What an external agent can do
Every MCP tool is an action from Isolation's one catalog, the same list the website, chat commands and the CLI use. Calling one is free, except agent_send.
The tools the Isolation MCP server has are the actions catalog. Everything a person can do with Isolation, from launching a session to inviting a member to reading the activity log, is written once as an action, and each action is reachable through every door: a button on the website, a command typed in Slack, Teams, Linear, Jira, GitHub or Buzz, a tool called over MCP, a command in a terminal. When an action is added it appears in all of them at once, with the same name, the same arguments and the same rules. The table below is that catalog.
What a token is
A token is one member in one organization, carrying that member's role. There is no service account and no organization-wide installation: the agent acts as you, in the organization you picked on the consent screen, and can do what you can do there and nothing you cannot. An Admin's token can stop a teammate's runaway session; a Member's token cannot. On top of the role, the rights you approved narrow the list further, so tools/list returns only what this connection may call. The rules are on OAuth, scopes and access tokens.
What it costs
Calling a tool is free. Listing, launching, opening a web view, sharing its link, reading logs: none of it starts a harness or spends AI tokens. The one exception is agent_send, which asks one of the session's agents for a turn and runs on your own AI credential, exactly as /ask does in a chat. A session launched on a Cloud Server draws the organization's balance for its uptime as it would from the website; on a Connected Server it draws nothing.
How to read the table
Each row is one action: the tool name an MCP client calls, its spelling as a chat command where it has one (the full grammar is on the commands reference), what it does, and who may call it. Most actions are for members through any door. A few are also open to the agent running inside a session, which reaches them from its own MCP, pinned to that session, as described on inside the sandbox. Every call, from any door, lands in the activity log with your name, the tool, the client and the outcome.
| Tool | What it does | Right | Who can call it | |
|---|---|---|---|---|
org_statuschat: /status | Organization status What is going on in the organization right now: which servers are up, which one new sessions launch on, the prepaid balance, and every session of yours that is running. Start here when someone asks 'what's running?' or 'is the server up?'. | org:read | read | website, chat, MCP, CLI |
workspaces_listchat: /workspaces | Your workspaces The workspaces you can launch: what each one clones, which environments it can launch with (the first is the default), and how many agents ride along. A workspace is how one person works: these are yours, not the whole organization's. | org:read | read | website, chat, MCP, CLI |
sessions_listchat: /sessions | Sessions Your sessions. Running ones by default; pass all=true for the history too. | org:read | read | website, chat, MCP, CLI |
servers_listchat: /servers | The organization's servers Every server sessions can run on: your own machines (free) and Cloud servers (billed by the hour), and whether each is up. | org:read | read | website, chat, MCP, CLI |
sandbox_types_listchat: /types | The sandbox types you can launch Every sandbox type across the organization's servers: a named size (cpus of a class, memory, disk) a session runs as, grouped by the server it lives on; on a Cloud server, with its price per running hour, per paused hour and per GB of egress. What session_launch takes as sandboxTypeId. | org:read | read | website, chat, MCP, CLI |
agents_listchat: /roster | Your agents The agents that ride into every session you launch: their names, what they run on, and each one's Nostr public key (its identity in Buzz: what a community admin needs to add it to a channel). Credentials are never included. | org:read | read | website, chat, MCP, CLI |
session_launchchat: /launch | Launch a session Start a session of one of your workspaces: an isolated sandbox with the repos cloned, the environment loaded and your agents inside. Answers as soon as the sandbox is being created: call session_get to watch it become ready. If the server is asleep this wakes it, which can take a few minutes on a Cloud server; the answer says so and you can call again. | sessions:write | write | website, chat, MCP, CLI |
session_stopchat: /stop | Stop a session Finish a session: the sandbox is destroyed and its work stops. Anything not saved to the workspace is lost, so ask first unless the person told you to stop it. | sessions:write | write | website, chat, MCP, CLI |
