TaScan MCP Server

Add one or more subtasks to a task (bulk). Subtasks support typed responses: "number" for per-set data (reps, weight, distance), "text" for notes, "choice" for options, "checkbox" for simple steps. Set-logging example: task "Bench Press" with subtasks Set 1/Set 2/Set 3 each response_type "number" — each completed set stores its value and timestamp, giving per-set timing for progression tracking.

Add one or more tasks to an event (task list). Supports bulk creation. IMPORTANT: Set response_type correctly — use "text" for info collection (names, phones, emails, notes), "photo" for visual verification (inspections, serial numbers, damage checks), "checkbox" only for simple confirmations. NOTE: To dispatch tasks to an AI agent use tascan_dispatch_to_agent instead. Writing into an agent inbox list requires the agent:dispatch permission (agent:dispatch:code for CODE:/SHELL: titles) — without it the call is refused.

Step 1 of the Closed-Loop Autonomous Operations Protocol. Retrieves full issue context including worker info, message thread, project history, and recent similar issues. Use this data to reason about the root cause and generate a remediation plan. Also supports server-side AI analysis via POST (calls Anthropic API directly).

Append 1 or 2 text turns (each a role, user or assistant, and its content) to a chat thread of an admin of your org (POST /chat/threads/:id/messages), the way the portal helper saves each exchange: each content is text of at most 32 KB with no data: URL; the thread's message_count and preview update and GET /chat/threads/:id reads them back in order. A receipted ledger event (the content hashed) is written first. Write tier.

Apply a saved QR look (qr_style_id, or null to clear) to a project, list, task or site (target + id: PUT on that item), or make it the default for a purpose (target purpose + purpose share, placard, asset, receipt or work_order: PUT /qr-styles/defaults). The look must be your org's. Write tier.

Apply a pre-built template to a task list, adding all template tasks

Run an AI condition assessment of an asset from a photo. The model scores 0-100 with the asset's full assessment history in context, so it reads degradation over time — returning the Condition Delta Score vs the previous assessment, defects, wear indicators, maintenance recommendations, and a degradation trajectory. Sensor-free predictive maintenance.

FULL Closed-Loop Autonomous Operations Protocol in one call. Server-side AI analyzes the issue, generates remediation tasks, creates a task list, and dispatches to the worker — all without human intervention. This executes Patent Claim 7: autonomous operations from issue detection through physical-world instruction delivery.

Cancel a scheduled text that has not been sent yet (status pending). A row already sending, sent, failed or cancelled is refused (409) — a sent text cannot be recalled.

Claim a fan-out seat task as a LOCAL subagent run (POST /runs/claim -> claim_agent_run(p_runner='local')). Only admitted when instance starts with "<your registered agent_id>:" -- the seat's own coord.agent_id, set when the fan-out was created (tascan_create_fanout seats[i].runner='local'). Any other instance is refused, claimed false with reason seat_not_yours -- this tool never claims a seat that is not yours, and never claims a cloud (research) seat at all (refused not_routable). Never mints a completion or a receipt by itself -- claiming only opens the run; work happens after, and tascan_finish_run is what leaves the signed receipt. Requires agent:dispatch:code. A foreign or unknown task_id is 404, never 403 (S2: another org's task never even appears to exist).

Duplicate a project's STRUCTURE (POST /projects/:id/clone): its task lists (not a work order's own lists), their tasks (never coordination cards) with response types, photo, safety and signature settings, subtasks, and attachments by reference, plus the location, dates, labor rules and report options. Nothing that happened is copied: no completions, issues, receipts, assignments or access settings. The copy gets the next project number and the name "<name> (copy)" unless you pass one. All or nothing: the copy is one database transaction, so a failure leaves nothing behind. Write tier.

Complete a subtask, optionally recording a typed response_value (e.g. the weight or reps for that set). Each completion is timestamped, so consecutive set completions yield per-set durations. Returns progress including all_subtasks_complete — when true, complete the parent task with tascan_complete_task.

Complete an ORDINARY task on behalf of a worker. Inserts a completion record and timer event. Coordination-cycle tasks (a CODE:/REVIEW: build or review, a Decision / Question / Integrate / Parked card on a project Decisions list — tasks that carry `coord`) are refused with 403 for every key tier: builds and reviews are completed by their runner, decisions only by the human on the worker page. SR-S2 rules (SR-API3): a key with an agent_id completes only as its own agent_registry worker (any other worker: 403 worker_not_key_owner); a key without one completes on behalf of the named worker (on_behalf_of, or worker_id) only when it is an owner/admin-tier root key, and the completion records on_behalf_of (actor and worker). A delegated key without an agent_id: 403 on_behalf_requires_owner_key.

Get an asset's longitudinal condition history — score trend over time, every assessment with grade, delta, findings, and who assessed it. The per-serial-number condition ledger.

Control a running fan-out (POST /coord/fanouts/:id/control). pause holds every unclaimed seat and stops re-firing; resume releases them; cancel supersedes every unclaimed task and closes once quiet; close_barrier drops unsettled (or named exclude_seats) seats and forces the synth now; retry_synth mints a new synth revision from the stored inputs of the current synth when every failed run is input_ref_mismatch, refused otherwise (not_synthesizing, no_synth_task, no_failed_runs, not_input_ref_mismatch). No amend or answer yet. Every action first records a signed control completion as the system worker of this org, never as another org identity. idempotency_key replays the prior outcome (replayed true) and applies nothing twice; a replayed resume after a later pause stays paused. Refused fanout_closed once the roll-up has closed. Requires agent:dispatch:code.

