Account Tools

Tools callable over account-mcp with a wka_live_* account key. Account keys default to read-only; every grant is explicit and spend-capped.

The Account Agent can also reach in-space tools via space_-prefixed passthrough (each space_<tool> maps to <tool> in the Space Tools tabs), containment-checked against its allowed spaces.

AI

get_my_model

Scope: ai:run

Read YOUR OWN current brain model and the list of models your owner allows you to switch to (with pricing and context windows). Only works for the Account Agent's own key.

set_my_model

Scope: ai:run

Switch YOUR OWN brain model. Pick the best tool for the job — e.g. a stronger model for hard reasoning, a cheaper/faster one for routine work — from the allowed list in get_my_model. Takes effect on your very next model call (no restart). Tell your owner when you switch and why.

Billing

get_commerce_status

Scope: billing:read

Check whether the account is set up to take payments, in plain terms — read this BEFORE telling the owner how to 'set up' or 'connect' payments. Returns stage (not_set_up | pending | ready), a summary to relay, a next_step (null when ready), and the spaces payments are live on. If it's already ready, there is nothing to set up. Never describe payment setup from memory, and never name the underlying payment provider — Wakato white-labels it; say 'payments' / 'get paid' / 'verify your business'.

get_usage_summary

Scope: billing:read

Recent account wallet transactions plus this key's rolling 30-day spend vs its limit.

Domains & DNS

add_dns_record

Scope: domains:write

Add a DNS record to a Wakato-purchased domain. REQUIRES OWNER APPROVAL: first call queues it; after approval, call again with approved_action_id.

assign_domain_to_space

Scope: domains:write

Assign one of the account's domains to a space (reversible; no DNS change).

delete_dns_record

Scope: domains:write

Delete a non-system DNS record from a Wakato-purchased domain. REQUIRES OWNER APPROVAL (same two-call flow as add_dns_record).

list_dns_records

Scope: domains:read

List a domain's DNS records (domains purchased through Wakato).

list_domains

Scope: domains:read

List the account's domains with verification/SSL status, expiry, auto-renew, space assignments, and email (Agent Mail) status.

purchase_domain

Scope: domains:write

Buy a domain (1 year, auto-renews yearly against the account wallet). REQUIRES OWNER APPROVAL: the first call prices it and queues the purchase; after the owner approves, call again with approved_action_id to execute. Counts against this key's spend limit. The domain arrives pointed at Wakato and email-ready. Optionally assigns it to a space.

search_domains

Scope: domains:read

Check domain availability and pricing. Pass a full domain (example.com) or a bare name to check common TLDs.

toggle_domain_auto_renew

Scope: domains:write

Turn yearly auto-renew on or off for a domain purchased through Wakato.

unassign_domain_from_space

Scope: domains:write

Remove a domain's assignment to a space.

update_dns_record

Scope: domains:write

Update a non-system DNS record on a Wakato-purchased domain. REQUIRES OWNER APPROVAL (same two-call flow as add_dns_record).

Funds & Budget

allocate_space_funds

Scope: funds:write

ADD budget to a space from the account wallet (top-up, never a replacement). Counts against this key's rolling 30-day spend limit. Check get_space_allocation first — don't allocate to a space that already has budget.

get_space_allocation

Scope: funds:read

Read one space's budget allocation (allocated / spent / remaining).

get_wallet

Scope: funds:read

Read the account wallet: total balance, unallocated amount, and per-space budget allocations.

reclaim_space_funds

Scope: funds:write

Reclaim unspent budget from a space back to the account wallet (does not count against the spend limit).

Gateway Models

disable_space_model

Scope: models:write

Remove a model from a space's gateway.

enable_space_model

Scope: models:write

Enable a model on a space's gateway so agents and apps in that space can use it.

list_available_models

Scope: models:read

List the platform model catalog (model_key, vendor, category, capabilities).

list_space_models

Scope: models:read

List the models enabled on a space's gateway.

