This is a duplicate of the actual entry deprecating this in favor of the original.
Set up human approval for your AI agents' tool calls.
Scored across 84 tools
The tools are systematically named and mostly target distinct resources, but several clusters create real selection risk: list_tool_catalog vs list_tool_definitions vs list_gateway_server_tools, get_X vs get_X_revision, and archive vs deactivate vs update vs activate. Descriptions resolve most cases, but with 84 tools an agent must read carefully to avoid misselection.
Tool names consistently use snake_case verb_noun patterns: create_*, get_*, list_*, update_*, archive_*, activate_*, revoke_*, set_*, and so on. Minor deviations like save_webhook_endpoint and read_reference are still readable and predictable.
84 tools is an extreme surface for an MCP server, even one covering a broad platform. The large number of near-sibling operations across agents, pipelines, gateway servers, escalation paths, webhooks, teams, audit, and permissions creates high discovery and selection cost; this is well beyond a well-scoped 3-15 tool surface.
Lifecycle coverage is unusually strong across pipelines, agents, gateway servers, escalation paths, webhook endpoints, and teams, including revisions, archive/restore, previews, and dependency blocking. There are still notable gaps such as no visible approval-request listing/decision tools and no member invitation or role/permission assignment operations, though some are intentionally app-managed.
Make an existing escalation path revision the active one (a rollback, or activating a draft).
Inputs: path_key (required), revision (required).
Make an existing gateway server revision the active one (a rollback, activating a draft, or serving a deactivated server again). The gateway serves it from its next configuration poll; scopes the revision leaves out are retired and their credentials dropped.
Inputs: revision (required), server_slug (required).
Make an existing pipeline revision the active one (a rollback, or activating a draft). New requests use it immediately; requests already in flight keep the revision they started on.
Inputs: revision (required), pipeline_key (required).
Make an existing team escalation policy revision the active one (a rollback, or activating a draft). Refused when it names someone who has since left the team. Requests already routed keep the revision they pinned.
Inputs: team_id (required), revision (required).
Make an existing webhook endpoint revision the active one (a rollback, activating a draft, or bringing an archived endpoint back). Webhook blocks post to the active revision's URL from their next delivery on.
Inputs: revision (required), endpoint_key (required).
Archive an agent: every live credential and provisioner token is revoked for good, no instance can be enrolled under it, and its name is freed while its slug stays taken. Instances and history stay readable. restore_agent brings the agent back, but revoked credentials stay revoked.
Inputs: agent_slug (required).
Archive an escalation path for good: it stops being active, refuses new revisions, and keeps its key and history. Refused while any active pipeline revision names it (list_escalation_path_uses names them); update those pipelines first.
Inputs: path_key (required).
Archive a gateway server for good: it is never served again, takes no new revisions and its slug cannot be reused, and every stored credential (the organization's and every member's) is dropped. Its history stays readable. To pause a server instead, use deactivate_gateway_server.
Inputs: server_slug (required).
Archive a pipeline: its revisions stay readable but none is active, its key is taken for good, and no request can reach it. Refused for the entry pipeline and while any active revision still delegates to it (list_pipeline_uses names them; remove those delegate blocks first).
Inputs: pipeline_key (required).
Archive a team: it leaves routing, its own and team-scoped grants are revoked and its escalation policy is deactivated; its roster and history stay readable and its name can be reused. Refused while an active escalation path or a pending request targets it, and for a team your directory manages. Requires a personal API key.
Inputs: team_id (required).
Deactivate a team's escalation policy, so a path level targeting the team reaches every member at once again. Its revisions stay and can be activated later.
Inputs: team_id (required).
Archive a webhook endpoint by deactivating its active revision. Its history and signing secret are kept, and activate_webhook_endpoint_revision brings it back. Refused while an active pipeline revision posts to it (list_webhook_endpoint_uses names them).
Inputs: endpoint_key (required).
Create an agent. Nothing reaches it until a runtime is connected: with the withhuman CLI on the machine the agent runs on, or with create_agent_instance or create_provisioner_token for a service you run. Every request it makes starts in the entry pipeline; give it rules with a branch on /agent/slug there, or a delegate to a pipeline of its own.
Inputs: name (required), slug (required), kind.
Register an instance of a service agent and mint its credential, for a runtime the withhuman CLI does not install (a service of yours speaking the Agent Approval Protocol). The answer carries the credential exactly once: hand it to whoever configures that runtime, because it cannot be read back. Personal agents' instances belong to the member who enrolls them through the CLI.
Inputs: name (required), agent_slug (required), metadata.
