MCP tools
Inth MCP provides one tool per REST operation. Tools return the same resource shapes as the REST API. The client should ask for confirmation before it calls a tool that changes data; every tool carries annotations that say whether it is read-only or destructive.
Organization tools
list_organizations
Lists the Inth organizations that your signed-in account can access, including
your role in each organization. The token must include organizations.read.
This tool has no arguments.
Example prompt:
List my Inth organizations and show my role in each one.
get_organization
Gets one organization. The token must include organizations.read.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | Yes | Organization ID |
Every other tool that takes an organizationId treats it as optional: without
it the saved active organization of your account is used. If that choice is
unavailable and you belong to multiple organizations, provide the ID explicitly. Tools that take a member,
invitation, project, scan, or item ID find the organization from that ID.
create_organization
Creates an organization owned by your signed-in account and sets up its
billing on the free plan. The token must include organizations.write.
Without it the call returns a tool error whose code is INSUFFICIENT_SCOPE.
| Argument | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Organization name, 3 to 255 characters |
slug | string | Yes | URL slug, 3 to 20 characters: lowercase letters and numbers, with single hyphens between groups |
Example prompt:
Create an Inth organization named Acme with the slug
acme.
You can own up to 50 organizations. A slug that is already taken is refused.
Member tools
list_members
Lists the members of an organization with their roles. The token must include
members.read. Any member can read the roster.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to the active one |
Example prompt:
Who is in my Acme organization, and what role does each person have?
update_member
Changes a member's role. The token must include members.write, and you must
be an admin or owner. Only owners can grant or take the owner role, you cannot
change your own role, and the last owner cannot be demoted.
| Argument | Type | Required | Description |
|---|---|---|---|
memberId | string | Yes | Member ID |
role | owner, admin, or member | Yes | New role |
remove_member
Removes a member from an organization. The token must include members.write,
and you must be an admin or owner. Only owners can remove owners, you cannot
remove yourself, and the last owner cannot be removed.
| Argument | Type | Required | Description |
|---|---|---|---|
memberId | string | Yes | Member ID |
list_invitations
Lists pending invitations. The token must include members.read, and you must
be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to the active one |
invite_member
Emails an invitation to join an organization. The invitation expires after 48
hours. The token must include members.write, and you must be an admin or
owner; only owners can invite owners. An address that is already a member or
already invited is refused.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to the active one |
email | string | Yes | Address to invite |
role | owner, admin, or member | Yes | Role granted on acceptance |
Example prompt:
Invite kim@acme.example to my Acme organization as an admin.
cancel_invitation
Cancels a pending invitation. The token must include members.write, and you
must be an admin or owner.
If acceptance or deletion wins a race with cancellation, the call returns CONFLICT. Refresh the member list before trying again.
| Argument | Type | Required | Description |
|---|---|---|---|
invitationId | string | Yes | Invitation ID |
Project tools
list_regions
Lists the regions available when creating a project. Use the returned region
ID with create_project.
This tool has no arguments.
Example prompt:
Which regions can I use for a new Inth project?
list_projects
Lists projects with their consent settings. You can list every project you can
access or limit the result to one organization. The token must include
projects.read.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Only return projects from this organization |
Example prompt:
List the projects in my Acme organization.
get_project
Gets one project with its consent settings. The token must include
projects.read.
| Argument | Type | Required | Description |
|---|---|---|---|
projectId | string | Yes | Project ID |
create_project
Creates a project and its consent runtime. Admins and owners can use this tool
when the organization has API access and the token includes projects.write.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization; defaults to the active one |
name | string | Yes | Project name |
region | string | Yes | Region ID returned by list_regions |
consent.trustedOrigins | string array | No | Origins allowed to use the consent runtime |
consent.branding | inth, c15t, or none | No | Branding shown on the consent banner |
Example prompt:
Create an Inth project named Docs in the Frankfurt region for the Acme organization. Trust
https://docs.example.comand show Inth branding.
Check the organization, region, project name, and trusted origins before you
approve the call. To find the required IDs first, ask the client to run
list_organizations and list_regions.
update_project
Renames a project, changes its description, or changes its consent settings.
Arguments left out are unchanged. Renaming a project also changes its slug and
dashboard URL. The token must include projects.write, and you must be an
admin or owner. Removing branding needs a plan that includes it.
| Argument | Type | Required | Description |
|---|---|---|---|
projectId | string | Yes | Project ID |
name | string | No | New project name |
description | string or null | No | New description, or null to clear it |
consent.trustedOrigins | string array | No | Origins allowed to use the consent runtime |
consent.branding | inth, c15t, or none | No | Branding shown on the consent banner |
Example prompt:
Add
https://staging.example.comto the trusted origins of the Docs project.
delete_project
Archives a project and its consent runtime. The token must include
projects.write, and you must be an admin or owner. Confirm before approving.
| Argument | Type | Required | Description |
|---|---|---|---|
projectId | string | Yes | Project ID |
API key tools
list_api_keys
Lists the organization API keys. Secrets are never returned. The token must
include api-keys.read, and you must be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to your active organization |
create_api_key
Creates an organization API key with the rate limit of the current plan. The
secret is returned once. The token must include api-keys.write, and you must
be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
name | string | Yes | Key name, shown in the key list |
organizationId | string | No | Organization ID; defaults to your active organization |
Example prompt:
Create an API key named "CI deploy" for my Acme organization.
