AgentLayerdocs
Modules · Powers

MCP tools

The 56 tools the kevin MCP server exposes, grouped, with what is pre-granted and what always asks.

The server runs outside the host's shell sandbox, which is how it reads the deny-gated secrets store, shells out to gh, and makes the git writes a worktree needs. Tool names are prefixed mcp__plugin_agent-kevin_kevin__ in permission lists.

GroupTools
Tasks (7)task_query · task_get · task_create · task_update · task_close · task_thread · task_scan
Knowledge (7)capture · compile_status · compile_next · compile_write · knowledge_lint · links_rewrite · memory_prune
Reports and surfaces (2)report_write · dashboard
Worktrees (3)setup_worktree · list_worktrees · remove_worktree
Upgrade and hosts (2)run_upgrade · codex_setup
Seed (3)seed_scan · seed_export · seed_import
Database (4)database_list · database_schema · database_query · database_fork
GitHub (11)github_pr_list · github_pr_view · github_pr_comments · github_pr_diff · github_pr_checks · github_run_list · github_run_view · github_run_log · github_issue_list · github_issue_view · github_fast_forward
Browser (6)browser_screenshot · browser_pdf · browser_markdown · browser_record · browser_flows · web_search
SEO (8)serpapi_search · open_page_rank · google_auth · gsc_sites · gsc_query · gsc_inspect · page_speed_psi · page_speed_audit
Utilities (3)curl_run · video_frames · ping

What is granted when

ClassToolsGranted
Always-on coretasks, knowledge, report_write, dashboard, setup_worktree, run_upgrade, codex_setup, seed_scan, seed_export, video_frames, pingAt init, in permissions.allow
Pack-gatedSEO, Browser, Database, GitHub groupsWhen you activate the pack in configure-skills
Always askremove_worktree (deletes a worktree), seed_import (overwrites identity files, merges permissions and MCP registrations), curl_run (leaves the machine)In permissions.ask, so no mode can auto-approve them
Prompt on uselist_worktrees, and any pack tool whose pack is not activeDefault host behaviour

This keeps settings.json an accurate audit trail: it advertises only the packs you opted into.

Notes on a few

  • compile_* return prompts; your session does the synthesis; compile_write confirms. See The brain.
  • database_* read tools run inside a BEGIN READ ONLY transaction with a statement timeout, then roll back, so Postgres itself rejects writes. database_fork is the one write: it clones a local database via CREATE DATABASE … TEMPLATE … for risky schema work.
  • github_* wrap the gh CLI with a read-only fine-grained token. There are no write subcommands; commenting, merging, and re-running workflows stay a human-in-terminal activity. github_fast_forward is the one git write: a forward-only fetch of your local default branches during sync.
  • web_search is a direct call to the Perplexity Search API with citations.
  • curl_run runs outside the sandbox with a host-scoped grant; video_frames extracts stills from a recording.

On this page