What an external agent can do
Every MCP tool is an action from Isolation's one catalog, the same list the website, chat commands and the CLI use. Calling one is free, except agent_send.
The tools the Isolation MCP server has are the actions catalog. Everything a person can do with Isolation, from launching a session to inviting a member to reading the activity log, is written once as an action, and each action is reachable through every door: a button on the website, a command typed in Slack, Teams, Linear, Jira, GitHub or Buzz, a tool called over MCP, a command in a terminal. When an action is added it appears in all of them at once, with the same name, the same arguments and the same rules. The table below is that catalog.
What a token is
A token is one member in one organization, carrying that member's role. There is no service account and no organization-wide installation: the agent acts as you, in the organization you picked on the consent screen, and can do what you can do there and nothing you cannot. An Admin's token can stop a teammate's runaway session; a Member's token cannot. On top of the role, the rights you approved narrow the list further, so tools/list returns only what this connection may call. The rules are on OAuth, scopes and access tokens.
What it costs
Calling a tool is free. Listing, launching, opening a display, sharing its link, reading logs: none of it starts a harness or spends AI tokens. The one exception is agent_send, which asks one of the session's agents for a turn and runs on your own AI credential, exactly as /ask does in a chat. A session launched on a Cloud Server draws the organization's balance for its uptime as it would from the website; on a Connected Server it draws nothing.
How to read the table
Each row is one action: the tool name an MCP client calls, its spelling as a chat command where it has one (the full grammar is on the commands reference), what it does, and who may call it. Most actions are for members through any door. A few are also open to the agent running inside a session, which reaches them from its own MCP, pinned to that session, as described on inside the sandbox. Every call, from any door, lands in the activity log with your name, the tool, the client and the outcome.
| Tool | What it does | Right | Who can call it | |
|---|---|---|---|---|
org_statuschat: /status | Organization status What is going on in the organization right now: which servers are up, which one new sandboxes launch on, the prepaid balance, and every sandbox of yours that is running. Start here when someone asks 'what's running?' or 'is the server up?'. | org:read | read | website, chat, MCP, CLI |
workspaces_listchat: /workspaces | Your workspaces The workspaces you can launch: what each one clones, which environments it can launch with (the first is the default), and how many agents ride along. A workspace is how one person works: these are yours, not the whole organization's. | org:read | read | website, chat, MCP, CLI |
sandboxes_listchat: /sandboxes | Sandboxes Your sandboxes. Running ones by default; pass all=true for the history too. | org:read | read | website, chat, MCP, CLI |
servers_listchat: /servers | The organization's servers Every server sandboxes can run on: Cloud servers, each sandbox billed per second by its size: whether each is up, and the server sizes each offers. | org:read | read | website, chat, MCP, CLI |
server_sizes_listchat: /sizes | The server sizes you can launch Every server size across the organization's servers: a named shape (cpus of a class, memory, disk) a sandbox runs as, grouped by the server it lives on; on a Cloud server, with its price per running hour, per paused hour and per GB of egress; and preview, what a preview can show on it (level full | limited | none, the preview kinds it hosts, and why when it is not full). What sandbox_launch takes as serverSizeId. | org:read | read | website, chat, MCP, CLI |
sandbox_launchchat: /launch | Launch a sandbox Start a sandbox of one of your workspaces: an isolated sandbox with the repos cloned, the environment loaded and your agents inside. Answers as soon as the sandbox is being created: call sandbox_get to watch it become ready. If the server is asleep this wakes it, which can take a few minutes on a Cloud server; the answer says so and you can call again. | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_stopchat: /stop | Finish a sandbox Finish a sandbox: the sandbox is destroyed and its work stops. Anything not saved to the workspace is lost, so ask first unless the person told you to stop it. | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_savechat: /save | Save the sandbox's work Commit and merge the sandbox's file tree back into its workspace, so the work survives the sandbox. Do this before stopping one. (What the agents learned is not here: it is the workspace memory, saved as they go: memory_save.) | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
sandbox_resources | A sandbox's resource usage What a running sandbox uses against its server size: cpu, memory and disk as percentages of the size, egress as a total (billed per GB on a Cloud server): the last sample and the last five minutes, plus the alerts that have fired on it. Sampled every 10 seconds on a server; a Cloud sandbox is measured when asked (at most every 15 seconds). | org:read | read | website, chat, MCP, CLI |
sandbox_get | One sandbox Everything about one running sandbox: its state, its agents, its views (terminals, editors, web previews) with the links you can share, and features: what its sandbox can show (linuxDesktop: a Linux app preview) and run (agents: the agent programs its machine has: an agent whose program is missing is not available there). | org:read | read | website, chat, MCP, CLI |
sandbox_routes | How a sandbox is reached The addresses the outside world dials for one sandbox: the zone its public previews live under and the origin its view frames load from. These are the sandbox's, never its server's. (ssh for an IDE goes through a view: isolation ssh.) | org:read | read | website, chat, MCP, CLI |
views_listchat: /views | The sandbox's views, each with its link to open The sandbox's views: terminals, editors, web previews and agent chats: each with the link to open it. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
view_kinds | What views and previews there are The kinds of view (terminal · editor · agent · preview) and of preview (web, API, a Linux or Windows app, the Android emulator, an Apple simulator, a Mac app window, a model playground): each one's name, what it shows, its icon id, its default port, what a sandbox needs to show it and which clients draw it: and the review layer's words: who may open a web preview's site, who may open a preview's link, a thread list's states and the comment limits. | org:read | read | website, chat, MCP, CLI |
view_createchat: /view | Add a new view to the sandbox Add a view to a running sandbox. type 'preview' with a url like http://localhost:3000 publishes what the sandbox serves on that port at a public address you can share: this is what 'show me the preview' means (kind 'web', the default; 'api' is the same proxy for an API). A preview of kind 'android' (the Android emulator: needs a server size with nested virtualisation), 'apple-device' (an iOS/iPadOS/watchOS/tvOS/visionOS simulator) or 'apple-window' (one Mac app's window: both need a macOS sandbox) or 'linux-desktop' (a Linux app preview: ONLY its app's windows, never a desktop) or 'windows' (the same on a Windows sandbox) STARTS that screen's source in the sandbox and streams it. A Linux/Windows preview's app says which program ({match: {exe, title}}, or {installed: <an id from preview_targets>}; none = any program built from the workspace) and how the sandbox starts it when it is not running ({start, build, cwd}: commands run as the member in the workspace; a running match is shown instead). For the other kinds target names the AVD (default 'iso'), the simulator ('iPhone 17 Pro @ iOS 26.3', a device type or a UDID: default the sandbox's newest iPhone on its newest runtime), or the app's bundle id (required): one the sandbox has: preview_targets lists them, and anything else is refused; port is optional. It shows on the sandbox screen only and has no public link; closing the view stops the source. A preview of kind 'model' is a playground against the sandbox's own OpenAI-compatible model server (vLLM, Ollama, TGI: found by the sandbox, or at port; target names the package that serves it, ollama or vllm) with a live GPU panel: on the sandbox screen only, no link. 'terminal' opens a shell (optionally running a command), 'editor' an editor on a folder (its Code, Changes and Files modes: edit, commit, browse, upload and download). | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
view_handoffchat: /continue | Continue an agent's conversation with another agent \"Continue with another agent\": open a NEW agent view in the same sandbox, on the agent you choose, that carries on the conversation of an existing agent view. The new agent starts from that thread: a fork of the same agent's session when you pick the same agent and it can fork (Claude Code, Codex), otherwise a first turn in which it reads the conversation condensed and says where things stand. The original view is left exactly as it is (one view is one thread with one agent). Refused when the conversation has nothing in it yet. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
preview_targets | What a preview can show in a sandbox The choices for a pixel preview's target in a RUNNING sandbox, read from its sandbox: for 'apple-device' every simulator device type on every installed runtime ('iPhone 17 Pro @ iOS 26.3': booted, shut down, or new: made on first use) plus simulators made under their own name (by UDID); for 'android' the emulators (AVDs); for 'apple-window' the running and installed apps (bundle ids); for 'linux-desktop' the running apps with a window and the installed ones (executable names; never a shell, a terminal or a file manager: PLAN O83): a running one becomes a preview's app.match.exe, an installed one its app.installed; for 'windows' the same on a Windows sandbox (notepad.exe). An app's icon is iconUrl (a link to its PNG, loaded on demand; iconId its content's id). default is what to preselect (the newest iPhone on the newest runtime; 'iso' for android). view_create refuses a target that is not listed. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
preview_app_opchat: /app-control | Start, restart or stop a preview's app Start, restart or stop the app a 'linux-desktop' or 'windows' preview shows (PLAN O83): start runs its start (after build) as you in the workspace when it is not running; restart stops it and starts it again (a rebuild included); stop ends what the preview started. Answers the app's state: never_started · building · starting · waiting_window · running · exited (with its exit code and the last lines of its output). | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
preview_app_setchat: /app | Set the app a preview shows Set which app a running preview shows, in place (PLAN O57, O83): a 'linux-desktop' or 'windows' preview takes an app: { match?: { exe?, title? }, installed?: an id from preview_targets, start?, build?, cwd? } ({} = the default rule: any program built from the workspace): and shows ONLY that app's windows: a running match is shown, otherwise start (after build) is run as you in the workspace. An 'apple-window' preview takes app.installed (an app's bundle id) or app.match.exe (a running app from Open windows). The view keeps its id, its links and its viewers. For this sandbox only: the workspace's view keeps what it was saved with. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