Hubs

add_hub_discussion_reply

Scope: hubs:write

Post a reply on a discussion thread (blocked if locked).

add_hub_moderator

Scope: hubs:write

Promote a user to hub moderator. permissions is an object of booleans: approve_members, approve_products, edit_hub.

add_hub_tab

Scope: hubs:write

Add a content tab to a hub the account owns. module is a slug from list_hub_catalog (about, members, products, feed, events, discussions, resources, rooms, custom_page). config holds module-specific settings, e.g. custom_page → { paper_id }.

approve_hub_member

Scope: hubs:write

Approve a pending join request. member_id from list_hub_members (status='pending').

assign_hub_to_space

Scope: hubs:write

Operate one of the account's hubs from a space (strict 1:1 — a hub runs from one space, a space runs one hub). The space's members and agent can then fully manage the hub.

create_hub

Scope: hubs:write

Create a community hub OWNED by this account. REQUIRES OWNER APPROVAL: the first call queues it; after the owner approves, call again with approved_action_id to execute. Optionally pass space_id to also operate the hub from that space (its members/agent then manage it). publish:true goes live immediately; otherwise it's a draft.

create_hub_course

Scope: hubs:write

Create a classroom course in an owned hub (auto-creates a Classroom tab if missing). Add lessons with create_hub_lesson.

create_hub_discussion

Scope: hubs:write

Start a discussion thread in a hub the account owns (auto-creates a Discussions tab). Optionally pin/lock or set category_id.

create_hub_discussion_category

Scope: hubs:write

Create a discussion category (auto-creates a Discussions tab if missing).

create_hub_event

Scope: hubs:write

Schedule an event in an owned hub (auto-creates an Events tab if missing). starts_at is an ISO timestamp; location_type online|in_person.

create_hub_lesson

Scope: hubs:write

Add a lesson to a classroom course. content is rich text; video_url optional; attachments is an array of {url, name, type}.

create_hub_resource

Scope: hubs:write

Add a resource to the hub library (auto-creates a Resources tab if missing). Provide a url OR a file_url. Optional category groups items.

create_hub_role

Scope: hubs:write

Create a membership role for a hub the account owns (e.g. Member, Seller, VIP). auto_approve grants it without review; is_public shows it on the join page. Attach abilities with set_hub_role_permissions, join gating with set_hub_role_requirements.

create_hub_room

Scope: hubs:write

Create a room in a hub the account owns. mode audio|video. schedule.mode: always (persistent) | once (set scheduled_start/end) | daily/weekly/monthly (recurring). Access: allowed_roles[]/allowed_members[] (empty = all members); require_approval = waiting room.

delete_hub_course

Scope: hubs:write

Delete a classroom course and all its lessons. course_id from list_hub_courses.

delete_hub_discussion

Scope: hubs:write

Delete a discussion thread and its replies.

delete_hub_discussion_category

Scope: hubs:write

Delete a discussion category (threads kept, uncategorized).

delete_hub_discussion_reply

Scope: hubs:write

Delete a reply from a discussion thread (moderation). reply_id from list_hub_discussion_replies.

delete_hub_event

Scope: hubs:write

Delete a hub event. event_id from list_hub_events.

delete_hub_lesson

Scope: hubs:write

Delete a classroom lesson. lesson_id from list_hub_lessons.

delete_hub_resource

Scope: hubs:write

Remove a resource from the hub library. resource_id from list_hub_resources.

delete_hub_role

Scope: hubs:write

Delete a hub role. Fails if members still hold it — reassign them first with set_hub_member_role.

delete_hub_room

Scope: hubs:write

Delete a hub video/voice room. room_id from list_hub_rooms.

get_hub

Scope: hubs:read

Get an owned hub's overview: profile, status, member counts (approved/pending/suspended), moderator count, public URL.

get_hub_attendance

Scope: hubs:read

Room attendance overview for an owned hub (mirrors the owner Attendance dashboard): totals, per-member and per-room minutes/sessions. Only tracked rooms count.

get_hub_classroom_progress

Scope: hubs:read

Classroom completion stats: per-course lesson_count, learners, completed, in_progress. Optional course_id narrows to one course.

get_hub_membership_plan

Scope: hubs:read

Get the hub's active paid membership plan, or free:true if the hub is free.

