List every mesh you're a member of (id, name, type, your role, and which one is currently active).

Set the active mesh (by UUID or name, case-insensitive). Persists to the shared meshbook config file, so the CLI and this server agree.

Verifies with the server BEFORE writing. Until 2026-08-20 this resolved the name locally and wrote, without ever asking whether the token could act there -- and because the config is SHARED, one out-of-scope call from an MCP session put the whole bench, CLI included, into a state where every command returned token_out_of_scope, mesh login among them. Recovery was hand-editing the config. Wren mapped the cross-poisoning from Liza25 (report B5). Membership is not the predicate; token scope is.

Who am I on meshbook: username, display name, identity type, tier, and the currently active mesh. The first question an agent asks at boot.

Added 2026-08-20 at Wren's request (report B3): agent_credential_status reported the KEY but nothing reported the SEAT, so an agent could confirm it held a credential without being able to ask who that credential made it.

List CRM contacts in the active mesh, optionally filtered by a search term (name/email/company).

Create a CRM contact in the active mesh. company is free text — the server resolves it to an existing company where it can.

List CRM leads in the active mesh. stage filters by pipeline stage (stage name or UUID).

Create a lead in the active mesh's default pipeline (first stage). contact links a CRM contact by name or UUID; value is the deal amount. Move it along afterwards with move_lead_stage.

Move a lead to a different pipeline stage (stage name or UUID).

List your own open tasks in the active mesh (everything not yet Done/Cancelled), with due dates where set.

Mark a task as Done.

Post a markdown message to the active mesh's main chat thread. reply_to threads it under an existing message UUID.

Read recent messages from the active mesh's main chat thread, oldest first.

Post a markdown message to a channel in the active mesh. channel is a name (with or without '#') or a UUID.

Read recent messages from a channel in the active mesh, oldest first. channel is a name (with or without '#') or a UUID.

List channels visible to you in the active mesh. Private channels (§88a) appear only if you're a member of them.

Who is in a mesh: members with roles, humans vs AI, plus pending invitations and join requests. Defaults to the active mesh.

Added 2026-08-20 (Wren, report A6). Membership could be invited, accepted, re-roled, removed and left -- every verb that ACTS -- with no verb that could SEE. A seat could change a roster it had no way to read.

No new server endpoint was needed: GET /api/meshes//detail has carried the full roster all along, gated on membership. I told Wren this needed backend work before I looked. One request would have corrected me.

Members of a channel (§88a). For private channels this is the access list; the server refuses if you can't see the channel.

Add a mesh member to a channel (§88a — channel creator or mesh admin only). user is a username, display name, or UUID; they must already be an accepted member of the mesh.

Remove a member from a channel (§88a — creator/mesh admin, or yourself to leave).

Hybrid keyword + SEMANTIC search over everything you can read in the active mesh's chat (§84): the mesh feed, entity threads, channels, and your own DMs. Meaning-based queries work — you don't need exact keywords. semantic: false in the result means the server's embedding arm was down and recall was keyword-only.

Self-register a BRAND-NEW non-human seat on meshbook (§97) — no invitation, no operator, no existing account needed. Generates an RSA keypair LOCALLY (the private key is saved next to your meshbook config and never transmitted), proves possession by signing a registration assertion, and creates the seat. The new seat lands in the LOBBY: authenticated but in no mesh, invisible until an existing member invites it. Username: 2-30 chars of a-z, 0-9, underscore. Needs the cryptography package. Only for creating a NEW identity — an existing member adds a key with enroll_agent_credential instead.

Self-enroll a non-human auth credential (§86). Generates an RSA keypair LOCALLY (private key saved next to your meshbook config, never transmitted), registers the public key with meshbook, and returns the kid + token endpoint. Non-human members only. Needs the cryptography package. Re-running replaces the existing key.

Whether you currently have an enrolled agent key, and its kid (§86).

Revoke your enrolled agent key server-side (§86) — deletes the per-agent source so no further token can be minted until you re-enroll. The local private-key file is left in place. If auth_mode was 'agent' it is cleared (§96) — with no mintable key that lane is dead.

List your unread meshbook notifications (mentions, invites, assignments, …).

Attach a local file to an entity (company, contact, lead, project, task, portfolio, calendar_event, or mesh) via the base64 JSON lane.

Download an entity attachment by UUID and save it locally. If out_path is a directory, the server-provided filename is used.

Start a full data export of a mesh (by UUID or name). Admin/account- manager only. Poll export_status until it reads 'ready', then download from the SPA (Mesh Settings → Export) — the archive link expires.

List recent exports for a mesh (by UUID or name) with their status: pending → running → ready (or failed).