view_linkchat: /share | The link to a preview The PUBLIC address of a preview: the link anyone can open. An api preview's is its address. Any other preview (a web app, a device, a desktop) streams its picture and has a link only while it is shared ( view_visibility_set watch or public): the link shows the picture live: the same page for everyone, pointers, the control lease. A web preview's SITE (the real app with the review layer) is answered as siteUrl while it is shared beyond its owner (review_share_set org or link). | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
review_share_setchat: /share-site | Who may open and review a web preview's site Who may open a web preview's SITE: the real app, served on its own link with the review layer (comments, cursors, chat). 'private' (the default): only you. 'org': members of this organization, once signed in (they can comment and be mentioned). 'link': ANYONE with the link: WARNING: they can USE and interact with the app (its pages, its forms, its data); a guest names itself to comment. Turning 'link' on makes a NEW link; leaving 'link' ends the old one at once. review_open gives the link. | sandboxes:write | write | website, chat, MCP, CLI |
review_tools_setchat: /review-tools | Turn a web preview's review tools on or off Turn a web preview's REVIEW TOOLS on or off: the layer the sandbox puts into its site (comments pinned to the page, live cursors, chat, the review toolbar). Off: the site is just the app, with nothing added (a package's preview: JupyterLab, ComfyUI: starts off; any other starts on). Who may open the site does not change ( review_share_set). A page already open takes it at its next load. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
review_openchat: /review | Open a web preview's site to review it The link that opens a web preview's SITE (the real app, with the review layer) for you, now: url carries a one-time ticket good for 5 minutes: open it at once, don't share it (share the site with review_share_set; siteUrl is the plain address). Name it by your sandbox + preview, or by link (a site address somebody sent you: a teammate's site shared with the organization, or your own). path opens that page of the app. | sandboxes:write | write | |
review_ask | Ask a paused sandbox's owner to resume it for a review From a paused sandbox's shared web site: ask the sandbox's owner to resume it for a review. One email to the owner (the visitor's name, an optional note), at most one per sandbox every 15 minutes; the visitor is never told who the owner is. | sandboxes:write | write | |
review_status | Is there a newer version of the site I am reviewing? For the review panel: whether a newer sandbox of the same workspace runs the same web preview (its site address), and whether this one has stopped. | org:read | read | |
view_visibility_setchat: /visibility | Share a preview: private, watch only or fully public Who may open a preview's public link: the preview's live PICTURE (a device, a Mac window, a Linux or Windows app). 'private' (the default): the sandbox's own people only: and turning a shared preview private closes its link at once, for everyone watching through it. 'watch': anyone with the link watches the preview live but cannot touch it. 'public': anyone with the link watches AND uses it (clicks, keys, buttons) under the control lease. For an api preview (private by default too; shared, its address is its link) 'watch' allows only reads, and 'private' leaves it on the sandbox screen only. /share then gives the link. A web preview has no picture: its real site is shared by level (review_share_set). | sandboxes:write | write | website, chat, MCP, CLI |
review_create | Add a review comment to a preview Start a review thread on a preview (any kind but api): a comment and WHERE it is: anchorKind frame (markers on the picture: pins, arrows, boxes, freehand strokes, each point 0..1 over the frame, with the frame's screenshot as image + frame), dom (an element of the real web page: anchor.dom selector, xpath, fingerprint, text quote), element (a UI element of a device or desktop: anchor.element, and the frame point in anchor.point), page (the page as a whole) or chat (a message of the preview's chat). Pictures: images [{data (WebP or JPEG, base64), w, h}], numbered in order, at most 6. Context: page (a web path + query, or a device's app · screen), pageTitle, commit, client, trail (the reviewer's last steps; typed values are never kept). The thread belongs to the preview in the workspace, so it is kept after the sandbox ends; read it with review_list, answer it with review_reply. | sandboxes:write | write | |
review_replychat: /reply | Reply to a review thread Reply to a review thread (by its id, rv-…): text, optional pictures [{data: WebP or JPEG base64, w, h}] and mentions. A reply to a reply goes to its thread. | sandboxes:write | write | |
review_listchat: /reviews | A preview's review threads The review threads on a preview (any kind but api): newest first, across every sandbox of the workspace (each names the sandbox and commit it came from): who said it, the comment, where (the anchor: markers on the frame, a page element, a UI element; the page), numbered pictures behind short-lived links, the reviewer's steps, and the replies. Name the preview through a running sandbox ( sandboxId + preview), or by workspace + preview when none runs; no preview = every preview of the workspace. Filters: state open|resolved|all (default all), page (one page's), sandbox (one sandbox's), kind comments (default) | chat (the preview's chat). A member also gets unread (the preview's count) and unread: true on each thread holding something they have not seen (review_seen with its id clears it). An agent gets its own sandbox's workspace: e.g. to fix the review points. | org:read | read | |
review_get | One review thread One review thread on a preview (or a reply, with its thread): the comment, its anchor, the page, the sandbox and commit, the reviewer's steps, short-lived links to its pictures, and its replies. | org:read | read | |
review_resolvechat: /resolve | Mark a review thread resolved Mark a review thread resolved (or open again with resolved: false). It stays on the timeline, marked with who resolved it. An agent of the sandbox may resolve what it fixed (\ | sandboxes:write | write | |
review_delete | Delete a review comment Delete a review comment and its pictures, for good: a thread's first comment takes the whole thread (its replies) with it. The workspace's owner deletes any; anybody else only their own. An organization's admin or owner may delete any member's comment in it (moderation: logged as theirs). | sandboxes:write | write | WEB_CLI_MOBILE |
review_activity | What happened on a preview's review A preview's review activity, newest first: who commented, replied or resolved (and on which page), who opened its site to review, and who changed who may open it. Name the preview like review_list. | org:read | read | |
review_notify_setchat: /review-notify | Which review comments you're told about Your review notifications (one mail every few minutes, batched): 'all' (the default): every new thread on your previews, replies and resolves in threads you're in, and mentions; 'replies': replies, resolves and mentions only; 'never': none. Without level, answers the current one. | sandboxes:write | write | website, chat, MCP, CLI |
review_send_to_agent | Hand review threads to an agent to fix Send review threads to one of the sandbox's agents as a task: by ids, or every OPEN thread of a preview (preview, optionally one page). The agent gets each thread's comment, where it is (page, element selector, text, UI element), the reviewer's steps and links to its pictures, and is asked to fix them and reply to each thread (review_reply): then resolve it. | sandboxes:write | write | |
review_seen | Mark review threads read Mark review threads read by you: every thread and reply on a preview (the inbox's unread count starts again from now; name the preview like review_list), or: with id: just that one thread (opening it clears its unread dot). Answers the preview's remaining unread. | sandboxes:write | write | |
review_members | Who can be mentioned in a review Who can be @mentioned in a review comment: the OTHER members of this organization (each one's id, name and @handle: never the caller, whom every composer's @ picker used to offer) and: when the reviewed sandbox is yours: your own agents (id and name; @name in the comment's text sends it the thread, PLAN O88). Members only. | org:read | read | |
view_delete | Close a view Remove a view from the sandbox. The sandbox keeps running; a preview's public address stops working. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
view_connectchat: /connect | Connect to a view from your own machine How to reach one of the sandbox's views from your own machine: through the isolation CLI, which carries ssh over HTTPS: no key, any network. Every door is the VIEW's own, by its id: a sandbox has no default view. A TERMINAL view answers isolation open view <id> (that very shell, in the member's terminal) and isolation connect view <id> (in a new window); an AGENT view the same for its conversation; an EDITOR view isolation connect view <id> (asks which IDE: VS Code, Cursor, Windsurf, Zed: or --ide) and one link per IDE: ssh exists only for an IDE, through the CLI, never as a line to type. A PREVIEW (web or api) answers with its preview address (the address IS its key, so a shared chat conversation is pointed at view_link / /share instead, which posts it knowingly). cli holds the commands; command is the old public ssh line, kept for older CLIs. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
ssh_keyschat: /keys | Who can ssh into this sandbox The public keys this sandbox lets in over ssh: the SSH keys of the member who launched it (their SSH credentials: added or removed, every running sandbox of theirs follows at once). Fingerprints only: never key material. A teammate's key never opens a sandbox that is not theirs. | org:read | read | website, chat, MCP, CLI |
sandbox_sshchat: /ssh | SSH access How to ssh into one of your sandboxes: its address ( ssh <sandbox>.isolation), the ~/.ssh/config entry to paste once (when the public ssh entry is available) and the one-line form, the sandbox's host key fingerprint, and your SSH keys it accepts. Works with plain ssh, scp, sftp and an IDE's Remote-SSH (VS Code, Cursor, JetBrains Gateway) from any machine with one of your SSH keys: or through the isolation CLI (isolation login sets a machine up). Nothing is ever handed out but public facts. | org:read | read | website, chat, MCP, CLI |
ssh_ticket | Open a sandbox's ssh door The isolation CLI's way to the sandbox's ssh door over HTTPS ( isolation ssh-proxy, the ProxyCommand its ~/.ssh/config block names): a ticket good for one minute that opens the door's socket on the sandbox's view origin. It opens the socket only: who gets in is still your SSH keys. | sandboxes:write | write | |
credential_catalog | What credentials you can add The add-credential menu every client draws, in order: the kinds (AI · Git · SSH · Custom · Apple signing), each kind's providers (AI: Anthropic, OpenAI, Google Gemini, OpenRouter, Cursor, GitHub Copilot, a Custom provider; Git: GitHub, GitLab, Bitbucket, another host) and, where a provider has more than one way in, the ways (a login or a key/token). Each leaf names the form and the action that adds it, with the arguments it fixes. | org:read | read | website, chat, MCP, CLI |
passkeys_list | Your passkeys The passkeys that sign in to your account: each one's name, whether it syncs between your devices, and when it was last used. | org:read | read | |
passkey_register_start | Add a passkey Step one of adding a passkey: the options this device creates it from (a one-time challenge, good for five minutes). The device's answer goes to passkey_register_finish. A sign-in older than ten minutes (on the website: always) must be confirmed first: refused with reauth_required: sign in with the emailed code again and pass the ticket it gives. | credentials:write | write | |
passkey_register_finish | Save a passkey Step two of adding a passkey: the device's answer to the challenge, verified and kept. From then on this device signs in with Face ID / Touch ID. | credentials:write | write | |
