---
title: "MCP tool reference"
canonical: https://trickest.com/docs/developer-tools/mcp/tools
description: "Every tool the Trickest MCP server exposes, what it does, and whether it reads, writes, or deletes."
---

# MCP tool reference

The server exposes 40 tools. Each one carries MCP annotations (`readOnlyHint`, `destructiveHint`, `openWorldHint`) that your client reads to decide when to prompt you, and a human title that appears in permission prompts (`trickest_workflow_delete` shows as **Workflow delete**).

**Effect** in the tables below is what the annotations say:

- **Read**: no change to your workspace. Clients can allow these without a prompt.
- **Write**: creates, updates, or stops something. Reversible by another write.
- **Destructive**: deletes, replaces, or spends compute. Tools marked **confirm** refuse to act until the agent passes `confirm: true`, and return a summary of what would happen instead.

Every tool that touches a workflow takes `workflowId`. There is no active-context step; one connection can drive any number of workflows.

## Status and discovery

| Tool | What it does | Effect |
|---|---|---|
| `trickest_status` | The connected user and the platform URL the server talks to. | Read |
| `trickest_ping` | Confirm the server can reach the Trickest API with the current credential. | Read |
| `trickest_library_search` | Search the library of tools, modules, and scripts. Filter with `type`. | Read |
| `trickest_tool_schema` | Full input and output schema of one library tool, so the agent wires ports by type. | Read |
| `trickest_guide` | One embedded platform guide as markdown: `script-io`, `workflow-builder`, `cli-grammar`, or `database-tql`. Omit `topic` to list them. | Read |

The four guides are also published as MCP resources under `trickest://guides/<id>`, for clients that load resources ahead of tools.

## Workflows

| Tool | What it does | Effect |
|---|---|---|
| `trickest_workflow_list` | List workflows in a space, or across all spaces with `all: true`. | Read |
| `trickest_workflow_get` | Workflow metadata plus the full node and edge graph. | Read |
| `trickest_workflow_create` | Create a workflow in a space or project. | Write |
| `trickest_workflow_delete` | Delete a workflow by name or ID. | Destructive, confirm |

## Nodes and connections

| Tool | What it does | Effect |
|---|---|---|
| `trickest_node_list` | Nodes in a workflow with their type, tool or script reference, and connections. | Read |
| `trickest_node_add` | Add a tool, script, or module node. Pass `from` to connect it from an upstream node; pass script source as `code` or `codeB64`. | Write |
| `trickest_node_set` | Set one input on a node, or a script body with `key: "script"`. Replaces the value in place rather than wiring a second primitive to the same port. | Write |
| `trickest_node_set_script` | Set a script node's body from `script` or `scriptB64`. Warns about malformed templates and unknown workspace variables. | Write |
| `trickest_node_set_script_args` | Set the positional runtime arguments a script receives. Pass `[]` to clear. | Write |
| `trickest_connect` | Connect two nodes. The server picks the ports from the schemas; pass `node:port` to force one. | Write |
| `trickest_disconnect` | Remove the connection between two nodes. | Write |
| `trickest_node_remove` | Remove one or more nodes in a single new workflow version. | Destructive |

## Runs

| Tool | What it does | Effect |
|---|---|---|
| `trickest_run_list` | Runs for a workflow, with an optional status filter. | Read |
| `trickest_run_get` | Status of one run with a per-node breakdown. | Read |
| `trickest_run_wait` | Poll a run for up to `maxWaitSeconds` (default 45) and return per-node status. Call again until `terminal: true`. | Read |
| `trickest_run_verify` | Post-run health check: per-node status plus a data-flow audit that flags every edge where the upstream produced output and the downstream produced none. | Read |
| `trickest_run_execute` | Start a run of the whole workflow, or of one node plus its upstream chain with `node`. Waits up to `maxWaitSeconds`, then hands over to `trickest_run_wait`. `overallSuccess` is `false` whenever any node failed, even when the run row says completed. Cap parallelism with `maxMachines`. | Destructive |
| `trickest_run_stop` | Stop a running execution. | Write |

## Outputs

| Tool | What it does | Effect |
|---|---|---|
| `trickest_output_get` | A node's output files, stdout, and stderr for a run. Start here when a node failed. | Read |
| `trickest_output_read` | One output file as text, capped at 50 KB with `truncated: true` past the cap. Defaults to the last run. | Read |
| `trickest_output_stdout` | A node's full stdout for a run. | Read |
| `trickest_output_stderr` | A node's full stderr for a run. The error that failed the node is here. | Read |

## Live Tables

| Tool | What it does | Effect |
|---|---|---|
| `trickest_database_list` | Tables available in the current workspace. | Read |
| `trickest_database_query` | Run a TQL filter expression against a table, with `select`, `orderBy`, `limit`, and `offset`. Returns `total_count`. | Read |

TQL is a filter language, not SQL: `port > 443 AND service = "http"`. The `database-tql` guide covers the syntax and the table lifecycle.

## Variables and memory

| Tool | What it does | Effect |
|---|---|---|
| `trickest_variable_get` | A workspace variable by name or ID. Secret values stay masked unless `reveal: true`. | Read |
| `trickest_variable_set` | Create a workspace variable, or replace the one with the same name. Replacing deletes and re-creates it, so the previous value is gone. | Destructive |
| `trickest_variable_rm` | Delete a workspace variable. | Destructive, confirm |
| `trickest_memory_search` | Search workspace memory by meaning. | Read |
| `trickest_memory_get` | One memory entry by key or ID. | Read |
| `trickest_memory_set` | Create or update a memory note: `section`, `log`, `plan`, `workflow_meta`, or `note`. | Write |

## Everything else: command dispatch

The curated tools above cover the paths agents take most. The rest of the platform, around 200 CLI commands, is reachable through five dispatch tools that take a command name from the registry and an `args` object. They are split by effect so your client can allow reads and prompt on the rest.

| Tool | What it does | Effect |
|---|---|---|
| `trickest_search_commands` | Find a command by free text or `domain` (`workflow`, `database`, `fleet`, and so on). Returns its name, description, effect, and argument keys. | Read |
| `trickest_query` | Run one read-only command, such as `workflows.get` or `fleet.ls`. Refuses anything that writes, and names the tool that owns it. | Read |
| `trickest_write` | Run one create, update, or control command, such as `workflows.create` or `runs.stop`. Refuses reads, execution, and deletes. | Write |
| `trickest_execute` | Run a command that executes code, spends compute, or contacts an external service, such as `runs.execute` or `skills.installUrl`. | Destructive, confirm |
| `trickest_delete` | Run a delete or other hard-to-reverse command, such as `workflows.rm` or `database.drop`. | Destructive, confirm |

Over a signed-in (OAuth) connection the `app.*` sandbox commands are hidden from `trickest_search_commands` and refused by `trickest_execute`. See [Limits](/docs/developer-tools/mcp#limits).

## Not offered over HTTP

Storage push and pull work on the filesystem of the machine running the server, which for the hosted endpoint is not yours. They are not registered on the hosted server. Use the [CLI](/docs/developer-tools/cli/storage-variables) or the [SDK](/docs/developer-tools/sdk/storage-variables) to move files.

---
_Markdown source of https://trickest.com/docs/developer-tools/mcp/tools._