mcp:readreaches every read-only tool, plus a curated set of safe creations (ephemeral workspace operations and throwaway pull request demos) that cannot damage existing infrastructure.mcp:writeadds the mutating tools - everything markedmcp:writebelow. Write access implies the read surface.
cluster_id argument (a UUID); call list_clusters first to discover IDs. Ankra verifies the cluster belongs to the token’s organisation before dispatch. Tools that are not cluster-scoped operate at the organisation level.
Creating a credential is deliberately not available over MCP or chat. Creating one would mean passing the secret itself as a tool argument, and Ankra refuses mutating tool calls whose parameters contain literal secrets. Create credentials in the portal or CLI; over MCP you can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan or apply a GitHub credential rotation.
Clusters & Kubernetes
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_clusters | mcp:read | No | List every cluster in the organisation with state, environment, and Kubernetes version |
get_cluster_details | mcp:read | No | Detailed information about one cluster by name or ID |
get_cluster_attention_summary | mcp:read | No | The exact signals behind a cluster’s Needs Attention badge |
get_cluster_status | mcp:read | Yes | Cluster health overview |
get_cluster_snapshot | mcp:read | Yes | Full cluster overview in a single call |
get_cluster_cost | mcp:read | Yes | Estimated cloud infrastructure cost for the cluster |
get_stack_cost | mcp:read | Yes | Estimated cost attributed to one Stack, derived from its namespaces |
get_security_reports | mcp:read | Yes | Trivy Operator image-vulnerability summary |
get_compliance_reports | mcp:read | Yes | Trivy benchmark checks, remediation, passed controls, and configuration-audit summary |
get_cluster_bastion | mcp:read | Yes | Public IP of the Ankra-managed bastion/gateway host |
list_namespaces | mcp:read | Yes | List namespaces with their status |
get_resource_quotas | mcp:read | Yes | Resource quotas and current usage per namespace |
list_recent_executions | mcp:read | Yes | Recent platform executions (deployments, write operations) |
get_execution_details | mcp:read | Yes | Full details for one execution, including steps and error excerpts |
cluster_query | mcp:read | Yes | Structured lookup against the live cluster resource index |
cluster_search | mcp:read | Yes | Full-text search over the live cluster resource index |
cluster_describe | mcp:read | Yes | Full body of one named resource from the live cluster index |
get_pods | mcp:read | Yes | Pod status, restarts, and placement, with namespace/name/label filters |
get_pod_logs | mcp:read | Yes | Logs from a specific pod |
get_deployments | mcp:read | Yes | Deployment information |
get_statefulsets | mcp:read | Yes | StatefulSet information |
get_daemonsets | mcp:read | Yes | DaemonSet information |
get_services | mcp:read | Yes | Service information |
get_ingresses | mcp:read | Yes | Ingress information |
get_events | mcp:read | Yes | Kubernetes events (Normal/Warning) |
get_nodes | mcp:read | Yes | Node information |
get_configmaps | mcp:read | Yes | ConfigMap information |
get_secrets | mcp:read | Yes | Secret metadata (never secret values) |
get_jobs | mcp:read | Yes | Job information |
get_cronjobs | mcp:read | Yes | CronJob information |
get_pvcs | mcp:read | Yes | PersistentVolumeClaim information |
get_cluster_role_bindings | mcp:read | Yes | ClusterRoleBindings and RoleBindings for RBAC analysis |
describe_resource | mcp:read | Yes | Detailed YAML/JSON for one Kubernetes resource |
describe_resources | mcp:read | Yes | Batch-fetch multiple Kubernetes resources in one call |
restart_deployment | mcp:write | Yes | Rolling restart of a deployment |
scale_deployment | mcp:write | Yes | Scale a deployment to a replica count |
scale_statefulset | mcp:write | Yes | Scale a StatefulSet to a replica count |
delete_pod | mcp:write | Yes | Delete a specific pod |
delete_resource | mcp:write | Yes | Delete any Kubernetes resource, including custom resources |
apply_manifest | mcp:write | Yes | Apply a Kubernetes manifest to create or update resources |
patch_resource | mcp:write | Yes | Patch a Kubernetes resource (strategic merge or JSON patch) |
add_helm_registry | mcp:write | No | Add a Helm chart registry to the organisation’s catalog |
cancel_execution_step | mcp:write | No | Cancel one step of a running execution while the rest continues |
cancel_execution | mcp:write | No | Cancel a running platform execution; a mid-flight cancellation can leave the resource between versions until the next reconcile |
retry_execution | mcp:write | No | Retry a terminal (failed, cancelled, timeout) execution from the start with its original payload |