session_savechat: /save | Save the session's work Commit and merge the session's file tree back into its workspace, so the work survives the session: and push what its agents hold (their memory, threads and harness sessions) as their own objects. Do this before stopping one. | sessions:write | write | website, chat, MCP, CLI, and the agent inside the session |
session_resources | A session's resource usage What a running session uses against its sandbox type: cpu, memory and disk as percentages of the type, egress as a total (billed per GB on a Cloud server): the last sample and the last five minutes, plus the alerts that have fired on it. Sampled every 10 seconds on the server. | org:read | read | website, chat, MCP, CLI |
session_get | One session Everything about one running session: its state, its agents, and its views (terminals, editors, web previews) with the links you can share. | org:read | read | website, chat, MCP, CLI |
session_routes | How a session is reached The addresses the outside world dials for one session: the ssh host (its doorman's own name, over IPv6, or the shared bastion), the zone its public previews live under, and the origin its view frames load from. These are the session's, never its server's. | org:read | read | website, chat, MCP, CLI |
views_listchat: /views | The session's views The session's views: terminals, code editors, file browsers, web previews and agent chats: each with the link to open it. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
view_createchat: /view | Open a view on the session Add a view to a running session. type 'web' with a url like http://localhost:3000 publishes what the session serves on that port at a public address you can share: this is what 'show me the preview' means. 'terminal' opens a shell (optionally running a command), 'editor' an editor, 'directory' a file browser. | sessions:write | write | website, chat, MCP, CLI, and the agent inside the session |
view_linkchat: /share | The link to a preview The PUBLIC address of a web view: the link anyone can open, which is what 'show me the preview' means. Only a web view has one: every other kind of view is a door you go through rather than a link you send, and view_connect is what opens those. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
view_delete | Close a view Remove a view from the session. The session keeps running; a web view's public address stops working. | sessions:write | write | website, chat, MCP, CLI, and the agent inside the session |
view_connectchat: /connect | Connect to a view from your own machine How to reach one of the session's views from your own machine. A TERMINAL view answers with an ssh line that attaches that very shell; an AGENT view with one that lands in that very conversation, live, while the session screen stays on it; an EDITOR view with a link per local editor, because the editor drives the connection itself; a FILES view with a WebDAV address that mounts as a real drive (no ssh, no key). Nothing to install in any case. A WEB view is NOT one of these: a preview is a link you send rather than a door you go through, and view_link is what answers with it. The ssh doors work for a public key this session authorizes: the launcher's own, plus any added with ssh_key_authorize, which takes effect on the running session with no restart. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
ssh_keyschat: /keys | Who can ssh into this session The public keys that may open this session over ssh, and where each came from: 'account' keys belong to the member who launched it (and come back on the next launch), 'session' keys were allowed on this session only and disappear with it. Fingerprints only: never key material. | org:read | read | website, chat, MCP, CLI |
ssh_key_authorizechat: /allow-key | Let a key ssh into this session Authorize an ssh PUBLIC key on a session that is already running: the contents of a .pub file, one line. It takes effect in seconds and NOTHING restarts, so this is the answer to 'let me in' / 'I get permission denied' / 'my laptop's key isn't on the account': the session keeps everything it has. The grant belongs to this session only: no credential is created on anybody's account, and it is gone when the session ends. Whoever holds the matching private key gets a shell in the sandbox, so treat it as handing over access. | sessions:write | write | website, chat, MCP, CLI |
ssh_key_revokechat: /revoke-key | Take a key's ssh access away Stop a public key from opening this session, by fingerprint (from ssh_keys): effective at once on the running session. An account key revoked here is gone for THIS session only; it returns on the next launch. | sessions:write | write | website, chat, MCP, CLI |
session_logschat: /logs | The session's log The sandbox's own output: how it booted, what the clone did, why it failed. The first thing to read when a session is stuck or errored. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
