Read the SCF reference catalog (no org): controls, one control with its objectives and evidence, domains, frameworks, assessment objectives, evidence definitions. Pick with method.

Read the organization's control scope: list scoped controls with filters, one control in full, scoping stats, framework scope summary, or preview a framework scope change. Pick with method.

Change the organization's control scope (editor+; some methods admin): update or batch-update controls, scope or unscope a framework, set scope, basis, maturity, materiality or procedure overrides.

Read evidence tracking: list records, one record with its in-scope requiring controls, requiring controls alone, gaps, health, upcoming, frequency health, maturity and upgrade guidance, suggestions.

Create or update evidence tracking records (editor+): create one from a catalog id, upsert one record's tracking fields, or batch-upsert up to 500 in one transaction. Pick with method.

Read an evidence item's files: list them, one file with its download URL, one file's validation result, or the organization's validation summary. Pick with method.

Act on an uploaded evidence file (editor+): approve, reject or request revision; re-run validation; or soft-delete it (destructive). Pick with method.

List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

Manage evidence collection tasks (editor+): create one against a tracking record, update its fields, or mark it completed with notes. Pick with method.

Read AI evidence assessments: a file's verdict, the file summary, review queues, window assessments (list, one, versions, summary), and control composites. Pick with method.

Run and review AI evidence assessments (editor+, async): assess a file or many, assess a window or many, refresh stale windows, confirm or override verdicts, set window acceptance.

Read the risk register: list risks, one risk, the 5x5 matrix, summary, profile, risks for a control, or controls for a risk. Pick with method.

Change the risk register (editor+; accept is admin): create a risk assessment, update one, delete one (destructive), or record or renew a risk acceptance. Pick with method.

Read organization-defined custom risks: list them, or list the controls linked to one. Pick with method.

Manage custom risks (editor+): create, update or delete a risk (destructive); add, update or remove a linked control. Pick with method.

Read third-party risk data: list vendors, one vendor, its research, assessments (list, one, latest, status), certifications, compensating controls, action items. Pick with method.

Manage vendors (editor+): create or update a vendor, trigger AI research, or trigger a DPSIA assessment (async). Pick with method.

Manage a vendor's sub-records (editor+): create, update or delete a certification, a compensating control, or an action item. Deletes are destructive. Pick with method.

Read the systems inventory: list systems, one system, catalog templates, a system's capabilities and recipes, recipe status, org evidence capabilities, systems for an evidence type.

Manage the systems inventory (editor+): create or update a system, declare or update an evidence capability, or generate collection recipes (async). Pick with method.

Read capability themes (KSIs): list themes, one theme, the multi-axis scorecard, per-theme evidence posture, or the controls mapped to a theme. Pick with method.

Read organization data: list organizations, one organization, its settings, members, audit log, change cursor, or the organization work queue. Pick with method.

Update the organization profile and maturity targets (write — admin): business_size, mission_statement, maturity_targets. Partial: only passed fields change.

Read the caller's own view: the current user (the API key's identity), their work queue, or their notifications. Pick with method.

Mark notifications read for the current user (write — self only): one by notification_id, or every notification when all=true. Acknowledge after processing scf_get_notifications.

Load more SCF tool groups into this session (teams, collaboration, documents, engagements, assurance, catalog-reconciliation, webhooks, journey, or all). Returns the tools now available.