [read]: Read a campaign's prep dashboard: audience size, package (deliverable) count, staged drafts, whether the content is ready, and whether it is finalized (and if a finalized shape has drifted).
- getCampaignSendReadiness [read]: Answer "can I start sending this campaign, and if not what's blocking?": the send-readiness preflight.
- getComplianceSettings [read]: Read the outreach compliance settings for the signed-in user: the CAN-SPAM physical mailing address and sender name that every campaign email must carry.
- listCampaignPackage [read]: List a campaign's package: every deliverable it sends, each resolved to its live title and canonical URL.
- listCampaigns [read]: List the caller's campaigns with their live status and counts (pending / sent / replied).
- listNewsletterIssues [read]: List a newsletter's issues: the campaigns bound to its subscriber folder: newest first, each with its status (draft / active / paused / done).
- listNewsletters [read]: List the caller's newsletters, each with its live subscriber count (from the bound folder).
- listNewsletterSequences [read]: List the Newsletter tool's triggered/transactional sequences: the lifecycle emails that fire on an event (welcome, payment success, the graceful payment-failed, access approval), with each one's…
- listSavedViews [read]: List the caller's own saved views: the named, reusable lenses over their contacts: each with its savedViewId, name, entity type, and filters.
- pauseCampaign [write]: Pause an active Campaign: its queued drafts hold and none advance until you resume it.
- removeCampaignPackageItem [write]: Remove a deliverable from a campaign's package.
- setComplianceSettings [write]: Set the outreach compliance settings for the signed-in user: the physical mailing address (a real postal address, legally required in every commercial campaign email) and the sender name shown in…
- simulateCampaign [read]: Simulate a campaign: a per-recipient DRY RUN showing exactly who would receive what (subject + body preview) and the resolved package links, with ZERO sends.
- startCampaign [write] [external]: Start a draft Campaign: fan its audience into the reviewed approve-each queue as one personalized draft per contact.

### Telegram (13)

Connected Telegram chats: search, sync control, quote mining, and contact mapping.

- connectTelegramAlerts [write] [external]: Link the owner's Telegram so needFromOwner can reach them, and read whether it is linked already.
- listTelegramChats [read]: List the user's synced Telegram chats: title, kind (dm/group/channel), whether sync is on, message count, and the mapped contact if any.
- listTelegramQuotesForContact [read]: List the Telegram quotes filed to a contact: the verbatim lines mined from their synced chats, newest first.
- mapTelegramChatToContact [write]: Map a synced Telegram chat to a Cloud contact (the person-object): pass an existing contactId, or a name to resolve or create one.
- mineTelegramQuotes [read]: Surface the most quotable lines from a synced Telegram chat: the counterparty's substantive, verbatim messages, ranked.
- needFromOwner [write] [external]: File something the OWNER has to decide or do, and put it where they cannot miss it.
- purgeTelegramChat [write] [destructive]: Purge a synced Telegram chat: permanently deletes the Cloud copy of its messages and quotes, then the chat itself.
- replyInTelegramChat [write] [external]: Stage a REPLY to a specific message in one of the caller's synced Telegram chats.
- saveTelegramQuoteToContact [write]: File a synced Telegram message as a quote on a person's page.
- searchTelegramMessages [read]: Full-text search across the user's synced Telegram messages, optionally scoped to one chat.
- sendTelegramMessage [write] [external]: Stage a NEW message to one of the caller's synced Telegram chats.
- setTelegramChatSync [write]: Turn syncing on or off for one Telegram chat.
- telegramConnectionStatus [read]: Check whether the user has connected their Telegram account, and read the connected account's handle + health status.

### Slack (6)

Ora in the room: read a Space's bridged Slack channels, threads, and history, and post as Ora through the per-class autonomy dial and approval queue.

- getSlackResponder [read]: Read how one bridged Slack channel is configured to answer: which model, where that model runs, and which Space it draws its context from.
- listSlackChannels [read] [external]: List the Slack channels the Space's bridge is authorized for, each with how it is configured to answer: { channelId, channelName, isExternal, dial, liveVisible, modelId, source, sourceSpaceName }.
- postSlackMessage [write] [external]: Post a message to a bridged Slack channel as the workspace's Ora app identity, always attributed to Ora, never a human.
- readSlackThread [read] [external]: Read a Slack thread from a bridged channel into context.
- searchSlackHistory [read] [external]: Search Slack history within the Space bridge's authorized channels only.
- setSlackResponder [write]: Set how one bridged Slack channel answers: which model, where it runs, and which Space it draws its context from.

### Instagram (6)

Connection status, posting, and archiving.

- archiveInstagram [write] [external]: Archive the user's connected Instagram account into their Private Files: pulls posts (images/videos), captions and comments via the Graph API into an "Instagram archive" folder, and attempts stories…
- instagramConnectionStatus [read]: Check whether the user has connected Instagram accounts, and read each account's username + health status.
- listInstagramConversations [read]: List the user's Instagram DM conversations (most recent first), each with the last message preview and whether it can still be replied to inside Meta's 24-hour window.
- postToInstagram [write] [destructive] [external]: Publish a post to the user's connected Instagram account from a hosted image or video URL, with an optional caption.
- readInstagramConversation [read]: Read one Instagram DM conversation's recent messages in order, plus whether it is still inside Meta's 24-hour reply window.
- sendInstagramReply [write] [destructive] [external]: Send a text reply to an existing Instagram DM.

### Social Calendar (11)

The content calendar a Space plans on: draft, review, approve, schedule, and publish posts. The agency drafts and schedules; the client approves; nothing reaches a channel unapproved.

- approvePost [write]: Approve a post that is in review, recording WHO approved it and when.
- attachPostMedia [write]: Attach photos or video from the Space's Files to a post.
- deletePost [write] [destructive]: Delete a post from the content calendar, along with its approvals and history.
- draftPost [write]: Draft a new social post on a Space's content calendar: caption, optional title/first comment, optional media from the Space's Files, and an optional scheduled slot.
- getPostStatus [read]: Read one post in full: its copy, channel, slot, where it sits in the approval flow, and its channel link or public post id once live.
- listScheduledPosts [read]: List a Space's calendar posts inside a date window: what is scheduled, when, on which channel, and where each one is in the approval flow.
- publishPostNow [write] [destructive] [consent] [external]: Publish an APPROVED Instagram or TikTok post immediately instead of waiting for its slot.
- requestPostChanges [write]: Send an in-review post back to draft with a comment saying what needs to change.
- schedulePost [write]: Put an APPROVED post into a slot, or move an already-scheduled one.
- submitPostForReview [write]: Send a drafted post to the client for sign-off.
- updatePost [write]: Edit a drafted post's caption, title, first comment, or channel.

### Music (10)

The workspace music library and connected Spotify playlists.