agent_sendchat: /ask | Ask an agent Send a message to one of the session's agents and wait for its reply. The agent works inside the sandbox: it can read and change the code, run commands, and use its tools: so a turn can take minutes. The reply comes back as text. | sessions:write | write | website, chat, MCP, CLI |
channel_attachchat: /attach | Connect this chat to a session Bind a chat channel (or a direct message) to a running session, so its agents can be mentioned there and answer there. Pass the connector you are in ('slack', 'teams', 'buzz') and that app's own id for the chat. Answers with the thread key per agent, which is what a connector needs to deliver a mention. One chat belongs to one session: binding a chat that is already connected moves it. | channels | write | website, chat, MCP, CLI |
channel_detachchat: /detach | Disconnect a chat Stop a chat reaching a session. The conversation stays where it is; the agents simply stop answering there. | channels | write | website, chat, MCP, CLI |
channels_listchat: /chats | Connected chats Which chats are connected to which sessions. A chat whose session has finished stays listed as ended: it can be reconnected to a new one. | org:read | read | website, chat, MCP, CLI |
agents_herechat: /agents | Who is in this conversation Which of the session's agents can be talked to here, and which one you are talking to. | org:read | read | chat only |
agent_pickchat: /agent | Talk to one agent Choose which of the conversation's agents your messages go to from now on. | org:read | write | chat only |
whoamichat: /whoami | Who you are here The member this connection acts as, the organization it acts in, and the rights it carries. Call it when you need to know whose workspaces and sessions you are looking at. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
activity_listchat: /activity | What has been happening Every action anyone in the organization took, from any door: the website, a chat app, an MCP client, a terminal, or an agent inside its session. Newest first. Filter by session, server, action, door, member, outcome or time. Owners and admins only. | org:admin | read | website, chat, MCP, CLI |
server_logschat: /server-logs | A server's own log The isolation-server process's log on one of the organization's machines: pairing, tunnels, launches, why a session would not start. This is the MACHINE's log; session_logs is a sandbox's own output. Owners and admins, because a server is the organization's. | org:admin | read | website, chat, MCP, CLI |
session_changeschat: /changes | What this session has changed The session's uncommitted and unmerged work: which files it touched, how far ahead of the workspace it is, and whether the workspace has moved on underneath it. Read it before saving or stopping. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
session_discardchat: /discard | Throw away this session's changes Undo work in the session's tree: tracked files go back to the workspace's version, untracked ones are deleted. Irreversible: nothing is committed anywhere first. Name paths to discard only those. | sessions:write | write | website, chat, MCP, CLI |
session_syncchat: /sync | Bring the workspace's latest into this session Pull the workspace's current main into the session's working tree. On a conflict the default stops and changes nothing; pass resolve to keep git's conflict markers in the tree and fix them by hand. | sessions:write | write | website, chat, MCP, CLI, and the agent inside the session |
session_merge_abort | Undo a resolve-mode sync Abandon a sync that was pulled in with conflict markers: the working tree goes back to how it was before the pull. | sessions:write | write | website, chat, MCP, CLI |
file_readchat: /read | Read one of the session's files One workspace-relative file from the session's working tree, as text. Pass ref 'workspace' to read the WORKSPACE's version instead: that is how you compare what changed. Text only, capped at 1MB. | org:read | read | website, chat, MCP, CLI, and the agent inside the session |
file_write | Write one of the session's files Replace one workspace-relative file in the session's working tree with the text given. stage also marks it resolved, which is what you do after fixing a sync conflict by hand. | sessions:write | write | website, chat, MCP, CLI |
session_renamechat: /rename | Rename a session Give a session a name a person can recognise. An empty name resets it to its id. | sessions:write | write | website, chat, MCP, CLI |
session_pausechat: /pause | Pause a session Stop the session's container without destroying it. Its files and its branch survive; session_resume brings it back. Use this instead of stopping when the work is not finished. | sessions:write | write | website, chat, MCP, CLI |