Start an unattended build-review-decide cycle (protocol v0.2). Queues T1 CODE: (or SHELL:) with your build_brief on the AI Inbox and T2 REVIEW: with your review_brief, born blocked on T1. T1 (2026-09-24 throughput): kind=review_only mints T1 as CAPTURE: instead — the executor stores the bundle from the repo at HEAD without a model call and the review runs on that; dry_run=true runs the dispatch PREFLIGHT only (nothing queued) and prints every problem at once (codes title_too_long, brief_rule, brief_names_unbundled_path, artifact_over_cap, migration_as_context (tascan repo only), idempotency_replay, kind_invalid — bad kind, bad revisable_by, review_only + task_type SHELL/RESEARCH, review_only + max_questions 0), then what the API could NOT check (unchecked[]: artifact_missing_at_head always — only the executor sees the repo, and a CAPTURE naming a missing path fails with "[artifact_missing_at_head]" in its error; artifact_over_cap for any path without a byte count — pass artifact_bytes; idempotency_replay only if its lookup failed) and warnings[] (a build_brief naming a context file outside the bundle); a real create that the API refuses prints the same problems[] list (when the transport hands the tool only the first problem's text, the tool re-runs the preflight and prints the whole list). The local executor builds, stores the exact bytes of artifact_paths as a bundle (build_ref = sha256 over the manifest), the independent reviewer reviews THAT bundle, an approve verdict mints a Decision task for the human authority (one SMS), Approve mints an Integrate task for the deploy id. Revise verdicts spawn revisions (cap max_revisions, default 3); reject, human Reject, scope violations or exhausted revisions PARK the cycle (a Parked task with Resume with notes / Close). REQUIRES agent:dispatch:code. Duplicate protection: the same idempotency_key, or (keyless) the same briefs + paths on a live root, within 24 h is refused by the preflight as idempotency_replay (400, nothing queued, the existing root_id in the problem) and printed as DUPLICATE with that root_id; only a replay the preflight could not see (a race) comes back from the RPC as 200 created=false, printed the same way. Optional `reviews[]` attaches a multi-lens review panel (design item 14a) in place of the single OpenAI review — one review task mints per lens and every blocking lens must approve before the Decision task mints. Track with tascan_get_cycle_report (root_id). Nothing spawns a cycle on its own.

Create a new event (task list) within a project. Supports team_mode (shared completions) and multi_instance (each worker gets isolated copy — great for surveys, onboarding, info collection). team_mode and multi_instance cannot both be true.

Create a fan-out: 1-30 seats (RESEARCH by default, or LOCAL subagent seats) plus one synthesizer under ONE cycle root (POST /coord/fanouts). No Decision cards, Parked cards or pages per seat: only a control action or the closing roll-up reaches a human. Needs an API key with agent:dispatch:code (an admin session has no dispatch budget: key_required). dry_run true runs the same validation and ceiling/cap pre-check and returns dry_run, plan_sha256, seats and problems without spending budget or creating anything. Otherwise it consumes seats + 1 dispatch units BEFORE the create; a refusal only the database can see (cap_below_plan, fanout_open_limit, bad agent_id, reserve_floor_unset) still consumes them, by design. Fails fanout_ceiling_unset until the owner sets a ceiling, over_ceiling when cap exceeds it. idempotency_key replays a duplicate within 24h on the same plan, else idempotency_body_mismatch. Every seat, the synth and the roll-up leave a signed completion. Track with tascan_get_fanout.

Create a client invoice and get its shareable link. Two ways to bill: (a) pass explicit line_items, or (b) pass project_id or task_list_ids plus hourly_rate (quarter-hour billing from first→last verified completion per list) or flat_rate_per_list, and TaScan builds one line per list from VERIFIED work ("<list> — 7/7 tasks verified · Sep 1 · 1.25h"); lists with no completions are skipped. A single-list invoice also mints a client-facing Service Report (acknowledge → pay) and links it. Returns invoice number, totals, url, and the work it billed.

Create a new TaScan project (top-level container for events). number is optional (the next P-number is assigned when omitted; a number already used in the org is refused 409). external_refs links customer job numbers.

Create a site (a job location) in the organization: name (1-200 characters) and optionally address, lat + lng (together), client_company and external_key (unique in your org: a second site with the same key is refused 409). Write tier.

Create a new worker (taskee) in the organization

Create a geofenced work zone. Delivery zones route workers who open the project Site Gate (geo.html?project=...) to this zone's task list when GPS places them inside the radius. Set enforce_on_list=true to zone-lock the task list — workers cannot start it from outside the zone.

Mint a time-limited, NARROWER child API key (POST /delegations, roadmap #11) — only read/write scopes may be requested; full, agent:dispatch, agent:dispatch:code, device:admin, delegate and webhooks:manage are always refused by name (I-6). TTL defaults to 1 hour (3600s), clamps to [60 seconds, 24 hours], and clamps further to THIS key's own expiry if it has one — a delegated key can never outlive its grantor. The child's tier is always a SUBSET of this key's own effective tier, never wider or lateral. Requires the delegate permission (owner-only to grant, requires full). The returned raw key is shown to you exactly ONCE — it is never stored server-side and cannot be retrieved again (I-10). Revoking this key (or any ancestor) cascades immediately to every key it delegated.

Delete a chat thread and its messages (DELETE /chat/threads/:id), the way the Simple page does; a receipted ledger event is written first. Write tier.

Delete an event (task list) and all its tasks and completions. This action is irreversible.

Delete a project that has NO history, after typing its name. Refused 409 project_has_history (with the counts) when it has any task or subtask completion, action receipt, issue, invoice or coordination task: archive it instead (tascan_update_project status archived). confirm_name must equal the project name exactly (400 confirm_name_mismatch). A receipted audit event (actor, project, name, counts, your audit note) is written BEFORE the delete; if it cannot be written nothing is deleted. The check, the audit event and the delete are one database transaction that locks receipts, tasks and the project first, so history created meanwhile is never deleted (503 busy, nothing deleted, when those locks are not had within 3 seconds: retry). Irreversible.

Delete a subtask and its completions. This action is irreversible.

Delete a specific task and its completions. This action is irreversible.