- addTracksToMusicPlaylist [write]: Add tracks to a Cloud-native "My Music" playlist by their library ids (from searchMusicLibrary).
- addTracksToPlaylist [write] [external]: Add tracks to a Spotify playlist by their Spotify track URIs (from searchTracks).
- createMusicAlbum [write]: Create a Cloud-native "My Music" album: the grouping an imported song lands into (session-to-song).
- createMusicPlaylist [write]: Create a new Cloud-native "My Music" playlist: a playlist of the user's OWN Cloud audio (recordings, uploaded files, voice notes), stored in their Cloud, not on Spotify.
- createPlaylist [write] [external]: Create a new playlist on the user's own Spotify account.
- importAudioToLibrary [write] [external]: Import a finished song into the user's own Cloud "My Music" library from a public audio URL or an already-uploaded file.
- listMusicAlbums [read]: List the user's Cloud-native "My Music" albums: each with its albumId, title, and when it last changed, most-recently-updated first.
- listMusicPlaylists [read]: List the user's Cloud-native "My Music" playlists: each with its playlistId, name, description, track count, and when it last changed, most-recently-updated first.
- searchMusicLibrary [read]: Search the user's own Cloud music library (their recordings, uploaded audio, and voice notes: NOT Spotify) by title, artist, or album.
- searchTracks [read] [external]: Search the Spotify catalog for tracks by title, artist, mood, or genre.

### Studio Apps (72)

Real multi-file apps built inside the workspace: files, manifests, secrets, rendering, sharing, and verification.

- addCustomDomain [write] [consent] [external]: Connect a custom domain to this account and start verifying it, optionally binding a Studio app to serve the whole site in the same call.
- appendStudioAppFile [write]: Append content to a file in a Studio app additively: no whole-file round-trip.
- archiveStudioApp [write] [destructive]: Archive a Studio app: move it to the recoverable Archived section.
- assignStudioAsset [write]: Assign an uploaded asset to a placeholder slot in a Studio app: the DETERMINISTIC placement: exact file path + exact slot name, no fuzzy matching.
- attachSecretToApp [write]: Attach an account-level secret to a Studio app: declares it in the app's capability surface (requestedSecrets) so the runtime proxy can inject it.
- attachStudioAppArtifact [write]: Attach a build output to a tagged release.
- bindApexStudioSite [write] [destructive] [consent]: Cut the apex hostname over to the seeded Studio site.
- checkSecretExists [read]: Check whether a Studio app secret is set: returns a BOOLEAN only, never the value.
- checkStudioApp [read]: Check the runtime health and discovery head of a Studio app.
- crawlSiteToContent [write] [external]: Crawl a public website into a Studio content pack.
- createDocSkill [write]: Create a docSkill: the document analog of a Studio template: the refined structure, formatting, tone, and method for a document CLASS (memo, SOP, retainer letter, proposal, brief, offer letter),…
- createStudioApp [write]: Create a new Studio app: a first-class Cloud object that renders at `thecloud.so/a/<slug>_<id>` and can be embedded in pages via the App Window block.
- deleteStudioAppFile [write] [destructive]: Delete a file from a Studio app by path.
- deleteStudioAppSecret [write] [destructive]: Delete a Studio app secret.
- draftArticle [write]: Draft an article for The Journal on the platform site.
- editStudioAppContent [write]: Replace a Studio app's contentHTML: the HTML the iframe renders at `/a/<slug>_<id>`.
- editStudioAppFile [write]: Surgically edit one file in a Studio app by find-and-replace: patch it in place instead of re-uploading the whole file.
- editStudioAppFileBatch [write]: Apply an ORDERED list of find-and-replace edits to one file in a Studio app, ATOMICALLY (all-or-nothing) in a single call.
- editStudioAppManifest [write]: Replace a Studio app's manifest: the capability declarations (requestedTools, requestedScopes), hosting mode, pricing, review status.
- forkDocSkill [write]: Fork a docSkill you can read into your own library: a NEW customized copy with a forkOf pointer back to the parent.
- getDocContract [read]: Resolve a named deliverable to ITS CONTRACT for you: your own override if any, else your org's, else the platform default (resolution order: user > org > platform).
- importMediaToApp [write] [external]: Import real media into a Studio app from consented external pages: a server-side render-then-harvest that lands deduped image files in the app's assets/ tree with provenance (source URL +…
- linkStudioAppDomain [write] [consent]: Point a custom domain at a Studio app, which then serves the whole site at that domain: the root and every path.
- lintStudioComposition [read]: Lint a Studio app for the Composition Layer gates: (1) the SCROLL-SHELL guarantee: a top-level header pinned (position: fixed/sticky) WITHOUT the shell that keeps it stable inside the render iframe…
- listArchivedStudioApps [read]: List your archived Studio apps, most-recently-archived first.
- listArticles [read]: List The Journal's articles on the platform site: title, slug, kind, topics, path, and whether each is published or still a draft.
- listCustomDomains [read]: List the custom domains on this account with their status, the Studio app each one serves, the canonical host the hosting layer reports, and the DNS records still outstanding.
- listDocContracts [read]: List the doc contracts: the stable, named deliverable SHAPES available to you: your own overrides, your org's, and the platform defaults you inherit.
- listDocSkills [read]: List your docSkills: the document skills in your universal library, most-recent first.
- listStudioAppAdmins [read]: List a Studio app's admin config: the owner, the explicit admin allowlist, and whether admins are resolved "manual" (allowlist only) or "space" (from the containing Space).
- listStudioAppArtifacts [read]: List the build artifacts released from a Studio app: the zips, binaries and generated file sets attached to its tagged versions.
- listStudioAppFiles [read]: List the files in a Studio app: returns each file's id, path, mimeType, byteSize, updatedAt (no content, that's readStudioAppFile).
- listStudioApps [read]: List the caller's Studio apps, most-recent first.
- listStudioAppSecrets [read]: List Studio app secrets: METADATA ONLY: key, scope, isSet (always true for a listed secret), used-by app count, and last-updated.
- listStudioAppShares [read]: List teams the Studio app is shared with.
- listStudioAppVersions [read]: List a Studio app's version history, newest first.
- mirrorStudioAppAsset [write] [external]: Mirror a public binary asset into a Studio app under assets/ by URL.
- mountVerbPack [write]: Mount an owned Studio verb pack into the caller's MCP catalog.
- moveStudioAppToSpace [write]: Move a Studio app into a Space so it lives with its project, instead of the owner's global Studio library.
- placeStudioMedia [write]: Place an already-uploaded media file into a spot in a Studio app, resolving a VAGUE mention to the right file + spot.
- promoteDocContract [write]: Promote one of YOUR ratified user-scope doc contracts to the PLATFORM DEFAULT: the commons floor every account inherits, including provisioned and staged ones (by resolution, never by copy).
- publishArticle [write] [consent]: Publish a drafted Journal article to the platform site.
- readStudioApp [read]: Read a Studio app: returns its name, contentHTML, manifestJSON, canonical URL, and its CITATION surface: `version` (the content hash of the app's current file tree) and `releases` (every tagged…
- readStudioAppFile [read]: Read a single file from a Studio app: returns its content + mimeType.
- rebuildStudioApp [write]: Rebuild a Studio app: reconcile it onto its canonical store so what the public /a/ route serves and what tools report agree.
- registerDocContract [write]: Register a NEW doc contract at version 1: a stable, named deliverable SHAPE others resolve and render.
- renameStudioApp [write]: Rename a Studio app.
- renderShareCard [write]: Rasterize self-contained HTML or SVG into a pixel-perfect share-card PNG and save it as a PRIVATE asset in a Studio app.
- renderStudioApp [read]: Render a Studio app headlessly and return SCREENSHOTS Ora can inspect.
- restoreStudioApp [write]: Restore an archived Studio app: bring it back whole (files, history, and settings all intact).
- rotateStudioAppSecret [write] [destructive]: Rotate a Studio app secret: replace its value with a new one.
- searchStudioAppFile [read]: Search the current text files of a Studio app with a safe JavaScript regular expression, without paging whole files through readStudioAppFile.
- seedApexStudioSite [write] [external]: Create or refresh the platform's public-site Studio app from the live marketing tree.
- setDomainDiscoverySettings [write]: Configure Google Search Console verification for a domain you manage.
- setStudioAppAdmins [write] [consent]: Set who administers a Studio app.
- setStudioAppFavicon [write]: Set or remove a Studio app's favicon: the icon its tab, bookmark, and home-screen shortcut wear.
- setStudioAppSecret [write] [destructive]: Set (create or overwrite) a Studio app secret's value: WRITE-ONLY.
- setStudioAppShareCard [write] [consent]: Request setting a Studio app's link-preview share card: the title, description, and cover image a shared /a/<slug>_<id> link unfurls with on Telegram/Slack/iMessage/social.
- setStudioAppVisibility [write] [consent]: Request a Studio app visibility change (public ↔ private).
- shareStudioApp [write] [consent]: Request sharing a Studio app with a team.
- tagStudioAppVersion [write]: Cut a release: give a Studio app version a permanent human name, so an outside document can cite exactly which design state it came from.
- transferStudioApp [write] [destructive] [consent]: Transfer a Studio app to another Cloud account by user id or email.
- unlinkStudioAppDomain [write] [consent]: Detach whichever Studio app a custom domain serves, so the domain stops serving that site.
- unmountVerbPack [write]: Unmount an owned Studio verb pack from the caller's MCP catalog.
- unpublishArticle [write] [consent]: Withdraw a published Journal article.
- unshareStudioApp [write] [consent]: Request removing a team's share on a Studio app.
- updateDocContract [write]: Publish a NEW version of an existing doc contract: update = a new version.
- uploadStudioAppAsset [write]: Upload a REAL BINARY FILE (an image, an icon, a font) into a Studio app's `assets/` tree, so the app serves it at a normal path with a real content type: no data-URI in the markup, and no waiting…
- validateAgainstDocContract [read]: Check a drafted deliverable against the contract it claims, BEFORE filing it.
- validateStudioApp [read]: Parse a Studio app's own source and report SYNTAX ERRORS with file, line and column: the verify-back loop that needs no browser at all.
- verifyCustomDomain [write] [external]: Re-run verification on a custom domain you manage and report where it stands.
- writeStudioAppFile [write]: Create or overwrite a file in a Studio app.