session_resumechat: /resume | Resume a paused session Start a paused session's container again, with its files and branch as they were. | sessions:write | write | website, chat, MCP, CLI |
session_usage | What this session has spent on AI Token usage read from the session's own harness transcripts, per model. Observational: it is what the session actually consumed, not an estimate. | org:read | read | website, chat, MCP, CLI |
view_update | Rename or restyle a view Change a view's label, or a terminal's colour scheme. The view keeps running. | sessions:write | write | website, chat, MCP, CLI |
session_restartchat: /restart | Restart a session with its environment's current values Recreate the session's container so a changed environment takes effect: variables and secret files are baked in when a container is created, so editing them does nothing until this. The session id, its files and its views survive; processes inside it stop. Answers as soon as the container is creating. | sessions:write | write | website, chat, MCP, CLI |
workspace_createchat: /new-workspace | Create a workspace Make a workspace: a name, the repositories to clone, and the environments it can launch with (the first is the default). It is yours: teammates cannot see it. Add its variables and files with environment_values_set afterwards. | workspaces:write | write | website, chat, MCP, CLI |
workspace_update | Change a workspace Edit a workspace: its name, repositories, environments, views or layouts. Pass rev from workspaces_list to be told if somebody changed it underneath you instead of overwriting them. Leaving environments out keeps the ones it has. | workspaces:write | write | website, chat, MCP, CLI |
workspace_delete | Delete a workspace Remove a workspace, its environments' values (secrets included) and its stored file tree. Irreversible, and sessions launched from it keep running: stop them first if you mean to. | workspaces:write | write | website, chat, MCP, CLI |
environment_valueschat: /values | An environment's variables and files What one environment of a workspace carries: variables and files, which of them are secret, and whether each secret has a value yet. A secret's value is never returned: not here, not anywhere. | org:read | read | website, chat, MCP, CLI |
environment_values_set | Set an environment's variables and files Write the values of ONE environment: variables and files, plain or secret. This REPLACES that environment's values: send the whole set. A secret with no value is declared but unset, which is how you say 'this must be filled in'. | workspaces:write | write | website, chat, MCP, CLI |
environment_rename | Rename an environment Rename one of a workspace's environments, moving its variables and files with it. Do this rather than editing the environment list: the list alone cannot tell a rename from a delete, and a delete takes every value with it. | workspaces:write | write | website, chat, MCP, CLI |
environment_clone | Copy an environment Make a new environment of a workspace with a copy of another's variables and files: secrets included, still encrypted. The usual way to make staging from production without retyping anything. | workspaces:write | write | website, chat, MCP, CLI |
agent_createchat: /new-agent | Add an agent Add an agent to your roster: a name, optionally a model and a system prompt (the harness: claude-code, codex, goose: follows the credential it launches with). It rides into every session you launch from then on. | workspaces:write | write | website, chat, MCP, CLI |
agent_update | Change an agent Edit one of your agents: its name, model or system prompt. Only what you send changes. It takes effect in sessions launched afterwards. | workspaces:write | write | website, chat, MCP, CLI |
agent_delete | Remove an agent Take an agent off your roster. Sessions already running keep the one they have; new ones will not include it. | workspaces:write | write | website, chat, MCP, CLI |
server_createchat: /add-server | Add a server Add a server to the organization. 'cloud' is a Cloud server: a region and the SANDBOX TYPES it offers (from servers_catalog: 'small' is the default; or your own shapes {name, cpus, memoryGb, diskGb, cpuClass?}); every session launched on it gets its own machine of its type's size, billed per second while it runs (per resource, at the region's rates): nothing runs or bills between sessions. 'connected' registers a machine you run yourself, which is free; for that, prefer server_pair_code and isolation-server connect, which needs no token to travel. | servers:write | write | website, chat, MCP, CLI |
servers_catalog | What a Cloud server can be What a Cloud server in a region costs this organization: the RATE CARD per resource (a shared or dedicated vCPU, a GB of memory, a GB of disk: which keeps billing while a session is paused: and a GB of egress; per hour, list minus the tier's discount), the standard sandbox types priced on it (small, standard, large, xlarge), and the shapes a custom type may take per cpu class. Read this before server_create or sandbox_type_create on a Cloud server. | org:read | read | website, chat, MCP, CLI |