reconcile_cluster | mcp:write | No | Re-render every stack member against the committed definitions and variables and re-apply drift (takes a cluster_id argument) |
get_node_usage | mcp:read | Yes | Live CPU and memory per node from metrics-server, with allocatable capacity and percentages (never a cached answer) |
get_pod_usage | mcp:read | Yes | Live CPU and memory per pod from metrics-server, optionally per container, filtered by namespace |
get_cluster_agent_status | mcp:read | Yes | The Ankra agent’s online state, version against the latest release, upgrade posture and last check-in |
upgrade_cluster_agent | mcp:write | Yes | Upgrade the agent to the latest release now instead of waiting for the fleet rollout (agents.manage) |
list_helm_releases | mcp:read | Yes | Every Helm release installed on the cluster, Ankra-managed or not, for drift detection |
get_cluster_dns_zone | mcp:read | Yes | The cluster’s generated DNS zone and the public domain hostnames publish under |
get_sops_config | mcp:read | No | Whether SOPS is enabled and the AGE public key secrets are encrypted with |
resize_bastion | mcp:write | Yes | Resize the bastion of an Ankra-provisioned cluster (clusters.write) |
resync_cluster_ssh_keys | mcp:write | Yes | Re-register the cluster’s SSH key with its provider (clusters.write) |
Stacks
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_stacks | mcp:read | Yes | List the cluster’s Stacks with their add-ons, manifests, and state |
get_stack_details | mcp:read | Yes | One Stack in full, including add-on and manifest configuration |
get_stack_history | mcp:read | Yes | Version history: who changed what and when, per resource |
get_stack_deployments | mcp:read | Yes | Deployment status grouped per resource, with failure detail |
export_cluster_iac | mcp:read | Yes | Export the cluster’s Stacks as an Infrastructure-as-Code YAML document |
validate_stack | mcp:read | Yes | Validate a Stack specification without applying it |
list_available_charts | mcp:read | No | Browse the Helm chart catalog with search and category filters |
create_stack | mcp:write | Yes | Create a new Stack on the cluster |
update_stack | mcp:write | Yes | Update a Stack’s add-ons, manifests, or configuration |
rename_stack | mcp:write | Yes | Rename a Stack |
redeploy_stack | mcp:write | Yes | Re-deploy a Stack to reconcile it onto the cluster |
clone_stack | mcp:write | Yes | Clone a Stack within or across clusters |
addon_install | mcp:write | Yes | Install a chart from the catalog into a Stack |
delete_stack | mcp:write | Yes | Delete an entire Stack and everything it deployed |
uninstall_addon_from_stack | mcp:write | Yes | Uninstall one add-on from a deployed Stack |
disconnect_manifest_from_stack | mcp:write | Yes | Remove a manifest from a deployed Stack |
list_stack_profiles | mcp:read | No | List reusable stack profiles, including public ones |
get_stack_profile | mcp:read | No | A stack profile’s metadata, version history, and contents |
create_stack_profile | mcp:write | Yes | Save a deployed Stack as a new reusable stack profile |
save_stack_profile_version | mcp:write | Yes | Snapshot a deployed Stack as a new version of an existing profile |
update_stack_profile | mcp:write | Yes | Update a stack profile’s metadata |
delete_stack_profile | mcp:write | Yes | Delete a stack profile and all its versions |
instantiate_stack_profile | mcp:write | Yes | Instantiate a stack profile onto the cluster |
validate_cluster_manifest | mcp:read | No | Validate an ImportCluster YAML the way ankra cluster validate and the API do, without changing anything |
apply_cluster_manifest | mcp:write | No | Apply an ImportCluster YAML declaratively: the cluster’s definition is replaced by the manifest (stacks.write) |
stage_cluster_manifest_drafts | mcp:write | No | Stage every stack in an ImportCluster YAML as a draft for a person to promote |
roll_cluster_to_version | mcp:write | Yes | Roll the whole cluster definition back to an earlier resource version (clusters.operate) |
export_stack_profile_iac | mcp:read | No | Export a published profile version as ClusterInfrastructureAsCode YAML |
import_stack_profile | mcp:write | No | Create a stack profile from a ClusterInfrastructureAsCode YAML document |
Add-ons
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_addons | mcp:read | Yes | List installed add-ons with sync status, health, and version |
get_addon_details | mcp:read | Yes | One add-on in detail, including its resource tree |
get_addon_status | mcp:read | Yes | Status of the add-ons Ankra manages on the cluster |
get_addon_history | mcp:read | Yes | Deployment history: previous versions and sync operations |
get_addon_settings | mcp:read | Yes | An add-on’s settings (chart version, namespace, sync options) |
get_addon_configuration | mcp:read | Yes | An add-on’s Helm values, with secret values redacted |