### Media & Video (35)

Image and video generation, transcription, conversion, compression, clip styling, blurring, and stream-safety review.

- acceptStreamSafeClass [write]: Accept a whole class of StreamSafe findings at once: apply the default fix to every pending finding of that class (e.g.
- addBlurRegion [write]: Add a blur region to a clip in a Studio video project.
- addTextClip [write]: Add a typewriter text/title to a Studio video project: text that reveals per character with an optional caret and a subtle, toggleable typing sound.
- applyStreamSafeFinding [write]: Resolve ONE StreamSafe finding by applying its fix to the timeline: a reversible blur region (for on-screen info), a cut, or an audio bleep (for spoken info).
- assembleStudioVideo [write] [external]: Assemble a Studio video project's uploaded clips into ONE finished video via the ffmpeg media worker: clips ordered, stitched with clean cuts, and audio normalized: landing a PRIVATE video file in…
- checkImageGeneration [read]: Check a background image generation/edit started by generateImage or editImage, by its jobId.
- clearClipStyle [write]: Remove all Figma-easy styling (corner radius, padding, shadow, background) from a clip in a Studio video project.
- compressMedia [write] [external]: Make a video or audio file smaller WITHOUT changing its format, on the media worker: the new, lighter file lands as a NEW PRIVATE file beside the original (the original is never touched, an existing…
- convertMedia [write] [external]: Convert a video or audio file in The Cloud into another format (mp4, mov, webm, mkv, m4a, mp3, wav) on the media worker, landing the result as a NEW PRIVATE file beside the original: the source is…
- dismissStreamSafeFinding [write]: Dismiss a StreamSafe finding without changing the video: mark it reviewed and off the gate (on the record).
- editImage [write] [external]: Edit or restyle an existing Studio image from a text prompt (inpaint / restyle).
- fileVideoWatchMoments [write]: File the cue moments of a video watch as Tasks, one row per moment, with the quote, the timestamp and the frame URLs in the body.
- generateImage [write] [external]: Generate an image from a text prompt and save it as a real asset inside a Studio app (Private by default).
- generateVideo [write] [external]: Generate a video clip with AI and add it to a Studio project as a PRIVATE asset in that project's media pool.
- getTranscript [read]: Read a transcript artifact produced by transcribeMedia back by its id: the full text, timestamped segments, word-level timings, and speaker diarization.
- listBlurRegions [read]: List every blur region on a Studio video project, with the clip each sits on and its shape, strength, feather, time window, and keyframes.
- listClipStyles [read]: List every styled clip on a Studio video project, with its corner radius, padding, shadow, and background.
- listGenerationPresets [read]: List the reusable generation presets available to you: versioned, calibrated parameter sets (engine, model, motion/camera/style discipline, take count) that you pass to generateVideo as presetId.
- listMyYouTubeVideos [read] [external]: List up to 200 videos from the signed-in member's own YouTube uploads playlist using their stored youtube.readonly connection.
- listStreamSafeFindings [read]: List the latest StreamSafe sweep's findings for a Studio video project: each finding's class, kind, confidence, time range, whether it has an on-screen box, and its resolution state (pending /…
- listTextClips [read]: List every typewriter text/title on a Studio video project, with its text, position, timing, and typewriter settings.
- lookCloser [write] [consent] [external]: Cut additional exact frames from a private video watch artifact already fetched into The Cloud, then append those timestamped frame URLs to that same artifact.
- prepStudioVideoForPosting [write] [external]: Run the StreamSafe privacy sweep over a Studio video project: the "Prep for posting" pass.
- readTranscript [read]: Read the transcript of audio or video the user recorded in The Cloud: voice notes and audio/video tiles.
- readVideoWatch [write]: Read one private video watch artifact in any state, and the poll for the handle watchVideo returns.
- removeBlurRegion [write]: Remove a blur region from a Studio video project.
- removeTextClip [write]: Remove a typewriter text/title from a Studio video project.
- renderStudioVideo [write] [external]: Render a Studio video project: burning in everything on the timeline (blur, corner-radius/padding/shadow/background styling, and typewriter text with its typing sound): via the ffmpeg media worker,…
- saveGenerationPreset [write]: Save the parameter set from one of YOUR finished generations as a reusable preset, so the next run starts from what worked instead of a retyped prompt.
- setClipStyle [write]: Style a clip, image, or text box in a Studio video project like a design tool: round its corners (one slider), pad it, add a drop shadow, or fill a background: all normalized so they read at any…
- setPrivateVideoAccess [write] [consent]: Turn the signed-in member's "Let Ora watch my private videos" setting on or off for their own YouTube connection.
- transcribeMedia [write] [external]: Transcribe spoken video or audio into a private, timestamped transcript (word timings + speaker diarization), reusing the shipped Deepgram/Whisper ASR.
- updateBlurRegion [write]: Update a blur region on a Studio video project: retime it, re-track it with new keyframes, or change its shape, strength, or feather.
- updateTextClip [write]: Update a typewriter text/title on a Studio video project: change its text, position, size, color, timing, or typewriter settings (speed, caret, sound).
- watchVideo [write] [consent] [external]: Start watching a public or unlisted URL, Cloud file, recording, or page media block on the member's attached machine.