get_hub_role

Scope: hubs:read

Get one hub role in full: its fields, assigned permission tags, and join requirements. role_id from list_hub_roles.

get_hub_stats

Scope: hubs:read

One-call overview of an owned hub: member counts, moderators, tabs, roles, and content counts (discussions, events, resources, classroom courses/lessons, rooms) plus paid-membership snapshot.

list_hub_catalog

Scope: hubs:read

Discover the building blocks for hub structure: tab_modules (about, members, products, feed, events, discussions, resources, rooms, custom_page…), permission_tags (role abilities), and role_requirement_types (join rules). Call first so add_hub_tab / set_hub_role_permissions / set_hub_role_requirements use valid slugs.

list_hub_courses

Scope: hubs:read

List an owned hub's classroom courses with lesson_count each.

list_hub_discussion_categories

Scope: hubs:read

List a hub's discussion categories.

list_hub_discussion_replies

Scope: hubs:read

List replies on a discussion thread (oldest first).

list_hub_discussions

Scope: hubs:read

List a hub's discussion threads (pinned first). Optionally filter by category_id.

list_hub_event_rsvps

Scope: hubs:read

List RSVPs for a hub event plus its going_count. event_id from list_hub_events (space-side).

list_hub_events

Scope: hubs:read

List an owned hub's events (upcoming:true filters to future events).

list_hub_lessons

Scope: hubs:read

List lessons in a classroom course (title, content, video_url, attachments, sort_order).

list_hub_members

Scope: hubs:read

List a hub's members with profile info. Filter by status (pending|approved|rejected|suspended|left).

list_hub_moderators

Scope: hubs:read

List a hub's moderators and their permissions (approve_members, approve_products, edit_hub).

list_hub_resources

Scope: hubs:read

List an owned hub's resource-library items (links/files grouped by category).

list_hub_roles

Scope: hubs:read

List a hub's membership roles (id, slug, name, auto_approve, is_public).

list_hub_rooms

Scope: hubs:read

List a hub's video/voice rooms with status and settings.

list_hub_tabs

Scope: hubs:read

List a hub's content tabs in display order (id, slug, name, module, config, sort_order, is_visible).

list_hubs

Scope: hubs:read

List the account's community hubs and which space (if any) operates each one.

reject_hub_member

Scope: hubs:write

Reject a pending join request (optional reason). member_id from list_hub_members.

remove_hub_member

Scope: hubs:write

Permanently remove a member from the hub. member_id from list_hub_members.

remove_hub_membership_plan

Scope: hubs:write

Archive the active paid plan and make the hub free.

remove_hub_moderator

Scope: hubs:write

Demote a moderator. moderator_id from list_hub_moderators.

remove_hub_tab

Scope: hubs:write

Remove a hub tab (also removes content living on it, e.g. that tab's events/resources). tab_id from list_hub_tabs.

reorder_hub_tabs

Scope: hubs:write

Set a hub's tab display order. tab_ids is the full ordered array of tab ids from list_hub_tabs.

set_hub_member_role

Scope: hubs:write

Assign a hub member to a role (omit role_id to clear). member_id from list_hub_members, role_id from list_hub_roles.

set_hub_membership_plan

Scope: hubs:write

Set/replace the hub's paid membership plan. billing one_time|subscription; price_cents ≥ 100; subscription needs billing_interval month|year. Archives any current plan.

set_hub_role_permissions

Scope: hubs:write

Replace a role's abilities. permissions is the full array of permission-tag slugs from list_hub_catalog. Empty array clears them all.

set_hub_role_requirements

Scope: hubs:write

Replace a role's join requirements. requirements is the full ordered array of { rule_type, config } using rule_type slugs from list_hub_catalog (kyc_verified, email_verified, profile_complete, has_tag {tag_slug}, answers_custom_question {question,…}, min_account_age_days {days}). Empty array clears them.

suspend_hub_member

Scope: hubs:write

Suspend a member (revokes access, keeps the row). member_id from list_hub_members.