passkey_delete | Remove a passkey Remove one of your passkeys: it no longer signs in to your account (the device may still list it until you delete it there). | credentials:write | write | |
view_token | Open a view from an app A short-lived key to ONE of the sandbox's views, on the sandbox's view origin: how the native apps (and the website's frame) load a terminal, editor or agent view. Answers { origin, path, token, expiresAt }: every request and WebSocket goes to origin + path with ?token=<token>. Good for that view only, for an hour; an open WebSocket outlives it, a reconnect asks again. A preview needs none: its address is its key (view_connect, view_link). view: \"_repos\" is the sandbox's REPOSITORIES: the editor's Code and git API on the whole workspace (no Files), so a cloned repo's Changes open without an editor view. | sandboxes:write | write | |
sandbox_logschat: /logs | The sandbox's log The sandbox's own output: how it booted, what the clone did, why it failed. The first thing to read when a sandbox is stuck or errored. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
agent_sendchat: /ask | Ask an agent Send a message to one of the sandbox's agents. The agent works inside the sandbox: it can read and change the code, run commands, and use its tools: so a turn can take minutes. The send starts the turn and waits a bounded while ( wait seconds; the default depends on where you call from): if the agent has answered by then the reply comes back as text, otherwise the answer is accepted with the thread and turn id: read the reply with agent_turn, or in the sandbox's agent view. | sandboxes:write | write | website, chat, MCP, CLI |
agent_turnchat: /turn | An agent's answer The state of one turn agent_send started: running, or done with the agent's reply. Pass the thread and turnId agent_send answered with. wait (seconds) waits for the turn to end first, bounded like agent_send's. A turn the server no longer holds (it restarted, or ended long ago) is an error that says so; the agent view keeps the whole conversation. | org:read | read | website, chat, MCP, CLI |
channel_attachchat: /attach | Connect this chat to a sandbox Bind THIS chat (the channel or direct message the command is typed in) to one of your running sandboxes, so its agents can be mentioned here and answer here. Only from inside the chat: /attach in the channel. Answers with the thread key per agent. One chat belongs to one sandbox: binding a chat that is already connected moves it. | channels | write | chat only |
channel_detachchat: /detach | Disconnect a chat Stop a chat reaching a sandbox. The conversation stays where it is; the agents simply stop answering there. | channels | write | website, chat, MCP, CLI |
channels_listchat: /chats | Connected chats Which chats are connected to which sandboxes. A chat whose sandbox has finished stays listed as ended: it can be reconnected to a new one. | org:read | read | website, chat, MCP, CLI |
agents_herechat: /agents | Who is in this conversation Which of the sandbox's agents can be talked to here, and which one you are talking to. | org:read | read | chat only |
agent_pickchat: /agent | Talk to one agent Choose which of the conversation's agents your messages go to from now on. | org:read | write | chat only |
whoamichat: /whoami | Who you are here The member this connection acts as, the organization it acts in, and the rights it carries. Call it when you need to know whose workspaces and sandboxes you are looking at. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
activity_listchat: /activity | What has been happening Every action anyone in the organization took, from any door: the website, a chat app, an MCP client, a terminal, or an agent inside its sandbox. Newest first. Filter by sandbox, server, action, door, member, outcome or time. Owners and admins only. | org:admin | read | website, chat, MCP, CLI |
server_logschat: /server-logs | A server's own log The isolation-server process's log on one of the organization's machines: pairing, tunnels, launches, why a sandbox would not start. This is the MACHINE's log; sandbox_logs is a sandbox's own output. Owners and admins, because a server is the organization's. | org:admin | read | website, chat, MCP, CLI |
sandbox_changeschat: /changes | What this sandbox has changed The sandbox's uncommitted and unmerged work: which files it touched, how far ahead of the workspace it is, and whether the workspace has moved on underneath it. Read it before saving or stopping. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
sandbox_views_savechat: /keepviews | Save the sandbox's new views to its workspace Save the views this sandbox made that its workspace does not have (sandbox_changes lists them under views) as the workspace's own views, so the next sandbox opens them too: a Finish drops them otherwise. Name keys to save only those. Views the workspace already has are left as they are. | workspaces:write | write | website, chat, MCP, CLI |
sandbox_sync_keep | Save a sandbox's views and layouts to its workspace Keep this sandbox's side of its views and layouts in its workspace: a view or layout made or changed here is written into the workspace, one closed here is deleted from it. Name views (keys) and layouts (ids) as sandbox_changes lists them under sync, or all to make the workspace match this sandbox: its views, its layouts, then its files (the Sync screen's Save). | workspaces:write | write | website, chat, MCP, CLI |
sandbox_sync_take | Put a sandbox's views and layouts back to its workspace's Take the workspace's side of views and layouts into this sandbox: a view or layout made here closes, one changed or closed here becomes the workspace's again (its views started or renamed to match). Name views (keys) and layouts (ids) as sandbox_changes lists them under sync, or all to RESET the sandbox to its workspace: its layouts and views, and its changed files discarded (irreversible). | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_discardchat: /discard | Throw away this sandbox's changes Undo work in the sandbox's tree: changed files go back to the workspace as this sandbox last saved or synced it, new ones are deleted. Cloned repositories, uploads and the agents' state are not touched. Irreversible: nothing is committed anywhere first. Name paths to discard only those. | sandboxes:write | write | website, chat, MCP, CLI |
repo_commit_pushchat: /push | Commit and push a cloned repository Commit everything uncommitted in one of the sandbox's cloned repositories (changes and new files) and push it to that repository's remote branch: the only way a cloned repository's work outlives the sandbox. A push the access can't do keeps the commit in the sandbox and says so. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
sandbox_syncchat: /sync | Bring the workspace's latest into this sandbox Pull the workspace's current main into the sandbox's working tree. On a conflict the default stops and changes nothing; pass resolve to keep git's conflict markers in the tree and fix them by hand. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
sandbox_merge_abort | Undo a resolve-mode sync Abandon a sync that was pulled in with conflict markers: the working tree goes back to how it was before the pull. | sandboxes:write | write | website, chat, MCP, CLI |
file_readchat: /read | Read one of the sandbox's files One workspace-relative file from the sandbox's working tree, as text. Pass ref 'workspace' to read the WORKSPACE's version instead: that is how you compare what changed. Text only, capped at 1MB. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
file_write | Write one of the sandbox's files Replace one workspace-relative file in the sandbox's working tree with the text given. stage also marks it resolved, which is what you do after fixing a sync conflict by hand. | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_renamechat: /rename | Rename a sandbox Give a sandbox a name a person can recognise. An empty name resets it to its id. | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_pausechat: /pause | Pause a sandbox Stop the sandbox's container without destroying it. Its files and its branch survive; sandbox_resume brings it back. Use this instead of stopping when the work is not finished. A GPU sandbox's pause releases its GPU and its resume starts a fresh one: only the workspace comes back: work in a cloned repository that is not pushed is lost. | sandboxes:write | write | website, chat, MCP, CLI |
sandbox_resumechat: /resume | Resume a paused sandbox Start a paused sandbox's container again, with its files and branch as they were. | sandboxes:write | write | website, chat, MCP, CLI |
preview_app_relaunchchat: /relaunch | Relaunch an Android preview's app Start the app on an Android preview's emulator again (force-stop, then its launcher activity): package, or the app that was in front when the emulator last went down: what a resume does by itself when the emulator had to cold-boot (PLAN O55). Its in-memory state is gone; the app starts fresh. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
preview_devicechat: /device | A device preview's power Where an Android emulator or iOS/iPadOS simulator preview is: starting, on, failed, or asleep (put to sleep: it starts again when someone opens the preview or an action uses it): with what can be done now (start it, put it to sleep, restart it, reset it to factory), each naming its action. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
preview_device_powerchat: /power | Start a device preview or put it to sleep Start an Android emulator or iOS/iPadOS simulator preview ( on: true: one put to sleep, before installing an app on it with adb or simctl from a terminal, which does not wake it; one already on is left as it is), or put it to sleep (on: false: the emulator saves its state and stops, the simulator shuts down keeping its apps and data; the next use starts it again from there). With wait (the default for an agent, the MCP, a terminal and a chat) a start answers once the device shows its screen, or after about 40 s while it still boots. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
preview_device_restartchat: /device-restart | Restart a device preview Stop an Android emulator or iOS/iPadOS simulator preview and start it again (what the preview's Retry does): asleep, it just starts. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
preview_device_resetchat: /device-reset | Reset a device preview to factory Every sandbox you have run in this organization, newest first: its server, server size, when it ran, what it was charged and how many AI tokens it used: with the organization's balance. | sandboxes:write | read | website, chat, MCP, CLI, and the agent inside the session |
sandbox_state_setchat: /set-sandbox-state | Save a sandbox screen's layout Replace the sandbox screen's working copy ( config: its layouts and view specs) and/or the environment manifest it now runs (envItems, after a restart). Last writer wins; the workspace is untouched. | sandboxes:write | write | WEB_CLI_MOBILE |
view_update | Rename or restyle a view Change a view's label, or a terminal's colour scheme. The view keeps running. | sandboxes:write | write | website, chat, MCP, CLI |
preview_elementschat: /elements | What a preview shows Read what a preview shows NOW: a WEB preview's page (loaded in a headless browser inside the sandbox at the preview's own address: is the app running, what does it show) or a device or app preview (the Android emulator, an iOS Simulator, a Mac, Linux or Windows app preview): the app and screen in front (a page: its host, title and path) and every UI element on it as rows: role, label, identifier (a web element's id, data-testid or name), where it is (0..1 of the screen), its depth and path in the tree, each with a line to print. After changing the app pass fresh: true (it waits for the screen to settle; a web page is reloaded and its network left to settle) and picture: true to also get the screen as a JPEG image. A web page is laid out 1280 px wide; width: 390 reads its phone layout. Narrow it with query (text in a label or id, or a role such as button) or at ({x, y}, 0..1: the elements under that point). Read-only: it never taps or types, and a field's label is its name or hint, never what was typed into it. The first read of a web page may answer that a browser is being made ready: ask again after the time it says. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