### Fonts & Typography (7)

Handwriting-to-font creation from a template photo, uploaded font families, applying a font to an appearance slot, and exporting the packaged files.

- applyFont [write] [consent]: Apply an uploaded font to a workspace appearance slot (workspaceFont, pageBodyFont, or monoFont).
- createFontFromImages [write]: Start a font from one or more uploaded images of the owner's handwriting or lettering, plus an optional style prompt.
- deleteFont [write] [destructive] [consent]: Delete a font family and all its variants.
- exportFontPackage [write] [consent] [external]: Export a font family package (.ttf + .otf + .woff2 + license/metadata ZIP).
- getFont [read]: Read one font variant or handwriting job status.
- listFonts [read]: List your uploaded and handwriting font families plus in-progress jobs.
- resetFont [write] [consent]: Reset an appearance font slot back to the default bundled typeface.

### Agents & Machines (25)

Dispatch agents to your own attached hardware, watch runs, and collect results.

- drainMachine [write]: Drain (or un-drain) one of your machines: the safe way to take a box offline without losing agent work.
- fleetDrainStatus [read]: Read the drain state of your machines plus every agent run that stopped short and can be picked up.
- getAgentResult [read]: Read the outcome of a dispatched agent session by its conversationId: the orchestrator readback that completes the dispatch→readback→synthesize loop.
- gradeRun [write]: Grade one of your agent runs: record whether it was "useful", "partial", or "failed", plus an optional failure mode when it fell short ("grounding" | "instruction-following" | "format" | "tool-use"…
- handoffSession [write]: Hand this session off to a successor: write the baton, open the next session on the SAME machine and seat, and mark this one handed off: one verb instead of the ritual.
- listAgentSessions [read]: List your agent sessions on the live roster: every agent currently queued, running or PARKED across your machines, PLUS any lane DROPPED in the last 24 hours: each with its title, state, the machine…
- listMachines [read]: List the machines attached to your account that can run agents: each with its name, lifecycle status, derived liveness, last-seen heartbeat, browser readiness, and latest telemetry.
- listSessions [read]: List your sessions as the SESSION BUS sees them: the roster you address `messageSession` from.
- messageSession [write]: Send a message from one of YOUR sessions to another one, across machines.
- readAgentOutput [read]: Read back what a dispatched agent session actually PRODUCED: its full transcript, final output, and tool-call log: by conversationId.
- readDeliveryFlow [read]: Read how long each of your fleet's deliveries actually took to move, one row per delivery (a ledger Task and every lane that worked it), with every value linked back to the receipt it came from.
- readFleetRegeneration [read]: Read the last self-regeneration reports for your fleet, newest first, without running a new pass.
- readSessionSweeps [read]: Read the last sessions sweeps, newest first, without running a new one.
- recheckSeatSignIn [write]: Ask one of your machines to RE-PROBE its agent seats right now: whether the Claude, Codex and Cursor CLIs are installed, signed in, and able to complete a one-turn smoke.
- regenerateFleet [write]: Run a self-regeneration pass over the fleet RIGHT NOW: read every attached machine and every seat on it, classify each seat into exactly one class, carry out the repairs that are safe to make…
- reportPresence [write]: Names your own presence node in the user's Agents panel.
- resumeAgentRun [write] [external]: Pick up an agent run that stopped short: respawn it on the same machine, continuing the SAME branch, seeded with a preamble pointing at the work its predecessor left behind (so it continues rather…
- runAgent [write] [external]: Start (spawn) an autonomous agent on one of your machines to carry out a task.
- runOnMachine [write] [destructive] [external]: Run a single shell command on one of your machines (a MachineSync box) through The Cloud, and stream its output back into the Agents view: box ops without a physical terminal (update the daemon,…
- setLaneCap [write]: Set how many agent lanes one of your machines runs AT ONCE: the pace knob for a box that is running hot.
- setMemoryGuard [write]: Read or adjust the memory guard on one of your machines: the rule that stops a box CLAIMING new agents while it has no memory to give.
- steerAgent [write]: Amend a QUEUED or RUNNING agent session in flight: add an instruction to a lane instead of stopping it and firing a fresh one.
- stopAgent [write]: Stop one of your running agent sessions: a graceful halt of an agent you started, for a runaway, duplicate, or no-longer-needed run.
- sweepSessions [write]: Reconcile every session that ended badly against what it ACTUALLY produced, and repair what can be repaired.
- tagSession [write]: Add tags to or remove tags from one of YOUR agent sessions: the exact mirror of `tagPage`, applied to a dispatched run instead of a page.

### Browser (5)

Drive a headless browser on your own attached machine: open a page, read it as markdown, screenshot it, act on it (consent-gated), and close it. Public web only in P0.

- browserAct [write] [destructive] [external]: Act on a browser session's current page: click an element, type text into a field, or press a key.
- browserClose [write] [external]: Close a browser session and free its slot (sessions are capped in number).
- browserOpen [write] [external]: Open a URL in a fresh headless browser session on one of your machines (a MachineSync box) and return a sessionId you drive with the other browser verbs.
- browserRead [write] [external]: Read the current page of a browser session as markdown, plus key metadata (title, final URL, description).
- browserScreenshot [write] [external]: Capture a screenshot of a browser session's current page.

### Loops (11)

Scheduled recurring agent runs: create, customize, start, pause, and run now.

- createLoop [write]: Create a Loop: a recurring AI recipe (prompt + style preset) that fires on a cadence (interval/cron/idle) against an optional target (a repo, Space, Studio app, or task), with a model, write policy,…
- customizeLoop [write]: Edit a Loop's shared recipe: its prompt, style preset (archetype), or write-policy CEILING.
- deleteLoop [write] [destructive]: DESTRUCTIVE: permanently delete a Loop you own.
- getLoopDetail [read]: Read ONE Loop in full: its prompt (the pinned recipe body), style preset, cadence, target, model, write policy and budgets, its consent record and whether consent is stale, plus its recent run…
- listLoopModels [read]: List the model ids a Loop can be pinned to (the same picker the Loops tab's create/edit flow uses).
- listLoops [read]: List the caller's Loops with live status (active/paused/stopped), pausedReason, write policy, cadence, target, next/last run time, whether consent is stale, and the latest recap.
- pauseLoop [write]: Pause a Loop: it stops firing on its cadence but keeps its config, recipe, and run history intact, and can be resumed with startLoop.
- runLoopNow [write] [external]: Fire one Loop run immediately, off-cadence (never advances its schedule).
- startLoop [write]: Resume a paused Loop (or confirm an active one stays active) so it fires on its cadence again.
- stopLoop [write]: Stop a Loop for good: retires it from the scheduler (status: stopped).
- updateLoop [write]: Edit an existing Loop's instance config: cadence (trigger), target, model, budgets, concurrency, or its own write policy (never above the recipe's ceiling: use customizeLoop to raise the ceiling…

### GitHub & Code (22)

Repos, issues, pull requests, code search, and the read/branch/commit path to opening a PR.