server_update | Rename a server Change a server's label. | servers:write | write | website, chat, MCP, CLI |
server_ssh | A server's ssh door How a self-hosted server exposes ssh into its sessions (docs/doorman-plan.md §11): off, this machine only, or on the network at an advertised address: and whether that address is reachable from the internet, private (a VPN/LAN, expected), or not answering. A cloud-sessions server has no door of its own: its sessions each carry theirs. | org:read | read | website, chat, MCP, CLI |
server_ssh_set | Set a server's ssh door Turn a self-hosted server's ssh door off, to this machine only, or on to the network: with the address it listens on (bind, default 127.0.0.1:2200, never 22) and the SEPARATE address people connect to (advertise: a forwarded port, a tunnel endpoint). Reachability is yours: the door is probed from the internet and the result shown, never assumed. The host applies a changed bind on its next isolation-server up. | servers:write | write | website, chat, MCP, CLI |
sandbox_type_request | Ask for a sandbox type A member with nothing to launch as asks the organization's owners and admins for a sandbox type: they get an email pointing at the Servers page. Once an hour per member. | sessions:write | write | website, chat, MCP, CLI |
sandbox_type_create | Add a sandbox type Add a named size to a server: a cpu class (shared, the default, or dedicated), cpus, memory and disk a session of it gets. On a connected server it must fit the machine (cpus in 0.5 steps, memory in 256 MB steps; shared only); on a Cloud server it must be a provider shape (1, 2, 4, 8 or 16 cpus; shared: memory in 256 MB steps, 256 MB–2 GB per cpu; dedicated: 2 GB steps, 2–8 GB per cpu) and is priced per resource at the region's rates for the organization's tier (servers_catalog). Owner/admin. | servers:write | write | website, chat, MCP, CLI |
sandbox_type_update | Change a sandbox type Rename or resize a sandbox type. Applies to NEW sessions only: a running session keeps the numbers it launched with. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
sandbox_type_delete | Remove a sandbox type Remove a sandbox type from its server. A type sessions still run under is hidden from pickers and stays named on those sessions; a server left with no type gets its smallest one back on the next launch. Owner/admin. | servers:write | write | website, chat, MCP, CLI |
server_remove | Remove a server Take a server out of the organization by DRAINING it: from this moment no new session can start on it and nobody's default points at it, but every session already running on it keeps running: with its sandbox, its views and its ability to pause and resume: and the server is torn down when the last one ends (a Cloud one's disk and sleep snapshot go with it; a connected one is just unregistered). Nothing is terminated. To end its sessions right now, use server_force_delete. | servers:write | write | website, chat, MCP, CLI |
server_delete_preview | What deleting a server would end Before force-deleting a server: the sessions still running on it and who launched each. This is the list a person must be shown and confirm: the exact sessions server_force_delete terminates. | org:read | read | website, chat, MCP, CLI |
server_force_delete | Force-delete a server DESTRUCTIVE. End every session still running on a server: their sandboxes are destroyed and anything in them that was never saved to a workspace is lost: and then remove the server. Requires confirm: true, and refuses if sessions started since the preview you were shown (pass their ids as expected). server_remove is the ordinary way, which drains instead of terminating. | servers:write | write | website, chat, MCP, CLI |
server_pair_codechat: /pair | A code to connect a machine Mint the one-time code that connects a machine of your own to this organization. Run curl -fsSL isolation.cloud/server/install | sh && isolation-server up && isolation-server connect <code> on that machine (Docker is all it needs). The code is redeemed BY THE MACHINE: its answer is that server's own credential, so it never travels through a chat. | servers:write | write | website, chat, MCP, CLI |
members_listchat: /members | Who is in this organization Everyone in the organization with their role, and every invitation still waiting to be accepted. | org:read | read | website, chat, MCP, CLI |
member_invitechat: /invite | Invite somebody Invite an email address to the organization. They get a link; if this deployment has no mailer, the invitation waits for them in-app at their next sign-in: either way it is never lost. Inviting the same address again re-sends it with a fresh link. | org:admin | write | website, chat, MCP, CLI |
