---
title: "MCP tool reference"
canonical: https://trickest.com/docs/developer-tools/mcp/tools
description: "Every tool the Trickest MCP server exposes, what it does, and whether it reads, writes, or deletes."
---

# MCP tool reference

The server exposes 40 tools. Each one carries MCP annotations (`readOnlyHint`, `destructiveHint`, `openWorldHint`) that your client can use when applying its permission policy, and a human title that appears in permission prompts (`trickest_workflow_delete` shows as **Workflow delete**).

Annotations are hints, not a guarantee of a confirmation prompt.

**Effect** in the tables below is what the annotations say:

- **Read**: no change to your workspace. Clients can allow these without a prompt.
- **Write**: creates, updates, or stops something. Reversal depends on the operation.
- **Destructive**: deletes, replaces, or spends compute. Tools marked **confirm** refuse to act until the agent passes `confirm: true`, and return a summary of what would happen instead.

Pass the resource identifiers requested by each tool, such as `workflowId` or `runId`. The hosted connection does not share your local CLI’s active workflow. Discover the input schema before calling a tool.

## Status and discovery

| Tool | What it does | Effect |
|---|---|---|
| `trickest_status` | The connected user and the platform URL the server talks to. | Read |
| `trickest_ping` | Confirm the server can reach the Trickest API with the current credential. | Read |
| `trickest_library_search` | Search the library of tools, modules, and scripts. Filter with `type`. | Read |
| `trickest_tool_schema` | Full input and output schema of one library tool, so the agent wires ports by type. | Read |
| `trickest_guide` | One embedded platform guide as markdown: `script-io`, `workflow-builder`, `cli-grammar`, or `database-tql`. Omit `topic` to list them. | Read |

The four guides are also published as MCP resources under `trickest://guides/<id>`, for clients that load resources ahead of tools.

## Workflows

| Tool | What it does | Effect |
|---|---|---|
| `trickest_workflow_list` | List workflows in a space, or across all spaces with `all: true`. | Read |
| `trickest_workflow_get` | Workflow metadata plus the full node and edge graph. | Read |
| `trickest_workflow_create` | Create a workflow in a space or project. | Write |
| `trickest_workflow_delete` | Delete a workflow by name or ID. | Destructive, confirm |

## Nodes and connections

| Tool | What it does | Effect |
|---|---|---|
| `trickest_node_list` | Nodes in a workflow with their type, tool or script reference, and connections. | Read |
| `trickest_node_add` | Add a tool, script, or module node. Pass `from` to connect it from an upstream node; pass script source as `code` or `codeB64`. | Write |
| `trickest_node_set` | Set one input on a node, or a script body with `key: "script"`. Replaces the value in place rather than wiring a second primitive to the same port. | Write |
| `trickest_node_set_script` | Set a script node's body from `script` or `scriptB64`. Warns about malformed templates and unknown vault variables. | Write |
| `trickest_node_set_script_args` | Set the positional runtime arguments a script receives. Pass `[]` to clear. | Write |
| `trickest_connect` | Connect two nodes. The server picks the ports from the schemas; pass `node:port` to force one. | Write |
| `trickest_disconnect` | Remove the connection between two nodes. | Write |
| `trickest_node_remove` | Remove one or more nodes in a single new workflow version. | Destructive |

## Runs

| Tool | What it does | Effect |
|---|---|---|
| `trickest_run_list` | Runs for a workflow, with an optional status filter. | Read |
| `trickest_run_get` | Status of one run with a per-node breakdown. | Read |
| `trickest_run_wait` | Poll a run for up to `maxWaitSeconds` (default 45) and return per-node status. Call again until `terminal: true`. | Read |
| `trickest_run_verify` | Post-run health check: per-node status plus a data-flow audit that flags every edge where the upstream produced output and the downstream produced none. | Read |
| `trickest_run_execute` | Start a run of the whole workflow, or of one node plus its upstream chain with `node`. Waits up to `maxWaitSeconds`, then hands over to `trickest_run_wait`. `overallSuccess` is `false` whenever any node failed, even when the run row says completed. Cap parallelism with `maxMachines`. | Destructive |
| `trickest_run_stop` | Stop a running execution. | Write |