- cancelArmedMerge [write]: Cancel one active GitHub pull request merge-when-green arm.
- commitFiles [write] [external]: Commit one or more files to a feature branch on a connected GitHub repo (multi-file atomic commit).
- createBranch [write] [external]: Create a branch on a connected GitHub repo from a named base.
- createIssue [write] [external]: Create an issue in a GitHub repository.
- getPullRequest [read] [external]: Get one GitHub pull request in detail: diff stats, GitHub's mergeableState (clean / dirty / blocked / behind / unstable / unknown), and the check runs on its head commit as `checks` with…
- getPullRequestDiff [read] [external]: Read a bounded unified diff for one GitHub pull request.
- listArmedMerges [read]: List the caller's active GitHub pull requests that are armed to merge when required checks pass.
- listGatekeepRules [read]: List GateKeep rule packs for a GitHub connection.
- listIssues [read] [external]: List issues for a GitHub repository.
- listPullRequests [read] [external]: List pull requests for a GitHub repository.
- listRepos [read] [external]: List the user's GitHub repositories across every connected account.
- listRepoTree [read] [external]: Browse a connected GitHub repo's file tree at a ref, optionally scoped to a path and depth.
- listShepherdLedger [read]: List Shepherd ledger entries for a GitHub connection.
- mergePullRequest [write] [destructive] [consent] [external]: Request a merge of a connected GitHub repo's pull request.
- openPullRequest [write] [external]: Open a pull request on a connected GitHub repo.
- readRepoFile [read] [external]: Read one file from a connected GitHub repo at any ref: the reliable read path for drafting a diff in chat.
- reviewPullRequest [write] [destructive] [external]: Submit a review on a connected GitHub repo's pull request: APPROVE, REQUEST_CHANGES, or COMMENT: acting as the user's connected GitHub account.
- searchCode [read] [external]: Search code across the user's GitHub repositories with GitHub code-search syntax.
- setMergeApprovals [write] [consent]: Request a change to a connected GitHub account's "Merge approvals" dial: the standing consent that decides whether a green pull request merges on its own or waits for the owner.
- shepherdRunNow [write] [destructive] [external]: Run Shepherd now for a repository, with one pull request as the immediate review focus.
- shepherdStatus [read]: Read Shepherd status for a connected GitHub account: last fire, when the owner's cadence is next due, the dial, and how many ledger rows the bounded recent window held.
- updateGatekeepRule [write]: Create a new versioned repo-scoped GateKeep rule pack.

### Commerce (121)

Storefront catalog, products, variants, inventory, and Amazon product resolution.

