---
title: MCP tools
description: Tools available through Inth MCP, with arguments and example prompts.
---
Inth MCP provides one tool per REST operation. Tools return the same resource
shapes as the REST API. The client should ask for confirmation before it calls
a tool that changes data; every tool carries annotations that say whether it is
read-only or destructive.

## Organization tools

### `list_organizations`

Lists the Inth organizations that your signed-in account can access, including
your role in each organization. The token must include `organizations.read`.

This tool has no arguments.

Example prompt:

> List my Inth organizations and show my role in each one.

### `get_organization`

Gets one organization. The token must include `organizations.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|Yes|Organization ID|

Every other tool that takes an `organizationId` treats it as optional: without
it the saved active organization of your account is used. If that choice is
unavailable and you belong to multiple organizations, provide the ID explicitly. Tools that take a member,
invitation, project, scan, or item ID find the organization from that ID.

### `create_organization`

Creates an organization owned by your signed-in account and sets up its
billing on the free plan. The token must include `organizations.write`.
Without it the call returns a tool error whose code is `INSUFFICIENT_SCOPE`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`name`|string|Yes|Organization name, 3 to 255 characters|
|`slug`|string|Yes|URL slug, 3 to 20 characters: lowercase letters and numbers, with single hyphens between groups|

Example prompt:

> Create an Inth organization named Acme with the slug `acme`.

You can own up to 50 organizations. A slug that is already taken is refused.

## Member tools

### `list_members`

Lists the members of an organization with their roles. The token must include
`members.read`. Any member can read the roster.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to the active one|

Example prompt:

> Who is in my Acme organization, and what role does each person have?

### `update_member`

Changes a member's role. The token must include `members.write`, and you must
be an admin or owner. Only owners can grant or take the owner role, you cannot
change your own role, and the last owner cannot be demoted.

|Argument|Type|Required|Description|
|--|--|--|--|
|`memberId`|string|Yes|Member ID|
|`role`|`owner`, `admin`, or `member`|Yes|New role|

### `remove_member`

Removes a member from an organization. The token must include `members.write`,
and you must be an admin or owner. Only owners can remove owners, you cannot
remove yourself, and the last owner cannot be removed.

|Argument|Type|Required|Description|
|--|--|--|--|
|`memberId`|string|Yes|Member ID|

### `list_invitations`

Lists pending invitations. The token must include `members.read`, and you must
be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to the active one|

### `invite_member`

Emails an invitation to join an organization. The invitation expires after 48
hours. The token must include `members.write`, and you must be an admin or
owner; only owners can invite owners. An address that is already a member or
already invited is refused.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to the active one|
|`email`|string|Yes|Address to invite|
|`role`|`owner`, `admin`, or `member`|Yes|Role granted on acceptance|

Example prompt:

> Invite [kim@acme.example](mailto:kim@acme.example) to my Acme organization as an admin.

### `cancel_invitation`

Cancels a pending invitation. The token must include `members.write`, and you
must be an admin or owner.

If acceptance or deletion wins a race with cancellation, the call returns `CONFLICT`. Refresh the member list before trying again.

|Argument|Type|Required|Description|
|--|--|--|--|
|`invitationId`|string|Yes|Invitation ID|

## Project tools

### `list_regions`

Lists the regions available when creating a project. Use the returned region
ID with `create_project`.

This tool has no arguments.

Example prompt:

> Which regions can I use for a new Inth project?

### `list_projects`

Lists projects with their consent settings. You can list every project you can
access or limit the result to one organization. The token must include
`projects.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Only return projects from this organization|

Example prompt:

> List the projects in my Acme organization.

### `get_project`

Gets one project with its consent settings. The token must include
`projects.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`projectId`|string|Yes|Project ID|

### `create_project`

Creates a project and its consent runtime. Admins and owners can use this tool
when the organization has API access and the token includes `projects.write`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization; defaults to the active one|
|`name`|string|Yes|Project name|
|`region`|string|Yes|Region ID returned by `list_regions`|
|`consent.trustedOrigins`|string array|No|Origins allowed to use the consent runtime|
|`consent.branding`|`inth`, `c15t`, or `none`|No|Branding shown on the consent banner|

Example prompt:

> Create an Inth project named Docs in the Frankfurt region for the Acme
> organization. Trust `https://docs.example.com` and show Inth branding.

Check the organization, region, project name, and trusted origins before you
approve the call. To find the required IDs first, ask the client to run
`list_organizations` and `list_regions`.

### `update_project`

Renames a project, changes its description, or changes its consent settings.
Arguments left out are unchanged. Renaming a project also changes its slug and
dashboard URL. The token must include `projects.write`, and you must be an
admin or owner. Removing branding needs a plan that includes it.

|Argument|Type|Required|Description|
|--|--|--|--|
|`projectId`|string|Yes|Project ID|
|`name`|string|No|New project name|
|`description`|string or null|No|New description, or null to clear it|
|`consent.trustedOrigins`|string array|No|Origins allowed to use the consent runtime|
|`consent.branding`|`inth`, `c15t`, or `none`|No|Branding shown on the consent banner|

Example prompt:

> Add `https://staging.example.com` to the trusted origins of the Docs project.