terminal_shellschat: /shells | Which shells a terminal can switch to The shells installed in a RUNNING sandbox that a terminal view can switch to (Linux: bash, and zsh or fish when the image has them; Windows: Git Bash, PowerShell, Windows PowerShell, cmd), the one the terminal runs now ( current) and the program running in its foreground, if any (busy: a switch would end it). terminal_shell_set switches; with one shell there is nothing to switch to. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
terminal_shell_setchat: /shell | Switch a terminal's shell Restart a terminal view's process in another shell installed in the sandbox (an id from terminal_shells: bash, zsh, fish; on Windows bash = Git Bash, pwsh, powershell, cmd): for this sandbox only: the workspace's view keeps no shell, and the view's start command is not run again. When a program runs in the terminal's foreground the switch is refused (code busy, naming it) unless force is true: a switch ends it. | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
sandbox_restartchat: /restart | Restart a sandbox with its environment's current values Recreate the sandbox's container so a changed environment takes effect: variables and secret files are baked in when a container is created, so editing them does nothing until this. The sandbox id, its files and its views survive; processes inside it stop. Answers as soon as the container is creating. | sandboxes:write | write | website, chat, MCP, CLI |
workspace_createchat: /new-workspace | Create a workspace Make a workspace: a name, the repositories to clone, and the environments it can launch with (the first is the default). It is yours: teammates cannot see it. Add its variables and files with environment_values_set afterwards. | workspaces:write | write | website, chat, MCP, CLI |
workspace_update | Change a workspace Edit a workspace: its name, repositories, environments, packs, views or layouts. Pass rev from workspaces_list to be told if somebody changed it underneath you instead of overwriting them. Leaving environments or packs out keeps the ones it has. | workspaces:write | write | website, chat, MCP, CLI |
workspace_fileschat: /files | A workspace's saved files What a workspace's saved file tree holds: every path and its size, as of the last sandbox save. This is what an export shares when it includes the files. It lists the tree as saved, never a running sandbox's unsaved changes. | org:read | read | website, chat, MCP, CLI |
workspace_export | Export a workspace A portable .isoworkspace archive of one of your workspaces: its definition (repositories, views, layouts; never a secret or an environment value) and, unless files is false, its saved files as they are on main: one commit, never the history. Answers a download link valid for five minutes. | org:read | read | WEB_CLI_MOBILE |
workspace_import | Import a workspace Start importing a .isoworkspace archive as a NEW workspace of yours. Answers a single-use upload link valid for five minutes: POST the archive's bytes to it once and the answer is the new workspace. Environments start empty: an archive never carries a value. | workspaces:write | write | WEB_CLI_MOBILE |
workspace_delete | Delete a workspace Remove a workspace, its environments' values (secrets included) and its stored file tree. Irreversible. Sandboxes launched from it keep running but can no longer save to it: stop them first if you mean to. | workspaces:write | write | website, chat, MCP, CLI |
environment_valueschat: /values | An environment's variables and files What one environment of a workspace carries: variables and files, which of them are secret, and whether each secret has a value yet. A secret's value is never returned: not here, not anywhere. | org:read | read | website, chat, MCP, CLI |
environment_values_set | Set an environment's variables and files Write the values of ONE environment: variables and files, plain or secret. This REPLACES that environment's values: send the whole set. A secret with no value is declared but unset, which is how you say 'this must be filled in'. | workspaces:write | write | website, chat, MCP, CLI |
environment_rename | Rename an environment Rename one of a workspace's environments, moving its variables and files with it. Do this rather than editing the environment list: the list alone cannot tell a rename from a delete, and a delete takes every value with it. | workspaces:write | write | website, chat, MCP, CLI |
environment_clone | Copy an environment Make a new environment of a workspace with a copy of another's variables and files: secrets included, still encrypted. The usual way to make staging from production without retyping anything. | workspaces:write | write | website, chat, MCP, CLI |
environment_value_rename | Rename a variable or file in an environment Rename ONE value of an environment in place: a variable's name, or a file's path: keeping its value, secret ones included, without re-entering it. The answer to 'the project renamed DATABASE_URL to DB_URL' or 'the key file moved'. | workspaces:write | write | website, chat, MCP, CLI |
workspace_rename | Rename a workspace Give one of your workspaces a new name. | workspaces:write | write | website, chat, MCP, CLI |
workspace_repo_add | Add a repository to a workspace Add a repository its sandboxes clone at launch: its address (https:// or ssh), and optionally the folder under /workspace (default: the repository's name), the branch (default main) and which of your git credentials clones it. | workspaces:write | write | website, chat, MCP, CLI |
workspace_repo_edit | Change a workspace's repository Change one repository of a workspace in place: its address, its folder, its branch, or the git credential that clones it (credentialId \ | workspaces:write | write | website, chat, MCP, CLI |
workspace_repo_remove | Remove a repository from a workspace Stop cloning one repository into a workspace's sandboxes (the repository itself is untouched). Name it by its folder or its address. | workspaces:write | write | website, chat, MCP, CLI |
workspace_view_set | Add or change a workspace's view Add a view every launch of the workspace opens, or change one ( key; with no type, only the settings given change: a rename is {key, label}). The same settings as view_create: type terminal (optionally a command), editor, agent (which of your agents) or preview: kind web/api with the app's port or url (http://localhost:3000/), or a pixel kind (android, apple-device, apple-window, linux-desktop, windows, model) with its optional port, target or app. into {layoutId, path} also puts it in a layout's pane. | workspaces:write | write | website, chat, MCP, CLI |
workspace_view_delete | Remove a workspace's view Remove one of a workspace's views; every layout pane showing it becomes an empty pane. | workspaces:write | write | website, chat, MCP, CLI |
workspace_layout_set | Set a workspace's layout Add a layout to a workspace, or change one ( layoutId): its tree of panes: {type: \ | workspaces:write | write | website, chat, MCP, CLI |
workspace_layout_delete | Remove a workspace's layout Remove one of a workspace's layouts (its views stay). | workspaces:write | write | website, chat, MCP, CLI |
workspace_needs_set | Set what a workspace needs of one kind Set what a workspace's sandboxes need of ONE pack kind (workspace_needs lists the kinds): e.g. kind apple-runtime, names [\ | workspaces:write | write | website, chat, MCP, CLI |
environment_add | Add an environment Add an environment to a workspace (a name; omitted: a free one). Its variables and files are set with environment_value_set. | workspaces:write | write | website, chat, MCP, CLI |
environment_delete | Delete an environment Delete one of a workspace's environments and every variable and file in it (secrets included). A workspace keeps at least one. | workspaces:write | write | website, chat, MCP, CLI |
environment_move | Reorder an environment Move one of a workspace's environments to a position in its list; the first is the default a launch takes. | workspaces:write | write | website, chat, MCP, CLI |
environment_value_set | Set one variable or file of an environment Add or change ONE value of an environment: a variable (kind var, the default) or a file (kind file, its path under /workspace): leaving the others as they are. secret: encrypted and never shown back (omitted: as it was; new values are plain). A secret sent without a value keeps the one it has. from renames (or moves) the value called that first, keeping its value. | workspaces:write | write | website, chat, MCP, CLI |
environment_value_delete | Remove one variable or file of an environment Remove ONE value of an environment: a variable by its name or a file by its path (kind only when both share it). Its value, a secret's too, is deleted. | workspaces:write | write | website, chat, MCP, CLI |
workspace_check | Check what is typed for a workspace Check fields as a member types them, by the rules the editing actions refuse with: the same sentences: name, repoUrl (+ repoDir; answers the folder and title it would get), environment (a new name; from = the one being renamed), key + kind (a variable's name or a file's path), port (a web preview's port or address). With workspaceId, clashes with what it has too (repo = the repository being changed). | org:read | read | website, chat, MCP, CLI |
workspace_form | The workspace editor's words What the workspace editor shows: the fields' placeholders and hints, the empty lines, and (with workspaceId) its repositories and environments as rows, with their values, lines and the questions before removing. | org:read | read | website, chat, MCP, CLI |
ai_credential_createchat: /add-ai-credential | Add an AI credential Add an AI credential your agents can run on. provider: anthropic · openai · gemini · openrouter · custom (any OpenAI-compatible endpoint: baseUrl required) · github (GitHub Copilot: a fine-grained token with the Copilot Requests permission) · cursor. name is yours to choose (default: the provider's name); several of one provider are fine. value is the key. auth: \"login\" instead adds a SUBSCRIPTION: openai: a ChatGPT login (for Codex) and github: a GitHub login (for Copilot), each with a device code (the answer is a URL and a code to enter there; finish with ai_credential_complete); anthropic: a Claude login (your Claude Pro or Max subscription, for Claude Code): either value = the token claude setup-token printed (sk-ant-oat01-…), or no value: the answer is Claude's sign-in URL (Isolation signs you in itself, no sandbox needed); sign in there and finish with ai_credential_complete and the code the page shows. openrouter's baseUrl is prefilled (https://openrouter.ai/api/v1); model is the model its agents start on: required for openrouter and custom, optional elsewhere (an agent's model is changed in its view). Keys and logins are sealed and swapped by Isolation: never put in a sandbox. | credentials:write | write | website, chat, MCP, CLI |
ai_credential_complete | Finish adding an AI credential Finish a sign-in ai_credential_create started: a ChatGPT login (OpenAI) or a GitHub login (GitHub): pending until you approve the code in your browser, then the login is sealed as a credential; a Claude login (Anthropic): give the code the sign-in page showed, and the token Claude Code printed is sealed as a credential (a wrong code ends that sign-in: start again); a whole claude setup-token token (sk-ant-oat01-…) given as the code is kept as the login instead. | credentials:write | write | website, chat, MCP, CLI |