unassign_hub_from_space

Scope: hubs:write

Disconnect a hub from its operating space. The hub stays owned by the account; only the space delegation is removed.

update_hub

Scope: hubs:write

Edit a hub the account owns: name, description, short_description, logo_url, banner_url, visibility, category, business_description, hub_fee_percent (0–100 commission), default_contract_id, media (gallery [{ id, type, url, thumbnail_url, caption }]). (Enabling commerce / status changes go through the hub's review flow.)

update_hub_course

Scope: hubs:write

Edit a classroom course (title, description, cover_url, sort_order). course_id from list_hub_courses.

update_hub_discussion

Scope: hubs:write

Edit a discussion thread — title/body, pin/lock, or category. discussion_id from list_hub_discussions.

update_hub_event

Scope: hubs:write

Edit a hub event. event_id from list_hub_events.

update_hub_lesson

Scope: hubs:write

Edit a classroom lesson (title, content, video_url, attachments, sort_order). lesson_id from list_hub_lessons.

update_hub_membership_plan

Scope: hubs:write

Patch the hub's ACTIVE paid membership plan in place (price, interval, granted role, lapse behavior).

update_hub_moderator

Scope: hubs:write

Update a moderator's permissions. moderator_id from list_hub_moderators.

update_hub_resource

Scope: hubs:write

Edit a resource in the hub library. resource_id from list_hub_resources (space-side).

update_hub_role

Scope: hubs:write

Edit a hub role's fields (name, description, icon, color, auto_approve, is_public, sort_order). role_id from list_hub_roles.

update_hub_room

Scope: hubs:write

Edit a hub room (title, description, recording, schedule, access control). room_id from list_hub_rooms.

update_hub_tab

Scope: hubs:write

Edit a hub tab (name, icon, visibility, sort_order, or merge into its config). tab_id from list_hub_tabs.

Integrations

add_integration_action

Scope: integrations:write

Add an action (a callable endpoint) to a custom integration. Once the integration is assigned to a space, each action becomes a tool that space's agents can call.

assign_ad_account_to_space

Scope: integrations:write

Give a space access to a connected ad account (from list_integrations) so its agents can create/manage campaigns on it. REQUIRES OWNER APPROVAL (two-call flow).

assign_bank_account_to_space

Scope: integrations:write

Give a space access to a connected bank account (from list_integrations) so its finance surfaces can use it. REQUIRES OWNER APPROVAL (two-call flow).

assign_composio_connection_to_space

Scope: integrations:write

Give a space access to a connected third-party app (Composio — Gmail, Outlook, Calendar…, from list_integrations) so its agents can use it. REQUIRES OWNER APPROVAL (two-call flow).

assign_custom_integration_to_space

Scope: integrations:write

Give a space access to a custom integration — its agents can then call the integration's actions. REQUIRES OWNER APPROVAL (two-call flow).

assign_social_account_to_space

Scope: integrations:write

Give a space access to a connected social account (from list_integrations) so its agents can post/manage DMs on it. REQUIRES OWNER APPROVAL (two-call flow).

create_custom_integration

Scope: integrations:write

Build a custom integration to ANY REST/HTTP API (GoHighLevel, HubSpot, an internal service…) so your agents can call it. Provide the base URL, how it authenticates, and optionally its actions (endpoints). Any credentials go straight to encrypted Vault and are never readable back. Executes immediately; the integration is UNASSIGNED until you call assign_custom_integration_to_space (owner approval). If the OWNER must supply the API key, capture it with request_secret_input first — never ask them to paste a key into chat.

delete_custom_integration

Scope: integrations:write

Permanently delete a custom integration (and its actions, events, and space assignments). Its stored credentials are wiped from Vault.

delete_integration_action

Scope: integrations:write

Remove an action from a custom integration.

list_custom_integrations

Scope: integrations:read

List the account's custom API integrations in detail — base URL, auth type, every defined action (endpoint), and which spaces each is assigned to. Use before add_integration_action / update_custom_integration.

