> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # MCP Tool Reference > Every tool the Ankra MCP server exposes, with the scope each one requires and whether it targets a specific cluster. This page lists the full tool surface of the Ankra MCP server - 174 tools across clusters, Kubernetes, Stacks, add-ons, applications, credentials, GitOps, observability, provisioning, cluster lifecycle, managed Kubernetes, CI/CD, and collaboration. The same tool registry powers the AI Assistant in the product and chat over Slack, Microsoft Teams, and SCM comments, so what you can ask Ankra to do is the same everywhere. For connecting a client and creating tokens, see [MCP Server](/platform/mcp-server). Two scopes gate access: * **`mcp:read`** reaches every read-only tool, plus a curated set of safe creations (ephemeral workspace operations and throwaway pull request demos) that cannot damage existing infrastructure. * **`mcp:write`** adds the mutating tools - everything marked `mcp:write` below. Write access implies the read surface. **Cluster-scoped** tools require a `cluster_id` argument (a UUID); call `list_clusters` first to discover IDs. Ankra verifies the cluster belongs to the token's organisation before dispatch. Tools that are not cluster-scoped operate at the organisation level. Creating a credential is deliberately **not** available over MCP or chat. Creating one would mean passing the secret itself as a tool argument, and Ankra refuses mutating tool calls whose parameters contain literal secrets. Create credentials in the portal or [CLI](/reference/cli/credentials); over MCP you can list and inspect credentials (secret fields are always redacted), validate names, delete unused credentials, and plan or apply a GitHub credential rotation. ## Clusters & Kubernetes | Tool | Scope | Cluster-scoped | Description | | ------------------------------- | ----------- | -------------- | -------------------------------------------------------------------------------------- | | `list_clusters` | `mcp:read` | No | List every cluster in the organisation with state, environment, and Kubernetes version | | `get_cluster_details` | `mcp:read` | No | Detailed information about one cluster by name or ID | | `get_cluster_attention_summary` | `mcp:read` | No | The exact signals behind a cluster's Needs Attention badge | | `get_cluster_status` | `mcp:read` | Yes | Cluster health overview | | `get_cluster_snapshot` | `mcp:read` | Yes | Full cluster overview in a single call | | `get_cluster_cost` | `mcp:read` | Yes | Estimated cloud infrastructure cost for the cluster | | `get_stack_cost` | `mcp:read` | Yes | Estimated cost attributed to one Stack, derived from its namespaces | | `get_security_reports` | `mcp:read` | Yes | Trivy Operator image-vulnerability summary | | `get_cluster_bastion` | `mcp:read` | Yes | Public IP of the Ankra-managed bastion/gateway host | | `list_namespaces` | `mcp:read` | Yes | List namespaces with their status | | `get_resource_quotas` | `mcp:read` | Yes | Resource quotas and current usage per namespace | | `list_recent_executions` | `mcp:read` | Yes | Recent platform executions (deployments, write operations) | | `get_execution_details` | `mcp:read` | Yes | Full details for one execution, including steps and error excerpts | | `cluster_query` | `mcp:read` | Yes | Structured lookup against the live cluster resource index | | `cluster_search` | `mcp:read` | Yes | Full-text search over the live cluster resource index | | `cluster_describe` | `mcp:read` | Yes | Full body of one named resource from the live cluster index | | `get_pods` | `mcp:read` | Yes | Pod status, restarts, and placement, with namespace/name/label filters | | `get_pod_logs` | `mcp:read` | Yes | Logs from a specific pod | | `get_deployments` | `mcp:read` | Yes | Deployment information | | `get_statefulsets` | `mcp:read` | Yes | StatefulSet information | | `get_daemonsets` | `mcp:read` | Yes | DaemonSet information | | `get_services` | `mcp:read` | Yes | Service information | | `get_ingresses` | `mcp:read` | Yes | Ingress information | | `get_events` | `mcp:read` | Yes | Kubernetes events (Normal/Warning) | | `get_nodes` | `mcp:read` | Yes | Node information | | `get_configmaps` | `mcp:read` | Yes | ConfigMap information | | `get_secrets` | `mcp:read` | Yes | Secret metadata (never secret values) | | `get_jobs` | `mcp:read` | Yes | Job information | | `get_cronjobs` | `mcp:read` | Yes | CronJob information | | `get_pvcs` | `mcp:read` | Yes | PersistentVolumeClaim information | | `get_cluster_role_bindings` | `mcp:read` | Yes | ClusterRoleBindings and RoleBindings for RBAC analysis | | `describe_resource` | `mcp:read` | Yes | Detailed YAML/JSON for one Kubernetes resource | | `describe_resources` | `mcp:read` | Yes | Batch-fetch multiple Kubernetes resources in one call | | `restart_deployment` | `mcp:write` | Yes | Rolling restart of a deployment | | `scale_deployment` | `mcp:write` | Yes | Scale a deployment to a replica count | | `scale_statefulset` | `mcp:write` | Yes | Scale a StatefulSet to a replica count | | `delete_pod` | `mcp:write` | Yes | Delete a specific pod | | `delete_resource` | `mcp:write` | Yes | Delete any Kubernetes resource, including custom resources | | `apply_manifest` | `mcp:write` | Yes | Apply a Kubernetes manifest to create or update resources | | `patch_resource` | `mcp:write` | Yes | Patch a Kubernetes resource (strategic merge or JSON patch) | | `add_helm_registry` | `mcp:write` | No | Add a Helm chart registry to the organisation's catalog | ## Stacks | Tool | Scope | Cluster-scoped | Description | | -------------------------------- | ----------- | -------------- | ---------------------------------------------------------------------- | | `list_stacks` | `mcp:read` | Yes | List the cluster's Stacks with their add-ons, manifests, and state | | `get_stack_details` | `mcp:read` | Yes | One Stack in full, including add-on and manifest configuration | | `get_stack_history` | `mcp:read` | Yes | Version history: who changed what and when, per resource | | `get_stack_deployments` | `mcp:read` | Yes | Deployment status grouped per resource, with failure detail | | `export_cluster_iac` | `mcp:read` | Yes | Export the cluster's Stacks as an Infrastructure-as-Code YAML document | | `validate_stack` | `mcp:read` | Yes | Validate a Stack specification without applying it | | `list_available_charts` | `mcp:read` | No | Browse the Helm chart catalog with search and category filters | | `create_stack` | `mcp:write` | Yes | Create a new Stack on the cluster | | `update_stack` | `mcp:write` | Yes | Update a Stack's add-ons, manifests, or configuration | | `rename_stack` | `mcp:write` | Yes | Rename a Stack | | `redeploy_stack` | `mcp:write` | Yes | Re-deploy a Stack to reconcile it onto the cluster | | `clone_stack` | `mcp:write` | Yes | Clone a Stack within or across clusters | | `addon_install` | `mcp:write` | Yes | Install a chart from the catalog into a Stack | | `delete_stack` | `mcp:write` | Yes | Delete an entire Stack and everything it deployed | | `uninstall_addon_from_stack` | `mcp:write` | Yes | Uninstall one add-on from a deployed Stack | | `disconnect_manifest_from_stack` | `mcp:write` | Yes | Remove a manifest from a deployed Stack | | `list_stack_profiles` | `mcp:read` | No | List reusable stack profiles, including public ones | | `get_stack_profile` | `mcp:read` | No | A stack profile's metadata, version history, and contents | | `create_stack_profile` | `mcp:write` | Yes | Save a deployed Stack as a new reusable stack profile | | `save_stack_profile_version` | `mcp:write` | Yes | Snapshot a deployed Stack as a new version of an existing profile | | `update_stack_profile` | `mcp:write` | Yes | Update a stack profile's metadata | | `delete_stack_profile` | `mcp:write` | Yes | Delete a stack profile and all its versions | | `instantiate_stack_profile` | `mcp:write` | Yes | Instantiate a stack profile onto the cluster | ## Add-ons | Tool | Scope | Cluster-scoped | Description | | ---------------------------- | ----------- | -------------- | ------------------------------------------------------------------ | | `list_addons` | `mcp:read` | Yes | List installed add-ons with sync status, health, and version | | `get_addon_details` | `mcp:read` | Yes | One add-on in detail, including its resource tree | | `get_addon_status` | `mcp:read` | Yes | Status of the add-ons Ankra manages on the cluster | | `get_addon_history` | `mcp:read` | Yes | Deployment history: previous versions and sync operations | | `get_addon_settings` | `mcp:read` | Yes | An add-on's settings (chart version, namespace, sync options) | | `get_addon_configuration` | `mcp:read` | Yes | An add-on's Helm values, with secret values redacted | | `sync_addon` | `mcp:write` | Yes | Trigger a sync to apply pending changes from the source repository | | `rollback_addon` | `mcp:write` | Yes | Roll an add-on back to a previous deployment version | | `update_addon_settings` | `mcp:write` | Yes | Update an add-on's settings | | `update_addon_configuration` | `mcp:write` | Yes | Update an add-on's Helm values | ## Applications | Tool | Scope | Cluster-scoped | Description | | ----------------------------------- | ----------- | -------------- | -------------------------------------------------------------------------- | | `list_applications` | `mcp:read` | No | List the organisation's applications with state and analysis status | | `get_application` | `mcp:read` | No | One application's repository, artifacts, pull request, and lifecycle state | | `get_application_jobs` | `mcp:read` | No | The platform jobs behind an application's analysis and generation | | `get_application_deployments` | `mcp:read` | No | Where an application is deployed and its readiness | | `list_application_installations` | `mcp:read` | No | List the installations of an application across clusters | | `list_application_workflow_runs` | `mcp:read` | No | CI workflow runs for an application's repository | | `get_application_workflow_run_jobs` | `mcp:read` | No | Jobs and step detail for one application workflow run | | `create_application` | `mcp:write` | No | Connect a repository as a new application and start analysis | | `deploy_application` | `mcp:write` | No | Deploy an application onto a cluster as part of a Stack | | `retry_application` | `mcp:write` | No | Re-run analysis and generation after a failure | | `reconcile_application` | `mcp:write` | No | Re-evaluate an application against its repository and refresh its state | | `rerun_application_workflow` | `mcp:write` | No | Re-run a CI workflow run for an application | | `delete_application` | `mcp:write` | No | Disconnect an application from Ankra | ## Credentials | Tool | Scope | Cluster-scoped | Description | | ------------------------------------ | ----------- | -------------- | ------------------------------------------------------------------------------------------- | | `list_credentials` | `mcp:read` | No | List every credential across all providers, with availability and sync state | | `get_credential` | `mcp:read` | No | One credential's identity, availability, and dependents - secret fields are always redacted | | `validate_credential_name` | `mcp:read` | No | Check whether a credential name is valid and free to use | | `get_github_credential_usages` | `mcp:read` | No | Everything that depends on a GitHub credential | | `verify_github_credential` | `mcp:read` | No | Probe a GitHub App credential's installation and report each check | | `get_github_credential_activity` | `mcp:read` | No | Recent GitHub App installation activity events for a credential | | `plan_github_credential_replacement` | `mcp:read` | No | Build the plan for rotating a deprecated GitHub OAuth credential to a GitHub App credential | | `list_provider_credentials` | `mcp:read` | No | List cloud provider and SSH key credentials | | `list_gitops_credentials` | `mcp:read` | No | List GitHub credentials available for GitOps | | `list_gitops_repositories` | `mcp:read` | No | List repositories reachable under a GitHub credential | | `delete_credential` | `mcp:write` | No | Delete a credential that is not in use | | `replace_github_credential` | `mcp:write` | No | Apply a planned GitHub credential rotation (organisation admins only) | ## GitOps | Tool | Scope | Cluster-scoped | Description | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------------------- | | `list_gitops_conflicts` | `mcp:read` | No | Open GitOps merge conflicts: resources changed in both Git and the cluster | | `get_gitops_conflict_diff` | `mcp:read` | No | The Git, cluster, and base sides of one conflict, with secrets redacted | | `resolve_gitops_conflict` | `mcp:write` | No | Resolve one GitOps merge conflict by picking the winning side | ## Source Control & Workspaces | Tool | Scope | Cluster-scoped | Description | | ------------------------------ | ----------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `github_list_repositories` | `mcp:read` | No | List GitHub repositories the connected account can reach | | `github_list_repository_files` | `mcp:read` | No | List files and directories in a repository | | `github_read_file` | `mcp:read` | No | Read one file from a repository | | `github_list_workflow_runs` | `mcp:read` | No | Recent GitHub Actions workflow runs for a repository | | `github_get_workflow_run_jobs` | `mcp:read` | No | Jobs and step-level detail for one workflow run | | `github_get_job_logs` | `mcp:read` | No | Log output for one GitHub Actions job | | `github_list_artifacts` | `mcp:read` | No | GitHub Actions artifacts for a repository | | `github_download_artifact` | `mcp:read` | No | Download and read the contents of an artifact | | `github_commit_files` | `mcp:write` | No | Commit one or more files to a repository | | `github_create_pull_request` | `mcp:write` | No | Create a pull request with file changes | | `scm_create_pull_request` | `mcp:write` | No | Open a pull request on a GitHub repository - the pull request itself is the review gate | | `workspace_search_code` | `mcp:read` | No | Search an application's source repository from an ephemeral, locked-down workspace | | `workspace_read_file` | `mcp:read` | No | Read one file from an application's source repository via an ephemeral workspace | | `workspace_list_files` | `mcp:read` | No | List an application repository's files via an ephemeral workspace | | `deploy_pr_demo` | `mcp:read` | No | Deploy a throwaway, time-limited demo of a pull-request build into an isolated namespace; returns a public `preview_url` when a demo domain or active cluster DNS zone is configured | | `demo_stop` | `mcp:read` | No | Tear down a pull-request demo | ## Observability & Alerts | Tool | Scope | Cluster-scoped | Description | | ------------------------ | ---------- | -------------- | --------------------------------------------------------------------- | | `list_alerts` | `mcp:read` | No | The organisation's alert definitions, firing state, and alert metrics | | `query_prometheus` | `mcp:read` | Yes | PromQL instant query against the cluster's Prometheus | | `query_prometheus_range` | `mcp:read` | Yes | PromQL range query over a time window | ## Provisioning & Nodes | Tool | Scope | Cluster-scoped | Description | | ----------------------------- | ----------- | -------------- | ------------------------------------------------------------------------ | | `list_instance_types` | `mcp:read` | No | Instance types and pricing per cloud provider | | `list_proxmox_options` | `mcp:read` | No | Provisioning options a Proxmox VE credential can reach | | `list_morpheus_options` | `mcp:read` | No | Provisioning options an HPE Morpheus credential can reach | | `create_hetzner_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on Hetzner Cloud | | `create_ovh_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on OVHcloud | | `create_upcloud_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on UpCloud | | `create_digitalocean_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on DigitalOcean | | `create_proxmox_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on Proxmox VE | | `create_morpheus_cluster` | `mcp:write` | No | Create and provision a Kubernetes cluster on HPE Morpheus | | `list_cluster_nodes` | `mcp:read` | No | The provisioned VM nodes of a cluster, with live provider status | | `restart_node` | `mcp:write` | No | Restart one provisioned node - control plane, worker, or bastion | | `ssh_diagnose_node` | `mcp:read` | No | Diagnose a node at the OS level over SSH via the bastion | | `ssh_repair_node` | `mcp:write` | No | Repair a node's Kubernetes service unit through the node-recovery engine | ## Cluster Lifecycle & Node Groups Day-2 operations for Ankra-provisioned clusters on every self-managed provider (Hetzner, OVHcloud, UpCloud, DigitalOcean, Scaleway, Proxmox VE, HPE Morpheus). These tools accept `cluster_name` or `cluster_id` directly, so they work from any conversation. | Tool | Scope | Cluster-scoped | Description | | ---------------------- | ----------- | -------------- | ---------------------------------------------------------------------------------------- | | `list_node_groups` | `mcp:read` | No | Node groups, control plane topology, and worker counts for one cluster | | `scale_workers` | `mcp:write` | No | Scale the default worker pool, or one named node group | | `add_node_group` | `mcp:write` | No | Add a node group with instance type, count, and optional labels, taints, and autoscaling | | `update_node_group` | `mcp:write` | No | Change one aspect of a node group: instance type, autoscaling bounds, labels, or taints | | `delete_node_group` | `mcp:write` | No | Delete a node group and its nodes | | `change_control_plane` | `mcp:write` | No | Change the control plane's node count or instance type (cluster must be stopped) | | `stop_cluster` | `mcp:write` | No | Stop a cluster: its virtual machines are terminated while configuration is preserved | | `start_cluster` | `mcp:write` | No | Start (re-provision) a stopped cluster, optionally