ai_credential_deletechat: /remove-ai-credential | Delete an AI credential Delete one of your AI credentials: its key or login is deleted. Allowed while agents run on it: each of them (yours, and a teammate's on a shared one) is left needing a credential and does not start until it gets one (Set credential). Running sandboxes lose it at their next call to it. ai_credentials_list names the agents on each credential, so a door can ask first. | credentials:write | write | website, chat, MCP, CLI |
ai_credential_share | Share an AI credential with the organization Professional and up, owners and admins: share one of YOUR AI keys with the organization (shared: true) or stop sharing it (false). Every member can then run agents on it; its key is swapped by Isolation and nobody else ever sees it. A login (ChatGPT, GitHub, Claude) is one person's account and cannot be shared. | credentials:write | write | website, chat, MCP, CLI |
agent_name_check | Is this agent name free? Whether a name can be one of your agents': one word of lowercase letters, digits and hyphens (2–24, a letter first), not one of your agents' names and not a teammate's @handle. Answers the clean name, available, and why not. | org:read | read | website, chat, MCP, CLI |
agent_createchat: /add-agent | Add an agent Add one of your agents: a name (its @mention handle: one word of lowercase letters, digits and hyphens, 2–24, a letter first; not one of your agents' names nor a teammate's handle), the AI credential it runs on: credentialId: one of yours from ai_credentials_list (its id or name), or a NEW key inline in credential (ai_credential_create's fields): and readWorkspace (“Read workspace on start”, default false: whenever it starts it first reads the workspace). Which views open when a sandbox launches is the WORKSPACE's (its views and layouts: an agent view bound to the agent); otherwise open it with New view → Agent, or @name it. The credential decides what runs: Anthropic (a key or a Claude login) → Claude Code, OpenAI → Codex, Google Gemini → Gemini CLI, GitHub Copilot → Copilot, Cursor → Cursor, OpenRouter or a Custom provider → an agent on that provider's model. It starts on the credential's default model; change the model in the agent's view. | credentials:write | write | website, chat, MCP, CLI |
agent_update | Change an agent Change one of your agents: its name (the same rules as agent_create), the credential it runs on (credentialId: an id or name) or readWorkspace (“Read workspace on start”). Only what you send changes. In your RUNNING sandboxes: a new name relabels its views at once (the agent itself goes by it from its next start); a new credential reaches a Cloud sandbox at once (a sandbox on a self-hosted or private host keeps what it launched with until it is relaunched, and the old credential's access stops now); readWorkspace applies to sandboxes launched afterwards. | credentials:write | write | website, chat, MCP, CLI |
agent_deletechat: /remove-agent | Delete an agent Delete one of your agents. Its credential stays (it is a card of its own); its views stay in their workspaces and say the agent is gone; a running sandbox's next call for it is refused. | credentials:write | write | website, chat, MCP, CLI |
models_listchat: /add-server | Models to pick for an agent Model ids to pick for an agent, per AI provider (anthropic, openai, google, openrouter, groq, …). OpenRouter's is its LIVE list (every model it routes to, refreshed hourly). A suggestion, not a limit: any model id the provider accepts works. credential (an id or name) answers for that credential's provider. | org:read | read | website, chat, MCP, CLI |
servers_catalog | What a Cloud server can be What a Cloud server costs: the server sizes it can offer, each with its ONE price per running hour (the same in every region and on every plan: PLAN §6), its price while paused (its disk) and egress per GB: for kind linux (the default) small, medium, large; for kind apple the macOS VMs of those shapes, each billed as the organization's 24 h Mac day in the region (dayUsd); for kind windows the Windows sizes (windows-small, windows-medium) plus the Windows remote-desktop licence per member per month (licenceUsdPerMemberMonth, when set), or why Windows is not offered: and the shapes a custom size may take per cpu class (server_size_quote prices one). Read this before server_create or server_size_create on a Cloud server. Linux GPU servers have their own list: gpu_catalog. | org:read | read | website, chat, MCP, CLI |
server_update | Change a server Change a server's label: and, on a Linux GPU server, its base (isolation, pytorch, comfyui or vllm, or {type, tag} from gpu_catalog's bases: new launches only: a running or paused sandbox keeps its image) and its volume: {sizeGb, path?} grows the private volume (it can only grow) or moves its mount path from the next launch; \ | servers:write | write | website, chat, MCP, CLI |
workspace_needs | What a workspace needs, per server The packs a workspace needs (declared, else what its last launch detected: Apple platforms, Android SDK packages, optional packages such as Chromium) and, for each server it could launch on, whether they are there, will be fetched first (a few GB, once per machine), or cannot be had by that server size: what the launch dialog says before a launch. | org:read | read | website, chat, MCP, CLI |
workspace_package_setchat: /package | Add or remove an optional package on a workspace | workspaces:write | write | website, chat, MCP, CLI |
database_listchat: /databases | List databases A workspace's databases (with workspaceId): each one's engine and major version, its mode: copy ( local: each sandbox gets its own database made from yours when it starts, each table copied, read Live or Read-only) or direct (your real database, shared by every sandbox and agent): the connection it reads (never its password), its per-table setting (the size above which a table starts Live, how many tables you set by hand, or every table Live), its seed command, the env var its URL is in; every engine's capabilities, the modes' and per-table choices' descriptions and warnings; and how much of your storage the copies use. Or a sandbox's own databases (with sandboxId, or an agent's own sandbox): each one's state (waiting for its engine, copying, seeding, ready, error), its size, when it was copied and last reset, the tables it reads Live and Read-only, and the env var (DATABASE_URL by default) that points at it. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
database_add | Add a database to a workspace Give a workspace a database, reached at the env var it names (DATABASE_URL for the first, <NAME>_DATABASE_URL for others; it overrides an environment value of that name). mode: copy (default; local): every sandbox gets its own database of the same engine and major, made from your real database (connection: the engine's URL, e.g. postgresql://…, as a user that cannot write: one that can is refused with the lines that make one: or, for an engine whose database is a file (SQLite), the file's path in your workspace, sqlite:///data/app.db) when it starts, then runs seed (a command in /workspace: migrations, test users); without a connection it starts empty and the seed builds it; reset puts it back in seconds; your database is only read. Where the engine has tables, per table it is Copy (copied), Live (read from your database, the sandbox's changes kept in the sandbox) or Read-only (read from your database, changes refused) as the engine allows: tables bigger than bigTableMb (default 1024) start Live, the rest are copied: change any table with database_table_set (database_tables lists them). direct: no copy: every sandbox and agent uses your real database at once (changes and migrations hit everyone, nothing can be reset: use a development or staging database, never production). The password is sealed and never enters a sandbox. Each engine's modes, versions and per-table choices are in database_list (engines); the engine is fetched on demand. Its next sandboxes have it: a running one keeps what it started with. | workspaces:write | write | website, chat, MCP, CLI |
database_edit | Change a workspace's database Change one of a workspace's databases: its mode (copy or direct: see database_add), its connection (a URL; without a password the kept one stays; empty removes it: a copy then starts empty), its major version, the size above which a table starts Live (MB), its seed command (empty clears it) or its env var. Per-table choices are database_table_set's. Its next sandboxes use the change; a running one keeps what it started with (database_refresh copies a running one again from the current source). | workspaces:write | write | website, chat, MCP, CLI |
database_remove | Remove a database from a workspace Remove one of a workspace's databases (and its sealed password). Its next sandboxes go without it; a running sandbox keeps its copy until it finishes. | workspaces:write | write | website, chat, MCP, CLI |
database_tableschat: /dbtables | List a database's tables A workspace database's tables (or the engine's word for them), read from your REAL database: each one's size, estimated rows and whether it has a primary key, what the automatic rule suggests for it and why (\"2.4 GB, written often → Live\": tables up to the size are copied, bigger ones Live where they can be: never Read-only), what you set by hand, and what the next sandbox does with it (Copy, Live or Read-only); the tables you set that your database no longer has. Tables are named <schema>.<table> (every schema but the system's). No sandbox is needed: we read them ourselves, read-only, with the password we keep sealed: and keep the last list, which is answered at once with its time ( refresh: true reads them again now). Where we cannot reach your database or check its certificate, one of your running Cloud Linux sandboxes reads them instead (the one you name with sandboxId, else one of this workspace's). Only for a copy with a connection. | org:read | read | website, chat, MCP, CLI |
database_testchat: /dbtest | Test a database connection Try a workspace database's connection now: the saved one (name), or a connection URL before you save it (connection; without a password, the saved database's kept one is used: only for the same user at the same host and port): we log in to your real database ourselves, read-only, and answer its version and how many tables it has (\"Connected · Postgres 17 · 42 tables\"), with a warning when its version is newer than the copies run. For a copy (the default mode) the user must not be able to write: one that can is refused ( not_read_only) with the lines that make a user that cannot. A saved database's table list is kept, so its per-table setting opens at once. Where we cannot reach it or check its certificate, one of your running Cloud Linux sandboxes tries instead. A database that is a file in your workspace (SQLite) has no connection: its file is looked at in one of this workspace's running sandboxes (\"File found · 120 KB\", or kept in Git LFS, or not there yet). Nothing is written to your database. | org:read | read | website, chat, MCP, CLI |
database_table_setchat: /dbtable | Set what sandboxes do with one table Choose what every new sandbox does with ONE table of a workspace database (a copy with a connection): copy (copied when the sandbox starts), live (read from your database; the sandbox's changes kept in the sandbox: needs a primary key) or read-only (read from your database; the app's writes to it fail), or suggested (back to the automatic rule). Your choice wins over the rule at every start; the tables you never set follow it. Running sandboxes keep what they started with (database_refresh copies one again). | workspaces:write | write | website, chat, MCP, CLI |