- activateProductSet [write] [consent]: Activate a named product set (menu): ONE action that publishes exactly its members to the storefront.
- addProductsToSet [write]: Add products to a named product set (menu), by set id or slug.
- addShopNotificationRecipient [write]: Add an email address to ONE shop's order-notification recipients, optionally subscribed to specific event types (order.paid, refund.issued, payment.failed, payment.disputed, omit eventTypes for all).
- applyPackageUpdate [write]: Take the newer version of an Exchange listing onto the member's own copy of it: same app, same slug, same links, new contents.
- archiveProduct [write] [consent]: Archive ONE catalog product: the SAFE way to retire an item.
- attachModifierGroup [write] [consent]: Attach a modifier group to a product, or narrow it to ONE variant (e.g.
- attachPaymentLinkToEntry [write]: Attach an existing payment link to one shop entry so the entry can show deposit, paid, and balance state.
- authorModifierGroup [write]: Author a reusable modifier GROUP and its full choice set in one call: the structured model behind "pick one color", "choose accessories", and "add gift wrap".
- authorProductOptions [write]: Author a product's FULL option matrix in one call: its option GROUPS (e.g.
- bindSpacePaymentAccount [write] [consent]: Bind a personal Stripe Connect account to a Space so Offers charge through it (e.g.
- bindStorefrontOwner [write] [consent]: Scope a Studio app's storefront to ONE brand (Space) so it serves only that brand's products: the fix for a multi-brand account whose storefront shows every brand at once.
- browseExchange [read]: Browse The Exchange, the public catalog of apps, pages, skills, workflows, projects and Spaces, the same way a person browses the storefront.
- buyListing [write] [consent]: Price a paid Exchange listing for the member and hand back the checkout link they open to pay.
- cancelApprovedOrder [write] [destructive]: Call off an order the user approved.
- cancelRecurringPaymentLink [write] [consent]: Stop a repeating invoice so no further ones are raised.
- checkShopSender [write]: Re-check whether a shop's sending domain has verified (SPF/DKIM), and report the current state plus the DNS records still expected.
- clearTaxRate [write]: Remove a tax answer so it reads as UNSET again.
- commerceConfirmCart [read]: Render the inline Amazon order-confirmation card for one product the user chose.
- commerceFindItem [read]: Find Amazon products for an 'order this' / 'add this to cart' intent.
- createAddOn [write]: Attach ONE add-on (modifier) to a product: e.g.
- createCoupon [write]: Mint ONE discount code for a shop.
- createInvoice [write] [external]: Create and finalize one shop invoice from a reviewed preview.
- createLocation [write]: Create a shop's fulfillment location: the pickup/fulfillment anchor an order joins to.
- createOffer [write]: Create a Space Offer as a PRIVATE draft (never auto-publishes).
- createPaymentLink [write]: Create one Cloud-hosted payment link with library products, manual lines, an optional deposit, and an email, phone, or saved client.
- createProductSet [write]: Create a NAMED product set (a menu) in a Studio app's catalog: a stable, ordered list of products a merchant can activate as a unit.
- createRecurringPaymentLink [write] [consent] [external]: Put a payment request on a repeat: the same lines, client and terms billed every N days, weeks, months or years until cancelled, or for a set number of invoices, or up to an end date.
- createVariant [write]: Add ONE variation to a product: e.g.
- deactivateCoupon [write]: Stop a coupon being redeemed.
- deactivateProductSet [write] [consent]: Deactivate a named product set (menu): sends exactly its members back to draft, pulling that menu off the storefront while every product row, price, and history survives.
- deleteAddOn [write] [destructive]: Remove ONE add-on (modifier) from a product.
- deletePaymentLink [write] [destructive] [consent]: Soft-delete a payment link so it stops accepting payment while its payment history remains.
- deleteProduct [write] [destructive] [consent]: Request PERMANENT deletion of ONE catalog product and its variants/add-ons.
- deleteVariant [write] [destructive]: Remove ONE variation from a product.
- detachModifierGroup [write]: Detach one modifier-group attachment from a product or variant without deleting the reusable group.
- discoverForMe [read]: Given what the member is working on right now, return Exchange listings across every kind that would help, each with the REASON it was suggested.
- getCartSettings [read]: Read how a shop's checkout works: what it collects, which payment methods it accepts, whether buyers pay on the shop's own page or on the hosted payment page, its sales-tax rate, and whether it asks…
- getGoLiveReadiness [read]: Answer "what still stands between this shop and taking real money from real customers" in one call.
- getInvoiceEmailSettings [read]: Read a shop's CUSTOMER invoice email settings: whether the branded lifecycle emails are on, which kinds send (invoice.sent, invoice.reminder, invoice.payment_received, invoice.paid), the reminder…
- getOffer [read]: Get one Offer by id: pricing, publish state, Stripe sync ids, whether the Space payment account is ready, and the public checkout link.
- getProductConfiguration [read]: Read a product's EFFECTIVE configuration: every modifier group that applies (with any variant narrowing), its owner-authored title, choices after exclusions and overrides, defaults, exclusivity,…
- getProductRelations [read]: Read ONE product's full structure: its variations (each with an absolute price) and its add-ons / modifier lists (each with a signed price delta, owner-authored group name, and single/multiple…
- getShopNotificationSettings [read]: Read ONE shop's order-notification settings: whether money-event emails are on, the additional recipients and which event types each hears (order.paid, refund.issued, payment.failed,…
- getShopRailsReadiness [read]: Answer "can this shop sell a gift card and bill an invoice yet, and if not what is the next thing to do about it" in one call.
- getShopRules [read]: Read a shop's house rules: zero-inventory behavior, fallback lead time, ordered category or name-pattern lead-time rules, low-stock floor, automatically attached modifier groups, and the default…
- getStorefrontState [read]: Diagnose a Studio app's storefront: the owner the product embed resolves to, the catalog's product count broken down by publish state (draft / active / archived / storefront-published), and a…
- getTaxSettings [read]: Read what a shop charges in sales tax: the online shop's own rate, and every pickup location's rate with where that answer comes from.
- importProductsFromTable [write]: Promote a Cloud Table into real commerce products for a Studio app in one step: the connector-independent path to a live catalog.
- installPackage [write]: Deliver an Exchange listing the member is entitled to: an app is cloned into their Studio as their own copy, a page pack lands in one Space, a skill is equipped in one Space and no other, and a verb…
- issueGiftCard [write]: Issue ONE gift card directly, with no order behind it: the counter sale.
- listCoupons [read]: List a shop's discount codes and what each one is worth: code, flat or percent value, any minimum cart, window, redemption limits and how many times it has actually been redeemed (settled payments…
- listGiftCards [read]: List the gift cards a shop has issued and its exact redeemable liability per currency, which is what is left on its ACTIVE cards.
- listInvoices [read]: List a shop's invoices with customer, total, due date, payment link, and truthful payment state.
- listLocations [read]: List a shop's fulfillment locations: every location under the app's owner with its full stored shape: name, address, timezone, weekly availability (pickup slots in minutes-from-midnight local time),…
- listModifierGroups [read]: List the reusable modifier-group library for a Studio app, including every choice, stable ID, price delta, availability, default, and exclusivity rule.
- listMyEntitlements [read]: What the member can access: Exchange listings plus paid or owner-granted placed pages, profiles and files.
- listOffers [read]: List Offers owned by a Space (including private drafts).
- listPaymentLinks [read]: List a shop's payment links with customer, payment status, amount paid, balance, and Cloud URL.
- listPayments [read]: Answer "did I get paid?" from The Cloud's settled-charge ledger: every payment that actually settled to the caller or a Space they manage: offer/membership subscription cycles,…
- listPortalMembers [read]: List the members of a brand's member portal: the people who signed in or created an account on the brand's own site, with how many orders they have placed with that brand, what they have spent, and…
- listProducts [read]: List the products a Studio app's STOREFRONT SERVES, with each item's publish state (draft / active / archived / published / hidden), effective storefront price, currency, and SHIPS (whether each…
- listProductSets [read]: List a Studio app's named product sets (menus) with each set's slug, member count, always-on pin, and status.
- listRecurringPaymentLinks [read]: List a shop's repeating invoices with their cadence, when the next one goes out, how many have been sent, and how the run ends.
- listSpacePaymentAccounts [read]: List the caller's personal Stripe Connect accounts AND, when a Space is given, the accounts that Space actually charges through: the picker for "use Teka Stripe on ENOK" and the answer to "what does…
- listTemplatePackage [write] [consent]: Put an APPROVED listing of the member's on sale in The Exchange, which makes it publicly buyable.
- moveProductsToSpace [write] [consent]: File one or more catalog products under a brand (Space) so a Space-bound storefront serves only that brand and publish-all scoped to it never sweeps a sibling: the fix for a multi-brand account…
- moveShopToSpace [write] [consent]: Move a LEGACY shop onto the Space it lives in, so it charges to that Space's Stripe account instead of a person's: the self-serve repair for "checkout pays the wrong business".
- placeApprovedOrder [write] [destructive] [external]: Place an order the user has ALREADY approved, by driving their own machine through the merchant's checkout in a session opened for this order alone.
- placeConfiguredOrder [write] [consent]: Place a real order for a CONFIGURED product on a Cloud shop: a builder cake, a made-to-spec item: by handing over the configuration itself: which product, which variant, which option choices, any…
- previewInvoice [read]: Preview the exact customer, lines, currency, total, due date, and memo for a shop invoice.
- provisionPortalMember [write] [consent]: Admit someone to an app's member portal by email, and state what they hold.
- publishAllProducts [write] [consent]: Publish EVERY draft product in a Studio app's catalog to the storefront in one call: the "go live" verb for a freshly migrated catalog where every item landed as draft.
- publishProduct [write] [consent]: Publish ONE catalog product to a Studio app's storefront: flips it from draft (or archived) to active so the product embed serves it.
- publishProducts [write] [consent]: Publish MANY catalog products to a Studio app's storefront in ONE call: pass the list of product IDs to take live together.
- readCloudNumberRegistration [read]: Read Cloud Numbers 10DLC registration status only.
- readListing [read]: Open ONE Exchange listing: its description, its version and changelog, the submission gates a reviewer passed it on, how many people installed it, and whether the member already owns a copy (and…
- readOrderExecution [read]: Say where one order stands, in one word.
- readPurchaseApproval [read]: Read what the user did about an order you asked them to approve.
- readPurchaseReceipts [read]: Read settled wallet purchase receipts from the append-only ledger.
- readSpendPolicy [read]: Read the spending limits the user has put on their wallet for agents: whether agent spending is on at all, which currency the limits bound, the most you may spend on one order, the most across a…
- removeProductsFromSet [write]: Remove products from a named product set (menu), by set id or slug.
- removeShopNotificationRecipient [write]: Remove an email address from ONE shop's order-notification recipients.
- requestPurchaseApproval [write]: Show the user one exact order and ask them to approve it.
- researchPurchase [read]: Research one purchase brief from need to quote.
- revokePortalMember [write] [destructive]: Revoke one person's access to a brand's member portal.
- searchCloudNumbers [read] [external]: Search live carrier availability for a Cloud Number by three digit area code, returning the numbers that can be bought right now and what each can carry.
- sendInvoice [write] [destructive] [consent] [external]: Stage or send one invoice email.
- sendPaymentLink [write] [destructive] [consent] [external]: Send a payment link by email or text.
- setCartSettings [write]: Change how a shop's checkout works: update phone and notes collection, choose accepted payment methods, choose the checkout page, set the shop's sales-tax rate, and switch the checkout tip row on or…
- setIncludedItemsPolicy [write]: Set the "first N included, then X each" pricing policy on a modifier group.
- setInventory [write]: Set the on-hand inventory count on a product (turns inventory tracking on) or on one variant.
- setInvoiceEmailSettings [write]: Change a shop's CUSTOMER invoice emails, the branded lifecycle mail a buyer receives.
- setNoTax [write]: Record that a shop or one of its pickup locations charges NO sales tax.
- setOfferVisibility [write] [consent]: Set an Offer public (listed + buyable) or private (hidden).
- setOptionExclusions [write]: Exclude specific option CHOICES from ONE product, or restore them: without editing the shared modifier group every other product reads.
- setOrderChipColors [write]: Change one order Status or Stage color for a shop.
- setProductSetAlwaysOn [write]: Pin (or unpin) a product set always-on.
- setProductsShipping [write]: Answer the SHIPS question for MANY catalog products in ONE call: pass the product IDs and ships:true or ships:false.
- setShopNotifications [write]: Turn ONE shop's order-notification emails on or off and/or set the per-hour cap.
- setShopRules [write]: Set a shop's house rules.
- setShopSender [write]: Register the address a shop sends receipts, form auto-replies, and form notifications from, and get back the SPF/DKIM DNS records to publish for its domain.
- setSpendPolicy [write] [consent]: Ask to change the spending limits on the user's wallet.
- setTaxRate [write]: Set the sales-tax rate a shop charges, either for the ONLINE SHOP (omit `location`) or for ONE pickup location (name it in `location`, which overrides the shop for orders fulfilled there).
- setupGiftCardRail [write]: Set a shop up to sell gift cards, in one call: find or create its gift card product, then say which amounts it sells and whether a buyer may name their own.
- startCloudNumberCheckout [write] [consent] [external]: Open a Stripe Checkout link to buy one Cloud Number on a plan, monthly or annual.
- submitTemplatePackage [write]: Submit one of the member's OWN Studio apps to The Exchange as a listing, which freezes a snapshot of it and sends that snapshot to review.
- suggestAmazonProducts [read]: Suggest Amazon products in chat as affiliate-tagged shopping cards so the user can buy and commission flows to Teka on the resulting cart.
- syncCheckoutBranding [write] [external]: Re-run the hosted checkout branding sync for a shop.
- unpublishAllExcept [write] [consent]: Keep ONLY the named products live and send every other live product back to draft: the inverse of publishAllProducts, and the verb behind "deactivate everything that is not on the forever menu, but…
- unpublishProduct [write] [consent]: Unpublish ONE catalog product from a Studio app's storefront: flips it from active back to draft, pulling it off the storefront while keeping the product row intact.
- unpublishProducts [write] [consent]: Unpublish MANY catalog products from a Studio app's storefront in ONE call: pass the list of product IDs to pull off the storefront together.
- updateAddOn [write]: Edit ONE add-on (modifier) in place: name, price delta, required flag, availability, order, or its group (modifierListName / selectionType).
- updateCoupon [write]: Change what an existing coupon is worth or who may redeem it: value, minimum cart, window, redemption limits, or status (active / paused / archived).
- updateLocation [write]: Edit ONE fulfillment location in place: rename it, set pickup hours (weekly availability: per-weekday slots in minutes-from-midnight LOCAL time, e.g.
- updateOffer [write]: Update an Offer's name, description, or pricing.
- updatePortalMemberEntitlements [write] [consent]: Replace what one existing portal member can reach.
- updateProduct [write]: Edit ONE catalog product in place: name, description, base price (in minor units, e.g.
- updateRecurringPaymentLink [write]: Change a repeating invoice: its cadence, how the run ends, the payment window, or the memo.
- updateVariant [write]: Edit ONE product variant (a price tier / SKU) in place: name, price (minor units), SKU, and availability.
- vetTemplatePackage [write]: Vet a submitted Exchange listing and record the decision: approve it or reject it.
- voidGiftCard [write] [destructive]: Void ONE gift card: the remaining balance immediately stops being spendable, and whoever is holding the card cannot use it.