list_integrations

Scope: integrations:read

See EVERY connected integration across the account and which spaces can use each: custom API integrations, social accounts, ad accounts, bank accounts, and third-party apps (Composio). Each item includes the id + the assign_with tool to hand it to a space. (Professional email and domains have their own tools: list_email_addresses, list_domains.)

unassign_ad_account_from_space

Scope: integrations:write

Revoke a space's access to an ad account.

unassign_bank_account_from_space

Scope: integrations:write

Revoke a space's access to a bank account.

unassign_composio_connection_from_space

Scope: integrations:write

Revoke a space's access to a third-party app connection.

unassign_custom_integration_from_space

Scope: integrations:write

Revoke a space's access to a custom integration.

unassign_social_account_from_space

Scope: integrations:write

Revoke a space's access to a social account.

update_custom_integration

Scope: integrations:write

Update a custom integration's metadata (name/description/base_url/category/instructions/data_flow_mode), disable/enable it (status), or rotate its credentials. Credentials go straight to encrypted Vault.

update_integration_action

Scope: integrations:write

Edit an existing action on a custom integration (any of method/path/headers/body_template/parameters/etc.).

Members

invite_to_space

Scope: members:write

Send an email invitation to join a space.

list_space_members

Scope: members:read

List a space's members (user ids and roles).

remove_space_member

Scope: members:write

Remove a member from a space. The space owner cannot be removed.

Phone

assign_phone_number_to_space

Scope: phone:write

Assign one of the account's existing phone numbers to a space.

create_sms_consent_page

Scope: phone:write

Create (or refresh) a public hosted SMS consent/opt-in page for a campaign draft and set it as the draft's consent_url. Carriers verify this URL anonymously. The consent_text must state: the brand name, what messages subscribers get and how often, 'Message and data rates may apply', 'Reply STOP to cancel, HELP for help', and that consent is not shared with third parties. space_id decides which space hosts the page — ask the owner if unsure; do not guess.

delete_10dlc_draft

Scope: phone:write

Delete a 10DLC brand or campaign DRAFT. Deleting a brand draft also deletes its campaign drafts. Registered brands/campaigns can only be deleted by the owner in the UI (that also deregisters them at Telnyx).

draft_10dlc_brand

Scope: phone:write

Prepare a 10DLC brand registration as a DRAFT for the owner to review and submit (submission + the $4/mo billing consent happen in Backstage → Phone Numbers). For businesses: legal name must match IRS records (CP-575) exactly and a 9-digit EIN is required, or identity verification fails. Sole proprietors register under their own legal name with a mobile number that receives an SMS verification PIN. Returns a compliance report — fix errors before telling the owner it's ready.

draft_10dlc_campaign

Scope: phone:write

Prepare a 10DLC SMS campaign as a DRAFT under a brand for the owner to review and submit ($10/mo, consented in the UI). Carriers reject vague campaigns — the description must say concretely WHO the recipients are, HOW they opt in (form, checkbox, keyword), and WHAT they receive; sample messages must identify the brand by name and match the declared use case; marketing samples need 'Reply STOP to opt out'. A public consent-page URL is strongly recommended (create_sms_consent_page can host one). Returns a compliance report.

get_10dlc_status

Scope: phone:read

Full 10DLC SMS-compliance picture: brands, campaigns (drafts included), and which phone numbers can already send SMS. Pass sync=true to refresh pending brands/campaigns from the carrier registry first — use this to poll for approval instead of asking the owner to click Refresh. US numbers cannot send SMS until an approved brand + active campaign are linked to them.

link_number_to_campaign

Scope: phone:write

Link one of the account's phone numbers to an ACTIVE 10DLC campaign so it can send SMS. Free and reversible. Campaigns auto-link existing numbers on activation — use this for numbers bought later. Sole-proprietor campaigns allow 1 number.

list_phone_numbers

Scope: phone:read

List the account's phone numbers with billing status and space assignment.

purchase_phone_number

Scope: phone:write

Purchase a phone number from search results. Bills the account wallet monthly and counts against this key's spend limit. Optionally assigns it to a space.

search_available_phone_numbers

Scope: phone:read

Search local phone numbers available for purchase (number, region, monthly cost).