database_tables_all_live | Make every table Live Make every table of a workspace database (a copy with a connection) Live in its next sandboxes: read from your database, the sandbox's changes kept in the sandbox, nothing copied at start (a table without a primary key, or one views use, is still copied). Clears the tables you set by hand; set one again afterwards with database_table_set. off: true goes back to the automatic rule. | workspaces:write | write | website, chat, MCP, CLI |
database_tables_suggested | Reset a database's tables to suggested Forget every per-table choice of a workspace database (and \ | workspaces:write | write | website, chat, MCP, CLI |
database_resetchat: /dbreset | Reset a sandbox's database Put a sandbox's database copy back exactly as it was when the sandbox started (its copy and seed): in seconds, whatever its size: every change made since (writes, migrations, dropped tables; the sandbox's changes to its Live tables) is gone. Connections to it are closed. A direct database is the real one and has nothing to reset. Without a name, every copy of the sandbox. An agent resets its own sandbox's copies (run destructive migrations and tests, then reset). | sandboxes:write | write | website, chat, MCP, CLI, and the agent inside the session |
database_refresh | Copy a sandbox's database again from its source Copy a running sandbox's database again from the workspace's CURRENT source: your database as it is now, a changed connection, seed command or per-table choices: instead of what it started with. Slower than a reset (a whole copy); every change in the copy is lost. A direct database is the real one and has nothing to refresh. Without a name, every copy of the sandbox. A database added to the workspace after the launch, moved to another major version or to another mode, needs a new sandbox. | sandboxes:write | write | website, chat, MCP, CLI |
server_size_request | Ask for a server size A member with nothing to launch as asks the organization's owners and admins for a server size: they get an email pointing at the Servers page. Once an hour per member. | sandboxes:write | write | website, chat, MCP, CLI |
server_size_create | Add a server size Add a named size to a server (optionally a macOS sandbox: on Cloud, or on a self-hosted Mac that reports it: or a Linux one with nested virtualisation for the Android emulator, Cloud servers only): a cpu class (shared, the default, or dedicated), cpus, memory and disk a sandbox of it gets. On a connected server it must fit the machine (cpus in 0.5 steps, memory in 256 MB steps; shared only); on a Cloud server it must be a provider shape (1, 2, 4, 8 or 16 cpus; shared: memory in 256 MB steps, 256 MB–2 GB per cpu; dedicated: 2 GB steps, 2–8 GB per cpu) and is priced per resource at the region's rates for the organization's tier (servers_catalog). Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_size_update | Change a server size Rename or resize a server size. Applies to NEW sandboxes only: a running sandbox keeps the numbers it launched with. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_size_delete | Remove a server size Remove a server size from its server. A size sandboxes still run under is hidden from pickers and stays named on those sandboxes; a server left with no size gets its smallest one back on the next launch. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_fixed_ips | A server's fixed outgoing IPs The fixed outgoing IPs of a Cloud server: each address, the sandbox using it (or free), and the price per address-hour. A launch takes a free one for its sandbox's whole running life (given back at pause and finish); none free = a random outgoing IP. While the organization's balance is at $0, releaseNotice says when they are released unless it tops up. Not offered on GPU or macOS servers. Owner/admin. | org:read | read | website, chat, MCP, CLI |
server_fixed_ip_add | Add a fixed outgoing IP Add a fixed outgoing IP to a Cloud server's pool. Each address is charged every hour the organization holds it, in use or not (an hour started counts). A sandbox launched on the server takes a free one, so whatever it connects to sees that address. An organization whose balance stays at $0 has its addresses released after a 14-day grace (warned by mail; topping up cancels it). Not offered on GPU or macOS servers. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_fixed_ip_remove | Remove a fixed outgoing IP Remove a fixed outgoing IP from a server's pool: the address is gone for good (allow-lists naming it stop matching). Refused while a running sandbox uses it: pause or finish that sandbox first. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_remove | Remove a server Take a server out of the organization by DRAINING it: from this moment no new sandbox can start on it and nobody's default points at it, but every sandbox already running on it keeps running: with its sandbox, its views and its ability to pause and resume: and the server is torn down when the last one ends (a Cloud one's disk and sleep snapshot go with it; a connected one is just unregistered). Nothing is terminated. To end its sandboxes right now, use server_force_delete. | servers:write | write | website, chat, MCP, CLI |
server_delete_preview | What deleting a server would end Before force-deleting a server: the sandboxes still running on it and who launched each. This is the list a person must be shown and confirm: the exact sandboxes server_force_delete terminates. | org:read | read | website, chat, MCP, CLI |
server_force_delete | Force-delete a server DESTRUCTIVE. End every sandbox still running on a server: their sandboxes are destroyed and anything in them that was never saved to a workspace is lost: and then remove the server. Requires confirm: true, and refuses if sandboxes started since the preview you were shown (pass their ids as expected). server_remove is the ordinary way, which drains instead of terminating. | servers:write | write | website, chat, MCP, CLI |
members_listchat: /members | Who is in this organization Everyone in the organization with their role, and every invitation still waiting to be accepted. | org:read | read | website, chat, MCP, CLI |
member_invitechat: /invite | Invite somebody Invite an email address to the organization. They get a link; if this deployment has no mailer, the invitation waits for them in-app at their next sign-in: either way it is never lost. Inviting the same address again re-sends it with a fresh link. | org:admin | write | website, chat, MCP, CLI |
invite_revoke | Withdraw an invitation Cancel an invitation that has not been accepted. Its link stops working. | org:admin | write | website, chat, MCP, CLI |
member_role_set | Change what somebody may do Set a member's role: owner, admin or member. Only an owner may change roles, and an organization always keeps at least one owner: demoting the last one is refused rather than leaving it ownerless. | org:admin | write | website, chat, MCP, CLI |
member_remove | Remove somebody from the organization Take a member out. Their sandboxes keep running until they are stopped, but their access ends immediately: including the organization's shared AI credentials, whose tokens are revoked on the way out. | org:admin | write | website, chat, MCP, CLI |
org_leave | Leave this organization Remove yourself. If you are its only owner you cannot: make somebody else an owner first, or delete the organization. | org:admin | write | website, chat, MCP, CLI |
org_subscribe | Start a plan Start this organization's plan: Personal ($20/month with $20 of Cloud Usage credited each month, one member) or Professional ($100/month with $100 of Cloud Usage each month, unlimited members, team controls): the amounts are the Stripe catalogue's (org_subscription lists them); unused usage does not roll over; top-ups never expire. Monthly only. Answers the checkout page to open (or an embedded checkout); the card it takes is kept for auto-recharge. Owner only. Enterprise is a contract: talk to us. An organization that already has a plan changes it with org_plan_set. Where Stripe is not configured (local) the plan activates directly. | org:admin | write | |
org_plan_set | Change the plan Change an organization's existing plan: to Professional (applies now: a new monthly period starts today, the unused Personal time is prorated and the period's $100 of Cloud Usage is credited), back to Personal, or none to cancel: both wait for the end of what was paid for (org_subscription shows it), and asking for the current plan again un-schedules it. Personal is one member. Owner only. | org:admin | write | |
org_plan_preview | What a plan change would do Before changing the plan: whether it applies now or at the end of the period, what an upgrade charges right away (prorated) and to which card, and when a downgrade or a cancel lands. Changes nothing. Owner only. | org:read | read | |
org_subscription | The organization's plan Which plan the organization is on (personal, professional, the enterprise contract, or none: the welcome credit only), the subscription's state, a scheduled change if any, this period's unused Cloud Usage and when it expires, the auto-recharge rule, the plan's limits, and the plans on offer with their prices and included usage. | org:read | read | website, chat, MCP, CLI |
billing_portal | The billing portal The Stripe customer portal for this organization: the card on file, invoices and receipts. Plans change through org_plan_set, not there. Owner only. | org:admin | read | |
billing_autorecharge | Auto-recharge the balance When the organization's compute balance falls under the threshold, charge the saved card the amount and add it: checked every minute, at most once every ten. threshold: null turns it off. Owner only. | org:admin | write | |
billing_invoices | The invoices The organization's Stripe invoices, newest first: number, date, amount, status, and the links to the hosted invoice and its PDF. Owner or admin. | org:read | read | website, chat, MCP, CLI |
billing_details | The billing details What the invoices print for this organization: name, email, address, EU VAT number. Owner only. | org:read | read | |
billing_details_set | Set the billing details Set what the invoices print: name, email, address (line1, line2, city, postalCode, state, country as a two-letter code) and an EU VAT number (taxId; empty removes it). Owner only. | org:admin | write | |
billing_card_change | Change the card Start changing the organization's card: answers a setup to confirm in the page (a client secret + the publishable key); billing_card_set makes the confirmed card the one on file. Owner only. | org:admin | write | |
billing_card_set | Use the confirmed card After billing_card_change was confirmed in the page: make that payment method the organization's card for renewals, prorations and auto-recharge. Owner only. | org:admin | write | |
billing_history | The balance's history Every movement of the organization's balance that is not a sandbox's metering: top-ups, auto-recharges (and a refused one, at $0), each period's plan Cloud Usage and what of it expired unused (negative), the welcome credit, Mac days and Windows licences (negative): newest first. | org:read | read | website, chat, MCP, CLI |
cost_report | Platform costs Operator only. The month's platform cost report: revenue, cost and margin per organization, every meter against the plan's allowances, the fixed items, the capacity bars and the price card. | org:read | read | OPERATOR_DOORS |
cost_price_set | Set a platform price Operator only. Set one line of the platform's price card: a meter (or a fixed item fixed.<vendor>.<what>), its vendor, unit, USD micros per unit, the plan's included allowance and its period, a note: and stamp it verified. | org:admin | write | OPERATOR_DOORS |
cost_price_delete | Remove a platform price Operator only. Remove one line (a fixed item) from the platform's price card. | org:admin | write | OPERATOR_DOORS |
cost_nightly_run | Read the vendors' costs now Operator only. Run the nightly cost read now (each vendor's figures for the month so far). | org:admin | write | OPERATOR_DOORS |
