MCP Tools & Scopes

The MCP server exposes one tool per Tissue operation, named <area>_<verb>. Tools are filtered at runtime by your token's scopes: a read-only token never sees write or delete tools at all; they don't appear in the tool list. Every tool carries MCP annotations (readOnlyHint/destructiveHint/idempotentHint) so hosts can prompt for confirmation on destructive actions, and returns machine-readable structuredContent alongside human-readable text.

Available tools

Tool	Scope	What it does
`whoami`	(none)	Show account, user, and effective token scopes
`search_tissue_docs`	(none)	Keyword-search these docs (returns relevant sections)
`cell_list`	`cells:read`	List all deployed Cells
`cell_get`	`cells:read`	Get metadata and bindings for a Cell
`cell_logs`	`cells:read`	Recent `console.log` output from a Cell
`cell_errors`	`cells:read`	Recent uncaught errors from a Cell
`cell_deploy`	`cells:write`	Deploy a JS Cell from source code
`cell_invoke`	`cells:read`	Make an HTTP request to a Cell and return the response
`cell_delete`	`cells:delete`	Delete a Cell
`gate_status`	`cells:read`	Show a Cell's gate policy and active session/link counts
`gate_set`	`cells:write`	Set or replace a Cell's gate policy (audience, allow list, domains, SSO identity providers)
`gate_remove`	`cells:write`	Remove the gate — the Cell becomes public again
`gate_link_create`	`cells:write`	Mint a shareable capability link (token shown once)
`gate_link_list`	`cells:read`	List a gated Cell's capability links
`gate_link_revoke`	`cells:write`	Revoke a capability link by id
`gate_session_list`	`cells:read`	List a gated Cell's viewer sessions
`gate_session_revoke`	`cells:write`	Revoke one viewer session by sid
`gate_revoke_all`	`cells:write`	Revoke every session — all viewers sign in again
`pulse_list`	`cells:read`	List a Cell's pulse (cron) schedules
`pulse_trigger`	`cells:write`	Fire a Cell's pulse handler now ("run now")
`c3_database_list`	`databases:read`	List all c3 SQL databases
`c3_database_create`	`databases:write`	Create a new c3 database
`c3_database_drop`	`databases:delete`	Delete a database
`c3_query`	`databases:read`	Run a read-only query and get rows back
`c3_execute`	`databases:write`	Run INSERT / UPDATE / DELETE / DDL
`c3_batch`	`databases:write`	Run multiple statements atomically
`g7_bucket_list`	`buckets:read`	List all g7 buckets
`g7_bucket_create`	`buckets:write`	Create a new bucket
`g7_bucket_delete`	`buckets:delete`	Delete a bucket
`g7_object_list`	`buckets:read`	List objects in a bucket
`g7_object_get`	`buckets:read`	Download a small object (text or base64)
`g7_object_put`	`buckets:write`	Upload a small object (text or base64)
`g7_object_delete`	`buckets:delete`	Delete an object
`g7_presign_upload`	`buckets:write`	Get a short-lived presigned PUT URL (binary/bulk upload)
`g7_presign_download`	`buckets:read`	Get a short-lived presigned GET URL (binary/large download)
`vault_key_list`	`vault:read`	List secret key names for a Cell
`vault_set`	`vault:write`	Set an encrypted secret for a Cell
`vault_delete`	`vault:write`	Delete a secret
`domain_list`	`domains:read`	List custom domains and their status
`domain_add`	`domains:write`	Register a custom domain on a Cell (returns the ownership challenge)
`domain_verify`	`domains:write`	Re-check a domain's DNS and advance its status
`domain_remove`	`domains:delete`	Remove a custom domain
`token_list`	`account:read`	List the account's API tokens
`token_create`	`account:write`	Create a new scoped API token
`token_revoke`	`account:write`	Revoke an API token
`sensor_list_devices`	`cells:read`	List sensor devices registered under a Cell
`sensor_get_device`	`cells:read`	Fetch one device's registry record
`sensor_register_device`	`cells:write`	Register a device (returns its one-time token)
`sensor_set_device_enabled`	`cells:write`	Enable or disable (quarantine) a device
`sensor_rotate_device_token`	`cells:write`	Issue a new token for a device
`sensor_delete_device`	`cells:delete`	Revoke a device entirely
`vesicle_endpoint_create`	`vesicle:write`	Issue a webhook ingest URL (it accepts deliveries before any Cell exists)
`vesicle_endpoint_list`	`vesicle:read`	List endpoints with their bindings and capture counts by state
`vesicle_endpoint_get`	`vesicle:read`	Get one endpoint, including its full ingest URL
`vesicle_endpoint_bind`	`vesicle:write`	Point an endpoint at a Cell and path
`vesicle_endpoint_rotate`	`vesicle:write`	Issue a new ingest URL; the old one keeps working for a grace window
`vesicle_endpoint_revoke`	`vesicle:delete`	Revoke an endpoint — stored captures survive
`vesicle_capture_list`	`vesicle:read`	List an endpoint's stored deliveries (metadata, never bodies)
`vesicle_capture_get`	`vesicle:read`	Read one delivery verbatim — redacted unless `include_secrets`
`vesicle_replay`	`vesicle:write`	Re-send one delivery, or a range, into the bound Cell