invite_revoke | Withdraw an invitation Cancel an invitation that has not been accepted. Its link stops working. | org:admin | write | website, chat, MCP, CLI |
member_role_set | Change what somebody may do Set a member's role: owner, admin or member. Only an owner may change roles, and an organization always keeps at least one owner: demoting the last one is refused rather than leaving it ownerless. | org:admin | write | website, chat, MCP, CLI |
member_remove | Remove somebody from the organization Take a member out. Their sessions keep running until they are stopped, but their access ends immediately: including the organization's shared AI credentials, whose tokens are revoked on the way out. | org:admin | write | website, chat, MCP, CLI |
org_leave | Leave this organization Remove yourself. If you are its only owner you cannot: make somebody else an owner first, or delete the organization. | org:admin | write | website, chat, MCP, CLI |
org_subscribe | Start a plan Start this organization's plan from Personal: Professional ($19/month flat, up to 5 members) or Enterprise ($99/month + $2 per seat, and $20 of compute balance credited every paid month), monthly or yearly (the amounts are the Stripe catalogue's; org_subscription lists them). Answers the checkout page to open; the card it takes is kept for auto-recharge. Owner only. An organization that already has a plan changes it with org_plan_set. Where Stripe is not configured (local, staging) the plan activates directly. | org:admin | write | |
org_plan_set | Change the plan Change an organization's existing plan: to Enterprise, to yearly, back to Professional or to Personal. An upgrade applies now, prorated; a downgrade is scheduled for the end of what was paid for (org_subscription shows it), and asking for the current plan again un-schedules it. Professional takes up to 5 members. Owner only. | org:admin | write | |
org_plan_preview | What a plan change would do Before changing the plan: whether it applies now or at the end of the period, what an upgrade charges right away (prorated) and to which card, and when a downgrade lands. Changes nothing. Owner only. | org:read | read | |
org_subscription | The organization's plan Which plan the organization is on and for what interval, its members and seats, the subscription's state, a scheduled downgrade if any, and the auto-recharge rule. | org:read | read | website, chat, MCP, CLI |
billing_portal | The billing portal The Stripe customer portal for this organization: the card on file, invoices and receipts. Plans change through org_plan_set, not there. Owner only. | org:admin | read | |
billing_autorecharge | Auto-recharge the balance When the organization's compute balance falls under the threshold, charge the saved card the amount and add it: checked every minute, at most once every ten. threshold: null turns it off. Owner only. | org:admin | write | |
billing_invoices | The invoices The organization's Stripe invoices, newest first: number, date, amount, status, and the links to the hosted invoice and its PDF. Owner or admin. | org:read | read | website, chat, MCP, CLI |
billing_details | The billing details What the invoices print for this organization: name, email, address, EU VAT number. Owner only. | org:read | read | |
billing_details_set | Set the billing details Set what the invoices print: name, email, address (line1, line2, city, postalCode, state, country as a two-letter code) and an EU VAT number (taxId; empty removes it). Owner only. | org:admin | write | |
billing_card_change | Change the card Start changing the organization's card: answers a setup to confirm in the page (a client secret + the publishable key); billing_card_set makes the confirmed card the one on file. Owner only. | org:admin | write | |
billing_card_set | Use the confirmed card After billing_card_change was confirmed in the page: make that payment method the organization's card for renewals, prorations and auto-recharge. Owner only. | org:admin | write | |
billing_history | The balance's history Every credit to the organization's compute balance: top-ups, auto-recharges (and a refused one, at $0), the monthly Enterprise credit: newest first. | org:read | read | website, chat, MCP, CLI |
pricing_get | Cloud-sessions pricing Operator only. The three numbers Cloud-sessions prices are made of (pricing.ts, docs/resource-pricing-plan.md): the markup over the provider's cost (the list rate of every resource, per region) and the Professional and Enterprise discounts in percent. A sandbox type is priced per resource on its region's card; an organization pays list minus its tier's discount. Answers the provider's cost card (dated), the rate cards per region and tier, and the presets priced. | org:read | read | OPERATOR_DOORS |