### Profiles (7)

Public profile pages, link and text blocks, and visibility.

- createProfileLinkBlock [write]: Create a link block on a Profile page: one link rendered as a rich preview tile.
- createProfilePage [write]: Create a Page on a Profile: a bento-grid layout of visual tiles.
- createProfileTextBlock [write]: Create a rich-text block on a Profile page: bio text, headings, or descriptive content.
- fetchProfileLinkMetadata [read] [external]: Fetch rich metadata for a URL: title, description, favicon, thumbnail, and platform data from YouTube, Instagram, Spotify, Pinterest, GitHub, LinkedIn, TikTok, or any OpenGraph site.
- listProfiles [read]: List the user's Profiles: public-facing profile surfaces, separate from private Spaces.
- setProfileVisibility [write] [consent]: Request a Profile visibility change (public ↔ private).
- updateProfile [write]: Update a Profile's display name, bio, and slug: identity and content only.

### Apps & Assets (4)

The workspace app launcher plus brand-mark and character-asset lookup.

- fetchBrandMark [read] [external]: Fetch a vendor's REAL brand mark from their own site: favicon / .well-known / brand assets: as an SVG with recorded provenance, never a drawn one.
- fetchDigiAsset [write]: Materialize an exact Digi: one of The Cloud's character sprites: into a Studio app's assets as a transparent SVG at assets/digis/<digiId>.svg, ready to reference from the app's markup (e.g.
- listApps [read]: List the apps available in The Cloud.
- listDigiLibrary [read]: List the addressable Digis: The Cloud's exact character sprites (Ora, the Alpaca, and the agent archetypes like Scout / Guide / Oracle).

### Import & Migration (3)

Bring an existing Notion workspace into The Cloud.

- getNotionImportStatus [read]: Check the progress of a background Notion import started by importFromNotion.
- importFromNotion [write] [external]: Migrate the Notion pages/databases shared with The Cloud into Pages.
- listNotionPages [read] [external]: Preview the Notion pages and databases your connected Notion workspace shared with The Cloud: before importing.

### Governance & Consent (13)

The consent floor as tools: record and revoke consent, mint and revoke scoped access, and read the telemetry ledger.

- catchUpOnGovernance [read]: Catch up on what has changed in the rules you work under, without re-reading any of them.
- hardenRule [write]: Persist a rule in the owner's scope.
- listCuratedRooms [read]: List the curated outbound Waiting Rooms you have minted: the raise pipeline.
- listStaleCuratedRooms [read]: List your STALE Waiting Room grants: the union of two labeled sets: reason "pre_relabel" (bare curated_room grants never claimed, curated, or labeled: the pre-relabel board noise) and reason…
- listStandingConsent [read]: List the standing permissions the user has given you: the action classes you may carry out immediately, with no approval card, because they tapped "Always allow" on one.
- listTelemetryLedger [read]: List your Telemetry Ledger: the append-only, owner-visible record of everything that left your custody (when, source, destination, purpose, scope, trigger).
- mintCuratedRoom [write]: Mint a curated outbound Waiting Room for one recipient: the room IS the artifact you send.
- readPulses [read]: Read your recent pulses: when each ran, what the session was focused on, which hard rules it caught being broken and what each lookout found.
- recordChange [write]: Record one row in the Changes feed.
- recordConsent [write]: Record consent to email a contact (or a whole filtered set) under a scope: the action that makes a contact sendable.
- revokeConsent [write]: Revoke a previously recorded consent scope from a contact (or a whole filtered set): the inverse of recordConsent.
- revokeCuratedRoom [write] [destructive]: Revoke ONE Waiting Room grant you own: close a live door.
- selfRegenerate [read]: The pulse supporting the Charter's self-regeneration operating rule.

