Stable Baseline MCP Server

Per-item: apply a successor's `suggested_start_date`/`suggested_end_date` to its real dates and clear `needs_dependency_review`. For a whole-plan cascade use `applyTaskDependencyCascade`.

Add a comment or activity entry to an improvement.

Add evidence to an improvement. Types: document_section, diagram_node, incident_note, feedback, free_text.

Add a comment or activity entry to a plan.

Add a user to a team as a regular member. Idempotent — returns already_member=true if already on the team. User must be an active organisation member.

Author shapes onto a whiteboard from high-level specs (you do NOT need the full Excalidraw element schema). Appends to the canvas. PLACEMENT ON AN EXISTING BOARD (critical): NEVER guess x/y onto a board that already has content — guessed coordinates land ON TOP of existing shapes and create an unreadable pile. Either (a) OMIT x/y entirely and the server auto-places the new elements together in clear space BELOW the current content, or (b) FIRST call getWhiteboard({ includeElements:true }) to see where existing shapes already are and choose a genuinely EMPTY region. Pass explicit x/y only for a deliberate layout in space you have confirmed is empty. PREFER THE RICHEST FORM THAT FITS, not plain rectangles: for a sticky/post-it note use { type:'sticky', text, backgroundColor } (a first-class note with an auto-fitting bound label — there is NO sticky-note stencil; OMIT x/y and it is auto-placed in clear space below existing content, so it doesn't land on top of the current drawing); for kanban/scrum/story boards, flowcharts, UML/ER, BPMN, org charts, wireframes/mockups, charts or people use a LIBRARY STENCIL in ONE call — { type:'stencil', stencil:'<name e.g. decision>', x, y } fuzzy-matches by name with no prior listWhiteboardStencils call (pass width/height to SCALE the whole stencil and text to fill its single label); for cloud/software-architecture use ICONS — { type:'image', iconPath:'dev/docker.svg', x, y } (paths from listArchitectureIcons); reserve raw rectangles/ellipses for when no standard form fits. Expressive enough to reproduce real Excalidraw templates (sticky-note brainstorm grids, sketchy mind maps, flowcharts). Each spec: { type: 'rectangle'|'ellipse'|'diamond'|'sticky'|'text'|'arrow'|'line'|'freedraw'|'frame'|'image'|'stencil', id?, x, y, width, height, text? (STRONGLY PREFER setting a shape's label via its own `text` — it becomes a centered, auto-WRAPPED bound label fitted to the shape; do NOT drop a separate type:'text' element on top of a shape as its label. Standalone type:'text' is for free-floating titles/notes and now also wraps to its width; Yes/No label on an arrow — emojis are fine, e.g. 'Risks ⚠️'), fontSize?, fontFamily? (1=hand-drawn default, 2=normal, 3=code), textAlign?, backgroundColor? (name 'blue'/'green'/'yellow'/'pink'/'violet'/'orange'/'teal'/… or hex), strokeColor?, fillStyle? ('solid'|'hachure'|'cross-hatch'), strokeStyle? ('solid'|'dashed'|'dotted' — use 'dashed' for grid/category borders), strokeWidth? (1 thin/2 bold/4 extra), roughness? (0 clean, 1 default, 2 very sketchy/hand-drawn — use 2 for organic mind maps), roundness? (number type or null for sharp), opacity?, name? (frame title), frameId? (put a shape inside a frame), start?:{id}, end?:{id} (connect arrows/lines to shapes by id — connectors AUTO-CLIP to the shape edges, never overrun to the centre, AUTO-ROUTE around any shapes in between so a decision's No/loop-back branch never cuts straight through the boxes between source and target, and bound text auto-wraps + centres), routing? ('straight' default | 'elbow' for clean right-angle flowchart/org-chart connectors | 'curved'), startArrowhead?/endArrowhead? (arrowheads are SOLID filled triangles by default — just OMIT them. Pass null for a plain mind-map spoke with no head. Do NOT pass 'arrow': that is Excalidraw's open 'V' and is auto-upgraded to a solid triangle anyway), points? ([[0,0],[dx,dy]] relative, only for manual geometry — almost never needed; binding by id is better), props? (escape hatch: any other Excalidraw field) }. ARCHITECTURE ICONS: to place a software-architecture icon (AWS/Azure/GCP/Docker/Kubernetes/databases/etc.), first call listArchitectureIcons to find one, then add a spec { type:'image', iconPath:'<relative_url e.g. dev/docker.svg>', x, y, width:96, height:96, text?:'<caption shown below>' } — the icon is stored as a URL reference (never base64). Use imageUrl instead of iconPath