Check if TouchDesigner is running and Envoy is reachable. Returns connection state, crash detection, process liveness, and project config. Works even when TD is down. envoy_unresponsive / main_thread_stalled flag a TouchDesigner that is alive but frozen.

Launch TouchDesigner with this session's pinned instance's .toe (unpinned: the registry default's). Use to start TD for the first time or restart after a crash. Waits for Envoy to become reachable before returning.

Quit this session's pinned TouchDesigner gracefully and relaunch its .toe (unpinned: the registry default's). Other TD instances are never touched. Waits for the process to exit before relaunching. Use when TD is running but needs a fresh start.

Switch THIS session's TouchDesigner instance or list all registered instances. Omit the instance parameter to list available instances with their status. Provide an instance name (toe basename) to re-pin this session's bridge to that instance -- other sessions' routing is untouched unless all_sessions=true.

List the modal dialogs a TouchDesigner instance currently shows (ui.messageBox, missing-file and save-changes prompts, the license box, file pickers). Runs on the bridge, so it works while TD's main thread is blocked by the dialog and every Envoy tool is timing out. TD draws its own dialogs, so their text is not readable through the OS: pass screenshot=true to save a PNG of each one and Read it. Returns blocked=true when a dialog is up.

Dismiss a modal dialog that is blocking a TouchDesigner instance, then verify it is gone. Default action=auto runs the ladder close (WM_CLOSE) -> escape -> enter until the window disappears; the main TouchDesigner window is never a target. Use list_dialogs (with screenshot=true) first so you know what you are dismissing: close/escape decline a question, enter accepts its default.

Report this machine's Convoy host presence and, when it is running, its realm, peer, queue, and identity status. This is a host-only read and never wakes TouchDesigner. Explicit convoy_* tools use this host for remote routing; ordinary Envoy tools remain local until convoy_select_node explicitly pins this session to a Convoy node.

Pin this MCP session's ordinary Envoy tool calls to one exact Convoy node. The selection survives peer dropouts and never falls back to local TouchDesigner. Call with no arguments to inspect the selection, or clear=true to restore direct local routing.

Use Convoy's optional, host-private consumer of Owlette's published API for site/machine inventory, online detail, and command status. Command submission requires a separate local host opt-in and an idempotency key. Owlette is not the Convoy LAN transport and mcp_tool_call is always refused here.

List the local and reachable remote Embody nodes known to this machine's Convoy host. Returns stable host/node/runtime identities, connection state, address, and version metadata. Local nodes carry a capabilities field (td_python, full_shell); remote nodes deliberately do not -- absent means unknown, never allowed.

Self-update Embody on Convoy nodes to the latest GitHub release -- one node or the whole fleet -- without the TD Python grant. Dispatches the bounded update_embody operation (sha256-pinned manifest, downgrade-refusing) as a durable job per node and returns the handles; poll convoy_get_job. Nodes must run Embody >= 6.0.257 to serve the operation.

List live controller sessions, selected targets, leases, and active work across reachable Convoy hosts. Read-only and never wakes TouchDesigner.

Measure Convoy reachability to one explicit node through the host-native ping operation. It reports the node's known online state without starting or waking TouchDesigner.

Start one exact, previously registered offline TouchDesigner node from its host-pinned launch profile. No executable, path, argv, or environment is accepted from the caller.

Restart one exact running TouchDesigner node. The default require_clean policy refuses dirty, unsaved, or unverifiable state; save_then_restart explicitly saves first. Destructive restart policies are not exposed by this build.

Relay one Envoy operation to an explicit Embody node. The target is always identified by host_id and node_id; Convoy never silently falls back to a local TouchDesigner instance.

Run one ordered Envoy batch on each explicit Convoy target. Targets execute independently and may run concurrently; the result preserves input order and reports partial success. This does not promise distributed atomicity or rollback.

Read a previously relayed Convoy delivery from its owning peer. Use the target_host_id, convoy_id, and delivery_id returned by convoy_call.

Acknowledge that this controller has safely observed one terminal Convoy delivery. This idempotent call lets the target release protected result artifacts and eventually reap the job. Verified artifact downloads and successful artifact saves acknowledge automatically; use this tool for other terminal results or to retry an indeterminate acknowledgement.

Materialize one private Convoy artifact from its owning host onto this client machine. Images are returned as MCP image content; other files are verified and returned as a local temporary path. Use the artifact reference returned by a Convoy job rather than copying a remote filesystem path.

Verify one Convoy artifact and explicitly save it in this bridge project's .embody/convoy/artifacts directory. The project is derived from this Envoy bridge's own configuration; remote paths and caller-selected project roots are never used. Existing files are preserved unless overwrite is true.

Send one file from this bridge's project to a Convoy node. The source must resolve inside this project. By default it lands in the target project's .embody/convoy/inbox/; with worktree= at dest inside the target's sibling -wt- worktree (create one with convoy_call convoy_git worktree_add); with live=true at dest inside the live project, which needs Allow Execute TD Python on the target because a synced .py reloads into TouchDesigner. dest defaults to the file name for the inbox and to the file's own project-relative path otherwise. Existing files are kept unless overwrite is true.

Request cancellation from the exact host that owns a durable delivery. Queued work cancels definitively; an active host subprocess receives best-effort process-tree cancellation. TouchDesigner work already past its host boundary is reported as non-cancellable, never simulated. Cancellation never wakes TouchDesigner.

Delete a stale node row (the row a renamed, moved, or deleted project left behind). Without host_id it acts on THIS machine's Convoy host app; with host_id (the owning host from convoy_list_nodes) the request is relayed to that host over its live session and its rules decide. Refuses while the node still has a delivery that has not FINISHED, and names the blocking delivery ids so they can be cancelled; a finished result never holds a row, because results are fetched by delivery id and outlive it; an online row is never forgotten. Rows unseen for a week are evicted automatically; this is the immediate manual path. The Convoy page's Forget Offline Nodes... button is the in-TD bulk equivalent, fleet-wide, with an enumerating confirmation.