Create an escalation path with its first revision and activate it (unless activate is false). A path says who reviews a request the pipeline hands to a person: level nodes page targets (user targets by membership id, team targets by team id) and wait escalate_after before the next level; if_else nodes branch on urgency, working hours or the request itself; defer nodes hold the request until working hours. Call read_reference (escalation_paths) first. The key is permanent: pipelines name it, and it stays taken even after archiving.
Inputs: name (required), nodes (required), path_key (required), repeat, +2 more.
Register an MCP server on the gateway with its first revision and activate it unless activate is false. Agents reach its tools as __, but only the tools set_agent_tool_access grants them, and every call still goes through the approval pipelines. Store an organization-held scope's credential afterwards with set_gateway_scope_headers; an OAuth scope is connected by a person in the app, and a member-held scope by each member on their Connections page.
Inputs: name (required), scopes (required), server_slug (required), url, +2 more.
Create a pipeline that a delegate block in another pipeline can hand matching requests to, with its first revision active at once. Use it to give one team its own part of the approval flow: the entry pipeline decides which requests reach it, the new pipeline decides what happens to them. A person then grants the team pipeline.read, pipeline.write and pipeline.activate at pipeline: in the app so they can edit it and nothing else.
Inputs: name (required), pipeline_key (required), blocks, default_escalation_path.
Create a provisioner token for a service agent, which lets a fleet or platform create instances of the agent on its own, each with a credential of its own, through the Agent Approval Protocol. It cannot make approval requests itself. The answer carries the token exactly once: hand it to whoever runs the platform, because it cannot be read back.
Inputs: agent_slug (required).
Create a team, optionally with its first members. Teams are escalation targets: a level that names a team reaches every current member, or runs the team's escalation policy when it has one. Requires a personal API key; organization keys cannot manage teams.
Inputs: name (required), membership_ids.
Stop serving a gateway server by deactivating its active revision. Its history and stored credentials are kept; activate_gateway_server_revision serves it again.
Inputs: server_slug (required).
Remove every credential the organization stores for one organization-held scope (its headers, or its OAuth token and client registration). Calls with the scope fail until it is connected again; the server and its revisions stay.
Inputs: scope (required), server_slug (required).
Read one agent: its kind and status, a page of its instances (id, name, owner, status, liveness, credentials) and a page of its provisioner tokens. Instance and token ids are what update_agent_instance, revoke_agent_credential and revoke_provisioner_token take.
Inputs: agent_slug (required), instance_q, instance_offset, instance_status, +2 more.
Read one audit event by id with its full data.
Inputs: event_id (required).
Read an escalation path's active revision: its nodes, working hours, repeat setting and warnings. Not found when the path has no active revision; use list_escalation_path_revisions then.
Inputs: path_key (required).
Read one escalation path revision, active or not, with its nodes and warnings.
Inputs: path_key (required), revision (required).
Read a gateway server's active revision: the configuration the gateway serves. Not found when no revision is active; use list_gateway_server_revisions then.
Inputs: server_slug (required).
Read one gateway server revision, active or not.
Inputs: revision (required), server_slug (required).
Read a pipeline's active revision with its blocks in order and its default escalation path. Blocks come back in the shape update_pipeline accepts, so you can edit and resubmit them.
Inputs: pipeline_key (required).
Read one pipeline revision, active or not, with its blocks.
Inputs: revision (required), pipeline_key (required).
List everything a pipeline revision names (escalation paths, webhook endpoints, delegated pipelines, an edition's block dependencies) with each one's state: what stands in the way of activating it.
Inputs: revision (required), pipeline_key (required).
Tell one approval request's story from its audit events: the pipeline's conclusion and the block that asked for a person, every AI judge assessment, the escalation steps and the claim history. Needs only request.read on the request, not audit.read.
Inputs: request_id (required).
Read a team's active escalation policy: how a level targeting the team pages its members, with warnings for targets who have left. Not found when no policy is active; such a level then reaches every member at once.
Inputs: team_id (required).
Read one team escalation policy revision, active or not, with warnings for targets who have since left the team.
Inputs: team_id (required), revision (required).
Read one tool catalogue entry with its full input schema and description.
Inputs: id (required), agent_slug.
Read a webhook endpoint's active revision: name and URL. The signing secret is never returned here; it is shown once when the endpoint is created or its secret rotated.
Inputs: endpoint_key (required).
Read one webhook endpoint revision, active or not.
Inputs: revision (required), endpoint_key (required).
List the organization's agents: slug (what pipelines and conditions refer to), name, kind, status, and recent request counts.
Inputs: status.
List an agent's grants on gateway servers: per server, the mode (none, selected or all), the tools and scopes granted, and the revision set_agent_tool_access needs. Every instance of the agent inherits them.
Inputs: agent_slug (required).
Search the organization's audit log, newest first by default: who did what to which subject and how it ended, every approval decision, pipeline outcome, configuration change and API key action included. Filters combine; page with next_cursor. total_count is how many events match.