for any other public image. Combine icons with labelled boxes + elbow arrows for clean architecture diagrams. LIBRARY STENCILS: for hand-drawn, on-brand elements (scrum/kanban columns, flowchart symbols, UML/ER, BPMN, org-chart nodes, wireframe widgets, stick figures), FIRST call listWhiteboardStencils to find one, then add { type:'stencil', stencilKey:'<key from listWhiteboardStencils>', x, y } (or { type:'stencil', stencil:'<name e.g. decision>', pack?:'<pack>', x, y } to fuzzy-match by name). A stencil is a mini-whiteboard (a collection of elements) of kind 'symbol' or 'template' (listWhiteboardStencils returns the kind + its embedded `labels`). For a SYMBOL (one atomic labelled node — flowchart box, BPMN task, org node), pass id + text + width/height: the label auto-fits its single slot and arrows bind to it via start/end {id}. For a TEMPLATE (a multi-component layout — Alerts, Forms, Tables, Charts), place it WHOLE (no single text); the result returns its `children` (id + text + colour + position) so you retext, recolour, or DELETE specific parts by id via updateWhiteboardScene (cluster children by y to act on a whole row/variant). STRONGLY prefer stencils over plain rectangles for wireframes/mockups, kanban/scrum boards, UML/BPMN, org charts; for dense flowcharts, plain shapes with bound text + elbow arrows are equally reliable. (For a plain sticky/post-it note use type:'sticky', NOT a stencil — there is no sticky-note stencil.) FRAMES: a frame is a NON-DESTRUCTIVE, ANY-SIZE container. To enclose shapes that ALREADY exist, add ONE type:'frame' sized to cover them (Excalidraw auto-captures elements inside a frame's bounds) or set those shapes' frameId — never recreate or delete-and-redraw content just to frame it. If a frame doesn't fully cover its content, just RESIZE the frame (patch its width/height). Deleting a frame (deleteIds:[frameId]) leaves all its contents intact on the canvas — it only removes the frame border + title. PRESENTATION/SLIDES: when the user wants a presentation or slide deck, create type:'frame' slides sized width:1280,height:720 (16:9), laid out LEFT-TO-RIGHT at the same y (x: 0, then 1440, 2880, 4320, …), each with a `name` (the slide title). Put every slide's shapes/text/images INSIDE its frame by setting their frameId to that frame's id (give the frame an id and reference it). Slides play in order (left-to-right, then top-to-bottom) in the board's Present mode and export to PPTX, so one frame = one slide. FLOWCHART recipe: rectangles (roundness null for sharp process boxes), diamonds for decisions, arrows with routing:'elbow' and Yes/No as the arrow's text. Use type 'sticky' for sticky/post-it notes (a solid-fill note with an auto-fitting bound label — set text + backgroundColor); type 'line' with no arrowheads + roughness:2 for sketchy mind-map spokes. FREEHAND DOODLES: to actually draw/doodle/sketch freehand, use { type:'freedraw', points } where points is a RELATIVE [[x,y],…] path of the stroke (e.g. a squiggle, circling or annotating something, a hand-drawn star/heart/smiley/arrow, an organic blob) — it renders as one smooth freehand stroke. x/y is the origin; omit x/y to auto-place. Chain several freedraw specs for a multi-stroke doodle. NOTE: freehand is always SOLID (Excalidraw ignores strokeStyle on freedraw) — colour, strokeWidth and opacity DO apply; a freedraw with strokeStyle:'dashed' or 'dotted' is automatically rendered as a smooth dashed/dotted line so the dashes actually show. Give shapes ids and reference them from connectors. Connectors may also bind to shapes ALREADY on the board by their id (get them via getWhiteboard includeElements:true) — you do NOT need to resend existing shapes; the server reads the live scene to bind the arrow and route it around the other boxes. Great for brainstorms, mind maps, flowcharts, org charts, SWOT, retros. PROCESS: for any non-trivial board call getWhiteboardGuide FIRST to plan it; then after adding, ALWAYS call getWhiteboardImage to SEE the result and check layout, labels, spacing, overlaps and how shapes connect — if anything looks off, fix it with updateWhiteboardScene (patch by id) and render again, iterating until it looks right. RESULT: returns `added` (count), `placement` (bounding box {x,y,width,height} of what you just added) and `autoPlaced` (true when you omitted x/y so it was placed in clear space below existing content) — use placement/autoPlaced to tell the user WHERE the new elements landed, never invent a location.

