Corply MCP Server

Generate a reviewable repository patch plan from a valid catalog manifest: the unpublished local @corply/payments alpha package coordinate, exact manifest, environment-variable-name template, structured external Paddle sandbox setup handoff, framework adapter files, and required verification checks. Makes zero provider/network calls, writes no files itself, never overwrites existing files, and never handles credential values. The manifest is verify-exact and must never be merged field-by-field; generated code is create-only and code collisions require deliberate integration. The calling agent must inspect each target path, apply safe files, follow the provider handoff only after founder authentication, run every returned check locally, capture SHA-256 evidence references, call verify_payment_integration with truthful pass/fail/not-run evidence, repair from its report, and repeat. Do not execute the afterPublishCommand until the package is actually published. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Legacy Paddle path only. After prepare_revenue_launch returns sandbox_build_ready, deterministically generate the integrity-hashed sandbox-only manifest that the agent will commit inside an existing legacy integration. This is a pure draft action: it stores no hosted state, makes zero provider calls, creates no Paddle account/catalog, charges nothing, and accepts no secret values. The hash detects drift but is not a provider approval or cryptographic signature. Same company + projectKey + inputs returns the same project and hash. Next call configure_payment_catalog. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Create or exactly replay one local sandbox merchant-route draft for Corply's own payment pipeline. This reversible backend save accepts only company, route key, USD, and an idempotency key; it cannot accept or store credentials, provider IDs, identity documents, terms acceptance, bank/card data, or a production setting. It makes zero provider calls, creates no external account, activates nothing, and moves no money. Afterward call get_payment_pipeline_status; provider onboarding, payout-bank connection, route activation, and live enablement remain separately confirmed actions. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Canonical read for Corply's own payment pipeline: returns non-secret merchant routes, lifecycle counts, gross settled/refunded/paid-out totals, recent payment state, reconciliation state, and exact blockers for one company. It never returns provider credentials, hosted payment tokens, bank/card data, or customer data; makes zero provider calls and moves no money. Use this instead of the legacy Paddle integration planner when the founder wants Corply-controlled payment portals. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Record evidence that the company completed one exact materialized work occurrence outside Corply. The command pins rule/version/subject/occurrence, requires a durable idempotency key and explicit attestation, and routes the immutable claim to automatic, operator, or professional review. This tool never marks the work completed merely because evidence was submitted; use the normal fact and work-transition tools only after the returned review and remaining evidence/outcome gaps are resolved. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Atomically stage or promote one event occurrence's stable ID and mutable anchor fact. Use this for every fact named by an event rule; scalar writes are rejected to prevent mixed IDs/deadlines. If evidence is required, the first call returns candidate fact IDs. Bind evidence to each evidence-gated candidate, then retry with identical source and validity inputs; both facts become canonical in one transaction. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Record a company-owned evidence artifact, then freshly resolve the plan. Evidence is not task completion by itself; attach its id when transitioning a work item. For new files, call upload_operating_evidence (or the authenticated multipart upload endpoint) and use its server-returned filePath/fileHash. Founder-uploaded documents remain claims: use submit_operating_fact_evidence to bind and queue them for operator review. Only an operator may directly promote an evidence-confirmed fact. Professional determinations require named reviewer credentials. A guidance link or model assertion is never professional evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Record a typed, versioned company or subject fact and freshly resolve the plan. High-impact facts become canonical only with the registry's required confirmation/evidence. Never infer immigration status, work authorization, tax/legal conclusions, or other restricted facts; record explicit evidence or a qualified professional determination. A non-promoted candidate is not safe to treat as true. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Create an attorney-review draft case for one canonical one-time corporate action. Use policyVersion 2026.09.01-attorney-draft-v1. This records an intake case only: it does not provide legal advice, sign documents, file anything, charge money, issue/cancel/transfer shares, or mutate the cap table. Use an exact companyId and a stable idempotency key. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Get one company-scoped corporate-action case with its canonical approval/signature workflow, blockers, attorney gate, and natural-language next step. Never infer that a cap-table change occurred from case status. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

List durable corporate-action cases for one exact company, optionally filtered by status, with attorney-gated next-step context. This is read-only and never reads another company's cases. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