pricing_set | Set Cloud-sessions pricing Operator only. Sets the markup over the provider's cost (percent) and/or the Professional and Enterprise discounts (percent). Every organization's Cloud sandbox types are re-priced; running sessions keep the prices frozen at their launch. | org:admin | write | OPERATOR_DOORS |
plan_prices_get | The plans' prices Operator only. The six amounts of the plan catalogue: Professional and Enterprise per month and per year, the Enterprise seat per month and per year: as Stripe holds them (or the defaults where Stripe has none yet), and whether the Worker's Stripe key is live or test. | org:read | read | OPERATOR_DOORS |
plan_prices_set | Set the plans' prices Operator only. Sets any of the six plan amounts (USD): professionalMonth, professionalYear, enterpriseMonth, enterpriseYear, seatMonth, seatYear. Written to Stripe with the Worker's own key: a new Price on the same product takes the lookup key, the old one is archived: existing subscriptions keep the price they were sold at; new checkouts and plan changes take the new one. Products are created when the account has none (the live catalogue's first setup). | org:admin | write | OPERATOR_DOORS |
org_tier_set | Set an organization's tier Operator only. Which tier an organization is on: personal, professional or enterprise: set by hand: a comped or enterprise-contracted org, a support fix. The tier decides what the organization may use: members beyond one, the managed connectivity a connected server gets, the Cloud providers. The product path is org_subscribe (the seat subscription sets the tier and the webhook keeps it); an owner never sets the tier directly, or every gate would be one call away. Defaults to the caller's organization; orgId targets another. | org:admin | write | OPERATOR_DOORS |
control_plane_create | Create a control-plane instance Operator only. Registers a regional control plane (cp-eu-1 …) at the https origin its host will answer on and mints its one-time pairing code. With provision: true the box itself is created (a Hetzner server booted from the cloud-box user-data: Docker, Caddy, the isolation-server command, the compose from the channel, the doorstep) and pairs on its own with that code; its addresses become the row's and the origin's DNS (R6). Without it, the host is set up by hand and isolation-server connect <code> is the last step. | org:admin | write | OPERATOR_DOORS |
control_plane_pair_code | A fresh pairing code for a control-plane instance Operator only. Mints a new one-time code for an EXISTING instance: a rebuilt host, an expired code: and drops the old ones. Run isolation-server connect <code> on the box. | org:admin | write | OPERATOR_DOORS |
control_plane_status | A control-plane box, as its provider sees it Operator only. For a box we provisioned: the machine's state at the provider (initializing, running, gone) and its IPv4: the answer to \ | org:admin | read | OPERATOR_DOORS |
control_plane_move | Move an organization's future sessions to another box Operator only. Drops the organization's assignment in a region (its peer on the current box goes) so its NEXT launch lands on to: or on whichever box has the least load, when to is omitted. Sessions already running stay where they are until they close. Refused while the organization has open sessions on the current box. | org:admin | write | OPERATOR_DOORS |
control_plane_drain | Drain a control-plane box for retirement Operator only. No new organizations are assigned to it; every organization with no open session on it is moved off now, the rest as their sessions close (the sweep keeps at it). Empty → retired. Answers what is left. | org:admin | write | OPERATOR_DOORS |
control_plane_destroy | Destroy a control-plane box Operator only. Deletes the machine at the provider (when we provisioned it), forgets every organization's assignment to it and removes its rows. Refused while sessions are open on it: drain first. The origin's DNS name is left to you. | org:admin | write | OPERATOR_DOORS |
control_planes_list | The control-plane instances Operator only. Every regional control plane with its status, peer capacity in use, assigned organizations and open sessions. | org:admin | read | OPERATOR_DOORS |
control_plane_retire | Retire a control-plane instance Operator only. No new organizations are assigned to it; its sessions run on and its peers are freed by the idle sweep. | org:admin | write | OPERATOR_DOORS |
org_update | Change the organization Rename the organization, change the slug its URLs use, or its avatar colour. (What a session launches as is picked at launch and remembered per workspace: nothing here.) | org:admin | write | website, chat, MCP, CLI |
transcribe | Speech to text Push-to-talk: a short recording (a minute at most, base64) spoken to text by Whisper, in the member's voice language (English unless set) unless one is given. Professional and Enterprise. The website's agent view uses it for its microphone. | org:read | read | |