### `delete_project`

Archives a project and its consent runtime. The token must include
`projects.write`, and you must be an admin or owner. Confirm before approving.

|Argument|Type|Required|Description|
|--|--|--|--|
|`projectId`|string|Yes|Project ID|

## API key tools

### `list_api_keys`

Lists the organization API keys. Secrets are never returned. The token must
include `api-keys.read`, and you must be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to your active organization|

### `create_api_key`

Creates an organization API key with the rate limit of the current plan. The
secret is returned once. The token must include `api-keys.write`, and you must
be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`name`|string|Yes|Key name, shown in the key list|
|`organizationId`|string|No|Organization ID; defaults to your active organization|

Example prompt:

> Create an API key named "CI deploy" for my Acme organization.

### `roll_api_key`

Replaces the secret of a key. The old secret stops working immediately and the
new one is returned once. The token must include `api-keys.write`, and you
must be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`keyId`|string|Yes|API key ID|
|`organizationId`|string|No|Organization ID; defaults to your active organization|

### `delete_api_key`

Revokes a key. The token must include `api-keys.write`, and you must be an
admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`keyId`|string|Yes|API key ID|
|`organizationId`|string|No|Organization ID; defaults to your active organization|

## Code Audit tools

List tools take an optional `organizationId`; without it the active
organization of your account is used. Tools that take a scan, repository, or
item ID find the organization from that ID.

### `list_code_audit_repositories`

Lists the GitHub repositories the Inth App can reach, with the projects each is
linked to, ordered by repository ID. The token must include `code-audit.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Defaults to the active organization|
|`limit`|number|No|Page size, 1 to 100; defaults to 50|
|`cursor`|string|No|`nextCursor` from the previous page|

Returns `items`, `nextCursor`, and `hasMore`. Each request reads only the requested
repository page and its project links.

### `list_code_audit_scans`

Lists scans, newest first, with status, finding counts, and whether the report
is a free preview, locked, or fully unlocked. The token must include
`code-audit.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`repositoryId`|string|No|Only scans of this repository|
|`limit`|number|No|Page size, 1 to 100; defaults to 50|
|`cursor`|string|No|Cursor from the previous page of these filters|
|`status`|string|No|Only scans in this status|

Returns `items`, `nextCursor`, and `hasMore`. Pass `nextCursor` as `cursor`
to read older scans.

### `get_code_audit_scan`

Gets one scan with its progress. The token must include `code-audit.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`scanId`|string|Yes|Scan ID|

### `start_code_audit_scan`

Starts a scan of the production branch of a connected repository. The first
scan of a repository is a free preview; the previous preview must be unlocked
before another scan starts. The token must include `code-audit.write`, and you
must be an admin or owner. Confirm before approving: a scan spends credits when
its report is unlocked.

|Argument|Type|Required|Description|
|--|--|--|--|
|`repositoryId`|string|Yes|Repository ID from `list_code_audit_repositories`|

Example prompt:

> Scan the acme/website repository with Inth Code Audit and tell me what it
> found.

### `get_code_audit_scan_request`

When `start_code_audit_scan` returns `status: "starting"`, poll this tool with
its `preparationId` and `repositoryId` until it returns the scan. Requires
`code-audit.read` or `code-audit.write`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`preparationId`|string|Yes|Preparation ID from the start result|
|`repositoryId`|string|Yes|Repository ID from the start result|

### `get_code_audit_scan_issues`

Reads the findings of a scan. A free preview returns the visible findings plus
`lockedCount` and `unlockCredits`. The token must include `code-audit.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`scanId`|string|Yes|Scan ID|

### `unlock_code_audit_scan`

Spends credits to unlock the full report of a free preview. The token must
include `code-audit.write`, and you must be an owner. Confirm the credit cost
before approving; the call fails with `INSUFFICIENT_CREDITS` when the balance
is too low.

|Argument|Type|Required|Description|
|--|--|--|--|
|`scanId`|string|Yes|Scan ID|

## Inbox tools

### `list_inbox_items`

Lists findings in the Inbox, most recently updated first. The token must
include `inbox.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to the active organization|
|`status`|`open`, `accepted`, `dismissed`, or `resolved`|No|Only items in this status|
|`limit`|number|No|Page size, 1 to 100|
|`cursor`|string|No|Cursor from a previous page|

Example prompt:

> What open P0 and P1 findings are in my Acme Inbox?

### `get_inbox_item`

Gets one finding with its code evidence. The token must include `inbox.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`itemId`|string|Yes|Inbox item ID|

### `update_inbox_item`

Sets the status of a finding. Pass the `version` from the item as last read;
a stale version is refused so two people cannot overwrite each other. The token
must include `inbox.write`, and you must be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`itemId`|string|Yes|Inbox item ID|
|`status`|`open`, `accepted`, `dismissed`, or `resolved`|Yes|New status|
|`version`|string|Yes|The item's `version` as read|

Example prompt:

> I fixed the logging finding in the checkout handler. Mark it resolved.

### `create_inbox_github_issue`

Opens a GitHub issue in the connected repository for a code finding. Returns
the existing issue if one was already created. The token must include
`inbox.write`, and you must be an admin or owner.

|Argument|Type|Required|Description|
|--|--|--|--|
|`itemId`|string|Yes|Inbox item ID|

## Billing tools

### `get_billing`

Reads the plan, tier, credit balance, and automatic top-up settings of an
organization. Read only; purchases stay in the dashboard. The token must
include `billing.read`.

|Argument|Type|Required|Description|
|--|--|--|--|
|`organizationId`|string|No|Organization ID; defaults to the active organization|

Example prompt:

> How many Inth credits does Acme have left, and is auto top-up on?

An uncertain issue creation or failed persistence retains a reservation, so retries return `CONFLICT` until the result is reconciled. Repository and installation-token checks run before reservation, so preparation failures remain retryable. Refresh the item and contact support if the issue link does not appear.