---
title: "Available tools"
description: "The account server carries 54 tools. Each one does what a console screen does, under your platform role and your reach on the project you name."
canonical: https://past.dev/docs/mcp/tools
last-updated: 2026-10-22
---
# Available tools

> The account server carries 54 tools. Each one does what a console screen does, under your platform role and your reach on the project you name.

Product: past.dev MCP Server. Source: https://past.dev/docs/mcp/tools

Every tool mirrors a console action. The server resolves your platform role and your reach on the named project for each call, so an assistant can never do more than you can do in the console.

A tool your role does not hold is **absent from the tool list**. Calling an absent tool returns `unknown tool`, the same answer a tool that does not exist returns, so the list cannot be used to map what other roles can do.

### Naming a project

Project-scoped tools name their project by **slug**, the immutable name shown next to every key. Where the organization has exactly one live project, the argument may be omitted. Omitted with several live projects, the call is refused `project-required`. A project you do not reach and a project that does not exist are both **not found**.

### Organization

| Tool | Kind | What it does |
| --- | --- | --- |
| `get_viewer` | read | Who you act for: name, email, platform role, the organization, and every live project you reach with the level you reach it at. The first call an assistant should make. **Everyone.** |
| `get_organization` | read | The organization's name, slug, plan, creation date and member count. Mirrors Settings › General. **Everyone.** |
| `list_tags` | read | The organization's tag vocabulary, with how many projects carry each tag and how many rules match it. **Owner, Admin.** |
| `create_tag` | write | Adds a tag to the vocabulary. Lowercase letters, numbers and dashes. **Owner, Admin.** |
| `rename_tag` | write | Renames a tag. The projects carrying it and the rules matching it follow the new name, so nobody's access moves. **Owner, Admin.** |
| `merge_tags` | write | Merges one tag into another: the projects carrying it carry the other, and the rules matching it match the other. Destructive, so it asks for `confirm`. **Owner, Admin.** |
| `delete_tag` | write | Deletes a tag nothing depends on. A tag a project carries or a rule matches is refused. Destructive, so it asks for `confirm`. **Owner, Admin.** |

### Projects and keys

| Tool | Kind | What it does |
| --- | --- | --- |
| `list_projects` | read | The live projects you reach: slug, display name, tags, monthly caps, memory count and your level. `includeArchived` adds archived projects, for Owner and Admin. **Project Read.** |
| `get_project` | read | One project in full, as the Settings › Projects drawer shows it, including who reaches it. **Project Read.** |
| `create_project` | write | Creates a project. The slug is derived from the name as the console derives it, and the creator gets project Admin. **Member and above.** |
| `update_project` | write | Renames a project and sets its tags. The slug never changes. **Project Admin.** |
| `archive_project` | write | Archives a project: out of the switcher, and every call on its keys refused. **Project Admin.** |
| `unarchive_project` | write | Brings an archived project back into the switcher and back onto its keys. **Project Admin.** |
| `delete_project` | write | Deletes a project permanently and revokes every key it holds. Destructive, so it asks for `confirm`. **Project Admin.** |
| `set_project_caps` | write | Sets the project's monthly ingestion cap and monthly credit cap. **Project Admin.** |
| `list_api_keys` | read | A project's live keys, newest first: id, name, masked value, created by, created and last used. Never the clear value of a key. **Project Admin.** |
| `create_api_key` | write | Mints a project key, attributed to you under Created by. The answer carries the clear value once, and the assistant is told to hand it to you and put it nowhere else. **Project Admin.** |
| `revoke_api_key` | write | Revokes a project key. It stops working on its next call and cannot be restored. Destructive, so it asks for `confirm`. **Project Admin.** |
| `get_mcp_server` | read | A project's end-user MCP server, as Build › MCP server shows it: on or off, its address (the address it would take while it is off), the login connection, the live access links, and whether anybody can sign in yet. **Project Admin.** |
| `enable_mcp_server` | write | Turns a project's end-user MCP server on and answers with its address. There is nothing to choose: the address comes from the organization and project slugs. **Project Admin.** |
| `create_mcp_access_link` | write | Mints an access link for one identity, optionally created with its traits. The link is the credential, so the answer carries it once and the assistant is told to hand it to you and put it nowhere else. The server must be on. **Project Admin.** |
| `get_project_access` | read | Who reaches one project: each person with their level, where it comes from (role, rule or grant), and until when. **Project Read.** |
| `grant_project_access` | write | Grants one member direct access to one project at Read, Write or Admin, optionally until a date. Bounded by what you hold yourself. **Project Admin.** |
| `revoke_project_grant` | write | Withdraws one member's direct grant. Access they hold through their role or a rule stays. Destructive, so it asks for `confirm`. **Project Admin.** |