Add an existing organisation member to a workspace with a workspace-level role. Idempotent — returns the existing membership if already a member. Caller must be a workspace owner or admin.

Apply a previously previewed KG scope change. Atomically writes kg_scope rows and dispatches a re-ingest batch (batch_id = token). Idempotent. Rate limit 5/h.

Apply a previously previewed subscription change. Same-tier seat changes update Stripe in place; cross-tier upgrades from Free return a hosted Checkout URL. Refuses target=free (use cancelSubscription) and target=enterprise (sales-led). Rate limit 5/h. Use only AFTER previewSubscriptionChange and after the user confirms the preview's pricing — never call apply without the user seeing the preview first.

Auto-schedule every item in a plan so all FS/SS/FF task-dependencies are respected (topological pass, durations preserved). Returns the before/after diff and logs a comment on every item that moves. Use `forwardOnly: true` to only shift items currently in violation (never pull already-valid items earlier). Use `pinnedItemIds` to keep specific items at their current dates. Pairs with `previewTaskDependencyCascade` (same inputs, dry-run).

Auto-design a complete, visually polished whiteboard from a natural-language goal using the PREMIUM multi-agent pipeline (the same one the in-app assistant uses): it browses the stencil/icon library, composes the WHOLE board, renders it, critiques the rendered image, and refines — far better than hand-placing shapes. This is the one-shot whole-board designer; it is NOT a conversation (for a deck you can chat with and refine turn by turn use designDeckInWhiteboard, and for a refinable illustration use designIllustrationInWhiteboard). COST + APPROVAL: this costs 50 credits per board and requires the user's explicit approval. Call it FIRST without `confirm` to get the exact cost + the workspace credit balance; show that to the user and only call again with `confirm: true` once they agree. If they decline (or lack credits), build the board directly with the standard whiteboard tools (addWhiteboardElements / insertWhiteboardDiagram / listWhiteboardStencils) at no extra charge. It runs in the BACKGROUND and returns immediately with a sessionId; the board fills in over 1-3 minutes. The 50 credits are refunded automatically if the design fails on our side. Optional `designProfile: 'branded-executive'` instead builds an ON-BRAND, fully-editable McKinsey-style SLIDE DECK themed by the org's brand kit (palette/fonts) — use it when the user wants polished branded business slides; it builds in-process and the board is ready on return. Optional `designProfile: 'illustrated'` instead builds an editable-illustration board: pick it for illustrated, image-based, picture-style, richly-drawn or educational explainer boards (e.g. illustrate photosynthesis, an illustrated diagram of the water cycle, a textbook-style visual). It generates a rich text-free vector illustration and overlays real, editable text labels with leader lines on top. It is available to every organisation and costs the same flat 50 credits (credits are the only gate). Optional `designProfile: 'image'` instead builds a single, polished, on-brand IMAGE board with all the text baked into the picture (no editable shapes): pick 'image' when the user wants a single finished image, poster or infographic they will refine by AI mask edits rather than by moving editable shapes. It is also available to every organisation at the same flat 50 credits.

Linked-mentions rail: every edge whose dst matches the named entity.

Emergency stop for KG ingestion: cancels queued/running build runs, queued/running rebuild batches, demotes still-eager unfinished chunks. Optionally narrowed to one project. Requires can_manage_kg + (project write if project_id supplied). Rate limit 5/min.

Cancel a pending invitation by id. Sets status='revoked'. Server resolves the organisation_id from the invitation row; the credential must match that org AND hold can_manage_members. Idempotent. Rate limit 30/min. Use when the user asks to cancel, revoke, or undo a pending invitation — for example to correct a typo'd email address before re-inviting.

Cancel a single KG rebuild batch. Queued runs flip to 'cancelled' immediately; running runs finish naturally. Requires can_manage_kg. Rate limit 5/min.

Apply a previewed soft cancellation (cancel_at_period_end=true). Customer keeps full access until period end. Rate limit 5/h. Use only AFTER previewSubscriptionCancellation and after the user confirms — never cancel without showing the preview first.