MANDATORY before any signing: prepare (or reuse) the checkout link for the one-time Corply incorporation fee. Two tiers, and the ONLY difference is how long registered agent is covered: registeredAgent='year_one' is $449 (Essential: formation plus the first year of registered agent), registeredAgent='lifetime' is $799 (formation plus registered agent for the life of the company). Ask the founder which they want before calling; default to year_one if they do not care, because they can upgrade later for $350 at any time via request_registered_agent_upgrade with nothing lost. Optionally include Corply Mail in the SAME Stripe checkout: corplyMail='annual' includes 365 days, then renews at $119/year; corplyMail='monthly' includes 365 days, then renews at $15/month; corplyMail='none' creates no recurring mail subscription. Before selecting annual or monthly, disclose the exact renewal price, that Stripe stores the payment method, and that the founder can cancel in Billing. Never infer consent; default to none. Promo codes are accepted on year_one only. Show the returned checkoutUrl to the founder in chat as a markdown link — creating the link needs no confirmation; the founder chooses whether to Pay in the browser. Only the lead founder pays, once per company; cofounders never pay, and editing/regenerating documents never re-charges. Safe to re-call: it reuses the open session, and switching tier retires the old link and issues the right one. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Upgrade a company from first-year registered agent to LIFETIME registered agent for $350, at any time after the incorporation fee is paid. This is the difference between the $449 Essential tier and the $799 Lifetime tier, so a founder who chose Essential loses nothing by upgrading later. Returns {status:'checkout_ready', checkoutUrl, amountDue} — show the link to the founder as a markdown link, then poll await_registered_agent_upgrade. Returns {status:'already_lifetime'} if the company already has lifetime coverage, in which case say so and do NOT offer to charge again. Requires a paid incorporation fee first: there is no registered agent to extend otherwise. Safe to re-call, it reuses the open session. No promo codes on this one. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Requires the incorporation fee to be PAID first (request_payment → await_payment). Phase-aware and idempotent: before Delaware acceptance it prepares each founder's one filing-stage bundle. The incorporator's bundle includes the Certificate of Incorporation; every founder's bundle includes the narrow Founder Formation Authorization for the enumerated standard post-acceptance records. After acceptance, standard-v1 records are executed from that stored authorization and must never become a second human signature request. Only a legacy formation that predates the authorization can return a post-acceptance signing bundle. Once an authorized founder's RSPA is fully executed and establishes the stock-purchase date, Corply prepares and executes that founder's 83(b) automatically from the same stored authority. This preparatory action needs no confirmation and sends no cofounder email. It returns only the caller's safe server-issued signing bundle and review link; present reviewUrl as a markdown link. Use the separately confirmed invite_cofounders or nudge_signer action for external messages. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Wait for the incorporation payment to land. Returns {status: 'paid'|'pending'|'expired'|'unpaid'}. Call it in a LOOP until it returns 'paid' — do not call request_signature, invite_cofounders, or submit_for_formation before then; they refuse with PAYMENT_REQUIRED. 'expired' → run request_payment again for a fresh link. 'unpaid' → no session yet; run request_payment first. Each call waits at most ~8 seconds by design — long-held requests get killed by the gateway. Call it REPEATEDLY until it returns 'paid'; a 'pending' result includes retryAfterSeconds. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Wait for the $350 lifetime registered-agent upgrade to land. Returns {status:'lifetime'|'pending'|'expired'|'unpaid'}. Call in a LOOP until 'lifetime'. 'expired' → call request_registered_agent_upgrade again for a fresh link. 'unpaid' → no session yet, call request_registered_agent_upgrade first. Each call waits at most ~8 seconds by design, because the gateway kills long-held requests; a 'pending' result includes retryAfterSeconds. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Check the formation's saved company name and up to five supplied alternatives through OpenSOSData. Pass the currently saved selectedName exactly and preserve the desired alternative order. Returns every name with available=true, false, or null when only that provider request failed. Previously rejected names return false without another provider call. Results are advisory and never block document generation; Corply operations performs the mandatory Delaware check immediately before filing. No confirmation is required. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Use for a broad company briefing, company disambiguation, or a founder asking what matters next. It is not a prerequisite for a goal-specific tool because every Corply result now carries server-authored context continuation. Returns the privacy-filtered caller/org/company context, lifecycle origin, formation/payment/filing/document/signature state, standard Delaware C-corp configuration, deterministic operating plan, and execution boundaries. Prerequisite: an authenticated active organization member. No confirmation is required; resolving may materialize the same deterministic canonical plan but creates no external side effect. When multiple companies exist, pass companyId and never guess. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Requires the incorporation fee to be PAID first (request_payment → await_payment). Compatibility action that emails each OTHER listed founder's pending review-and-sign link after documents are generated. It never creates or refreshes membership invitations; use invite_member earlier, after explicit founder confirmation. Only run when the lead explicitly asks. Sign links are delivered directly to each cofounder and are shown here only when their email fails. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Invite a cofounder to this organization by email. Call only after the founder explicitly confirms the invitation. This membership invitation is independent of name checks, documents, payment, and signatures. They join from their own connected Corply session by signing in with that email. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Create a short-lived, one-time external-browser link for the taxpayer to enter the SSN/ITIN required on their exact signed 83(b) election. Use only after that founder has signed. Never ask for, accept, repeat, or place a TIN in chat. The link is reversible and may be refreshed without additional confirmation. Corply never stores the TIN as a database field; Corply Ops receives only a short-lived encrypted mail-ready PDF to print and mail. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