Tombstone a worker record (is_active=false). REFUSES if the worker has any task/subtask completions or payments — merge those into the real worker with tascan_merge_workers instead. Never hard-deletes.

Step 3 of the Closed-Loop Autonomous Operations Protocol. Dispatches remediation to the worker via MULTI-CHANNEL delivery: (1) issue thread message, (2) in-app notification, (3) progress feed update, (4) SMS if phone on file, (5) optional remediation task list creation. Closes the loop from digital AI analysis to physical worker execution.

PREFERRED tool for sending work to an AI agent. Dispatches a task to the agent's inbox — picked up and executed automatically. No list ID needed. REQUIRES the agent:dispatch permission on this connection (CODE:/SHELL: tasks also require agent:dispatch:code) — reconnect and tick the agent checkbox(es) if refused. Routing is by TITLE PREFIX only: CODE: SHELL: PLAN: MCP: → local Claude Code on Mike's PC; RESEARCH: WRITE: REVIEW: → cloud; no prefix (DEFAULT) → local while the PC agent is alive, else cloud. The cloud agent refuses CODE/SHELL/PLAN/MCP. Use "agent" param to target a specific agent (default: claude-code-local). Use tascan_list_agents to discover available agents; track progress with tascan_get_task (its "agent" block).

Record a chief-of-staff dispatcher action on a coordination cycle as a receipt (protocol v0.2 D6, POST /coord/cycles/:root/dispatcher-actions): hand_review_approve, hand_review_revise, park, bundle_recovery, migration_apply, deploy or decision. Mints a completed task + completion under the Chief of Staff worker and a dispatcher_action ledger event on the root. kind=deploy additionally requires evidence.deploy_id (a Netlify deploy id) and composes the same integrate-as-note every root gets with coord_record_integration when the root is authorized — one call that does both records. Requires agent:dispatch.

Read or author a task's evidence policy (protocol v0.2 V9b, GET|PUT /evidence/policy/:task_id — one route, two methods, so one tool). action=get evaluates the pinned policy against the evidence ledger so far: whether it is usable and satisfied, and its progress (read tier). action=set authors/updates a policy in your org's namespace when definition is given (definition.require is a non-empty array of requirement objects; definition.min_count, when set, must be an integer from 1 through definition.require.length) or, when definition is omitted, pins the task to an existing active policy_id (write tier).

Cross-entity search: find projects (by name, project number or customer job number in external_refs; each with its status), task lists, tasks, workers, condition assets, sites (by name, address or client company) or work orders (by number or description) in one call — with ids and parent context to disambiguate. Use this instead of walking projects→lists→tasks or guessing ids from display names.

Find candidate same-person worker records with per-signal match detail (Patent 4 §6.25(b) signals: phone reuse, name similarity, GPS pattern correlation). Turns identity fragmentation from an accidental discovery into a monitorable metric, and feeds the merge workflow its candidate list.

Finish a claimed local run (POST /runs/:run_id/finish). outcome='completed' stores `document` (and optional `verification`) as the seat's own build artifacts under EXACTLY the artifact_paths the fan-out named for this seat, hashes them into build_ref, and finishes the run -- this mints a real task_completions row and a SIGNED TASCAN RECEIPT for your work (tascan_get_receipt), the same as any other build; `document` is your deliverable and IS what gets hashed, so send the real content, not a summary. Zero changes to coord_fanout_settle / the barrier / the roll-up -- your completion releases the next held seat and, once every seat settles, feeds the fan-out's own synthesizer and rollup exactly like a cloud research seat's would. outcome='failed' finishes the run failed with your `error` text and stores nothing. Requires agent:dispatch:code. A run outside your org, or already finished, is refused (404 / the RPC's own not_live).

Generate a QR code for a task list (event) that workers can scan to access tasks. TaScan draws the QR itself (an SVG, also returned as a data: URI in qr_image_url); no third-party QR service ever sees the link.

Mint a shareable report and get its link. Types: completion (full proof-of-work for one list: tasks, responses, subtasks, photos, GPS + place names, timing, QR pair), service (client-facing version of a list with YOUR company branding and a Client Acknowledgment button — the ack files into the list thread), project (every list in a project rolled up), evidence (compliance Evidence Pack; admin sign-in required to view). Links are stable — the same list/project returns the same link. Optionally text the link to a phone through the TaScan SMS lane.

Read the access object of a task list (list_id) or a task (task_id): access_level (open, assigned or secured; a task-level value wins over its list), the effective level, human assignees and agent_assignee (the one agent whose key may reach the list and every task on it; a task shows its list's, inherited), and the floor (a Decisions list or a passkey card never goes below assigned). Read tier.

Read THIS credential's own per-key action budget (GET /budget): daily limits (sms, invites, payment-request cents per day and per request, dispatch, human pages) and today's spend against them. A NULL limit (or no budget row at all) means unlimited on that counter. A key can only ever see its OWN budget, never another key's (I-3, no tool or key ever reads another key's row). Read tier.

Manifest of a stored build bundle by build_ref (protocol v0.2 build_artifacts): the exact files the executor produced for the cycle's artifact_paths, each with sha256, byte length and whether text content is stored (binary or over-cap files keep the sha only). build_ref = sha256 over the manifest, computed in the database once; the reviewer reviews THESE bytes, the human approves THIS ref, the integrate task records THIS ref. Read tier. Use tascan_get_build_file to read a file. Truncated at 12000 chars. Reading the manifest is discovery, not a read of any file.

Store an already-computed diff for one file of a build bundle against a base commit (protocol v0.2 item 6, POST /coord/builds/:build_ref/diff — the parser has no GET for this path; a deployed function ships no git object database, so tascan-agent/deployer.js computes the diff text with its own persistent worktree and this route only validates + stores it via coord_set_artifact_diff). build_sha256 must equal the artifact's own stored sha256 or the call is refused; storing a diff replaces that file's stored full content with the diff going forward. There is currently no REST route that reads a stored diff back (GET /builds/:build_ref and /builds/:build_ref/file do not surface it) — this tool only writes one. Requires agent:dispatch.

