"Managing Clerk Authorization" matching MCP tools:

• whoami

  shiply

  Who am I? Returns the signed-in account: email, @handle, plan + limits, counts of sites/domains/drives, and connected DNS providers. Call this first to orient before managing sites or domains.

  Connector

• ic_admin_list_members

  Immersive Commons

  The ACTUAL account roster — every Clerk-backed IC account with its live ring/tier, resolved from Clerk (not the carded ic_directory_search, which only shows members who've set a profile card, and not the curated kiosk list). This is what you want to answer 'who are the members' or find a specific account (e.g. one that hasn't set a card yet). Each member: { user_id, name, email, tier ('public'|'ft-member'|'ai-floor'|'ic-member'|'operator'), pending_request (the tier they've requested but not yet been granted, or null), created_at }. Args: { tier?: filter to one ring; q?: case-insensitive name/email/user_id substring filter; limit?: number (default 200, max 500); offset?: number (default 0) }. Filters apply to the fetched page; `total` is the full Clerk account count and `has_more` tells you to page with offset (default limit covers all IC accounts in one page today). Required scope: admin:tier_review.

  Connector

• clerk.get_connected_accounts

  Vee3

  List Clerk applications connected to the authenticated Vee3 account. Returns clerk_instance_id, display name, environment type, and whether each connection is the default. Use clerk_instance_id on future Clerk calls, or omit it to use the default account. If accounts is empty, the user must connect a Clerk application at https://vee3.io/dashboard/connections before Clerk capabilities work. Agents cannot complete the connection flow; ask the user to connect, then call this tool again. Cost = 0 tokens.

  Connector

• ic_leaderboard_connect_github

  Immersive Commons

  Verify a GitHub Personal Access Token against api.github.com/user, then store the resulting username on your IC profile. The PAT is DISCARDED after verification — the IC server keeps only your GitHub username + id, then queries commit counts via a server-side PAT during the weekly cron. Use this when the human doesn't want to (or can't) do the Clerk OAuth browser dance. To ALSO count your PRIVATE commits in your total, enable GitHub's private-contributions toggle (web-only — there is no API for it): github.com/<your-username> → 'Contribution settings' button (above your contribution graph) → enable 'Private contributions' (docs: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-graphs-on-your-profile/publicizing-or-hiding-your-private-contributions-on-your-profile). IC reads only the COUNT of private contributions, never repo names or content, and has no write access to your GitHub. Args: { pat: string }. Returns: { ok, github: { login, id, name?, avatarUrl? }, next_steps: string[] }. Required scope: github:link.

  Connector

• search_person

  Handelsregister

  Find every company a person runs or represents - across BOTH registers in one call (cross-border person search). Read-only. Parameters: - name (required): person name substring, case-insensitive, e.g. "Mustermann". - country (optional, default "all"): "AT" | "DE" | "all". - page_size (optional, default 25): results per country. - status (optional, default "all"): "active" | "inactive" | "all". Returns the merged search_companies envelope ({countries, results, per_country, notices}) plus ``person_query``; every result card carries ``country``, ``company_id`` and the matched manager. AT matches the primary managing director, DE matches all managing directors AND registered signatories. IMPORTANT: matching is by name and the registers publish birth YEAR only - a shared name across companies or countries does not prove the same person (the notice says so; use birth years and context to corroborate). For general company search use search_companies with other filters; manager_name can be combined there too.

  Connector

• clerk.count_users

  Vee3

  Return the total number of users in a connected Clerk application. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Cheaper than listing users when you only need the total count. Cost = 2 tokens.

  Connector

• get_billing_portal

  BorealHost

  Get a Stripe billing portal URL for managing payment methods and invoices. Returns a URL (not a redirect) that the human can open in a browser. Requires: API key with read scope. Args: flow: Optional. Set to "payment_method_update" to go directly to the payment method update page. Returns: {"url": "https://billing.stripe.com/p/session/..."}

  Connector

• clerk.rotate_oauth_application_secret

  Vee3

  Rotate the client secret for a confidential OAuth application in a connected Clerk application. **Sensitive** — the response includes a new client_secret. Update authorized OAuth clients immediately and do not log the secret. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated OAuth application summary with the new client_secret. Cost = 10 tokens.

  Connector

• clerk.update_organization_metadata

  Vee3

  Merge metadata into a Clerk organization (deep merge — existing keys are preserved unless overwritten). Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the updated organization summary. Cost = 8 tokens.

  Connector

• get_public_housing

  HUD Housing Data

  Get public housing buildings and developments in a state. Queries HUD's open ArcGIS data for public housing inventory. No API key required. Returns building names, addresses, unit counts, and managing Public Housing Agency information. Args: state: Two-letter US state abbreviation (e.g. 'WA', 'TX'). city: Optional city name to filter results. limit: Maximum number of records to return (default 50, max 500).

  Connector

• get_tiktok_post_ad_authorization

  Hermoso

  Read the Spark-Ads authorization status of a post the authorized account owns — whether it is promotable, its authorization CODE, and the window the authorization runs for. A SPARK AD CANNOT OUTLIVE ITS AUTHORIZATION, so check the end time before building a campaign around a post. TIKTOK ERRORS RATHER THAN ANSWERING when a post has no authorization code at all, so a not-found style refusal from here almost always means Ad authorization was never turned on (or the code was deleted) — turn it on with set_tiktok_post_ad_authorization — and not that anything is broken. NEEDS THE TIKTOK ACCOUNT AUTHORIZATION (see tiktok_account_status). Read-only, free.

  Connector

• clerk.change_instance_domain

  Vee3

  Change the primary or secondary home URL for a connected Clerk instance. WARNING: Destructive operation — changing the instance domain invalidates active sessions and may cause brief downtime. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns whether Clerk accepted the domain change request. Cost = 10 tokens.

  Connector

• clerk.get_jwks

  Vee3

  Retrieve the JSON Web Key Set (JWKS) for verifying Clerk session tokens. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns public signing keys for verifying Clerk JWTs. Cost = 2 tokens.

  Connector

• clerk.delete_organization

  Vee3

  Permanently delete an organization from a connected Clerk application. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. This action is irreversible. Returns the deleted organization id and a deleted flag. Cost = 10 tokens.

  Connector

• clerk.get_sign_up

  Vee3

  Retrieve an in-progress sign-up from a connected Clerk application by sign-up id. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns status, contact fields, missing and unverified fields, and completion timestamps. Cost = 3 tokens.

  Connector

• clerk.get_user

  Vee3

  Retrieve one Clerk user by id. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns id, name, primary email, and created_at. Cost = 3 tokens.

  Connector

• clerk.list_jwt_templates

  Vee3

  List JWT templates in a connected Clerk application. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns each template's id, name, claims, lifetime, allowed_clock_skew, created_at, updated_at, signing_algorithm, and custom_signing_key, plus total_count. Cost = 5 tokens.

  Connector

• clerk.list_organization_invitations

  Vee3

  List organization invitations across a Clerk instance. Optionally filter to one organization via organization_id. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns invitation summaries and total_count. Cost = 5 tokens.

  Connector

• clerk.list_organization_memberships

  Vee3

  List members of a Clerk organization. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns membership id, user_id, role, and created_at for each member, plus total_count. Cost = 5 tokens.

  Connector

• clerk.revoke_actor_token

  Vee3

  Revoke an actor token in a connected Clerk application so it can no longer be used for impersonation. **Sensitive** — invalidates a high-privilege token. Call clerk.get_connected_accounts first. Pass clerk_instance_id to target a specific connection, or omit it to use the default account. Returns the revoked actor token object. Cost = 5 tokens.

  Connector