update_10dlc_brand_draft

Scope: phone:write

Update a 10DLC brand DRAFT (only rows with status 'draft'). Send just the fields to change. Returns the updated draft plus a fresh compliance report.

update_10dlc_campaign_draft

Scope: phone:write

Update a 10DLC campaign DRAFT (only rows with status 'draft'). Send just the fields to change. Returns the updated draft plus a fresh compliance report.

validate_10dlc_draft

Scope: phone:read

Preflight a 10DLC draft against the same deterministic carrier-compliance lint the submission form runs: brand identification in samples, opt-in clarity, STOP/HELP language, consent URL reachability and required phrases. Loop draft → validate → fix until it passes, THEN tell the owner it's ready to submit.

Professional Email

assign_email_address_to_space

Scope: email:write

Assign one of the account's email addresses to a space so its surfaces can send from it.

create_email_address

Scope: email:write

Create a professional email address (e.g. hello@yourdomain.com) on an email-enabled domain. REQUIRES OWNER APPROVAL (two-call flow). New addresses always require send approval in Agent Mail.

enable_email_on_domain

Scope: email:write

Make one of the account's domains email-ready (Agent Mail): registers it for sending/receiving and auto-writes MX/SPF/DKIM DNS. REQUIRES OWNER APPROVAL (two-call flow). Domains bought through purchase_domain are already email-ready.

list_email_addresses

Scope: email:read

List the account's professional email addresses (Agent Mail identities) with their domain and space assignments.

unassign_email_address_from_space

Scope: email:write

Remove an email address's assignment to a space.

Profiles

create_business_account

Scope: profiles:write

Create a DRAFT business account and fill whatever details you have — the owner completes verification afterward. This does NOT verify the business, accept any agreement, or enable payments: it only saves the business record (identity-light prefill). Verifying the business, accepting the verification agreement, and the sensitive identity/ownership checks are the OWNER's step at /settings/account-details/business/:id ('Create & Verify Business Account') — the agent cannot do it. Only profile_name is required; add everything else you know and leave the rest for the owner. Sensitive verification details (date of birth, government id, id documents) are never stored here — they're collected directly during verification. Returns the account_id and what's still missing before verification.

create_profile_post

Scope: profiles:write

Publish a post to a profile's Posts feed (the owner's wall). Needs body text and/or media. media = [{ url, type:'image'|'video' }]. Add the 'posts' tab (set_profile_tabs) so visitors see the feed.

create_wakato_profile

Scope: profiles:write

Create a public Wakato Profile on one of the account's accounts. Defaults to the personal (admin) account; pass account_type 'business' + account_id (from list_profile_accounts) for a business profile. Starts with the default content tabs (personal: About, Resources; business also gets Products, Reviews). The account's FIRST profile automatically becomes its primary. is_public defaults true — the page goes live immediately. Returns the profile id and public URL.

delete_profile_post

Scope: profiles:write

Delete a post from a profile's feed.

delete_wakato_profile

Scope: profiles:write

Permanently delete a Wakato Profile (and its posts + storefront links). If it was the account's primary and other profiles remain, the newest survivor is promoted to primary automatically.

get_business_details

Scope: profiles:read

Read a business account's full details — legal/tax info, addresses, the primary representative, additional owners — plus its verification status (verified? submitted? can it get paid?) and, when not yet verified, exactly which required fields are still missing. Use this to see what's filled and what to add before the owner verifies. account_id from list_profile_accounts.

get_wakato_profile

Scope: profiles:read

Get one Wakato Profile in full: name, description, video, theme, public/primary state, custom domain, its content tabs (read-modify-write these with set_profile_tabs), and curated storefront product ids. Use before editing.

list_cloud_agents

Scope: profiles:read

List the account's cloud agents (id, name, space, status, public_token) — the pool you can embed in a profile's 'agent' tab (set_profile_tabs → cloudAgentId + cloudAgentToken).

list_my_products

Scope: profiles:read

List the account's own commerce listings (id, title, price, status) — the pool you can curate onto a business profile's storefront with set_profile_products. Product/Review CONTENT itself always comes from commerce; this is just for choosing which listings a profile features.