cost_plan_set | Set the Cloudflare plan Operator only. Which Cloudflare Workers plan the account is on (free | paid): the report reads a limit as a hard stop on free, a billable overage on paid. | org:admin | read | OPERATOR_DOORS |
pricing_get | Cloud pricing Operator only. The two knobs Cloud prices are made of (pricing.ts, PLAN §6.1): the target gross margin and the ops load over raw cost: retail per size = the dearest region's cost × (1 + ops load) ÷ (1 − margin), one price per size worldwide, no plan discounts. Answers the cost cards' date and every catalogue size priced: cost per region, loaded cost, retail, margin per region; egress per GB and the Windows RDS line per member-month. | org:read | read | OPERATOR_DOORS |
pricing_set | Set Cloud pricing Operator only. Sets the target gross margin (percent, default 30) and/or the ops load over raw cost (percent, default 10): every organization's Cloud server sizes and GPU sizes are re-priced; running sandboxes keep the prices frozen at their launch: and/or the Windows remote-desktop licence price per member per month (windowsLicenceUsd: dollars, or null to unset: unset charges nothing; PLAN §6.2 proposes the figure pricing_get shows). | org:admin | write | OPERATOR_DOORS |
new_account_mail_get | New-account mail Operator only. Whether the platform operators are mailed when an address signs in to Isolation for the first time (PLAN O106): one mail per new account: the address, when, how it signed in, and the organization it created or joined. On unless an operator turned it off. | org:read | read | OPERATOR_DOORS |
new_account_mail_set | Turn the new-account mail on or off Operator only. Turns the operators' new-account mail (PLAN O106) on or off. Off drops any account still waiting for its mail; nothing is sent for it later. | org:admin | write | OPERATOR_DOORS |
plan_prices_get | The plans' prices Operator only. The two plan amounts: Personal and Professional per month: as Stripe holds them (or the defaults, $20 and $100, where Stripe has none yet), the Cloud Usage each credits per period, and whether the Worker's Stripe key is live or test. | org:read | read | OPERATOR_DOORS |
plan_prices_set | Set the plans' prices Operator only. Sets the plan amounts (USD per month): personalMonth, professionalMonth. Written to Stripe with the Worker's own key: a new monthly Price on the same product takes the lookup key (plan_personal_monthly / plan_professional_monthly), the old one is archived: existing subscriptions keep the price they were sold at. Products are created when the account has none. The Cloud Usage each plan credits is fixed in code (PLAN §6.3). | org:admin | write | OPERATOR_DOORS |
org_tier_set | Set an organization's tier Operator only. Which tier an organization is on: personal, professional or enterprise: set by hand: an Enterprise CONTRACT (the only way into Enterprise), a comped org, a support fix; with concurrency, the contract's limit on Cloud sandboxes running at once (0 = the plan's). The tier decides the limits (members, concurrent sandboxes, team controls). The self-serve path is org_subscribe (the subscription sets the tier and the webhook keeps it); an owner never sets the tier directly, or every gate would be one call away. Defaults to the caller's organization; orgId targets another. | org:admin | write | OPERATOR_DOORS |
contract_set | Write an Enterprise contract Operator only. Create an organization's Enterprise contract, or edit its open one (only the fields given change; null or \"\" clears one). A NEW contract names startsAt and endsAt (YYYY-MM-DD, UTC), interval (month | year: the BILLING interval: the fixed fees are invoiced in advance every month, or once a year for its 12 months) and paymentTerms (card: Stripe charges the saved card | invoice: Stripe sends the invoice, due in netDays). The commitment period is ALWAYS a month, on a yearly contract too: its commitment resets every month, nothing pools. Monthly amounts in USD, each zero unless given: platformFeeUsd, committedUsd (Cloud Usage credited when each month opens, like plan credit: no rollover: and invoiced with the fee), extraHostFeeUsd per private host-month beyond includedHosts (in arrears, on the month's peak), onboardingFeeUsd once on the first invoice. rateMultiplier prices this org's usage at list × it (never below our cost); overagePolicy (list | contract) is the rate usage beyond the commitment is invoiced at when a month closes; stopAtCommitment (default false) refuses new launches and stops running sandboxes once the month's commitment is used up, instead of billing overage; concurrency is the Cloud sandboxes running at once. Puts the organization on the Enterprise tier; refused over a live self-serve subscription. Edits to rates and policies apply at once, fixed amounts from the next billing interval. Once a contract ends and none is in force, the organization launches nothing new. A new contract records the Data Processing Agreement version in force (isolation.cloud/legal/dpa); every contract carries the private-host rule (a TPM 2.0 on the customer's hardware, EULA §6), and every invoice prints both. | org:admin | write | OPERATOR_DOORS |
contract_end | End an Enterprise contract Operator only. Ends an organization's open contract now (or at at, YYYY-MM-DD, if earlier than its end): the current month closes and its overage is invoiced, the unused commitment expires. From then the organization launches NO new sandbox (\ | org:admin | write | OPERATOR_DOORS |
contract_delete | Delete an Enterprise contract Operator only. Deletes an organization's open contract that has not billed a period yet (a mistake before it started). A contract that billed is ended with contract_end: its record stays. | org:admin | write | OPERATOR_DOORS |
contracts_list | Enterprise contracts Operator only. Every open Enterprise contract (with includeEnded, the ended ones too; with orgId, one organization's): its terms, the current period's usage against its commitment, the overage so far, and every period's invoices and their status. | org:read | read | OPERATOR_DOORS |
billing_contract | Your Enterprise contract The organization's Enterprise contract, read-only: its term, billing interval, platform fee and committed Cloud Usage per month (the commitment resets monthly), contract rate and overage policy, whether it stops at the commitment, included private hosts, concurrency, payment terms, the Data Processing Agreement version it was signed under, the private-host TPM requirement: and this month's usage against the commitment. Once a contract has ended and none is in force: that contract, with launchesBlocked (no new sandbox can start). Null when the organization has none. | org:read | read | website, chat, MCP, CLI |
billing_budgets | The monthly budgets The organization's monthly Cloud budget and each member's, with this month's spend against them (UTC month). At a budget new sandboxes are refused; running ones keep running. Owners and admins see everyone; a member sees the organization's and their own. | org:read | read | website, chat, MCP, CLI |
billing_budget_set | Set a monthly budget Set (or remove, with budget null) a monthly Cloud budget in USD: the organization's, or one member's ( member: their id, name or email). A team control of Professional and Enterprise. At the budget new sandboxes are refused with a clear message and the owners and admins are mailed once that month; running sandboxes keep running. Owner or admin. | org:admin | write | website, chat, MCP, CLI |
usage_reportchat: /usage | Cloud usage report Cloud usage (what metering charged, egress included) between two UTC days, grouped by member, workspace, size or day. Defaults: this month, by member. Owners and admins see the whole organization; a member sees their own. | org:read | read | website, chat, MCP, CLI |
billing_balancechat: /balance | The organization's balance The organization's balance and what is AVAILABLE to spend: the balance less what is HELD for commitments already made: a Mac day asked for and not yet ready (charged when it is), the next day of a Mac still in use in its last hour. Every launch is checked against the available amount, so the same money never covers two commitments. Lists each hold. Plan credit (this period's included usage) is part of the balance and is spent first. | org:read | read | website, chat, MCP, CLI |
mac_dayschat: /mac-days | The organization's Mac days The organization's Macs (Cloud macOS): each Mac being prepared (its day's price HELD until it is ready, when the day starts and is charged; released if it cannot be made or is cancelled) and each Mac the organization has, with when its current 24 h day started and ends, the days charged so far and whether the next day is held (a day continues only while a sandbox is open at its end). The last 7 days of history too. | org:read | read | website, chat, MCP, CLI |
mac_request_cancelchat: /mac-cancel | Cancel a Mac being prepared Cancel a Mac the organization asked for that is not ready yet (mac_days lists them): the request ends and the day's price HELD for it is released: nothing is charged. A Mac that is already ready has started its paid day and cannot be cancelled. Whoever asked for it, or an owner/admin. | sandboxes:write | write | website, chat, MCP, CLI |
box_create | Register a packed box Operator only. Registers one of our boxes (box-eu-1 …) that runs isolation-host with ISO_HOST_MODE=multi, and mints its one-time pairing code. The host pairs with that code and is handed its link (it dials out; nothing listens on the box); from its first heartbeat its packing report makes it a place Cloud launches land: for the organizations BOX_ORGS names. | org:admin | write | OPERATOR_DOORS |
box_pair_code | A fresh pairing code for a packed box Operator only. Mints a new one-time code for an EXISTING box: a rebuilt host, an expired code: and drops the old ones. | org:admin | write | OPERATOR_DOORS |
host_link_rekey | Re-key a host's link Operator only. Rotates the secret a host dials its link with (a connected machine, a packed box, an EC2 Mac host) without re-pairing it: the next secret goes to the host over its live link, the link object is re-opened with the new key: the old one is refused from then on: and the host comes back on the new key within seconds. An Enterprise private host is re-keyed by each welcome of its channel instead. | org:admin | write | OPERATOR_DOORS |
boxes_list | The packed boxes Operator only. Every packed box with its placement status, mode, what it may promise against what it has promised (cpu, memory, pods, per organization) and its open sandboxes. | org:admin | read | OPERATOR_DOORS |
box_fixed_ip_assign | Give a packed box's extra address to an organization Operator only. An extra IPv4 address routed to a packed box (allocated at the box's provider by hand: BACKLOG) becomes a fixed outgoing IP of an organization's Cloud server in the box's region: the box SNATs that organization's pods out through it (one address per organization per box). Charged to the organization like any fixed IP; its owners/admins remove it from the server's pool. | org:admin | write | OPERATOR_DOORS |
box_retire | Take a packed box out of placement Operator only. No new sandbox lands on the box; the ones on it run on (pause frees their slots, resume stays there). active: true puts it back. | org:admin | write | OPERATOR_DOORS |
mac_quarantine_keep | Keep a quarantined Mac Operator only. Keeps a quarantined Mac host (one its team was moved off, or whose rental ended) out of placement with its disk untouched for hours more from now (default 24, at most 720): the sweep gives it back through the ordinary scrub then. Each day the host is held past its AWS 24-hour minimum costs a day. | org:admin | write | OPERATOR_DOORS |
mac_quarantine_release | Give a quarantined Mac back now Operator only. Ends a quarantined Mac host's quarantine now: it is given back through the ordinary scrub (AWS scrubs the host; it is free for any organization once that is over) instead of waiting for its 24 hours or an operator's keep. | org:admin | write | OPERATOR_DOORS |