LEGACY PADDLE SUBSCRIPTION MIGRATION ONLY; for a new Corply-controlled payment portal call get_payment_pipeline_status instead. The calling coding agent must inspect framework, package manager, app/source root, and test/build commands itself before calling—never ask the founder for repository metadata. Reuses the authenticated company's non-secret formation facts, classifies whether the older fixed-price SaaS subscription Paddle merchant-of-record path fits, and returns only the commercial facts that genuinely need founder input. Makes zero provider calls and no writes; never requests credentials, identity documents, bank/card data, or acceptance of terms. If multiple companies exist, pass an exact companyId from get_company_briefing. Trust nextTool and do not bypass an unsupported marketplace, digital-goods, one-time/mixed/usage billing, physical-goods, or services result. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Owner/operator recovery for one uncertain Mercury onboarding attempt. Call only after Mercury directly confirms either the exact onboardingDataId and mercury.com signup link, or that no active application remains and a corrected retry is safe. Never infer or invent provider evidence. This action creates an auditable reconciliation record. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Read the exact active Moov sandbox wallet balance and compare it with Corply's immutable route-scoped platform-cash postings, then record a hash-bound reconciliation run. It makes provider reads only, exposes no provider account, wallet, credential, bank/card, or customer data, and moves no money. The first run may anchor a pre-existing wallet balance only before any payment or journal activity; later variance fails readiness closed. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

After fresh founder confirmation of the exact USD 1.00 Moov sandbox charge, create or replay one server-priced diagnostic order and send its server-configured card-payment source through Corply's durable create-and-authorize pipeline. The tool accepts no provider IDs, card/bank data, customer data, amount, currency, merchant, fee, reserve, or payout destination. It requires an active route, a fresh zero-variance reconciliation, server-held probe configuration, and an exact idempotency key. This is test-mode money movement only; it cannot charge live money, enable production, or prove settlement by itself. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