## Outputs

| Tool | What it does | Effect |
|---|---|---|
| `trickest_output_get` | A node's output files, stdout, and stderr for a run. Start here when a node failed. | Read |
| `trickest_output_read` | One output file as text, capped at 50 KB with `truncated: true` past the cap. Defaults to the last run. | Read |
| `trickest_output_stdout` | A node's stdout for a run, subject to response limits. | Read |
| `trickest_output_stderr` | A node's stderr for a run, subject to response limits. Inspect it when a node fails. | Read |

## Live Tables

| Tool | What it does | Effect |
|---|---|---|
| `trickest_database_list` | Currently lacks the workflow context required by its backing command. Use the dispatch alternative below. | Read |
| `trickest_database_query` | Run a TQL filter expression against a table, with `select`, `orderBy`, `limit`, and `offset`. Returns `total_count`. | Read |

To list a workflow’s tables, use `trickest_query` with `command: "database.listByWorkflow"` and `args: { workflowId: "<workflow-id>" }`. The curated list tool currently has no way to supply that required context.

TQL is a filter language, not SQL: `port > 443 AND service = "http"`. The `database-tql` guide covers the syntax and the table lifecycle.

## Variables and memory

| Tool | What it does | Effect |
|---|---|---|
| `trickest_variable_get` | A regular vault variable by name or ID. This tool does not read the separate secrets collection. | Read |
| `trickest_variable_set` | Create or replace a regular vault variable; `secret: true` uses the separate secrets collection and supports optional `space`. Replacement deletes before creating, so a failed creation can leave the value missing. | Destructive |
| `trickest_variable_rm` | Delete a regular vault variable. | Destructive, confirm |
| `trickest_memory_search` | Search vault memory by meaning. | Read |
| `trickest_memory_get` | One memory entry by key or ID. | Read |
| `trickest_memory_set` | Create or update a memory note: `section`, `log`, `plan`, `workflow_meta`, or `note`. | Write |

## Everything else: command dispatch

The curated tools above cover the paths agents take most. The rest of the platform, around 200 CLI commands, is reachable through five dispatch tools that take a command name from the registry and an `args` object. They are split by effect so your client can allow reads and prompt on the rest.

| Tool | What it does | Effect |
|---|---|---|
| `trickest_search_commands` | Find a command by free text or `domain` (`workflow`, `database`, `fleet`, and so on). Returns its name, description, effect, and argument keys. | Read |
| `trickest_query` | Run one read-only command, such as `workflows.get` or `fleet.ls`. Refuses anything that writes, and names the tool that owns it. | Read |
| `trickest_write` | Run one create, update, or control command, such as `workflows.create` or `runs.stop`. Refuses reads, execution, and deletes. | Write |
| `trickest_execute` | Run a command that executes code, spends compute, or contacts an external service, such as `runs.execute` or `skills.installUrl`. | Destructive, confirm |
| `trickest_delete` | Run a delete or other hard-to-reverse command, such as `workflows.rm` or `database.drop`. | Destructive, confirm |

Over a signed-in (OAuth) connection the `app.*` sandbox commands are hidden from `trickest_search_commands` and refused by `trickest_execute`. See [Limits](/docs/developer-tools/mcp#limits).

Command search omits unsupported commands. In particular, schedule list/get/enable/disable and fleet remove/scale are not available through dispatch. Use the discovered schema rather than assuming every CLI command is supported.

Responses larger than 100 KB may be truncated or rejected by the CLI-backed tools. Narrow a query or use the CLI/SDK to retrieve large outputs.

## Not offered over HTTP

Storage push and pull work on the filesystem of the machine running the server, which for the hosted endpoint is not yours. They are not registered on the hosted server. Use the [CLI](/docs/developer-tools/cli/storage-variables) or the [SDK](/docs/developer-tools/sdk/storage-variables) to move files.

---
_Markdown source of https://trickest.com/docs/developer-tools/mcp/tools._