### Contribution Ledger (9)

Append-only provenance + credits accounting: register signed contributions against artifacts, walk their lineage, and read the credits they earned.

- getContribution [read]: Read one contribution record by id: contributor, signature, artifact, and license grant.
- getCreditBalance [read]: Read your credit balance: the total plus a breakdown by event type (usage, bounty, learning).
- getLineage [read]: Walk a contribution's lineage: its full ancestry (what it derived from) and descendants (what derived from it).
- listContributions [read]: List contributions by member or by artifact.
- listCreditEvents [read]: List the credit events a contribution earned (usage, bounty, or learning), with amounts and their source references.
- listMyReports [read]: List the bug and feature requests THIS user has filed with Teka, newest first, with where each one has reached.
- lookupCrash [read]: Read the crash a reference code stands for - the error, the route, the app, the browser and when it happened.
- registerContribution [write]: Record an append-only contribution: a signed provenance record attaching a member to an artifact (a page, memory, table, studio app, or a skill/agent/template asset), with a license grant and…
- reportBug [write] [consent]: File a bug or a fix request to Teka, through the one secure route: it lands as a tracked request the user can follow, as an interaction and a task on Teka's side, and as an email to Teka's help desk…

### Workspace Admin (20)

Account provisioning, invites, signup approval, and staged account content.

- approveSignup [write]: Admit a pending applicant into The Cloud: the consent-gated owner action that grants full access (unlocks paid compute) for that account.
- createAccountInviteLink [write] [consent]: Mint the ONE-TIME claim link for a staged account: the /waiting-room/<token> URL the prospect opens to adopt the account (which atomically severs the builder).
- declineSignup [write]: Decline a pending applicant: they stay out of The Cloud (no access, no paid compute).
- hardenBranding [write] [external]: Audit The Cloud's outward branding against the one brand kit, and with apply true set what an API allows.
- listGenomes [read]: List the starter genomes: the authorable blueprints a workspace mint instantiates.
- listMaintenanceTasks [read]: List the fixed maintenance jobs this seat can run, with descriptions and idempotency.
- listPendingSignups [read]: List the people waiting in the Gate: every applicant still pending admission (who they are, their email, when they applied, and their linked CRM lead).
- listProvisionedAccounts [read]: List the provisioned accounts roster: every staged account with its lifecycle (staged-unclaimed → adopted, with builder access provably severed at adoption), active operator grants, and each…
- provisionAccount [write] [consent]: Stage a PROVISIONED ACCOUNT for a prospect: a real account built for them before they ever sign in.
- readGenome [read]: Read one genome in full: its versioned slot grammar: which surfaces carry the recipient's brand (identity), which Spaces/pages get created (substance), which systems get armed (booking / form /…
- reconcilePlanForUser [write]: Repair one account's plan against Stripe, and say what changed.
- revokeAccountInvite [write] [consent]: Revoke ONE pending claim-link invite for a staged account: the link immediately stops resolving and can never claim.
- revokeProvisionedAccess [write] [consent]: Kill EVERY door into a staged account: revokes all active operator grants (each grant's minted operator key dies with it) and all pending claim-link invites, in one call.
- runMaintenance [write] [consent]: Run one fixed, allowlisted one-shot repair without using the Convex dashboard.
- sendAccountInvite [write] [destructive] [consent] [external]: Email a staged account's claim link to its prospect: a REAL external send that cannot be unsent, so confirm per action like sendEmail.
- setClaimPreview [write] [consent]: Set the CLAIM-LANDING curated preview for a staged account: the headline and optional lead the prospect sees on the /waiting-room page before they take over.
- stageAccountContent [write] [consent]: Register PREPPED CONTENT into a staged account's package manifest: how you prep a Space for someone.
- stageMemorySeed [write] [consent]: Seed Ora's memory for a staged account: the greeting Ora authors live on the recipient's first open.
- verifyMint [write]: Run the WTF QUALITY GATE on a staged mint: the anti-slop block.
- waitlistSignup [write]: Waitlist a pending applicant: hold them off the active queue without a decision either way (still no access, no paid compute).

### Whop (3)

The connected Whop account through the generalized credential vault: connection status, allowlisted reads (memberships, companies, plans), and confirm-gated writes under the hardened read-allowlist doctrine.

- whopConnectionStatus [read]: Check whether the user has connected their Whop account and read the connection health (masked key prefix, method, last used).
- whopReadResource [read] [external]: Read a Whop resource: memberships, companies, plans, access passes, and other read endpoints.
- whopWriteResource [write] [external]: Write to a Whop resource: create/update/cancel memberships, plans, and any mutating endpoint.

## Pricing

- Personal: free: 100 AI credits/month, 100MB storage, 5 spaces, 5 task lists, 100 pages, Page publishing.
- Pro: $40/month or $400/year: 2,500 AI credits/month, 10GB storage, Unlimited spaces, 25 task lists, Unlimited pages, 3 custom domains, Page publishing.
- Max: $200/month or $2,000/year: 10,000 AI credits/month, 50GB storage, Unlimited spaces, Unlimited task lists, Unlimited pages, Unlimited custom domains, Page publishing, Priority support.
- Enterprise: custom pricing: Custom AI credits, Custom storage, Unlimited spaces, task lists, pages, and custom domains, SSO & SAML, Audit logs, Dedicated support.

## Limits

- AI Credits: Personal 100/mo · Pro 2,500/mo · Max 10,000/mo · Enterprise Custom
- Storage: Personal 100MB · Pro 10GB · Max 50GB · Enterprise Custom
- Spaces: Personal 5 · Pro Unlimited · Max Unlimited · Enterprise Unlimited
- Task Lists: Personal 5 · Pro 25 · Max Unlimited · Enterprise Unlimited
- Pages: Personal 100 · Pro Unlimited · Max Unlimited · Enterprise Unlimited
- Custom Domains: Personal Not included · Pro 3 · Max Unlimited · Enterprise Unlimited
- Page Publishing: Personal Yes · Pro Yes · Max Yes · Enterprise Yes
- SSO & SAML: Personal Not included · Pro Not included · Max Not included · Enterprise Yes
- Audit Logs: Personal Not included · Pro Not included · Max Not included · Enterprise Yes
- Support: Personal Email · Pro Email · Max Priority · Enterprise Dedicated

MCP key-authentication attempts are throttled to 10 per minute per origin; over budget returns a clean 401.

Current pricing page: https://www.thecloud.so/pricing

## What we claim

- OpenOS™ by Teka LLC: OpenOS™ is Teka LLC's unregistered mark for the AI-native workspace and related software services provided through The Cloud (thecloud.so). (https://www.thecloud.so/openos)
- An always-on agent environment: The Cloud (thecloud.so) is an always-on environment where your AI keeps working when your laptop closes. (https://www.thecloud.so/machinesync)
- First-class MCP infrastructure: The Cloud (thecloud.so) is both an MCP server, where any AI reads your memory and acts in your workspace with consent, and an MCP client, where your workspace consumes Linear, GitHub, Vercel, and more. (https://www.thecloud.so/connect)

## Support

Questions an agent cannot answer from this file: team@thecloud.so
Provenance: Ora BUILDER · gpt-5.6-sol · MachineSync