sync_addon | mcp:write | Yes | Trigger a sync to apply pending changes from the source repository |
rollback_addon | mcp:write | Yes | Roll an add-on back to a previous deployment version |
update_addon_settings | mcp:write | Yes | Update an add-on’s settings |
update_addon_configuration | mcp:write | Yes | Update an add-on’s Helm values |
list_helm_registries | mcp:read | No | The organisation’s connected Helm registries with sync state (credentials never returned) |
get_helm_registry | mcp:read | No | One registry with a page of the charts it holds |
list_helm_registry_sync_jobs | mcp:read | No | A registry’s sync jobs, to see whether a missing chart simply has not synced |
list_helm_registry_credentials | mcp:read | No | Stored registry credentials by name and id only |
sync_helm_registry | mcp:write | No | Re-read a registry’s index now (helm.manage) |
get_chart_default_values | mcp:read | No | A chart version’s default values.yaml |
render_chart_template | mcp:read | No | Render a chart version’s manifests server-side like helm template, with optional values |
get_chart_details | mcp:read | No | Detailed chart information at a repository URL: maintainers, versions, app versions |
Applications
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_applications | mcp:read | No | List the organisation’s applications with state and analysis status |
get_application | mcp:read | No | One application’s repository, artifacts, pull request, and lifecycle state |
get_application_jobs | mcp:read | No | The platform jobs behind an application’s analysis and generation |
get_application_deployments | mcp:read | No | Where an application is deployed and its readiness |
list_application_installations | mcp:read | No | List the installations of an application across clusters |
list_application_workflow_runs | mcp:read | No | CI workflow runs for an application’s repository |
get_application_workflow_run_jobs | mcp:read | No | Jobs and step detail for one application workflow run |
create_application | mcp:write | No | Connect a repository as a new application and start analysis |
deploy_application | mcp:write | No | Deploy an application onto a cluster as part of a Stack |
retry_application | mcp:write | No | Re-run analysis and generation after a failure |
reconcile_application | mcp:write | No | Re-evaluate an application against its repository and refresh its state |
rerun_application_workflow | mcp:write | No | Re-run a CI workflow run for an application |
delete_application | mcp:write | No | Disconnect an application from Ankra |
get_application_setup_proposal | mcp:read | No | The generated setup: detected stack, setup PR, database, and the deploy contract with its negotiable options |
revise_application_setup | mcp:write | No | Change a recorded deploy-contract default; commits the revised contract to the setup branch |
get_application_publish_readiness | mcp:read | No | Whether the repository can publish images - registry, Actions secrets, publish step, and an actually-pushed image |
list_application_env_secrets | mcp:read | No | Stored environment-secret keys (values are never returned) |
set_application_env_secret | mcp:write | No | Store one environment-secret value (API-token only - chat surfaces never carry secret values) |
delete_application_env_secret | mcp:write | No | Remove one stored environment-secret key |
apply_application_env_secrets | mcp:write | No | Seal the stored secrets into every deployment and roll the workloads |
get_application_auto_deploy | mcp:read | No | Whether push-to-deploy is enabled and the build watermark it converges from |
set_application_auto_deploy | mcp:write | No | Turn push-to-deploy on or off (enabling stamps the current build; a manual rollback is never fought) |
get_application_container_security | mcp:read | No | Image CVEs from the pipeline’s scans plus Dependabot and OSV |
get_application_code_security | mcp:read | No | SAST and IaC findings from the pipeline’s scan artifacts |
get_preview_domain | mcp:read | Yes | The DNS zones and hostname suffix a cluster may publish on - always consult before proposing a public hostname |
Credentials
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_credentials | mcp:read | No | List every credential across all providers, with availability and sync state |
get_credential | mcp:read | No | One credential’s identity, availability, and dependents - secret fields are always redacted |
validate_credential_name | mcp:read | No | Check whether a credential name is valid and free to use |
get_github_credential_usages | mcp:read | No | Everything that depends on a GitHub credential |
verify_github_credential | mcp:read | No | Probe a GitHub App credential’s installation and report each check |