After fresh founder confirmation of the exact USD 0.01 Moov sandbox payout, send one cent from one exact settled diagnostic payment through Corply's durable payout command to the route's server-resolved verified standard-ACH bank. The tool accepts no amount, currency, provider ID, wallet, bank/card data, or payout destination. It requires the exact paymentKey, active sandbox route, fresh zero-variance reconciliation, and verified bank. This is test-mode money movement only; the scheduled worker records the provider's exact after-the-fact payout fee from transfer and wallet evidence before reconciliation can pass. It cannot move live money or enable production. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Create one consented Mercury partner prefill and return the founder-only signup link. Call get_bank_onboarding_status first. Never request or include an SSN, identity image, raw formation document, Mercury credential, or legal name/EIN override; Corply loads trusted company facts server-side. Obtain fresh founder confirmation that Corply may send the supplied owner, address, and business data to Mercury before calling. The founder still completes Mercury identity verification, reviews the application, accepts Mercury's terms, and submits it. Reuse the exact idempotencyKey after a timeout and never invent a new key for an uncertain attempt. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Create or recover the secure hosted Moov sandbox onboarding link for one existing Corply payment route. This makes an idempotent provider call after a durable local claim, pre-fills only the canonical legal business name, and asks the founder to complete identity, ownership, underwriting, pricing disclosure, capability, and payout-bank setup directly with Moov. It never receives identity documents, bank/card data, provider credentials, or terms acceptance in chat, activates no route, and moves no money. Return the onboardingLink to the founder, then call get_payment_pipeline_status after they complete it. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Requires the incorporation fee to be PAID first (request_payment → await_payment). Hand the fully-signed formation to the human filing pipeline, then best-effort notify the organization and email the signed incorporation documents to each founder. Does NOT file with Delaware. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Submit one founder-provided document for an evidence-confirmed operating fact. This stages the exact typed assertion, binds the server-verified immutable artifact, and creates a durable operator-review claim. Submission never makes the fact canonical and the resolver will continue to ask for it until an operator approves the exact claim. filePath/fileHash must come from upload_operating_evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Attach an already-existing company without creating a Corply formation. Records name, jurisdiction, entity type, date, and file number as founder assertions—not verified facts—then returns a refreshed get_company_briefing result and requests the charter, bylaws, and cap table/stock ledger when available. Prerequisites: active company-manager access, an explicit companyId when the organization has multiple companies, and a stable idempotencyKey. Safe retries with the same key and exact request return the original result; reusing the key for different inputs is rejected. No extra confirmation is required because this records the user's explicit assertion and does not file, pay, sign, invite, or verify anything. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Advance one case through the explicit durable state graph after the stated human action actually occurred. Requires the exact current expectedStatus and stable idempotency key. Attorney approval of the current policy version is mandatory beyond attorney review. This never signs, files, charges, or mutates any cap-table/stock-ledger record. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Apply confirmed answer changes to a frozen, pre-submission formation. This supersedes the frozen legal documents and open signature requests, reopens intake, and requires document regeneration and fresh signatures. Use only after the founder explicitly confirms that consequence. Partial data still deep-merges over stored answers. Returns the server-authoritative standardConfiguration with the canonical nextStep. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Append hash-backed evidence to one exact company-scoped corporate-action case. This records an immutable reference only; it does not claim the underlying approval, signature, filing, payment, ledger update, or cap-table mutation occurred unless the referenced evidence actually proves it. Never include document contents, tax IDs, payment credentials, or secrets in metadata. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

First tool for opening a company bank account. Returns any durable Mercury prefill handoff, an in-flight or reconciliation state, or the current direct Mercury fallback. It never reads or returns SSNs, identity documents, provider credentials, or submitted KYC payloads. A handoff URL is available only to an active owner, founder, cofounder, or operator membership. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Return the company's live cap table: every holder with their security type, shares, price paid, and computed ownership %, plus total shares issued. Auto-seeded with founder common stock at formation. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Validate and deterministically add the founder-approved fixed-price SaaS subscription catalog to an integrity-hashed Corply Pay manifest. The agent derives technical product/price/entitlement keys, environment-variable names, and the SaaS category matching the already-approved business model; do not ask the founder for implementation identifiers or a tax code. Inputs contain environment-variable NAMES only—never Paddle IDs, API keys, webhook secrets, bank/card data, or customer data. Makes zero provider calls and charges nothing. Refuses drifted manifests, duplicate identifiers, model/category mismatches, or catalog/billing-model contradictions. Next call create_payment_integration_bundle. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Phase-aware immutable generation. Company-name search results are advisory and do not gate this action. Before filing, status 'ready' produces only the filing-stage Certificate of Incorporation. After Delaware acceptance, status 'formed' produces Bylaws, Action of Incorporator, Initial Board Consent, one RSPA per founder, and the unsigned SS-4 using the recorded accepted date. After an electing founder's RSPA is fully executed, Corply automatically produces that founder's 83(b) Election from the actual stock-purchase date and executes it under the advance authorization captured in the founder's signing bundle. A canonical next step may call this tool without another founder confirmation solely to retry that automatic 83(b) preparation. Otherwise, confirm before creating immutable legal documents. Before filing, editing a generated application reopens the formation, supersedes its Certificate and collected signatures, and requires re-generation and re-signing. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: follow the canonical nextStep—confirm when checkpoint=true; an automatic 83(b) preparation retry explicitly needs no new approval.