list_profile_accounts

Scope: profiles:read

List the accounts a Wakato Profile can be attached to: the one personal (admin) account plus any business accounts, each with its id, name, and @username. Start here — create_wakato_profile needs a business account id (personal defaults automatically).

list_profile_followers

Scope: profiles:read

List an account's followers (people/businesses following it). account_type 'admin' (personal) or 'business' + account_id from list_profile_accounts.

list_profile_following

Scope: profiles:read

List the accounts an account is following. account_type 'admin'/'business' + account_id from list_profile_accounts.

list_profile_posts

Scope: profiles:read

List posts on a profile's Posts feed (most recent first, pinned on top).

list_wakato_profiles

Scope: profiles:read

List all of the account's public Wakato Profiles (the /profile/:username pages) with their public URL, whether each is public and the account's primary, video/tab presence, and view count.

set_primary_profile

Scope: profiles:write

Make a profile the account's primary — the one the bare @username URL (/profile/:username) resolves to. Only one profile per account is primary at a time (this unsets any other). Bare-@username resolution applies to the personal account; business profiles are always addressed by their full URL.

set_profile_products

Scope: profiles:write

Choose exactly which of the account's listings appear on a BUSINESS profile's storefront (Products tab). Pass the full set of product_ids (from list_my_products) — this replaces the current selection; an empty array clears it. Only business/seller profiles have a storefront.

set_profile_tabs

Scope: profiles:write

Replace a profile's content tabs (read the current set with get_wakato_profile first, then send the full new array). Each tab = { id, label, type, isDefault?, ...type fields }. Types: 'about' (intro, optional pageId to render a Page), 'resources' (resources: [{ id,title,description,thumbnailUrl,linkUrl }]), 'page' (pageId — render one of the space's Pages), 'social' (spaceId + optional platforms[]/autoUpdate — pulls the space's social posts), 'posts' (the profile's own feed), 'products' & 'reviews' (business-only; CONTENT is pulled from commerce — you only choose whether the tab shows), 'agent' (business-only; cloudAgentId — embeds a cloud-agent widget). Products/Reviews/Agent tabs are ignored on personal profiles. An About tab is always kept.

update_account_identity

Scope: profiles:write

Edit the account HEADER identity that a profile shows but which lives on the ACCOUNT, not the profile row: @username, avatar, name/contact. account_type 'admin' (personal — display_name/first_name/last_name/avatar_url/bio/username/preferred_language) or 'business' (needs account_id from list_profile_accounts — profile_name/description/avatar_url/contact_email/contact_phone/website_url/industry/tagline/socials/username). username = 3–30 chars [a-z0-9_], globally unique.

update_business_details

Scope: profiles:write

Fill in or correct a DRAFT business account's details on an existing account_id (from list_profile_accounts). Send only the fields you're changing — partial updates are fine, so add what you have now and the owner can add the rest later. Same identity-light scope as create_business_account: this NEVER verifies the business, accepts the verification agreement, or enables payments — verification stays the owner's step. Passing owners replaces the whole additional-owners list. Returns which required fields are still missing before verification.

update_profile_post

Scope: profiles:write

Edit a post on a profile's feed (body, media, link, or pin state). Send only what changes.

update_wakato_profile

Scope: profiles:write

Edit a Wakato Profile's fields. Send only what changes. Setting is_public true/false publishes/unpublishes the page (no approval needed). custom_domain points the profile at a domain you control (pass null to clear) — DNS for the domain is managed separately.