get_github_credential_activity | mcp:read | No | Recent GitHub App installation activity events for a credential |
plan_github_credential_replacement | mcp:read | No | Build the plan for rotating a deprecated GitHub OAuth credential to a GitHub App credential |
list_provider_credentials | mcp:read | No | List cloud provider and SSH key credentials |
list_gitops_credentials | mcp:read | No | List GitHub credentials available for GitOps |
list_gitops_repositories | mcp:read | No | List repositories reachable under a GitHub credential |
delete_credential | mcp:write | No | Delete a credential that is not in use |
replace_github_credential | mcp:write | No | Apply a planned GitHub credential rotation (organisation admins only) |
Variables
Variables are the plain-text configuration values stack definitions interpolate with${{ ankra.variables.* }} - never secrets (the platform refuses secret-looking values; secrets travel SOPS-encrypted).
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_organisation_variables | mcp:read | No | The organisation-wide variables every cluster inherits |
list_cluster_variables | mcp:read | Yes | One cluster’s variables, overriding same-named organisation variables |
set_organisation_variable | mcp:write | No | Create or update (upsert) an organisation variable |
delete_organisation_variable | mcp:write | No | Delete an organisation variable |
set_cluster_variable | mcp:write | Yes | Create or update (upsert) a variable on one cluster |
delete_cluster_variable | mcp:write | Yes | Delete a variable from one cluster |
GitOps
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_gitops_conflicts | mcp:read | No | Open GitOps merge conflicts: resources changed in both Git and the cluster |
get_gitops_conflict_diff | mcp:read | No | The Git, cluster, and base sides of one conflict, with secrets redacted |
resolve_gitops_conflict | mcp:write | No | Resolve one GitOps merge conflict by picking the winning side |
get_gitops_status | mcp:read | Yes | The cluster’s sync state: repository, branch, credential, last and pending commits, plus credential_missing and source_mismatch |
Source Control & Workspaces
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
github_list_repositories | mcp:read | No | List GitHub repositories the connected account can reach |
github_list_repository_files | mcp:read | No | List files and directories in a repository |
github_read_file | mcp:read | No | Read one file from a repository |
github_list_workflow_runs | mcp:read | No | Recent GitHub Actions workflow runs for a repository |
github_get_workflow_run_jobs | mcp:read | No | Jobs and step-level detail for one workflow run |
github_get_job_logs | mcp:read | No | Log output for one GitHub Actions job |
github_list_artifacts | mcp:read | No | GitHub Actions artifacts for a repository |
github_download_artifact | mcp:read | No | Download and read the contents of an artifact |
github_commit_files | mcp:write | No | Commit one or more files to a repository |
github_create_pull_request | mcp:write | No | Create a pull request with file changes |
scm_create_pull_request | mcp:write | No | Open a pull request on a GitHub repository - the pull request itself is the review gate |
workspace_search_code | mcp:read | No | Search an application’s source repository from an ephemeral, locked-down workspace |
workspace_read_file | mcp:read | No | Read one file from an application’s source repository via an ephemeral workspace |
workspace_list_files | mcp:read | No | List an application repository’s files via an ephemeral workspace |
deploy_pr_demo | mcp:read | No | Deploy a throwaway, time-limited demo of a pull-request build into an isolated namespace; returns a public preview_url when a demo domain or active cluster DNS zone is configured |
demo_stop | mcp:read | No | Tear down a pull-request demo |
get_demo_diagnostics | mcp:read | No | Read a demo’s tracked record plus a log tail of its container’s most recent start attempt - the crash evidence behind a failed demo |
redeploy_demo | mcp:read | No | Redeploy an existing PR or branch demo with its recorded identity so the application’s saved demo configuration applies |
get_application_demo_config | mcp:read | No | Read an application’s saved demo environment defaults and throwaway-database flag |
update_application_demo_config | mcp:read | No | Replace an application’s saved demo configuration (the pre-setup every future demo inherits); affects only TTL-reaped demo namespaces |
Observability & Alerts
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_alerts | mcp:read | No | The organisation’s alert definitions, firing state, and alert metrics |
create_alert | mcp:write | No | Create an alert definition with rules in the evaluator’s vocabulary (cluster state, GitOps sync, metric thresholds, metrics stopped flowing, security findings, resource state, job status); a rule naming no clusters targets the bound cluster |
