> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/ai-tools/mcp/capabilities.md).

# MCP server capabilities

The tools the BaaS MCP server exposes, what it never does, and how your role on the project decides what an agent sees.

The BaaS MCP server exposes a small set of tools, each covering one area of your project. Most tools take an `action` that selects what it does. Which tools an agent sees depends on your role on the project. See [Permissions](#permissions).

## Tools

### Read the project

Available with the READ role.

| Tool                    | What it does                                                                                                                                                     |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `baas_docs_search`      | Searches the BaaS documentation and returns the matching pages, each with an excerpt and a link.                                                                 |
| `baas_docs_page`        | Reads one documentation page in full.                                                                                                                            |
| `baas_catalog_inspect`  | Lists the project's networks, its action plugins and their configuration contract, its public settings, and the metadata of its secret keys, never their values. |
| `baas_contract_inspect` | Reads the registered contracts: classes, ABI versions, deployments, mappings, and units.                                                                         |
| `baas_chain_read`       | Calls a registered contract's read functions, simulates a call, estimates its gas, or prepares an unsigned transaction for a wallet to sign.                     |
| `baas_user_inspect`     | Lists the project's users, reads one profile by wallet address, or the on-chain data stored for a user.                                                          |
| `baas_workflow_inspect` | Reads the workflows, one workflow with its trigger and actions, its runs, per-action outcomes, and cursor-paginated run logs.                                    |
| `baas_vault_inspect`    | Reads the Vault's keys, where each one is set up, and, on one network, a key's live status, balance, and transactions.                                           |

`run_logs` returns `{ data, limit, nextCursor }`, newest first. Use `limit` (default 20, maximum 100) and `cursor`, keeping the same limit; continue until `nextCursor` is null, even after an empty page. Large payloads are marked `contentTruncated`; the [REST endpoint and download](/baas-console/automations/runs-and-logs.md#read-the-logs) return complete stored payloads.

### Change the project

Available with the WRITE role, in addition to the tools above.

| Tool                         | What it does                                                                                              |
| ---------------------------- | --------------------------------------------------------------------------------------------------------- |
| `baas_workflow_manage`       | Creates and updates workflows, adds, updates, and reorders their actions, activates or deactivates them.  |
| `baas_trigger_manage`        | Attaches a workflow's trigger, webhook, cron, or contract event monitor, and updates a cron or a monitor. |
| `baas_trigger_rotate_secret` | Replaces the secret of a webhook trigger. The previous secret stops working immediately.                  |
| `baas_workflow_remove`       | Deletes a workflow, or one of its actions.                                                                |
| `baas_vault_manage`          | Prepares a key on every network of the project, or enables and disables it on one network.                |

`baas_trigger_manage` configures monitor `where`; `baas_workflow_manage` configures `batch.where`. Both accept nested `and`/`or` groups and the same [filter grammar](/baas-console/filters.md#through-the-api-and-the-sdk) as event-history searches: `=`, `!=`, `in`, `>`, `>=`, `<`, `<=`, `contains`, `starts_with`, `ends_with`, according to field type. Limits: 3 group levels, 8 rules and 50 values across the whole filter. A supplied `batch` requires a non-empty `where`; `{}` and `where: null` are refused. Omit `batch` on update to keep it, or set `batch: null` to disable it, adjusting batch-dependent config in the same update.

The Vault tools name a key by its id, the name it was added under, such as `deployer`, and a network by its `chainId`. The key listing says where a key is set up; its live state on a network, `enabled`, `disabled` or `unavailable`, is a separate read: see [Key states](/baas-console/vault.md#key-states). Keys are added and removed only in the Dashboard's [Vault](/dashboard/vault.md).

A change made through the MCP is the same as one made in the Console. A workflow change applies to its next runs. A key disabled on a network stops every new send or signature with it, including in a run already started.

## What the MCP never does

By design, the MCP is an inspection and configuration surface. These operations are not available to an agent, whatever its role:

* **Deploy a contract.** Use the [BaaS CLI](/baas-cli/cli.md).
* **Register or remove a contract.** Use the [Console](/baas-console/contracts/register-a-contract.md).
* **Submit a transaction or transfer funds.** The MCP can prepare an unsigned transaction; a wallet you control signs and sends it.
* **Start a workflow run.** Workflows run only from their own trigger: a webhook call, a cron schedule, or a monitored event.
* **Read a secret key or a Vault key.** Secret API keys are shown once at creation in [Console → API Settings → API Keys](/baas-console/api-settings/secret-keys.md). Of a Vault key, an agent sees its id (its name), provider, and address once it is set up, never the key itself.
* **Add or remove a key, manage project members, or wallet settings.** These stay in the BaaS Dashboard and the Console.

The MCP also holds back data an agent has no use for. A user's push notification tokens are never returned, only their count, and a webhook secret is shown once, right after it is rotated.

## Permissions

The MCP uses the role your account has on the project, the same one the Console uses. There is nothing to configure on the MCP side.

| Role      | What the agent sees                                                                 |
| --------- | ----------------------------------------------------------------------------------- |
| **READ**  | The inspection and documentation tools.                                             |
| **WRITE** | Everything in READ, plus the tools that create, update, pause, or delete resources. |

Owners have the WRITE tools as well. No tool requires the owner role.

Roles are granted by a project owner. When yours changes, sign out of the server and sign in again for the new role to apply. See [Sign-in and roles](/ai-tools/mcp/setup.md#sign-in-and-roles).

{% hint style="warning" %}
**Connect the MCP only to AI clients you trust**, and review write operations before approving them, especially on a production project. With a WRITE role, an agent can change live workflows and disable the keys they use. When in doubt, work with a READ role, or ask the agent to show you the configuration it intends to apply before it applies it.
{% endhint %}

## Content from outside BaaS

Webhook payloads, function logs, and user profiles can contain untrusted content. Keep your client's approval prompts enabled for write operations.