billing_topupchat: /topup | Add funds Start a top-up. Answers with a payment link to open: the organization's balance goes up once it is paid. Cloud servers and AI both draw on this balance. | org:admin | write | website, chat, MCP, CLI |
credentials_listchat: /credentials | Your credentials Your credentials in this organization: AI providers, git access, ssh keys and custom hosts: each with its label, what it is for, and how it is delivered. Values are never included, here or anywhere. | org:read | read | website, chat, MCP, CLI |
credential_createchat: /add-key | Add a credential Store an AI provider key, git access, an ssh public key or a custom host credential for you in this organization. It is encrypted at rest and only ever materialized inside a sandbox. Prefer credential_login_start for a Claude or Codex SUBSCRIPTION: that way no secret is typed anywhere. | credentials:write | write | website, chat, MCP, CLI |
credential_delete | Remove a credential Delete one of your credentials. Anything still pointing at it: an agent, a repository: falls back to having none until you pick another. | credentials:write | write | website, chat, MCP, CLI |
credential_login_start | Start signing in to an AI subscription Begin adding a Claude or Codex SUBSCRIPTION as a credential. Answers with a URL to open and, for Codex, the code to enter there. No secret is typed anywhere. Finish it with credential_login_complete. | credentials:write | write | website, chat, MCP, CLI |
credential_login_complete | Finish signing in to an AI subscription Complete a subscription login started with credential_login_start: for Codex by polling, for Claude with the code the page gave you. The credential is stored when it succeeds. | credentials:write | write | website, chat, MCP, CLI |
git_identity_getchat: /git-identity | Who your commits are from The name and email a session's commits are made with, and where it comes from: your account, GitHub's no-reply address, or one you set. | org:read | read | website, chat, MCP, CLI |
git_identity_set | Set who your commits are from Choose the author a session's commits carry: your account's details, GitHub's no-reply address (which keeps your email private), or a name and email you give. | credentials:write | write | website, chat, MCP, CLI |
apps_listchat: /apps | The apps you can drive Isolation from Every app in the registry: whether this organization has installed it, which account it is installed to, and whether YOU have connected your own account to it. An app nobody has installed still lists: that is how you find out it exists. | org:read | read | website, chat, MCP, CLI |
app_status | One app's status Whether this organization has installed one app, which account to, and whether you have connected your own account to it. | org:read | read | website, chat, MCP, CLI |
app_installchat: /app-install | Install an app for the organization Connect an app to the whole organization. An app that installs through its own OAuth screen (Slack, GitHub, Linear) answers with a LINK to open: you approve it there. One that is installed INTO the app instead (Teams, Jira: a package somebody adds, Buzz: a keypair) answers with the code that claims it: the workspace tells us who it belongs to by sending that code to the bot. Owners and admins. | org:admin | write | website, chat, MCP, CLI |
app_uninstall | Disconnect an app from the organization Remove the organization's installation of an app. Every member's connection to it goes with it, and its chats stop reaching Isolation. | org:admin | write | website, chat, MCP, CLI |
app_connectchat: /app-connect | Connect your own account in an app Tell Isolation which account in an app is YOU, so what you type there acts as you. For an app that can prove it with a redirect this answers with a link; for one that has only text, it answers with a code to send the bot as /isolation link <code>. Any member, for themselves. | credentials:write | write | website, chat, MCP, CLI |
app_disconnect | Forget which account in an app is you Remove your own connection to an app. Nobody else's, and the organization's installation stays: an admin who wants that uses app_uninstall. | credentials:write | write | website, chat, MCP, CLI |
Questions
Why does my agent see fewer tools than the table?
tools/list is filtered by the token's rights. A connection approved with the read-only default sees the list and status tools only. Reconnect and approve more rights to see the rest.
Which tools cost money?
Only agent_send, which runs one turn of an agent on your own AI credential. Every other tool answers from Isolation Cloud or the server without starting a harness or spending a token.
Can a tool act on a teammate's session?
No. A token is one member in one organization, and sessions are the member's. A teammate's session does not exist for it.