c3_query is read-only and works with a databases:read token; the query runs under an engine-enforced read-only connection, so any write is rejected; use c3_execute (databases:write) to modify data.

g7_object_get/g7_object_put are size-limited (256 KB) to keep bytes out of the model's context; small binary is supported via base64 (encoding: "base64"). For large or many files, use g7_presign_upload / g7_presign_download; they return a short-lived URL you upload/download bytes to directly (e.g. curl -T file "<url>"), so the data never passes through the model. Object keys may not contain @.

A captured webhook delivery is a third party's raw HTTP request, so it routinely carries live credentials. vesicle_capture_get masks them by default — header and JSON body values whose names match authorization, x-api-key, cookie, or anything ending -signature or -token come back as «redacted». include_secrets: true returns them intact, records an audit event on the account, and puts those credentials into the model's context and any transcript it reaches; use it only when a masked capture won't do.

Scope reference

Scope	Grants
`cells:read`	List cells, view metadata, logs, errors, gate status
`cells:write`	Deploy (create or update) cells, manage gate policies/links/sessions
`cells:delete`	Delete cells
`databases:read`	List databases, run read-only queries
`databases:write`	Create databases, run INSERT/UPDATE/DELETE/DDL
`databases:delete`	Drop databases
`buckets:read`	List buckets and objects, download objects
`buckets:write`	Create buckets, upload objects
`buckets:delete`	Delete objects and buckets
`vault:read`	List vault key names (never values)
`vault:write`	Set and delete vault secrets
`domains:read`	List custom domains and their status
`domains:write`	Register and verify custom domains
`domains:delete`	Remove custom domains
`account:read`	List API tokens
`account:write`	Create and revoke API tokens
`vesicle:read`	List webhook endpoints, list captures, read a capture
`vesicle:write`	Issue, bind and rotate endpoints; replay captures
`vesicle:delete`	Revoke endpoints, drop captures
`events:read`	Read the account activity feed
`billing:read`	Read entitlements and subscription state
`billing:write`	Change entitlements and subscription state
`mast:read`	Read mast channels, the feed and vitals
`mast:write`	Connect mast, create and change channels, send, acknowledge
`explant:export`	Request and download an explant of a Cell

25 scopes in total. The last six gate REST endpoints rather than MCP tools: no tool in the table above requires them, so a token holding only those sees just the two tools that need no scope.

An owner's browser-login session holds all 25 implicitly; an admin or developer session is capped at its role ceiling. API tokens carry an explicit allow-list, capped the same way, so scope them to the minimum an agent needs.

Common presets

# Full access
ribo token create "Claude" \
  --scope cells:read --scope cells:write --scope cells:delete \
  --scope databases:read --scope databases:write --scope databases:delete \
  --scope buckets:read --scope buckets:write --scope buckets:delete \
  --scope vault:read --scope vault:write

# Read-only across everything
ribo token create "Read-only" \
  --scope cells:read --scope databases:read --scope buckets:read --scope vault:read

# Deploy only (CI pipeline)
ribo token create "CI" --scope cells:read --scope cells:write

Things to ask Claude

Once connected, try:

Show me all my deployed Cells and their URLs.

Create a c3 database called "todos" with a tasks table (id, title, done, created_at).

Deploy a Cell called "hello" that returns "Hello, world!" for any request.

Show me the last 20 errors from my "payment-processor" Cell.

Security notes

API tokens are shown once at creation and can't be retrieved again. Store them in a password manager.
Scope tokens to the minimum required. A data-analysis agent needs databases:read, not cells:delete.
The MCP server holds no credentials of its own. Revoking a token (ribo token revoke <id> or the dashboard) immediately cuts off all access.