List Louvain communities for an org (optionally scoped by project).

Create a per-org BRAND KIT so Stable Baseline outputs come out fully on-brand. Upload your branding and it is auto-applied: pass a `logoUrl` (as little as your logo, and the vision model AUTO-EXTRACTS your palette and fonts), or an `officeUrl` (an existing .pptx/.docx, from which it extracts theme colours, fonts, logo, watermark and the embedded font files), or explicit `tokens`. The kit themes branded-executive slides AND document exports (PDF, Word, PowerPoint). Auth: can_admin_org. Tiered: free 0, pro 1, enterprise unlimited. Optionally set it as the default at a scope in one call.

Create a document from CDMD markdown (standard Markdown plus SB extensions — call getCdmdLanguageGuide if unfamiliar). The body goes in `cdmd` (`content` is accepted as an alias). Do not include DIAGRAM/IMAGE markers — insert them after with dedicated tools. Returns the new document's id and versionTimestamp (the optimistic-lock token for subsequent edits). Supports @-mentioning people: embed `<!-- REFERENCE: {"type":"user","id":"<user_uuid>","label":"Name"} -->` to notify a teammate. Use listAssignablePrincipals to look up the user_id from a name; mentions of users outside the project are silently dropped.

Step 2 of file ingest. After the file is uploaded via the PUT URL from createDocumentIngestSession, call this to start the async conversion. Returns { jobId, documentId } immediately — the document is created as a draft and progressively populated as the worker processes the file. Poll getDocumentIngestJob({ jobId }) to track progress. Idempotent: calling twice with the same sessionId returns the same job/document.

Step 1 of file ingest. Mint a single-use PUT upload URL for a large file (PDF, DOCX, plain text, or markdown — up to 150 MB). Returns { sessionId, uploadUrl, expiresAt, maxBytes }. Upload the raw bytes to uploadUrl with PUT, then call createDocumentFromUpload({ sessionId, projectId }) to start the conversion. The file is auto-deleted once the document is created.

Create a folder in a project. Supports nesting via parentId.

Create a PUT upload URL for a document image (max 10MB). Use the returned assetUrl with insertImageInDocument.

Create an improvement item in a project. Requires projectId and title. Auto-assigns friendly ID.

Create an improvement category or sub-category. Max two levels.

Create a new organisation owned by the calling credential's user. Auth: server-side eligibility gate via `can_user_create_organization` (free-tier users may only have one org). Per-credential rate limit 3/day. Slug auto-generated. The new org is OUTSIDE the credential's current scope (credentials are bound to one org); to use the new org from MCP, mint a fresh credential.

Create a plan in a project. Requires projectId and title.

Create a phase in a plan. Position and wbs_code are auto-computed.

Create a new project inside a workspace. Mirrors the UI Create Project dialog. Auth: write on workspace + credential's `can_lifecycle` capability. Validates name (1..200) and description (0..2000); icon defaults to '📁' if omitted. Server-side limit gate via `can_create_project_in_workspace`. Rate limit 30/min.

Create a task in a plan. Requires planId and title.

Create an FS/SS/FF scheduling edge with lag/lead between two items in the same plan (rendered as a Gantt arrow). FS = Finish-to-Start, SS = Start-to-Start, FF = Finish-to-Finish. `lagDays`: positive = lag, negative = lead/overlap. Rejects self-loops, duplicate (pred+succ+type) edges, cross-plan edges, and cycles.

Create a new team inside an organisation. Caller is added as the team's lead. Subject to plan team limit. Rate limit 30/min.

Create a PUT upload URL for a Vega/Vega-Lite data file. Use returned assetUrl in your Vega spec.

Create a whiteboard — an infinite Excalidraw canvas. A whiteboard is a hidden document (it won't appear in listDocuments) that hosts a single freeform canvas, and opens in the immersive whiteboard editor in the app. Returns documentId + diagramId. Author shapes afterwards with addWhiteboardElements (high-level specs) or updateWhiteboardScene. For anything beyond a blank board, call getWhiteboardGuide first to plan the layout (stencils vs architecture icons vs code/BPMN diagrams vs plain shapes), and render with getWhiteboardImage to verify as you go.