set_alert_enabled | mcp:write | No | Enable or mute one alert; muting keeps the firing history and settles its open incidents |
delete_alert | mcp:write | No | Permanently delete an alert definition, its rules and its firing history |
query_prometheus | mcp:read | Yes | PromQL instant query against the cluster’s Prometheus |
query_prometheus_range | mcp:read | Yes | PromQL range query over a time window |
list_alert_destinations | mcp:read | No | The Slack / Teams / Discord / PagerDuty / webhook endpoints notifications deliver to (webhook URLs redacted to their host) |
list_notification_routes | mcp:read | No | The rules that filter notifications by kind, severity, cluster and source onto destinations |
preview_notification_routing | mcp:read | No | Dry-run a hypothetical notification through the organisation’s routing and report every delivery, suppression and reason |
create_notification_route | mcp:write | No | Route matching notifications to an existing destination |
update_notification_route | mcp:write | No | Change one route’s filters, destination, priority, mode or enabled state |
delete_notification_route | mcp:write | No | Delete a route; what gets delivered or suppressed changes immediately |
test_notification_route | mcp:write | No | Queue a sample notification through a route’s destination (alerts.write) |
Security Center
The organisation-wide CVE surface with CISA KEV and EPSS exploitation intelligence;get_security_reports / get_compliance_reports above stay the per-cluster Trivy summaries.
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
get_security_overview | mcp:read | No | Fleet security summary: totals by severity, fixable counts, CISA KEV exposure, scanner coverage and top remediation candidates |
list_security_findings | mcp:read | No | Findings across every scanned cluster, exploited-in-the-wild first, with rich filters |
get_security_finding | mcp:read | No | One finding with its exploitation intelligence and every current occurrence |
get_security_advisory | mcp:read | No | The platform’s advisory for any CVE id: parsed NVD/OSV record, CISA guidance and your fleet exposure |
list_security_cluster_posture | mcp:read | No | Per-cluster finding counts, known-exploited exposure and scanner freshness |
Backup Vaults
Available while the organisation’s backups feature is enabled; vault creation with your own bucket keys, and restores, stay in the portal and CLI.| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_backup_vaults | mcp:read | No | The S3-compatible vaults backups and migration data move through, with verification status |
get_backup_vault | mcp:read | No | One vault’s provider, bucket, verification status and error excerpt (credentials never returned) |
list_backup_vault_imports | mcp:read | No | The data imports a vault holds, with upload status, databases and restore progress |
provision_backup_vault | mcp:write | No | Create a vault and let Ankra create its bucket from a stored credential (backups.manage) |
verify_backup_vault | mcp:write | No | Re-run the credential check against a vault’s bucket (backups.operate) |
Provisioning & Nodes
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_instance_types | mcp:read | No | Instance types and pricing per cloud provider |
list_proxmox_options | mcp:read | No | Provisioning options a Proxmox VE credential can reach |
list_morpheus_options | mcp:read | No | Provisioning options an HPE Morpheus credential can reach |
create_hetzner_cluster | mcp:write | No | Create and provision a Kubernetes cluster on Hetzner Cloud |
create_ovh_cluster | mcp:write | No | Create and provision a Kubernetes cluster on OVHcloud |
create_upcloud_cluster | mcp:write | No | Create and provision a Kubernetes cluster on UpCloud |
create_digitalocean_cluster | mcp:write | No | Create and provision a Kubernetes cluster on DigitalOcean |
create_proxmox_cluster | mcp:write | No | Create and provision a Kubernetes cluster on Proxmox VE |
create_morpheus_cluster | mcp:write | No | Create and provision a Kubernetes cluster on HPE Morpheus |
list_cluster_nodes | mcp:read | No | The provisioned VM nodes of a cluster, with live provider status |
restart_node | mcp:write | No | Restart one provisioned node - control plane, worker, or bastion |
ssh_diagnose_node | mcp:read | No | Diagnose a node at the OS level over SSH via the bastion |
ssh_repair_node | mcp:write | No | Repair a node’s Kubernetes service unit through the node-recovery engine |
Cluster Lifecycle & Node Groups
Day-2 operations for Ankra-provisioned clusters on every self-managed provider (Hetzner, OVHcloud, UpCloud, DigitalOcean, Scaleway, Proxmox VE, HPE Morpheus). These tools acceptcluster_name or cluster_id directly, so they work from any conversation.