Import a cap table from a Carta/Pulley CSV export (one-way — Corply becomes the system of record). Owner/founder only. Call with confirm:false first to PREVIEW the parsed holders; confirming REPLACES the company's entire existing cap table with the imported set. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Owner/operator-only grant or revocation of one person's expiring access to one restricted operating-data class. Use the narrowest subject and class, explain the business purpose, cap access at 90 days, and revoke immediately when the engagement ends. Revocation is retained as an audit tombstone. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Report one of YOUR post-incorporation tasks as done (for example, opening your bank account) with an optional note. Corply's team verifies and completes it — status becomes 'pending review'. Only works for tasks assigned to the founder. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Re-send the signature reminder email to a cofounder who hasn't signed yet. Only when the lead asks. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Compatibility read returning the caller's organization and company identities. Prefer get_company_briefing for company-specific work. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Search the organization's context memory + Corply reference KB for relevant facts. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Join an organization with an invite join code. Ask the user to confirm first ('Join {company} as a cofounder?') — joining switches your active organization and best-effort emails the other active organization members that their cofounder joined. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Read the exact hosted Moov sandbox onboarding invite, required capability statuses, default wallet, and verified payout-bank method for one Corply route, then converge the server-only route connection. It accepts no provider IDs, credentials, identity documents, bank/card data, or terms acceptance from chat. It makes provider reads only, never changes the provider account, and activates the sandbox route only when all required provider facts are currently ready; it moves no money and cannot enable production. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Persist a durable decision/fact into the organization's context memory. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Deterministically resolve and materialize the company's current operating graph. The lifecycle is always running—never report globally done. Treat unknown facts as unknown and ask only returned questions; never infer immigration/work permission or restricted personal facts. Honor evidence, signature, payment, authority, licensed-professional, and other human boundaries before acting. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Deep-merge upsert of the structured formation application for a company: incremental saves merge over what's already stored — a partial payload never wipes untouched sections. This reversible intake save needs no confirmation. Standard restricted founder shares default to an 83(b) election; omit those fields and do not ask the founder for a separate 83(b) decision. The signing bundle later captures the required authorization. It refuses changes to a frozen legal packet; use amend_frozen_application after explicit founder confirmation when documents and signatures must be superseded. Returns { formationId, standardConfiguration, nextStep }; use that configuration instead of generic capitalization advice. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Record one binding ESIGN/UETA consent for the exact server-issued bundle returned by get_status or request_signature. CALLER GATE: only the live signer may call it, after reviewing every listed document and giving one fresh affirmative act. Never reuse prior-session consent or sign for an absent cofounder. The opaque bundleId prevents omitted, added, or stale documents. For an eligible founder who already elected Section 83(b), the pre-filing Founder Formation Authorization also grants narrow advance authority: once the RSPA establishes the transfer date, Corply automatically completes and executes the election without another signature or confirmation. Then show/open the returned external-browser TIN link immediately and never ask for the TIN in chat. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Return the formation status for a company (or its latest formation): founder-facing checklist, the payment block, THIS caller's pendingSignatures + who else is awaitingOthers, postIncorp tasks, webDashboardUrl, nextStep, and an optional private celebration link after verified incorporation. Offer a newly discovered milestone once; trust nextStep over your own inference of what comes next. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Transition one materialized work occurrence by workItemId, then freshly resolve the company plan. Completion is rejected until attached company evidence covers every requirement and required human/professional boundaries. Legal, tax, regulatory, provider, and contractual requirements cannot be waived; change facts only with truthful evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

Store exact caller-supplied evidence bytes in the active company's private canonical evidence prefix and return the server-computed SHA-256 needed by record_operating_evidence. Use only when the client has supplied the actual base64 file bytes; never invent bytes from a description. Browser/desktop clients should use POST /operating/evidence/upload for files larger than the MCP limit. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Create or update one durable company-owned subject, including a person, location, product, offering, customer, vendor, contract, equity award, account, or obligation, then freshly resolve the plan. Use a stable externalKey; store decision facts through record_operating_fact, not opaque attributes. Never fabricate personal, immigration, or credential data. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Validate the formation application and return structured validationIssues whose kind distinguishes absent inputs from saved-but-invalid values. Promotes the formation to 'ready' when complete and returns the server-authoritative standardConfiguration with the canonical nextStep. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Inventory caller-reported local/sandbox evidence references against every required Corply Pay control: build/type tests, webhook authenticity/idempotency/out-of-order delivery, subscription lifecycle, deny-by-default entitlements, tenant isolation, return-URL validation, secret scan, and sandbox checkout. This tool reports only whether that caller-supplied inventory is complete; it does not execute or independently attest commands, establish sandbox or production readiness, or make provider calls. Passed/failed results require the exact command and a SHA-256 evidence reference. Evidence inventory completeness NEVER completes KYB/KYC, terms, payout-bank, provider approval, refunds, money movement, migrations, deployment, or production go-live; report those as explicit unverified human/external actions and require fresh founder confirmation for any later live action. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

Return the resolved caller identity (user + org). If pendingInvites is non-empty, tell the user and OFFER to join (confirm before redeem_invite). Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.