### Memory

| Tool | Kind | What it does |
| --- | --- | --- |
| `recall_memory` | read | Recalls from one project's memory, as `POST /api/v1/recall` does, with the same arguments, refusals, price and answer. With no `identity` it reads what the console's Memories screen shows. With an `identity` it reads as that identity. **Project Read.** |
| `ingest_memory` | write | Ingests one data point into a project, as `POST /api/v1/ingest` does: for the whole project, or for a named audience by its slug. An `id` that already exists replaces the earlier revision and the memories that came from it. It is charged as an API ingestion is. **Project Write.** |

### Members and access

| Tool | Kind | What it does |
| --- | --- | --- |
| `list_members` | read | Everyone in the organization: userId, name, email, platform role, joined date, the projects they reach, and pending invitations. **Owner, Admin.** |
| `invite_member` | write | Invites an email address at a platform role, with you as the inviter. `Owner` is refused, as on the screen. **Owner, Admin.** |
| `resend_invitation` | write | Sends a pending invitation again with a fresh link. The old link stops working. **Owner, Admin.** |
| `set_member_role` | write | Changes a member's platform role. Promoting to Owner transfers ownership. Destructive, so it asks for `confirm`. **Owner, Admin.** |
| `remove_member` | write | Removes a member, or revokes a pending invitation. The last Owner is refused. It also ends every account MCP session that person holds. Destructive, so it asks for `confirm`. **Owner, Admin.** |
| `list_access_rules` | read | The organization's tag-matched access rules: who each names, the tags and how they match, the level it gives, and when it lapses. **Owner, Admin.** |
| `list_access_groups` | read | The organization's groups, their members, and how many rules name each one. **Owner, Admin.** |
| `preview_access_rule` | read | Which live projects and which people a rule would match if it were saved as described. Nothing is written. **Owner, Admin.** |
| `create_access_rule` | write | Creates a tag-matched rule: the groups and people it names reach every live project its tags match, at its level, until it lapses. **Owner, Admin.** |
| `update_access_rule` | write | Replaces a rule with what you send, as saving the rule drawer does. Send every group, person and tag it should keep. **Owner, Admin.** |
| `delete_access_rule` | write | Deletes a rule. The people it reached lose that access unless a role, another rule or a grant gives it. Destructive, so it asks for `confirm`. **Owner, Admin.** |
| `create_access_group` | write | Creates a group of members that rules can name. A group grants nothing until a rule names it. **Owner, Admin.** |
| `update_access_group` | write | Renames a group or sets its members. Sent members replace the whole membership. **Owner, Admin.** |
| `delete_access_group` | write | Deletes a group. `Everyone` cannot be deleted, and neither can a group a rule names. Destructive, so it asks for `confirm`. **Owner, Admin.** |

### Plan, usage and requests

| Tool | Kind | What it does |
| --- | --- | --- |
| `get_plan` | read | The plan: the credits it includes, how many content bytes buy a credit, what a recall costs, how long a bought credit lasts, and what happens at zero. **Everyone.** |
| `get_usage` | read | This billing period's usage in UTC: credits spent against the credits included, split by what spent them, per project, with the reset date. **Owner, Admin, Billing.** |
| `list_requests` | read | One project's request log, newest first, with the Requests screen's filters, search and date range, paged by cursor. **Project Read.** |
| `get_request` | read | One call from the request log, as the Requests detail drawer shows it: method, path, status, the request id and the payload. **Project Read.** |
| `request_histogram` | read | Calls per time bucket over a range for one project, split by how they ended: accepted, accepted then failed later, and rejected. **Project Read.** |
| `get_management_key_activity` | read | What the organization's management key called in the last 30 days: each route with its method, call count and last call. **Owner, Admin.** |