Secrets

assign_secret_to_space

Scope: secrets:write

Give a space access to one of the account's secrets (its agents can then reference it via use_secret without seeing the value). REQUIRES OWNER APPROVAL (two-call flow).

create_secret

Scope: secrets:write

Store a secret (API key, login, token...) encrypted in the account vault. The value goes straight to encrypted storage and cannot be read back through account tools. Executes immediately (creation exposes nothing); sharing it with a space via assign_secret_to_space is what requires owner approval.

list_secrets

Scope: secrets:read

List the account's secrets (name, type, masked summary, space assignments). Values are NEVER readable through account tools.

request_secret_input

Scope: secrets:write

PREFERRED way to capture any sensitive value the owner must provide (API key, password, token, private key…). Opens a secure paste box pinned in this PM chat: the owner types the value straight into it and it goes directly to encrypted storage — you NEVER see the value, and it never appears in the chat. You only describe the SHAPE (name + which fields to collect); pass NO values. To rotate an existing secret, pass its secret_id (its type is kept). Use this instead of asking the owner to paste a secret into the chat for create_secret.

unassign_secret_from_space

Scope: secrets:write

Revoke a space's access to a secret.

Space API Keys

create_space_api_key

Scope: space_keys:write

Mint a scoped Space API key (wks_live_*) for a space this key may manage. The token is returned ONCE — use it against space-mcp / space-api for in-space work (contacts, tables, pages, automations...). Scope categories: ai, contacts, tables, pages, automations, forms, agent_mail, calendar, tasks, assets, social, messaging, documents, whiteboards, meet, phone, ads, cloud_agents, finance, integrations, secrets, wallet, apps.

list_space_api_keys

Scope: space_keys:read

List a space's API keys (metadata only — tokens are never retrievable).

revoke_space_api_key

Scope: space_keys:write

Revoke a space API key. Immediate and irreversible.

Spaces

claim_space_release

Scope: spaces:write

Claim a PURCHASED whole-space release into the account's space-snapshot library (entitlement-checked). Returns the claimed space snapshot with its typed public_id (snap_space_*) — then use create_space_from_snapshot to build the space. Artifact (agent/app) releases don't need claiming — install_snapshot takes release_id directly.

create_snapshot

Scope: spaces:write

Capture a cloud agent or Space App from a managed space into the portable snapshot library. Captures config/code only — channels, secrets, conversations and app data stay behind (they become install-time requirements). Returns the snapshot with its typed public_id (snap_agent_* / snap_app_*) — installable anywhere with install_snapshot.

create_space

Scope: spaces:write

Create a new space owned by the account. New spaces start with a $0 budget — allocate funds before running AI work. Spaces created by this key are always manageable by it, even under a space allowlist.

create_space_from_snapshot

Scope: spaces:write

Create a NEW space from a whole-space snapshot id (yours or one claimed from a purchased release) — restores its pages, forms, documents, tables, automations, booking pages, message templates, cloud agents, Space Apps, blog, assets, mail templates + signatures, email/SMS/call campaigns (as sender-less DRAFTS — no sender, no send history), call scripts, audiences, calendar events, business research, tags and contacts with fresh ids, then returns a READINESS report: missing AI models are auto-enabled and owned secrets auto-assigned; readiness.missing lists what still needs setup (secrets via request_secret_input, integrations, sending address / phone number for campaigns, a Space Computer for app agent features). Restored apps arrive consent-pending — the owner approves their capabilities. Secrets values, sending identity, live channels and message history never travel in snapshots.

get_space

Scope: spaces:read

Get a space's details, budget, and member count.

install_snapshot

Scope: spaces:write

Install a snapshot (agent or app) into a space and get a readiness report. Missing models are auto-enabled and owned secrets matching by name auto-assigned; the report's missing array lists what still needs the owner — resolve secrets with request_secret_input/assign_secret_to_space and connect integrations. Snapshots never carry secret values, channels, or data.

list_snapshots

Scope: spaces:read

List portable snapshots (cloud agents or apps) that can be installed into a space — the account's own library plus any shared into that space. Each entry reports dependency_count and whether it came from_this_space. Omit space_id to list the whole library.

list_space_snapshots

Scope: spaces:read

List the account's whole-space snapshots (structure + contents: pages, tables, automations, cloud agents, apps, contacts...), including snapshots claimed from purchased releases. Use create_space_from_snapshot with an id to rebuild one as a new space.

list_spaces

Scope: spaces:read

List the spaces this key may manage, each with its budget (allocated / spent / remaining).

update_space

Scope: spaces:write

Update a space's name, description, icon, or color.