Your coding agent reads
the docs your team already wrote.
16 tools, withheld by scope
Every tool delegates to a use case the product already had, so there is no second access path and no second set of rules. A read-only key is not shown the write tools at all — it does not merely have the call refused.
readEverything an agent needs to find and understand what your team already wrote.- list_projects
- The projects this credential can read, with counts and a URL a person can open.
- list_repositories
- Projects with their repositories nested, plus what the credential is allowed to reach — so a project you were not granted reads differently from one that does not exist.
- list_tree
- One repository's folder structure. The shape of the tree is how the team organises what it knows.
- list_documents
- The corpus map: every readable document with its title, one line on what it covers, its reader URL and its review state.
- search_docs
- Full-text search across every reachable repository in one statement, each hit carrying a URL, a resource uri and its status.
- read_doc
- One document's raw markdown as stored. No request to GitHub or GitLab, so it costs nothing against the repository's rate limit.
- read_changes
- The diff between the version a person validated and the text now — so a drift warning can be acted on rather than guessed at.
- list_notes
- The open feedback a person left, with the heading it is about and whether it was written against an earlier version.
- list_artifacts
- The artifacts written into a project: path, title, current version and when it last changed.
- read_artifact
- One artifact's current body. There is no patch on write, so revising one means reading it first.
- list_tickets
- marketing.data.mcp-tool.list_tickets
- read_handbook
- Read the project's Handbook: what the product does now, approved by a person, with nothing that is not built.
bundleWhole folders, cleaned and counted, in one block of text.- bundle_docs
- Several documents concatenated and cleaned — front matter and badges stripped, links rewritten — with a token estimate.
write_artifactsGranted separately, and reaching only the artifact namespace. A read-only key is not shown these tools at all.- write_artifact
- File a markdown document into a project's artifact namespace, versioned, with a URL a person can open. It can never reach a repository document.
- reply_to_note
- Answer one note as agrees, disagrees, needs clarification or addressed. A typed dissent is workflow state somebody can count.
- report_implementation
- Say the work has started, or that it exists. Evidence is required and is saved as a note. It records a claim, never a completion.
Four things no tool can do
Absences, not settings. There is no flag that turns any of these on, which is the point — a permission an administrator can grant is a permission somebody eventually grants.
No tool mutates a repository document
Not one. An agent writes into the artifact namespace or nowhere; nothing on this surface can reach a file the sync worker owns, change a branch, or repoint a docs root.
No agent can close a note
A reply moves a note to awaiting confirmation at most. There is no resolve tool, by any argument, and no reply changes a status. Only a person closes feedback.
No agent can delete an artifact
There is no delete tool. A write credential's job is to produce, not to dispose of human input — including its own earlier drafts, which keep their versions.
No free-text question over the surface
An agent may ask a question the current summary offered, and nothing else. Without that gate a key is an unvalidated, organization-funded channel to a third-party model.
An agent may claim that feedback is addressed. Only a person may close it.
This is the sentence a team adopts the product for, and it is a function with a test rather than a policy in a document.
- Agent
search_docs"idempotency" across 6 repositories · 3 hits
- 01AgentReads what the team already wrotesearch_docs across every repository it can reach, then read_doc for the ones that matter. Nothing pasted into a prompt, nothing out of date.
- 02AgentFiles what it producedwrite_artifact puts a spec, a migration plan or a review into the project beside the documentation, versioned, with a URL a person can open.
- 03PersonObjects, on a headingA reviewer leaves a note anchored to the section it is about. The agent sees it through list_notes, with the version it was written against.
- 04AgentAnswers — and may disagreeagrees, disagrees, needs clarification, or addressed. A typed dissent is a queue a lead opens on Monday; a transcript is something nobody reads twice.
- 05PersonCloses it, or does notThe note is waiting on a human either way. This is the asymmetry the whole layer exists for, and it is enforced in one function.
A credential can be told which documents exist
Set a minimum review state on a key and anything below it is 404 on every door — not filtered, not greyed out, not there.
The floor lives on the credential rather than in a tool argument, and that is the whole design: a filter the agent passes is a filter the agent can be prompted out of passing. It applies to the reader routes too, because a floor that stops at one surface is a floor with a second front door.
Two consequences read like bugs and are not. A document nobody has triaged has no status at all, so a validated floor on an untriaged corpus admits nothing — the console tells you so before you mint the key. And rejected is not a low rung on the scale: it means do not build this, so every floor above draft excludes it rather than sorting it last.
- Belongs to
- The organization, never the person who minted it.
- Reaches
- Exactly one project. There is no organization-wide key.
- Scopes
- read, bundle, write_artifacts — chosen at mint.
- Review floor
- Optional, and refused on a key that can write.
- Stored as
- A hash. The value is shown once and never again.
- Revocation
- Bites on the next request — nothing caches the lookup.
Give your agent the documentation instead of the prompt.
The read tools are on every plan, including Free. Rate-limited, never metered.
Start free