Read one file from a stored build bundle by build_ref and path (protocol v0.2 build_artifacts) — the exact bytes the executor produced, not a working-tree read. Returns up to 12000 chars per call with offset/limit paging (next_offset when truncated), plus the file's sha256 and byte length. Binary or over-cap files return no content (the sha256 still binds them). Read tier; this is what the independent reviewer reads. The header lines (path, build, sha256, chars a-b of total) are the record a reviewer's read is bound to; read every chunk until the range covers the whole file.

The audit report of one coordination cycle by its root task id (protocol v0.2, get_cycle_report): every step task (build, review, checkpoint, integrate, question, parked) with its revision and state, every execution attempt with runner, outcome, build_ref and usage/cost, every completion (receipt id = completion id, receipt hash), every reviewer verdict, every human decision and answer, the full trail (messages), the ledger events and the hash-chain verdict per task, plus spend against the cap. A computed summary (stage, attempts, verdicts, decisions, receipts, spend, chains_ok) comes first; pass full=true for the complete JSON (large). Read tier. This is the ONLY per-cycle notification surface: cycle steps do not e-mail or text anyone except the one checkpoint / human-question SMS.

Get one device by id: kind, name, status, location zone, credential rotation timestamps, revocation reason, and the last 20 evidence_events ids it produced. Never returns a credential hash.

Get details of a specific event (task list) including its tasks

Read a fan-out (GET /coord/fanouts/:id?view=). view=status (default): state, seat counts, spend, cap, synth_deadline_at, poll_after_s. view=report: the full cycle report (get_cycle_report) — every seat, review and control step. view=rollup: the exact roll-up response_value plus its leaves (path, sha256, completion_id) once closed. view=verify: the server recomputes rollup_ref over the frozen leaves and returns ok / mismatches — the same check scripts/verify-fanout.js performs independently from another machine, which is the trusted proof; this view is a convenience, not a substitute. A foreign org's fanout_id answers 404, never 403, so another org's fan-out never even appears to exist. Read tier, no dispatch permission required.

Read the organization profile (GET /org): id, name, industry, logo, time zone and the admin phone MASKED to its last 4 digits (a tool never sees the full number). Read tier. Editing the organization is done by an owner or admin in the TaScan portal, not by any tool.

Your organization's plan (GET /org/plan), read-only: plan (free, pro, ...) and whether billing is exempt. Billing changes happen in the TaScan portal only. Read tier.

Get details of a specific project

Fetch the signed Action Receipt (Ed25519 JWS) for one completed task by completion_id (tascan_get_task -> completions[].id). Returns a readable summary (what, who, verification, evidence hashes, outcome, ledger chain) plus receipt_id/serial/kid, the compact JWS and the public verify URL. Verify offline against the JWKS or online by POSTing a JSON body whose jws field holds the compact receipt. Read outcome and verification separately: outcome completed = the executor returned and a result was recorded; verification.result = the verdict of a named policy; all-null verification with reason no_policy_run = no policy ran. Never treat outcome=completed as success without a policy verdict you trust (protocol 8.3 C11). Verifier: 6.8. profile=public returns the separately signed public export profile (protocol 6.10): it withholds the raw org, list, project, worker, run and trace ids (each a 16-hex id_hash) and storage locators, and binds to the full receipt - the form for anyone outside the org. Read tier.

Get completion report for a task list (event) including task status, completions, workers, and photos. Set include_responses to also return the actual submitted response data (numbers, text, choices) for each completed task plus a per-task photos list with fetchable signed URLs (short-lived, ~1h) for the photo evidence.

Scan accountability data. Two modes: (1) tag_id — scans of a registered NFC tag; (2) task_list_id or project_id — every QR/link page-open stamp: when the code was scanned, GPS + IP + channel (qr/nfc/sms/email/link), who the scanner turned out to be, and the scan→start delta (how long between scanning and actually identifying + starting work — the sign-in-and-vanish metric).

Fetch the signature bundle for one signed document by signature assertion id (the signature_assertion_id inside the response value of a completed signature task). Returns the self-contained JSON an auditor can verify offline without trusting TaScan: the signed challenge preimage (v 2 also carries the typed name the signer entered, signer_typed_name), clientDataJSON, authenticatorData, signature, public key, the user-verification and backup flags, the document SHA-256, task id, completion id and time. Check it with: npx tascan-verify --signature bundle.json [--doc the-document.pdf]. Contains no signed URL, phone number or email. Read tier, organization-scoped.

Read one site with the projects and task lists linked to it. Read tier.

Check delivery status of a previously sent TaScan SMS by its Twilio SID (returned by tascan_send_sms). Shows queued/sent/delivered/undelivered/failed plus carrier error codes.

Get details of a specific task including completions and subtasks. Each completion carries photo_url (raw storage path, stable) and photo_signed_url (short-lived fetchable URL, ~1h; null when no photo) so you can actually view the photo evidence. Tasks dispatched to an AI agent also carry an "agent" block (state claimed|running|completed|failed|expired|released, attempts, current run with runner/trace_id/error) — the only place agent failures are reported. A completion with status "completed" means the executor returned and its result was recorded (a model refusal, a wrong answer or an administrative note all "complete"); it does NOT mean the requested result was accepted. Acceptance is the completion evidence_check / the receipt verification.result under a named policy, and in v0.1 no policy exists for agent tasks (exact-output and rubric policies are v0.2) — check the recorded response text yourself before treating an agent completion as success (protocol §2.6, §3.2, §8.3 C11).