mac_incidents_list | Mac outage incidents Operator only. The Mac outages (each declared failed: O120), newest first: the organization, the Mac, when it started and ended, how it ended, the rule's classification (ours · theirs · unclear), the paid hours it took and the Mac time given back for them, and who decided (the rule, or the operator who reviewed it). awaiting: true lists only the review queue: unclear incidents nobody approved or denied yet. | org:read | read | OPERATOR_DOORS |
mac_incident_get | One Mac outage incident Operator only. One Mac outage incident with all its evidence: the host's last heartbeat, when its links were last seen up, whether the host shut down cleanly, the sandboxes running on it; every AWS report recorded (status checks, scheduled events, the Dedicated Host's state); each recovery step with its time; the team's own stop/pause/restart actions around it; the decision, the review and the Mac time given back. | org:read | read | OPERATOR_DOORS |
mac_incident_review | Approve or deny a Mac outage incident Operator only. Decides an UNCLEAR Mac outage incident (the rule could not tell whose fault it was): approve gives the paid hours it took back as Mac time: added to the lease's day, at no charge (nothing when the rental is already over; never money): deny gives nothing. Once per incident; the operator and the note are recorded, and the organization's owners and admins are mailed either way. | org:admin | write | OPERATOR_DOORS |
mac_incidents_export | Export a month of Mac outage incidents Operator only. Every Mac outage incident that STARTED in a UTC month ( month: YYYY-MM, default the current one) as CSV: the incident, organization, Mac and instance, start and end, outcome, classification and its rule, the paid minutes lost and their price, the Mac minutes given back and when, who decided, the review and its note. | org:read | read | OPERATOR_DOORS |
spare_pools | The warm pools Operator only. Per AWS region and family (Linux, Windows): the stopped-spare bounds (min, max), the target the recent claims have set (it rises when launches cluster and falls back to the min after a quiet period), the spares ready and still preparing, the claims in the demand horizon, the cold creates the pool avoided, and what the waiting disks cost (platform cost). | org:read | read | OPERATOR_DOORS |
org_update | Change the organization Rename the organization, change the slug its URLs use, or its avatar colour. (What a sandbox launches as is picked at launch and remembered per workspace: nothing here.) | org:admin | write | website, chat, MCP, CLI |
org_create | Create another organization Found a NEW organization with you as its owner: its own members, servers, workspaces and balance. It starts with a Cloud server, a starter agent and workspace, and (for the first one you found) a small welcome credit. This connection stays in the organization it is in; the answer says how to switch. | org:admin | write | WEB_CLI_MOBILE |
org_delete | Delete this organization DESTRUCTIVE and final. Delete the organization this connection acts in, with its workspaces, members, servers and credentials. Owner only. Refused while it has open sandboxes, holds a Mac for the day (or has one being prepared), or has a balance of a cent or more. Requires confirm: the organization's slug or name, typed back. | org:admin | write | WEB_CLI_MOBILE |
org_stats | What the organization has used Sandboxes, AI tokens and spend in this organization: totals, per member, per workspace and per server: with its balance. Every member may read it: the spend is the organization's shared wallet. | org:read | read | website, chat, MCP, CLI |
account_updatechat: /handle | Change your name and preferences Your display name, the terminal theme your terminal views open with, the language push-to-talk listens for, and whether you get product emails (tips and onboarding: never login codes, invitations or receipts). Only the fields you pass change; an empty name goes back to showing your email. | credentials:write | write | website, chat, MCP, CLI |
account_delete | Delete your account DESTRUCTIVE and final. Delete your account: every organization where you are the only member goes with it, and you leave the others. Refused while an organization would be left without an owner, while you have an open sandbox, or while one you would take down still holds a Mac for the day (or has one being prepared). Requires confirm: your account's email, typed back. | org:admin | write | WEB_CLI_MOBILE |
tokens_list | Your tokens and connected apps What acts as you in this organization: the apps you approved on a consent screen (the Isolation CLI, an MCP client) and your personal access tokens: each with its id, the rights it carries, when it was last used and when it expires. Never a token's value. | org:read | read | WEB_CLI_MOBILE |
token_create | Mint a personal access token A bearer that acts as you in this organization, for a host that runs a command instead of opening a browser (a script, an MCP client, a CI job). Carries the rights you name: never more than this connection has: and optionally expires. The value is in this answer ONLY: it is stored hashed and cannot be read again. | credentials:write | write | WEB_CLI_MOBILE |
token_revoke | Revoke a token or disconnect an app End one of the grants tokens_list shows: a personal access token, or an app you approved, with every access token it minted. Named by its id from tokens_list, or by its name when only one has it. Revoking the one this connection uses signs this connection out. | credentials:write | write | WEB_CLI_MOBILE |
mcp_server_info | Where Isolation's MCP server is The URL to give an MCP client (Claude, Cursor, any MCP client) so it can act as you, and the rights a connection can ask for. | org:read | read | website, chat, MCP, CLI |
transcribe | Speech to text Push-to-talk: a short recording (a minute at most, base64) spoken to text by Whisper, in the member's voice language (English unless set) unless one is given. Every plan. The website's agent view uses it for its microphone. | org:read | read | |
billing_topupchat: /topup | Add funds Start a top-up. Answers with a payment link to open: the organization's balance goes up once it is paid. Cloud servers and AI both draw on this balance. | org:admin | write | PURCHASE_DOORS |
credentials_listchat: /credentials | Your credentials Your credentials in this organization: git access, ssh keys, custom hosts and Apple signing: each with its label, what it is for, and how it is delivered. Values are never included, here or anywhere. (The AI credentials your agents run on are ai_credentials_list.) | org:read | read | website, chat, MCP, CLI |
credential_createchat: /add-key | Add a credential Store git access, an ssh public key, a custom host credential or Apple signing for you in this organization. It is encrypted at rest and only ever materialized inside a sandbox. (An AI credential an agent runs on is ai_credential_create.) apple: a .p12 signing identity (base64) + its password, provisioning profiles (base64 each), and optionally an App Store Connect API key (issuer id, key id, the .p8's text): delivered ONLY to your macOS sandboxes, into a keychain made for the sandbox and removed when it ends. | credentials:write | write | website, chat, MCP, CLI |
credential_deletechat: /remove-credential | Remove a credential Delete one of your credentials (credentials are added and removed, never edited: to change one, remove it and add a new one). A repository still pointing at it falls back to the host-wide one until you pick another. An SSH key: named by its label or its fingerprint: stops opening your sandboxes at once, the running ones too. | credentials:write | write | website, chat, MCP, CLI |
git_identity_getchat: /git-identity | Who your commits are from The name and email a sandbox's commits are made with, and where it comes from: your account, GitHub's no-reply address, or one you set. | org:read | read | website, chat, MCP, CLI |
git_identity_setchat: /git-authors | Set who your commits are from Choose the author a sandbox's commits carry: your account's details, GitHub's no-reply address (which keeps your email private), or a name and email you give. | credentials:write | read | website, chat, MCP, CLI |
git_author_add | Save a commit author Keep a name and email as an author you can pick for your commits later: a work address beside a personal one. It does not change who your commits are from now; git_identity_set with mode custom does. | credentials:write | write | website, chat, MCP, CLI |
git_author_remove | Forget a saved commit author Remove a name and email from the authors you keep for your commits. Who your commits are from now does not change. | credentials:write | write | website, chat, MCP, CLI |
github_connect | Connect a GitHub account Answers with a link that connects a GitHub account as a git credential of yours in this organization: for cloning private repositories and listing them with github_repos. Open it in a browser signed in to Isolation and approve on GitHub. Connecting again adds another account. | credentials:write | write | website, chat, MCP, CLI |
github_repos | Your GitHub repositories The repositories your GitHub credentials can reach, most recently updated first: each with its clone URL, default branch and the credential that reaches it (pass that credential's id with the repo when adding it to a workspace). A repo two credentials reach is listed once per credential. | org:read | read | website, chat, MCP, CLI |
apps_listchat: /apps | The apps you can drive Isolation from Every app in the registry: whether this organization has installed it, which account it is installed to, and whether YOU have connected your own account to it. An app nobody has installed still lists: that is how you find out it exists. | org:read | read | website, chat, MCP, CLI |
app_status | One app's status Whether this organization has installed one app, which account to, and whether you have connected your own account to it. | org:read | read | website, chat, MCP, CLI |
app_installchat: /app-install | Install an app for the organization Connect an app to the whole organization. An app that installs through its own OAuth screen (Slack, GitHub, Linear) answers with a LINK to open: you approve it there. One that is installed INTO the app instead (Teams, Jira: a package somebody adds) answers with the code that claims it: the workspace tells us who it belongs to by sending that code to the bot. Owners and admins. | org:admin | write | website, chat, MCP, CLI |
app_uninstall | Disconnect an app from the organization Remove the organization's installation of an app. Every member's connection to it goes with it, and its chats stop reaching Isolation. | org:admin | write | website, chat, MCP, CLI |
app_connectchat: /app-connect | Connect your own account in an app Tell Isolation which account in an app is YOU, so what you type there acts as you. For an app that can prove it with a redirect this answers with a link; for one that has only text, it answers with a code to send the bot as /isolation link <code>. Any member, for themselves. | credentials:write | write | website, chat, MCP, CLI |
app_disconnect | Forget which account in an app is you Remove your own connection to an app. Nobody else's, and the organization's installation stays: an admin who wants that uses app_uninstall. | credentials:write | write | website, chat, MCP, CLI |
Questions
Why does my agent see fewer tools than the table?
tools/list is filtered by the token's rights. A connection approved with the read-only default sees the list and status tools only. Reconnect and approve more rights to see the rest.
Which tools cost money?
Only agent_send, which runs one turn of an agent on your own AI credential. Every other tool answers from Isolation Cloud or the server without starting a harness or spending a token.
Can a tool act on a teammate's session?
No. A token is one member in one organization, and sessions are the member's. A teammate's session does not exist for it.