roll_api_key
Replaces the secret of a key. The old secret stops working immediately and the
new one is returned once. The token must include api-keys.write, and you
must be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
keyId | string | Yes | API key ID |
organizationId | string | No | Organization ID; defaults to your active organization |
delete_api_key
Revokes a key. The token must include api-keys.write, and you must be an
admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
keyId | string | Yes | API key ID |
organizationId | string | No | Organization ID; defaults to your active organization |
Code Audit tools
List tools take an optional organizationId; without it the active
organization of your account is used. Tools that take a scan, repository, or
item ID find the organization from that ID.
list_code_audit_repositories
Lists the GitHub repositories the Inth App can reach, with the projects each is
linked to, ordered by repository ID. The token must include code-audit.read.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Defaults to the active organization |
limit | number | No | Page size, 1 to 100; defaults to 50 |
cursor | string | No | nextCursor from the previous page |
Returns items, nextCursor, and hasMore. Each request reads only the requested
repository page and its project links.
list_code_audit_scans
Lists scans, newest first, with status, finding counts, and whether the report
is a free preview, locked, or fully unlocked. The token must include
code-audit.read.
| Argument | Type | Required | Description |
|---|---|---|---|
repositoryId | string | No | Only scans of this repository |
limit | number | No | Page size, 1 to 100; defaults to 50 |
cursor | string | No | Cursor from the previous page of these filters |
status | string | No | Only scans in this status |
Returns items, nextCursor, and hasMore. Pass nextCursor as cursor
to read older scans.
get_code_audit_scan
Gets one scan with its progress. The token must include code-audit.read.
| Argument | Type | Required | Description |
|---|---|---|---|
scanId | string | Yes | Scan ID |
start_code_audit_scan
Starts a scan of the production branch of a connected repository. The first
scan of a repository is a free preview; the previous preview must be unlocked
before another scan starts. The token must include code-audit.write, and you
must be an admin or owner. Confirm before approving: a scan spends credits when
its report is unlocked.
| Argument | Type | Required | Description |
|---|---|---|---|
repositoryId | string | Yes | Repository ID from list_code_audit_repositories |
Example prompt:
Scan the acme/website repository with Inth Code Audit and tell me what it found.
get_code_audit_scan_request
When start_code_audit_scan returns status: "starting", poll this tool with
its preparationId and repositoryId until it returns the scan. Requires
code-audit.read or code-audit.write.
| Argument | Type | Required | Description |
|---|---|---|---|
preparationId | string | Yes | Preparation ID from the start result |
repositoryId | string | Yes | Repository ID from the start result |
get_code_audit_scan_issues
Reads the findings of a scan. A free preview returns the visible findings plus
lockedCount and unlockCredits. The token must include code-audit.read.
| Argument | Type | Required | Description |
|---|---|---|---|
scanId | string | Yes | Scan ID |
unlock_code_audit_scan
Spends credits to unlock the full report of a free preview. The token must
include code-audit.write, and you must be an owner. Confirm the credit cost
before approving; the call fails with INSUFFICIENT_CREDITS when the balance
is too low.
| Argument | Type | Required | Description |
|---|---|---|---|
scanId | string | Yes | Scan ID |
Inbox tools
list_inbox_items
Lists findings in the Inbox, most recently updated first. The token must
include inbox.read.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to the active organization |
status | open, accepted, dismissed, or resolved | No | Only items in this status |
limit | number | No | Page size, 1 to 100 |
cursor | string | No | Cursor from a previous page |
Example prompt:
What open P0 and P1 findings are in my Acme Inbox?
get_inbox_item
Gets one finding with its code evidence. The token must include inbox.read.
| Argument | Type | Required | Description |
|---|---|---|---|
itemId | string | Yes | Inbox item ID |
update_inbox_item
Sets the status of a finding. Pass the version from the item as last read;
a stale version is refused so two people cannot overwrite each other. The token
must include inbox.write, and you must be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
itemId | string | Yes | Inbox item ID |
status | open, accepted, dismissed, or resolved | Yes | New status |
version | string | Yes | The item's version as read |
Example prompt:
I fixed the logging finding in the checkout handler. Mark it resolved.
create_inbox_github_issue
Opens a GitHub issue in the connected repository for a code finding. Returns
the existing issue if one was already created. The token must include
inbox.write, and you must be an admin or owner.
| Argument | Type | Required | Description |
|---|---|---|---|
itemId | string | Yes | Inbox item ID |
Billing tools
get_billing
Reads the plan, tier, credit balance, and automatic top-up settings of an
organization. Read only; purchases stay in the dashboard. The token must
include billing.read.
| Argument | Type | Required | Description |
|---|---|---|---|
organizationId | string | No | Organization ID; defaults to the active organization |
Example prompt:
How many Inth credits does Acme have left, and is auto top-up on?
An uncertain issue creation or failed persistence retains a reservation, so retries return CONFLICT until the result is reconciled. Repository and installation-token checks run before reservation, so preparation failures remain retryable. Refresh the item and contact support if the issue link does not appear.