Read a task's trail messages (protocol v0.2 trail_messages, GET /tasks/:id/messages): question, answer, handoff and note/discussion entries, last 100, newest last (reading order). Optionally filter to a comma-separated set of kinds, and with since=<ISO time> read only messages newer than the last one you saw. Read tier. Post with tascan_post_message.

A task list's timesheet (GET /lists/:id/timesheet), read-only: each shift (who, clock in, clock out, breaks, hours; an open shift and a never-clocked-out one are flagged) and per worker per day the regular, overtime and double-time hours under the project's labor rules (overtime after 10 h by default), with totals. Optional worker_id. Read tier.

Read your organization's usage and quota snapshot for a billing period (GET /usage): SMS, email and AI call counts against their plan limits, the 100-receipt-per-month hard stop (used, allowance, hard_stop), the rate-limit window (60 requests per minute), and coordination-cycle spend in micro-USD for build roots created in that period. period defaults to the current UTC month (YYYY-MM). by_key additionally breaks coordination spend down per dispatch-scoped API key, refused (403 owner_required) to anything but an owner admin session -- a tsk_ key never gets it. Read tier.

Ungated, plain read of one worker row: name, contact, org, points, streaks, timestamps. (tascan_get_worker_passport is the rich stats view; this is the boring lookup.)

Get a worker's verified work passport — task counts, lists worked, photos submitted, GPS-verified hours, points, streaks, and earned merit badges, all computed from real completion data (not self-reported). Includes the shareable profile URL.

Extend a claimed local run's lease and mark it running (POST /runs/:run_id/heartbeat -> heartbeat_agent_run). ok false with reason not_live means the run is no longer yours -- the sweep expired it, or it was never yours to begin with -- STOP, do not finish it. Never mints a completion or a receipt. Requires agent:dispatch:code. A run outside your org is 404, never 403.

Invite a marketplace worker to a task list — the consented intro. TaScan texts the worker from its own number ("<Your org> wants you for <list>. Reply YES to share your contact and get the list, or NO to pass."). On YES the worker appears in your org with their name + phone, receives the list link, and you get a text + a thread message. On NO or silence (7 days) you never learn who they were. Use the worker_id from tascan_search_marketplace.

The org-wide issues inbox (GET /issues): every task issue across projects, newest first, filtered by status (OPEN, ACKNOWLEDGED, IN_PROGRESS, RESOLVED, CLOSED, or a comma list), project_id and site_id. Pass issue_id instead to read one issue's message thread (GET /issues/:id/messages). For one list use tascan_list_issues. Read tier.

Link a site to a project (project_id) or to a task list shown at the site (list_id) — exactly one. Both must be in your organization. Linking twice is a no-op. Write tier.

List all registered AI agents with their capabilities, inbox IDs, and status. Like reading input labels on a video matrix — discover which agents are available and what they can do before dispatching work.

List registered condition-ledger assets with their latest condition scores. Use to recover an asset_id for tascan_assess_condition or tascan_condition_history.

List the Ask TaScan chat threads of your org's admins (GET /chat/threads, newest first; admin_id narrows to one admin), or read one thread with its messages (thread_id). The same threads the Simple page and the portal show. Read tier.

List the organization's connectors (GET /integrations), e.g. the Salesforce Work Order bridge: provider, instance URL, the project and list new work lands on (with names), whether it is on, the last poll time and the last error. Never shows secrets: the client id, the client secret, its storage name and the connector config are never returned. Read tier. Turning a connector on or off, retargeting it or adding one is done by an owner or admin in the TaScan portal, not by any tool.

List coordination-cycle roots in the organization (protocol v0.2, GET /coord/cycles): root id, title, status, task_type, project, build_ref, deploy_id and the T2 review id, newest first. Filter by project_id and/or status. Read tier — a reviewer's read-only key can call this too. Follow up with tascan_get_cycle_report root_id=... for the full audit trail of any row.

List delegated child keys (GET /delegations): this key's own direct children (id, label, scopes, active/revoked, depth, expires_at) — never the raw credential. An admin session sees every delegated key in the org. Read tier.

List registered devices (RFID portals, barcode guns, PLCs, cameras, robots, tools, sensors) in the organization. Filter by status (active/revoked) or kind; paginate with an opaque cursor. Never returns a credential hash.

List all events (task lists) within a project

List AI Insights (GET /insights): the audit engine's suggestions for your org (ai_suggestions), pending by default; status applied, dismissed, explained, expired or all; optional project_id. Read tier.

List marketplace invites you have sent and their status (pending / accepted / declined / expired / failed). Accepted invites include the worker's name and phone — that is the consent boundary; pending and declined never do.

List invoices for the org (newest first) with status, client, total, due date and share link. Filter by status (draft/sent/paid/overdue/cancelled) or project.

List all issues for a task list (event). Returns open, acknowledged, and resolved issues with severity, type, and category. Use this to discover issues that need AI analysis via tascan_analyze_issue.

List gig payments and their lifecycle status: awaiting_completion (pledged, work not verified yet), ready_to_pay (verified — pay link sent to payer), paid, canceled. Filter by task list or status.

List TaScan projects in the organization (each with its number, e.g. P-00001, external_refs, report_options and its calendar_url, webcal_url, map_url and wallet_pass_url). Optional filters: status (exact, comma list), number (exact), ref (matches any external_refs[].ref exactly, e.g. a customer job number like P14-4680), and the portal's date filters: starts_after / ends_before (YYYY-MM-DD) and window (week = Sunday-Saturday, or month) on the project's start/end dates (one date = that day; none = its created day), in zone (an IANA zone; default the org time zone, else UTC).

Your saved QR looks (GET /qr-styles) with the per-purpose defaults, or, given task_id, list_id, project_id or site_id (and/or purpose share, placard, asset, receipt or work_order), the look that applies (GET /qr-styles/resolve: task, then list, project, site, purpose default, org default, then TaScan's own). Read tier.

List existing report links for a list or project (completion / service / project / evidence), newest first, with client acknowledgment status for service reports.