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_node_groups | mcp:read | No | Node groups, control plane topology, and worker counts for one cluster |
scale_workers | mcp:write | No | Scale the default worker pool, or one named node group |
add_node_group | mcp:write | No | Add a node group with instance type, count, and optional labels, taints, and autoscaling |
update_node_group | mcp:write | No | Change one aspect of a node group: instance type, autoscaling bounds, labels, or taints |
delete_node_group | mcp:write | No | Delete a node group and its nodes |
change_control_plane | mcp:write | No | Change the control plane’s node count or instance type (cluster must be stopped) |
stop_cluster | mcp:write | No | Stop a cluster: its virtual machines are terminated while configuration is preserved |
start_cluster | mcp:write | No | Start (re-provision) a stopped cluster, optionally control plane only |
upgrade_cluster | mcp:write | No | Upgrade the cluster’s Kubernetes version |
delete_cluster | mcp:write | No | Deprovision a cluster entirely; requires re-typing the cluster name to confirm |
Managed Kubernetes
Create and operate provider-managed control planes - EKS (AWS), AKS (Azure), GKE (Google Cloud), DOKS (DigitalOcean), UKS (UpCloud), OVHcloud MKS, and Kapsule (Scaleway).| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_managed_k8s_options | mcp:read | No | Regions, versions, and machine sizes a credential can deploy; per-cluster options and available upgrades |
create_managed_cluster | mcp:write | No | Create a managed Kubernetes cluster with one or more node pools |
list_managed_node_pools | mcp:read | No | Node pools of a managed cluster with counts and autoscaling state |
add_managed_node_pool | mcp:write | No | Add a node pool with size, count, and optional autoscaling |
update_managed_node_pool | mcp:write | No | Update a node pool’s count or autoscaling configuration |
delete_managed_node_pool | mcp:write | No | Delete a node pool |
discover_managed_clusters | mcp:read | No | The managed clusters already running behind a provider credential, marking the ones Ankra has imported |
import_managed_cluster | mcp:write | No | Adopt a managed cluster that already runs at the provider; Ankra fetches the kubeconfig and installs the agent itself |
upgrade_managed_cluster | mcp:write | No | Upgrade a managed cluster’s Kubernetes version |
stop_managed_cluster | mcp:write | No | Stop a managed cluster through provider-native power control when supported (AKS today) |
start_managed_cluster | mcp:write | No | Start a stopped managed cluster through provider-native power control when supported |
CI/CD & Deploy Analysis
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
cicd_propose_application_pipeline | mcp:read | No | Render the canonical Ankra CI/CD pipeline for a target repository |
cicd_validate_workflow_yaml | mcp:read | No | Validate a GitHub Actions workflow against Ankra’s platform invariants |
cicd_validate_chart_values | mcp:read | No | Validate Helm chart values against Ankra’s Kubernetes security defaults |
deploy_inspect_chart_values | mcp:read | Yes | Probe a chart’s values for the paths the deploy wizard cares about |
deploy_inspect_repo | mcp:read | Yes | Inspect key repository files for the application’s runtime needs |
deploy_finalize_analysis | mcp:read | Yes | Finalise a deploy analysis with the full analysis payload |
Tickets & Collaboration
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
ticket_list | mcp:read | No | List the organisation’s AI work board tickets |
ticket_get | mcp:read | No | One ticket in full: plan, review state, timeline, and links |
file_ticket | mcp:write | No | File a new ticket on the AI work board |
ticket_comment | mcp:write | No | Post a comment on a ticket |
ticket_update_status | mcp:write | No | Move a ticket through its lifecycle |
ticket_draft_plan | mcp:write | No | Write or revise a ticket’s plan document |
ticket_request_review | mcp:write | No | Ask for a review of the ticket’s drafted plan |