Inputs: q, sort, limit, order, +9 more.
List the event types this organization's audit log holds, the vocabulary for list_audit_events' event_types filter.
List an escalation path's revisions, newest first, with which one is active.
Inputs: path_key (required).
List escalation paths with their key, name, active revision and latest revision.
Inputs: status.
List the active pipeline revisions that name this path, as a block's path or as the default: what stands in the way of archiving it.
Inputs: path_key (required).
List a gateway server's revisions, newest first, with which one is active. Use it to find a revision to roll back to.
Inputs: server_slug (required), cursor.
List the MCP servers the organization registered on the MCP Gateway: slug, name, URL or tunnel, active revision, each scope (named credential) with whether its credential is stored and any warnings about its OAuth grant. Secret values are never returned.
Inputs: status.
List the tools a gateway server's downstream advertises, by their own names, as the gateway last listed them: the union, and per scope the tools that scope's credential lists, or why it could not. A scope marked refreshing is being listed again in the background (never listed, changed, or an hour old): call again shortly for the new listing. Use the names for set_agent_tool_access and pipeline conditions. Requires a personal API key.
Inputs: server_slug (required).
List the tunnels the organization runs in its own network, with their live connections and the entries they serve: the tunnel_id and tunnel_entry values a server reached through a tunnel names.
Inputs: status.
List the permission policies granted directly to one member: each policy's permissions, the scope they apply at and its revision. Grants the member inherits from teams are on list_team_permission_policies. Requires a personal API key.
Inputs: membership_id (required).
List the organization's members with the membership id (the id an escalation path's user target carries), display name, email, status, roles and team ids.
List every permission key this deployment knows, with what it allows, who can hold it, the kind of resource it applies to and whether it is dangerous. Use it to tell a person which grant to make, for example pipeline.write at pipeline: for a team that owns a delegated pipeline. Requires a personal API key that can read permission policies.
List a pipeline's revisions, newest first, with which one is active. Use it to find a revision to roll back to.
Inputs: pipeline_key (required).
List every approval pipeline: the entry pipeline every request starts in, then every pipeline a delegate block can hand requests to, each with its key, name, active revision number, the delegate blocks that hand requests to it, and history.
Inputs: status.
List the delegate blocks in active pipeline revisions that hand requests to this pipeline: what stands in the way of archiving it.
Inputs: pipeline_key (required).
List the predefined roles (owner, admin, reviewer, auditor) with the permissions each grants. Assigning roles and permission policies is done by a person in the app. Requires a personal API key.
List a team's escalation policy revisions, newest first, with which one is active.
Inputs: team_id (required).
List the permission policies a team holds, which every member inherits live: each policy's permissions, scope and revision. Requires a personal API key.
Inputs: team_id (required).
List teams with their id (what an escalation path's team target carries), name, member count and whether an escalation policy is active.
Inputs: status.
List the tools agents have reported or can reach, one entry per tool and source, with its schema, the instances offering it and whether its source is available. Use it to learn the exact tool names and argument fields pipeline conditions test. The catalogue is advisory: it never changes how a request is decided.
Inputs: q, offset, source, status, +2 more.
List every distinct tool definition across agents in one answer (name, server, schema and description, with the runtimes and instances offering it): the vocabulary to write pipeline conditions against.
List a webhook endpoint's revisions, newest first, with which one is active. Use it to find a revision to roll back to.
Inputs: endpoint_key (required).
List webhook endpoints (the URLs a pipeline's webhook block can ask for an outcome) with their key, active revision, and which pipelines use them.
List the active pipeline revisions whose webhook blocks post to this endpoint: what stands in the way of archiving it.
Inputs: endpoint_key (required).
Run a sample request through a set of blocks and report the outcome (approve, deny, human, or next), which block decided, its reason, and the escalation path a human exit would take. Each step lists a block the request reached, with the pipeline it belongs to; a branch or delegate reports enter or next for its condition, and end_of_branch when the request ran out of its blocks (for a delegate, out of the target pipeline). Delegate blocks expand to their targets' current active revisions, so the preview walks what a request would. Nothing is saved and no approval request is created. webhook blocks and other asynchronous kinds really call the endpoint or the model.
Inputs: blocks (required), sample (required), pipeline_key (required), default_ask_agent_owner, +1 more.
Read the exact grammar for pipeline blocks, conditions, or escalation path and team escalation policy documents. Read the relevant topic before writing one: unknown fields are refused and ids must be UUIDs.
Inputs: topic (required).
Remove a member from the organization for good: their sessions, API keys and agent instances stop working. Refused for your own membership, the last active owner, and members your directory manages. Requires a personal API key.
Inputs: membership_id (required), force.