List your org's scheduled texts (default: pending + sending, soonest first; status=sent|failed|cancelled to see history). Each row shows send_at, status, attempts, the Twilio sid once sent, and the last error for a failed row.

List the organization's sites (job locations: name, address, lat/lng, client company, external key). Filters: active (true, the default, false or all), q (name, address or client company) and project_id (sites linked to that project). Read tier.

List the subtasks of a task, including completion state, stored response values, and completion timestamps (per-set timing).

List all registered NFC tags in the organization with their linked projects/task lists and scan counts

List the tasks in an event (task list). status "open" returns only tasks with no completion yet: use it when checking for work to do, so a long list is not re-read in full. "done" returns only completed tasks; "all" (default) returns every task.

List available task templates (built-in and saved)

Read a task completion's verification verdicts and job queue (Verification Layer V2, GET /completions/:completion_id/verifications): completion_verifications rows (state, method, verifier, policy, confidence, finding) plus verification_jobs rows (state, attempts, last_error, result). Read tier.

List workers (taskees) in the organization. Supports filtering by name/email/phone substring, contact-info presence, and last-activity date. Each row includes completion_count (total task completions).

List geofenced work zones, optionally filtered by project. Shows center, radius, routing target, and zone-lock status.

Merge duplicate worker records into one canonical identity (Patent 4 identity consolidation). Reassigns every reference (completions, timer events, points, payments, rosters — 31 columns across 31 tables), backfills missing phone/email on the primary, sums points, and tombstones the duplicates (merged_into + is_active=false — NEVER hard-deletes). ALWAYS run with dry_run=true first and show Mike the counts; pass dry_run=false only after explicit confirmation.

Mint (or reuse) a task list's completion report and get its link (POST /lists/:id/completion-report): the same stable link tascan_generate_report type completion returns, never a worker's own shift report. Nothing is sent; text it with tascan_text_report. Write tier.

Nudge a worker by text about a task list (POST /lists/:id/nudge), through the same guards as the Simple page's nudge: the list must be yours, the recipient must be known to your org, burst limits, the SMS quota and STOP opt-outs apply, and the list link is appended. Send worker_id or phone (one), and an optional message (at most 300 characters). tascan_send_sms is the general text lane. Full tier.

Read organization-wide analytics: view org (GET /analytics/org, the get_org_analytics rollup) or view resolutions (GET /analytics/resolutions, paginated AI issue-resolution history, filterable by severity, category, and pattern-detected). Read tier.

Post one evidence event into the evidence ledger (protocol v0.2 V9a, POST /evidence): an actor did an action to an object at a point in time, optionally with a location and provenance. idempotency_key is required — the same (org, idempotency_key) always returns the same row, never a second insert. Optionally correlate the event to a task or task list. Write tier; a device credential (structurally different from an API key) is not reachable through this MCP connection, so device_id is never set here.

Post a message on a task trail (protocol v0.2 trail_messages): kind question, answer, handoff or discussion. A message never completes a task, never satisfies a gate and never pages anyone. The actor is stamped from your credential (key:<id>, actor_type "key" — a credential, never a human), never from the body; the executor and the reviewer consume a key's answers only when the key holds agent:dispatch. On an ordinary task this is write tier. On a CYCLE task (one with coord) it needs agent:dispatch (agent:dispatch:code when the task, or the asker a question task stands for, is CODE:/SHELL:) because the text can become executor prompt or reviewer input. kind=answer on a dispatcher-addressed question task answers it through coord_answer_question and releases the blocked asker; a human-addressed question is answered only on the worker page (403 here). finding (reviewer runner) and decision (human completion) cannot be posted. Body ≤ 8000 chars; idempotency_key makes a replay return the same message.

One call that gives a chat client (ChatGPT, Claude) a whole TaScan project in about 2,000 words: the project, every task list with task counts, open decisions and questions, the last 5 coordination cycles with verdicts and spend, the latest 5 receipts, and total spend — returned as Markdown (capped at 12,000 chars). Read tier. Use it before asking a human to paste anything.

A project's progress and insights (GET /projects/:id/insights), counted like the portal's panel: per task list done of total (people's tasks), open issues by list (open / acknowledged / in progress, 30 days; an archived, completed or demo project counts none unless demo=true), and the newest 20 activity items (completions, scans, issues) with who and when. Read tier.

Query one task's submitted responses across every list in a project — e.g. the same exercise repeated across many workout lists returns one chronological progression series instead of N report lookups. Match by task title pattern or exact task ID. Subtask completions interleave into the same series labeled 'Task › Subtask' (e.g. per-set values Set 1/2/3 with their own timestamps), so set-level progression chains across lists automatically.

One action to a genuinely verified receipt (POST /quickstart). Under your org it reuses-or-creates the project "TaScan Quickstart", its list "Quickstart" and the worker "Quickstart executor", adds a NEW task "Reply with the exact text: <expected>", completes it with your key, has the named policy quickstart_exact_output v1 compare the response to the expected text (verified or refuted, signed into the receipt), and publishes the receipt's public profile. expected defaults to "VERIFIED" (max 200 chars); response defaults to expected — pass a different response to see a refuted receipt. Returns the receipt URL and the public verify URL. Write tier.

Raise an issue on a task (POST /tasks/:id/issues), the way an admin does it in TaScan: status OPEN, source admin, the description as the first thread message. category DELAY, MISSING_MATERIALS, SAFETY_CONCERN, EQUIPMENT_ISSUE, WEATHER, PERSONNEL, QUALITY or OTHER (default); severity LOW, MEDIUM (default), HIGH or CRITICAL. Write tier.

Step 2 of the Closed-Loop Autonomous Operations Protocol. Post an AI-generated recommendation to an issue thread. Accepts both a text recommendation and an optional structured_recommendation object with task definitions for auto-dispatch. The recommendation is persisted in the AI audit trail.