Create a new workspace inside the organisation. Auth: ceiling — credential must hold `can_lifecycle` AND user must be org owner/admin. Rate limit 30/min. Slug auto-generated. Caller becomes workspace owner. Plan limits surface as WORKSPACE_LIMIT_REACHED errors.

Render tabular data as an aligned grid of labelled cells on a whiteboard, deterministically. Pass rows (an array of arrays) OR data (an array of objects), with optional headers; the server lays out evenly-spaced cells so you do NOT place each cell by hand. Use this to turn data, CSV, or JSON into a readable table on the board. Returns a compact summary. Auto-places below existing content unless x/y are given.

Delete a diagram: removes the database record AND every reference to it in the document body — the current marker format plus legacy forms (markers without an embedded diagramId, and old plain-text `[Diagram: name]` placeholders). The response's removedFromBody says whether a marker was actually found in the body, and versionTimestamp is the document's fresh lock token.

Delete a document.

Delete a folder recursively, including all nested folders and documents.

Delete an image from a document and storage.

Delete an improvement and all associated evidence and activity.

Delete an improvement category. Cannot delete system categories.

Delete a comment from an improvement.

Delete a plan, all its phases, and all tasks/improvements within it. This is a destructive operation that cannot be undone.

Delete a comment from a plan.

Delete a plan phase and all tasks/improvements within it. This is a destructive operation that cannot be undone.

Delete a resource_permissions row. Refuses if the row is the LAST admin grant on the resource. Rate limit 30/min. Use when the user asks to revoke access, remove access, take away access, unshare, or delete a permission grant on a specific resource.

Remove a task-dependency edge. Neither item's dates are changed.

Delete a team. Cascades: team members and team-granted resource permissions are removed automatically. Destructive; rate limit 5/min.

Delete a data file attachment from a document.

Delete a whiteboard (the host document and its canvas).

Design ONE reusable, on-brand SLIDE COMPONENT and add it to the org's component library so every future branded deck (autoDesignWhiteboard designProfile:'branded-executive') can use it. This is the self-improving design loop: an agent AUTHORS the component as a declarative template (a gradient/shadow/curve SVG skin + a native editable PPTX shape + reflowing bound-text slots), RENDERS it, a vision critic COMPARES the render to your brief and lists gaps, and it FIXES + re-renders until polished — then validates and stores it. Use it to grow the deck component catalogue beyond the built-ins (e.g. a 'kpi.delta' stat with an up/down arrow, a 'quote.card', a 'logo.strip'). Browse-first: if a component with this `key` already exists it is reused (pass force:true to redesign). Provide example `sampleSlots` so it can lay out real content, and a `projectId` for the small preview board it builds. Returns the stored component, the per-round critique trail, and the preview board id. It uses a few AI calls + renders (no flat credit charge); the new component is then free to reuse forever.

Create or refine a slide deck INSIDE an existing whiteboard by conversing with the AI design agent. Send a brief for a NEW deck, a change to an EXISTING one, or an answer to the agent's question. The agent builds a polished, on-brand deck and places it on the board; if the brief is ambiguous it asks ONE clarifying question (answer with the same sessionId). Returns immediately; poll getDeckReplyInWhiteboard for the result. Use for building or editing slide decks / presentations. WHITEBOARD IS REQUIRED: a deck always lives inside a whiteboard, so documentId (the whiteboard's id) is required. If you do NOT already have a whiteboard id, ASK THE USER which whiteboard they want the deck designed in — do NOT create a whiteboard automatically. Only call createWhiteboard first if the user explicitly asks for a brand-new board; otherwise use the id of the whiteboard they name. FIRST vs FOLLOW-UP: the first call (from nothing) builds; a follow-up call (an answer, a change, or a new instruction) passes the sessionId (or the deckId) plus the new message. kind:'deck' (default) is the premium on-brand HTML deck; kind:'express' builds the native, deterministic branded-executive deck directly on the whiteboard (faster, lower fidelity, one-shot, not conversational). COST + APPROVAL: a build costs 50 credits and an edit 10; a clarifying question is FREE. GENERATED IMAGES are extra and OFF by default: decks are type-only unless the user asks for visuals, in which case set imageCount (5 credits each, ceiling scales with slide count and plan tier, max 10) and the exact total is quoted before anything is charged — exactly that many images are produced, and the image surcharge auto-refunds if the build cannot deliver them. ADVANCED DECK BUILDING (optional, OFF by default): set advancedDeckBuilding:true to build the deck over several rounds of redraft and review by a panel of design, brand, accessibility and copy reviewers instead of one composer pass. It usually raises design quality, but it is not a guarantee. It is much slower and it costs more: a standard build takes roughly 2 to 8 minutes, advanced deck building takes roughly 15 to 20 minutes, and it adds 15 credits per depth level on top of the turn fee (advancedDeckBuildingDepth is 1 to 3, default 3, so +45 credits, making a 50-credit build cost 95). Only turn it on when the user asks for the highest quality and accepts the wait and the cost. Call FIRST without confirm to get the exact cost plus the workspace balance, show it to the user, and only call again with confirm:true once they agree. The fee is auto-refunded if a turn produces no change or fails. Returns sessionId (the conversation), deckId (the deck), status, turnType, started, awaitingUser, needsConfirmation, insufficientCredits, slideCount + slideCountClamped (the target the conversation now carries, and whether it was reduced to the maximum), advancedDeckBuilding (whether advanced deck building is on for this conversation), advancedDeckBuildingStatus, and assistantMessage. Export the finished deck with exportFromWhiteboard.