control plane only | | `upgrade_cluster` | `mcp:write` | No | Upgrade the cluster's Kubernetes version | | `delete_cluster` | `mcp:write` | No | Deprovision a cluster entirely; requires re-typing the cluster name to confirm | ## Managed Kubernetes Create and operate provider-managed control planes - EKS (AWS), AKS (Azure), GKE (Google Cloud), DOKS (DigitalOcean), UKS (UpCloud), OVHcloud MKS, and Kapsule (Scaleway). | Tool | Scope | Cluster-scoped | Description | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------------------------------------------------- | | `list_managed_k8s_options` | `mcp:read` | No | Regions, versions, and machine sizes a credential can deploy; per-cluster options and available upgrades | | `create_managed_cluster` | `mcp:write` | No | Create a managed Kubernetes cluster with one or more node pools | | `list_managed_node_pools` | `mcp:read` | No | Node pools of a managed cluster with counts and autoscaling state | | `add_managed_node_pool` | `mcp:write` | No | Add a node pool with size, count, and optional autoscaling | | `update_managed_node_pool` | `mcp:write` | No | Update a node pool's count or autoscaling configuration | | `delete_managed_node_pool` | `mcp:write` | No | Delete a node pool | | `upgrade_managed_cluster` | `mcp:write` | No | Upgrade a managed cluster's Kubernetes version | | `stop_managed_cluster` | `mcp:write` | No | Stop a managed cluster through provider-native power control when supported (AKS today) | | `start_managed_cluster` | `mcp:write` | No | Start a stopped managed cluster through provider-native power control when supported | ## CI/CD & Deploy Analysis | Tool | Scope | Cluster-scoped | Description | | ----------------------------------- | ---------- | -------------- | ----------------------------------------------------------------------- | | `cicd_propose_application_pipeline` | `mcp:read` | No | Render the canonical Ankra CI/CD pipeline for a target repository | | `cicd_validate_workflow_yaml` | `mcp:read` | No | Validate a GitHub Actions workflow against Ankra's platform invariants | | `cicd_validate_chart_values` | `mcp:read` | No | Validate Helm chart values against Ankra's Kubernetes security defaults | | `deploy_inspect_chart_values` | `mcp:read` | Yes | Probe a chart's values for the paths the deploy wizard cares about | | `deploy_inspect_repo` | `mcp:read` | Yes | Inspect key repository files for the application's runtime needs | | `deploy_finalize_analysis` | `mcp:read` | Yes | Finalise a deploy analysis with the full analysis payload | ## Tickets & Collaboration | Tool | Scope | Cluster-scoped | Description | | ----------------------- | ----------- | -------------- | ------------------------------------------------------------------ | | `ticket_list` | `mcp:read` | No | List the organisation's AI work board tickets | | `ticket_get` | `mcp:read` | No | One ticket in full: plan, review state, timeline, and links | | `file_ticket` | `mcp:write` | No | File a new ticket on the AI work board | | `ticket_comment` | `mcp:write` | No | Post a comment on a ticket | | `ticket_update_status` | `mcp:write` | No | Move a ticket through its lifecycle | | `ticket_draft_plan` | `mcp:write` | No | Write or revise a ticket's plan document | | `ticket_request_review` | `mcp:write` | No | Ask for a review of the ticket's drafted plan | | `ticket_submit_review` | `mcp:write` | No | Deliver a peer-review verdict on a ticket's plan | | `ticket_attach_demo` | `mcp:write` | No | Attach a demo environment to a ticket | | `list_agent_runs` | `mcp:read` | No | List the organisation's dispatched AI agent runs, newest first | | `get_agent_run` | `mcp:read` | No | One agent run in full, optionally with its session transcript tail | | `cancel_agent_run` | `mcp:write` | No | Cancel a live agent run and its session (organisation admins only) | ## Memory & Miscellaneous | Tool | Scope | Cluster-scoped | Description | | ----------------- | ----------- | -------------- | -------------------------------------------------------- | | `search_memories` | `mcp:read` | No | Search past conversation memories for relevant context | | `save_memory` | `mcp:write` | No | Save a fact, decision, or preference to long-term memory | | `web_fetch` | `mcp:read` | No | Fetch content from a public HTTPS URL as readable text | ## Related * [MCP Server](/platform/mcp-server) - endpoint, tokens, and client setup * [AI Assistant](/platform/ai-assistant) - the same tools in the product chat * [API Tokens](/reference/tokens)