Rename a team. Escalation paths name teams by id, so nothing else changes. Refused for a team your directory manages. Requires a personal API key.
Inputs: name (required), team_id (required).
Restore an archived agent to active. Credentials and provisioner tokens revoked when it was archived stay revoked; its instances can be enrolled again.
Inputs: agent_slug (required).
Revoke one instance credential for good: the runtime holding it can no longer make requests. To pause an instance instead, disable it with update_agent_instance.
Inputs: credential_id (required).
Revoke a provisioner token for good. Instances it already created keep their own credentials.
Inputs: provisioner_id (required).
Replace a webhook endpoint's signing secret. The old secret stops working at once for every revision, so deliveries fail signature checks until the receiver has the new one. The answer carries the new secret exactly once: relay it to whoever operates the receiving service.
Inputs: endpoint_key (required).
Create a webhook endpoint or save a new revision of one, and activate it unless activate is false. A new key answers with signing_secret exactly once: relay it to whoever operates the receiving service, because it is what verifies withHuman's signature and it cannot be read back. The URL must be public HTTPS.
Inputs: url (required), name (required), endpoint_key (required), activate.
Replace which of a gateway server's tools an agent may call, and with which scopes. Access decides what the agent sees and can call at all; the approval pipelines still decide every call it makes. The agent's next tool listing reflects the change, and calls check live access before they run.
Inputs: mode (required), revision (required), agent_slug (required), server_slug (required), +2 more.
Store the header set an organization-held static_headers scope calls its downstream with, replacing any stored set. Values are sealed at once and never returned by any tool or page; only the gateway reads them. Ask the person for the values rather than inventing them.
Inputs: scope (required), headers (required), server_slug (required).
Store the OAuth client every member signs in with on a member-held oauth scope, for an authorization server that offers no dynamic client registration. The secret is sealed and never returned. Replacing the client keeps members' tokens, though a token issued to the old client may need its member to reconnect.
Inputs: scope (required), client_id (required), server_slug (required), client_secret.
Replace a team's manual member list. Requires a personal API key; organization keys cannot manage teams.
Inputs: team_id (required), membership_ids (required), force.
Send one signed test delivery (type webhook_endpoint.test, flagged as a preview) to a revision's URL and report what came back, waiting up to 10 seconds. It checks the receiver's signature verification too. The test is recorded in the audit log.
Inputs: endpoint_key (required), revision.
Rename an agent or switch it between active and disabled. Disabling refuses every instance's credentials until the agent is active again, without revoking them. The slug never changes.
Inputs: agent_slug (required), name, status.
Rename one instance of an agent or switch it between active and disabled. Disabling refuses the instance's credentials until it is active again, without revoking them.
Inputs: instance_id (required), name, status.
Save a new revision of an existing escalation path (the whole document again, not a diff) and activate it unless activate is false. Pipelines that name the key pick up the active revision for new requests; requests already routed keep the revision they were pinned to.
Inputs: name (required), nodes (required), path_key (required), repeat, +2 more.
Save a new revision of a gateway server (name, URL or tunnel, and the whole scope list again) and activate it unless activate is false. Activating retires every scope the revision leaves out and drops its stored credentials; a retired scope name is refused.
Inputs: name (required), scopes (required), server_slug (required), url, +2 more.
Suspend a member (signs them out everywhere and refuses their sessions, API keys and agents) or reactivate a suspended one. Refused for your own membership, the last active owner, and members your directory manages. Requires a personal API key.
Inputs: status (required), membership_id (required), force.
Save a new revision of a pipeline (the entry pipeline, or one a delegate hands requests to) and activate it (unless activate is false). Blocks run in order and the first to decide wins: outcome blocks decide every request that reaches them, webhook blocks ask a service of yours (and a kind this deployment adds may ask a model), branch blocks run their own blocks only for requests their condition matches (so "if this, then that" is a branch holding an outcome block), and delegate blocks hand matching requests to another pipeline by key; a request that enters a branch or a delegated pipeline is decided inside it or goes to a human, and nothing after the block runs for it. A request no block decides falls through to human review, so end with an outcome block whose outcome is approve when the rest should be automatic. Every escalation path a block or the default names, and every pipeline a delegate names, must exist; activation additionally requires each to be active and refuses a delegation cycle. Call read_reference (pipeline_blocks) first.
Inputs: blocks (required), pipeline_key (required), name, activate, +2 more.
Save a new revision of a team's escalation policy (the whole document again, not a diff) and activate it unless activate is false. The policy orders how members are paged when a path level targets the team: levels name current members as user targets, or broadcast for everyone; every member a request reaches may still decide it. Call read_reference (escalation_paths) first.
Inputs: nodes (required), team_id (required), repeat, activate, +1 more.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Add one secure layer between your agents and this server.