### Debugging

These tools answer the questions an integration raises: where a send stopped, what a memory was built from, what an import will cost, and what is left to spend. They read what the console's Requests, Trace and Usage screens read, and none of them leaves a row in the request log, so listing your requests shows what your application sent and not what your assistant asked. Only `retry_ingestion` writes.

| Tool | Kind | What it does |
| --- | --- | --- |
| `explain_ingestion` | read | Where one ingestion stopped and what to do about it: its phase, why it stopped and whether a retry can fix it, each data point it carried with whether it is searchable and how many memories came out of it, and one sentence naming the next step. Name it by its ingestion id or by the request id that carried it. Start here when data does not show up. **Project Read.** |
| `retry_ingestion` | write | Runs an ingestion that failed again, under the same ingestion id, as Retry in the console's request drawer does. It spends no credits. Only a failed ingestion can be retried, and `explain_ingestion` says whether a retry can fix it. Asks for `confirm`. **Project Write.** |
| `find_trace_roots` | read | Memories and sources matching a search, newest first, in two paged groups: a source matches on its text and its data point id, a memory on its own words. Pass an ingestion id to list what one send carried. Each entry's id is what the lineage and timeline tools take. **Project Read.** |
| `get_trace_node` | read | One memory or source by its id: its headline, its data point and revision, when it occurred, arrived and became searchable, whether it is current, and how many inputs and outputs it has. A source carries its text, cut to 4,000 characters. **Project Read.** |
| `get_lineage` | read | What a memory was built from and what was built on it: the nodes around a root and the edges among them, where every edge reads as built from. This is the answer to "the system claims this, where did it come from". **Project Read.** |
| `get_timeline` | read | The same work on a clock: every node around a root with when it occurred, arrived and became searchable, the sends in the window that carried its sources, the recalls that returned it, and which memory replaced which. **Project Read.** |
| `estimate_ingestion` | read | Cuts files into the data points past reads best and prices them, before anything is sent: each file detected as email, chat, transcript, table, records, code, documentation or notes, the points, the batches to send them in, the credits, and how many points fit what is left. Writes nothing and spends nothing. **Project Read.** |
| `get_credit_balance` | read | The credits left, what the month included and bought with the day the bought ones lapse, the reset date, and one project's month: credits spent, ingestions, recalls, and what is left of its caps. The answer to a send refused with `402 out-of-credits` or `429 project-cap-reached`. **Project Read.** |

### Destructive tools ask first

Every tool marked destructive above takes a `confirm` argument. A call without `confirm: true` **does nothing**. It answers with one sentence describing what the call would do, and the assistant is expected to put that sentence to you before it calls again.

An unconfirmed call that the confirmed call would refuse answers the refusal instead of the sentence. An Admin who asks to make someone Owner, or the only Owner who asks to remove themselves, gets the refusal, so nobody is asked to agree to a change that will not happen.

> **A minted key or link is a secret**
>
> `create_api_key` is not destructive, but it mints a project key and the clear value is in the result. The tool description tells the assistant to hand the value back to you and put it nowhere else. Store it in your secret store, and revoke it with `revoke_api_key` if it reaches a transcript you do not control.
>
> `create_mcp_access_link` is the same: the link in the result reads and writes as its identity. Revoke it on **Build › MCP server** if it reaches a transcript you do not control.

### What no tool does

No tool reveals an existing key or access link, adds a login connection (it carries your identity provider's client secret), rotates the management key, changes the payment method, renames or deletes the organization, or transfers ownership except through `set_member_role`. Each of those is a screen action with a confirmation you read yourself. An assistant that needs one tells you where the button is.

**Reading and writing memory.** The account server recalls and ingests in the projects you reach, as the Memory API does and at the same price. Your users reach a project's memory through the end-user server, and your own software reaches it through the Memory API. Memory API reference: /docs/memory-api/api-reference