MCP tools

The server runs outside the host's shell sandbox, which is how it reads the deny-gated secrets store, shells out to gh, and makes the git writes a worktree needs. Tool names are prefixed mcp__plugin_agent-kevin_kevin__ in permission lists.

What is granted when

This keeps settings.json an accurate audit trail: it advertises only the packs you opted into.

Notes on a few

• compile_* return prompts; your session does the synthesis; compile_write confirms. See The brain.
• task_* carry each task's horizon, the day, week, or month it is planned for; task_query can filter by lane (carried, today, week, month, later).
• attention_write renders the attention view (the dashboard's Today view, or a project's page) and returns the same JSON the page embeds. See Attention.
• database_* read tools run inside a BEGIN READ ONLY transaction with a statement timeout, then roll back, so Postgres itself rejects writes. database_fork is the one write: it clones a local database via CREATE DATABASE … TEMPLATE … for risky schema work.
• github_* wrap the gh CLI with the fine-grained token of the repo's owner (GITHUB_TOKEN_<OWNER>, else GITHUB_TOKEN), or your own gh auth login when neither is set. github_pr_list filters by author, a pending review request, or a search query, so one call finds your pull requests and another the reviews you owe. github_sweep gathers everything waiting on you in one call: owed comments, review requests, re-reviews, pending reviews and conflicting PRs, decided from GitHub's own fields; with counts: true it returns only the numbers, which is how sync reads it. Merging and re-running workflows stay a human-in-terminal activity. github_fast_forward is the one git write: a forward-only fetch of your local default branches during sync.
• GitHub writes (github_issue_create, github_issue_comment, github_issue_update, github_pr_update, github_pr_create, github_comment_update) open, edit, comment on and label issues with screenshots or videos, open a PR from a pushed branch (always asking first), replace a PR's title or description, and fix a comment the token's own account wrote. They run on the same owner's token, so its permissions decide what they may do, and nothing closes an issue or edits someone else's text.
• helpdesk_* read support tickets from SupportCandy or Pylon through one shape, with the people on each ticket (customer, assignee, each message's author). helpdesk_connections lists the configured sites and workspaces, and every other helpdesk tool takes a connection to pick one. helpdesk_accounts and helpdesk_lookups list customer companies and reference data (statuses, categories, tags, teammates, macros). helpdesk_stats counts a queue's tickets in a window: numbers only, never ticket text, which is why sync can run it. helpdesk_attachment saves a ticket's log or screenshot to a temp folder outside the home. helpdesk_note and helpdesk_assign are the writes: a private note agents see and the customer never does, for a draft reply a person sends, and a SupportCandy ticket's assignee, read back to confirm it changed. See Helpdesk.
• appstore_reviews reads any app's App Store reviews from Apple's public feed, newest first, per country storefront. It learns which storefronts an app's reviews come from, asks a blank page again past Apple's cache, marks a read incomplete when a storefront that has had reviews comes back blank, gives no count when nothing came back (never zero), and never replies. A limit of 0 returns the counts alone, which is how sync can run it. See App Store reviews.
• slack_* read Slack as you, with a user token that has no write or DM scope; they run in the MCP server, which can read the token your shell can't. slack_waiting returns what's waiting on you (unanswered mentions, threads in shared channels where someone outside the workspace spoke last, and channels the channel map doesn't list) as who, where, how long and a link, never message text. See Slack.
• home_history reports and turns on the home's version history, and puts back a .git link a synced folder deleted. It writes only for a history it set up. See History.
• web_search is a direct call to the Perplexity Search API with citations.
• curl_run runs outside the sandbox with a host-scoped grant; video_frames extracts stills from a recording, and media_transcribe turns its speech into a timestamped transcript on the Mac itself (macOS 26+, needs yap). See the media skill in Skills.