Create or refine a standalone ILLUSTRATION INSIDE an existing whiteboard by conversing with the AI design agent. This is the illustration sibling of designDeckInWhiteboard: same conversation, same follow-up flow, but it makes ONE on-brand illustration placed on the board (not a slide deck). Send a brief for a NEW illustration, a change to an existing one, or an answer to the agent's question. The agent generates the illustration, places it on the board, and if the brief is ambiguous it asks ONE clarifying question (answer with the same sessionId). Returns immediately; poll getDeckReplyInWhiteboard for the result. Use it when the user wants a picture they can talk about and refine turn by turn (e.g. 'draw a friendly robot onboarding a new team', then 'make it warmer', 'add a second robot'). For a quick one-shot illustration with no follow-up, use generateIllustrationInWhiteboard instead. WHITEBOARD IS REQUIRED: an illustration always lives inside a whiteboard, so documentId (the whiteboard's id) is required. If you do NOT already have a whiteboard id, ASK THE USER which whiteboard they want the illustration designed in — do NOT create a whiteboard automatically. Only call createWhiteboard first if the user explicitly asks for a brand-new board; otherwise use the id of the whiteboard they name. FIRST vs FOLLOW-UP: the first call (from nothing) builds; a follow-up call (an answer, a change, or a new instruction) passes the sessionId (or the deckId) plus the new message. COST + APPROVAL: a build costs 50 credits and an edit 10; a clarifying question is FREE. Call FIRST without confirm to get the exact cost plus the workspace balance, show it to the user, and only call again with confirm:true once they agree. The fee is auto-refunded if a turn produces no change or fails. Returns sessionId (the conversation), deckId (the illustration's id), status, turnType, started, awaitingUser, needsConfirmation, insufficientCredits, and assistantMessage.

Per-item: clear `needs_dependency_review` without changing dates — keeps the edge, ignores the suggestion. Use when the successor should stay put despite the predecessor shifting.

Copy-paste existing whiteboard elements — the MCP equivalent of selecting a group and pressing Ctrl/Cmd+D. Clones the given elements (plus their group peers + bound text/labels) with FRESH ids, offsets the copy by dx/dy, and by default groups it into ONE new unit so it moves together. Use it to build something once (a labelled stencil frame, a kanban card, a UML class) then stamp out consistent repeats fast — then retext/recolour each copy by its new id (via the returned idMap) with updateWhiteboardScene. Pass `groupId` to copy a whole group as a unit (e.g. a placed stencil's groupId from its placement result) and/or `ids` for specific elements. Internal references (group membership, bound text containerId, arrow start/end bindings) are remapped within the copied set; a binding to an element you did NOT copy is dropped. Returns { duplicated, idMap (old id → new id), groupId (the copy's new unit group), elementCount }. Render with getWhiteboardImage afterwards to verify.