ticket_submit_review | mcp:write | No | Deliver a peer-review verdict on a ticket’s plan |
ticket_attach_demo | mcp:write | No | Attach a demo environment to a ticket |
ticket_assign | mcp:write | No | Assign a ticket to an agent, or clear its assignee so the board can staff it again |
list_agent_tasks | mcp:read | No | List the organisation’s AI agents with a can_work_board verdict and, when they cannot, the reason |
designate_board_worker | mcp:write | No | Designate an agent as a board worker, or remove that designation |
list_agent_runs | mcp:read | No | List the organisation’s dispatched AI agent runs, newest first |
get_agent_run | mcp:read | No | One agent run in full, optionally with its session transcript tail |
cancel_agent_run | mcp:write | No | Cancel a live agent run and its session (organisation admins only) |
Support Tickets
The support desk - the same ticketsankra support and the portal’s Support page show. These are requests to Ankra’s support team, distinct from the AI work board’s tickets above. Attachments stay in the portal and CLI because they carry file bytes.
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
list_support_tickets | mcp:read | No | The organisation’s support tickets with status, category, severity and cluster; filter by status, cluster or search text |
get_support_ticket | mcp:read | No | One ticket in full by number or id: description, the conversation with support, and attachment names |
create_support_ticket | mcp:write | No | Raise a support ticket with Ankra’s team on the user’s behalf (source agent); defaults to the session’s cluster in chat |
comment_support_ticket | mcp:write | No | Reply on a ticket as the customer; a ticket waiting on you moves back to in progress |
close_support_ticket | mcp:write | No | Close a ticket from the customer’s side, the same action as ankra support close |
Organisation & AI Posture
The organisation a token is bound to, who has access, what is parked awaiting a human decision, and how the organisation’s AI is configured. Membership, role, provider-key and endpoint writes stay in the portal and CLI.| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
get_organisation | mcp:read | No | The bound organisation: id, name, slug, member counts and organisation-wide settings |
list_organisation_members | mcp:read | No | Who has access: members, pending invites and Ankra’s service principals, with roles |
list_organisation_roles | mcp:read | No | Built-in and custom roles with the permissions each grants |
list_organisation_custom_dns_zones | mcp:read | No | The DNS zones the organisation’s clusters serve with their own credentials |
list_limit_requests | mcp:read | No | The latest limit-increase request per kind (billing.read) |
list_pending_actions | mcp:read | No | AI actions parked for a human decision, with risk, cluster, expiry and the bill of materials |
decide_pending_action | mcp:write | No | Approve or reject a parked action on behalf of an organisation admin; approving resumes the session that proposed it. MCP-only: in chat the action’s own card is the decision |
get_ai_settings | mcp:read | No | The active provider, which providers are configured (never the keys or endpoint addresses), and the autonomy pause state |
list_ai_models | mcp:read | No | The model catalog the chat picker offers, with tool, thinking and image support |
pause_ai_autonomy | mcp:write | No | Pause autonomous AI actions organisation-wide (ai.manage); chat and diagnosis keep working |
resume_ai_autonomy | mcp:write | No | Restore exactly what the pause turned off (ai.manage) |
Memory & Miscellaneous
| Tool | Scope | Cluster-scoped | Description |
|---|---|---|---|
search_memories | mcp:read | No | Search past conversation memories for relevant context |
save_memory | mcp:write | No | Save a fact, decision, or preference to long-term memory |
web_fetch | mcp:read | No | Fetch content from a public HTTPS URL as readable text |
Related
- MCP Server - endpoint, tokens, and client setup
- AI Assistant - the same tools in the product chat
- API Tokens