D4: the dispatcher records the Netlify deploy id for an authorized cycle — Integrate cards stop landing on Mike for something a key can prove instead (protocol v0.2, migration 181, coord_record_integration). Requires agent:dispatch. The root must be `authorized` (its checkpoint already Approved) with an open Integrate task; deploy_id must be a real Netlify deploy id — 24 lowercase hex, optionally "deployed:<id>" and/or a trailing build-ref hex prefix ("Deploy" and anything else is refused, bad_deploy_id). On success the root flips to `integrated`, the existing "Integrated: deploy …" trail note is posted, and the completion is stamped with your key as the actor (source api:key:<id>) — never as a human on the page. Idempotent: replaying the SAME deploy_id after the root is already integrated returns the same completion (replayed:true); a DIFFERENT deploy_id after integration is refused (409) without changing anything. A human may still complete the Integrate card on the worker page as an ops fallback, but only with a real deploy id too.

Register a new AI agent in the agent registry. The agent will appear in tascan_list_agents and can receive dispatched tasks. Self-registration for AI agents joining the TaScan network. REQUIRES the agent:dispatch permission (defining a dispatch target is a dispatch permission); inbox_id must be a task list (event) in your organization.

Register a physical asset (equipment, structure, vehicle, machine) in the condition ledger so it can be assessed over time. Each asset gets a longitudinal condition history with AI scoring and degradation trajectory.

Register a physical NFC tag to a project, task list, or specific task. When someone taps the tag, TaScan routes them to the linked resource. Tags use NTAG215 chips and are programmed with NFC Tools Pro.

Remove a worker from a project (DELETE /projects/:id/workers/:worker_id): deletes only that worker's assignments on the project's lists. Completions, issues and the worker record are untouched. Receipted first (actor, worker, lists, reason). To deactivate the worker everywhere use tascan_update_worker active false. Write tier.

Reply on an issue's thread (POST /issues/:id/messages): an issue_messages row from the admin side. media_path attaches a photo already uploaded to task-photos under issues/ (a storage path, never a URL). Write tier.

Reply to a task list WITH a task list — the two-way tasking primitive. Creates a new list linked into the parent's thread, aimed back at whoever sent the original (e.g. "Grant access — pick a window" with response_type date, or an info request with response_type text). The org gets pinged; the thread shows in both the worker portal and Simple Mode. Use tascan_get_thread-style follow-up via tascan_list_projects/tascan_get_report to read answers.

A report's engagement (GET /reports/:token/engagement, get_report_engagement): declared, engaged and idle minutes per worker shift on the report's list. There are no view or open counts. Read tier.

Pledge a payment on a task list: when the list is verified complete (every task done + photo evidence on photo-required tasks), the payer automatically receives a Stripe pay link that routes the money DIRECTLY to the worker (0% TaScan fee). No money moves and no card is stored at pledge time. The worker must have completed payout onboarding (Get Paid on their profile).

Enqueue an autonomous verification job for a task completion (Verification Layer V2 + V7 doc_check, POST /completions/:completion_id/verification-jobs): http_probe checks a URL (params url, and optionally expect_status, expect_content_type, expect_sha256), doc_check runs a named policy against params.url and params.policy_id. Read the result with tascan_list_verifications once the job runs. Write tier.

Apply or dismiss an AI Insight (POST /insights/:id/apply or /dismiss), with the Simple page's status writes (applied / dismissed, an optional dismiss reason). Apply marks it applied and returns the suggestion (title, body, action) for you to carry out; it runs no AI and changes nothing else. Only a pending (or explained) insight. Write tier.

Revoke a delegated child key immediately (DELETE /delegations/:key_id) — self-revoke, revoke by an ancestor key, or by an admin session of the org; any other caller is refused. Revoking cascades to every key IT delegated, in turn (the database trigger, not application code). Idempotent: revoking an already-revoked key reports already_revoked, no error.

Revoke a device credential immediately — the kill switch for a lost, stolen, or decommissioned device (RFID portal, barcode gun, PLC, camera, robot, tool, sensor). Its next evidence post is refused. Idempotent: revoking an already-revoked device reports already_revoked and mints no second receipt. Requires the device:admin permission (owner-only, needs full, never reachable through OAuth).

Create a chat thread for an admin of your org (no thread_id: POST /chat/threads with admin_id and an optional title, default New Chat) or rename one (thread_id: PUT /chat/threads/:id with title and/or preview). Write tier.

Create a saved QR look (no qr_style_id: POST /qr-styles), change one (PUT /qr-styles/:id) or delete one (delete true). style is a flat JSON object of the QR options; a logo is a storage path in your org's logo folder (<org id>/qr/<file>), never a data: URL. is_default true makes it the org default (the previous default is cleared). Write tier.

Schedule a transactional TaScan SMS for a future time (up to 90 days out): the text is sent by TaScan's own scheduler (every 5 minutes) through the same guarded lane as tascan_send_sms — recipient must be a worker of your org or a phone the org already knows, STOP opt-outs honoured, burst limits and the SMS quota apply, the "TaScan:" prefix is added, and a list_id appends a tap-to-open checklist link. Use this for reminders (e.g. "log your out time" each show night) — nothing outside TaScan needs to stay awake. Returns the scheduled row id; cancel with tascan_cancel_scheduled_sms while it is still pending. The same idempotency_key within an org returns the existing row instead of a duplicate.

Search the cross-org Worker Marketplace: workers who opted in (discoverable=true on their passport), ranked by passkey trust tier + verified completion volume. Skills are AI-inferred from REAL completed work, not resumes — each carries a verified_task_count and a civilian_equivalent job title. Returns sanitized public cards only (first name + last initial, skills, stats, passport URL) — never phone, email, or org membership.

Send a transactional TaScan SMS text to a worker (by worker_id, using their phone on file) or to a raw phone number. Optionally attach a task list — the recipient gets a tap-to-open checklist link. Attach images (MMS) with media_url (public https image URL) or media_base64 + media_type (jpeg/png/gif, max 3.5 MB) — e.g. a diagram, a tutorial photo or a site photo; the message text is optional when an image is attached. Sends from TaScan's carrier-registered A2P number (or the org's own Twilio if BYOK). Counts against the org's monthly SMS quota unless BYOK. Messages are auto-prefixed with "TaScan:" per carrier registration; transactional/work-related content only, no marketing.

Send a branded TaScan task notification email via SendGrid. Can notify anyone about a specific task list or task. Includes QR code, task summary, and "Open in TaScan" button.

Identify exactly which TaScan server and schema this MCP session is talking to. Call this FIRST when diagnosing anything — it makes "dev server masquerading as production" and "is my fix deployed yet" one tool call instead of an inference.

Set the security level of a task list (list_id) or a task (task_id): access_level (open, assigned, secured or null), human_assignees (worker ids, lists only) and agent_assignee (an agent_id of your org, or null; lists only: a task follows its list and refuses it as task_agent_assignee_unsupported). Raising it needs any write key that can see the item; lowering it or removing an assignee needs an owner/admin-tier key (an agent key is refused lower_requires_admin); a Decisions list or a passkey card never goes below assigned. The change and its access_changed ledger event are one transaction (all or nothing); access_conflict when the item changed meanwhile. Write tier.

Share a task list as a template (shared true: POST /templates/:list_id) or remove it from your templates (shared false: DELETE, receipted; the list itself is untouched). Returns template_url, the share link (template.html?id=). List reads carry the same template_url. Write tier.

Get a task list's share link and its QR code (an SVG drawn by TaScan; no third-party QR service), and optionally send the link to one person: send.phone or send.worker_id texts it through TaScan's guarded SMS lane (recipient must be known to your org, STOP opt-outs and limits apply), send.email e-mails it. Write tier for the link; sending needs the full access level. style is reserved for saved QR styles and ignored today.

Text an existing report's link to a phone (POST /reports/:token/text) through the guarded SMS lane: the number must belong to a worker or roster entry of your org, burst limits, the SMS quota and STOP opt-outs apply, and the report's task list proves ownership. token is the report token (tascan_mint_completion_report / tascan_generate_report). Full tier (it sends to a person).

The organization's Today summary (GET /today), counted exactly like the portal's Today: due_today, closed_today, awaiting_check, retake, photos_verified_7d and the needs list (each item's first reason of retake, issue, review, overdue, due_today). Archived, completed and demo projects never count (demo only with demo=true). The day is in zone (an IANA zone), else the org time zone, else UTC (timezone_fallback true). Read tier.

Remove a site's link to a project (project_id) or to a task list (list_id) — exactly one. The site, the project and the list themselves are not changed. Write tier.

Update an event / task list (name, description, team_mode, multi_instance, timer_mode). team_mode and multi_instance cannot both be true.

Update an invoice: mark it paid (records paid_at; a receipted ledger event with the actor, invoice id, number, amount and the before/after status is written first, and nothing changes if it cannot be), overdue, cancelled, or edit client details / notes / due date. A paid invoice is final: any further change is refused 409 invoice_paid_locked (no refunds, edits or deletes).

Change an issue's status (PUT /issues/:id): OPEN, ACKNOWLEDGED, IN_PROGRESS, RESOLVED or CLOSED. RESOLVED stamps resolved_at; a status message joins the thread. The issue is never deleted. Write tier.

Update a project (name, location, status, dates, number, external_refs, labor_rules, report_options). A number already used in the org is refused 409; external_refs replaces the whole list. report_options is merged into the stored object (other keys kept, a key set to null removed). labor_rules is validated like the projects CHECK.

Update a site (name, address, lat + lng, client_company, external_key, is_active). is_active false deactivates it (the soft delete: its links, work orders and visits stay). Write tier.

Update a subtask (title, description, response_type, response_config, requires_photo, sort_order).

Update a task (title, description, response_type, flags, sort_order). A task that sits in an AI agent inbox is agent input (the runner executes title + description), so ANY edit to it needs the agent:dispatch permission — agent:dispatch:code when the task is or becomes CODE:/SHELL:.

Update a worker profile (name, phone, email, actor_kind), or deactivate / reactivate the worker (active false / true with an optional reason: receipted as a ledger event first, never a delete; a merged record is never reactivated). Changing actor_kind to or from agent or admin is refused for every key: only an org owner or admin, signed in to the portal, can do that.

Update a geofenced zone — move the center, resize the radius, change the routing target, toggle zone-lock, or deactivate it (is_active=false).

Independently verify a TaScan Action Receipt JWS (protocol 6.8, POST /receipts/verify): size, envelope, signature, issuer origin, key lifecycle, hashing profile, value semantics, schema and chain check, with an online issued/serial check for the reference issuer. Public route: no TaScan scope is required by the API itself, though this MCP connection still needs some valid key to place any tools/call. Works for both the full and the public export profile. Keys come only from the issuer's own well-known key document (https://app.tascan.io/.well-known/tascan-receipt-keys.json for the reference issuer, or the equivalent well-known path for a foreign one) — this tool never supplies keys itself. Never verifies locally — always calls the reference verifier.

Void a completion that is wrong (POST /completions/:id/void): records a superseding refuted verdict (method void, with your reason) and a receipted completion_voided ledger event, and the task reads open again. The completion itself is never edited or deleted, so its receipt and hash chains stay valid. completion_id comes from tascan_get_task completions[].id. Full tier.

Hazard-zone compliance audit (OSHA / insurance): every zone crossing, PPE checkpoint verdict (complied / failed with what was missing / skipped), and breach, plus injury reports cross-referenced with the worker's last PPE checkpoint before the injury. Scope by project or zone, optionally by worker and date range. Same rows the printable Evidence Pack shows.