Edit a document: the PREFERRED tool for small targeted changes. Two patch dialects — do NOT mix them in one call. (1) ANCHOR patches {oldText, newText, before?, after?} — RECOMMENDED: replace an exact snippet of existing text with new text. oldText must match the document byte-for-byte AND be unique; if it occurs more than once, either expand oldText until it is unique, or add `before`/`after` (the EXACT text immediately before/after the match) to disambiguate. A no-match returns nearby context; an ambiguous match returns the occurrence count. Anchors do NOT drift, so you don't need fresh line numbers and they survive concurrent edits. Use newText:"" to delete. (2) LINE patches {startLine, endLine, replacement} — 1-based and INCLUSIVE: call getDocument first for line numbers; replace line 5 with {startLine:5,endLine:5}; INSERT before line N (deleting nothing) with {startLine:N,endLine:N-1}; append to an L-line document with {startLine:L+1,endLine:L}. Line numbers are ABSOLUTE and GO STALE after ANY edit — re-call getDocument before further line patches; out-of-range patches are rejected with the current line count. versionTimestamp from getDocument (or from any mutating tool's response — they all return the fresh token) is required for optimistic locking, EXCEPT when dryRun:true. If your token is stale, the error tells you who changed the document, when, and the currentVersionTimestamp — anchor patches survive concurrent edits, so retrying with that token is usually safe. Set dryRun:true to apply the patches and get the resulting text back WITHOUT saving (verify before committing — kills retry loops). IMPORTANT: getDocument displays lines as `NNNNN<TAB>content`; that prefix is display-only — oldText/before/after must contain only the content AFTER the tab. Do not edit or delete DIAGRAM/IMAGE marker lines (rejected with guidance) — use dedicated diagram/image tools. To @-mention a person, insert `<!-- REFERENCE: {"type":"user","id":"<user_uuid>","label":"Name"} -->`; look up the user_id via listAssignablePrincipals. Mentioned users are notified automatically.

Mask-edit (inpaint) one region of an image element on a whiteboard. Given the target image element id and a paint MASK (a PNG where WHITE marks the area to regenerate and BLACK is kept), it regenerates only the masked region using the prompt and replaces the image IN PLACE (same position + size). This is mainly used by the in-app image-board mask editor for boards designed with designProfile:'image'. It is available to every organisation; the small flat credit charge is the only gate (refunded automatically if the edit fails on our side).

Fetch a KG entity by id or name, with 1-hop neighbours.

Phase 5 / E3 — Provenance-aware assessor for a set of chunk_ids returned by kg_search. Returns per-chunk bucket (authored-grounded | extracted-high-conf | extracted-low-conf | no-support), overall distribution, dominant_bucket, and recommend_refusal. Pure metadata read - no LLM cost. Used by the agent's response policy to decide whether to answer confidently, caveat, or refuse.

Export a design that lives in a whiteboard to an editable PowerPoint (PPTX), PDF, PNG images, or raw HTML. Give it the whiteboard documentId and the designId (the deck). kind:'deck' (default) renders the finished deck via the export worker: 'pptx' = native, fully-editable PowerPoint (real shapes and text, not screenshots); 'pdf' = vector, one page per slide; 'png' = one image per slide (returned as a base64 array); 'html' = the self-contained deck HTML. Returns the file as base64 in data (pptx/pdf/html) or per-slide base64 in slides (png). The design must be finished; one that is still generating, failed, or archived returns a clear message.

Find and replace EXACT substrings in a document (NOT regex: wildcards and patterns are matched literally). Replaces EVERY occurrence and returns the replacement count; best for renames and repeated phrases. For a single targeted change at a known location, prefer editDocument (anchor patches). Case-sensitive by default. Diagrams/images are automatically protected — only document text is affected. Returns document.versionTimestamp (the fresh optimistic-lock token) like every other mutating tool, so you can chain straight into editDocument or the diagram tools. Pass versionTimestamp to opt into optimistic locking (optional here — whole-document find/replace is position-independent). Note: when the `replace` value contains a `<!-- REFERENCE: {...} -->` marker (e.g. inserting a user mention), it round-trips losslessly through the editor and triggers notifications if it adds a new user mention.

Get the CDMD markdown language specification. Call before createDocument if unfamiliar with syntax.

Composite credit balance for an organisation: plan_credits (recurring monthly bucket), top_up_credits (purchased one-offs, gross), bonus_credits (admin grants), total, and period_end (next plan reset).

List active credit packages available for purchase (name, credits, bonus_credits, price in cents AUD). Catalog read — visible to any MCP credential. Pair with createCreditPurchaseLink (Phase 6) to start a checkout.

Read the plan entitlements (limits + capability flags) that apply to the caller's organisation. Returns { tier, display_name, limits, features }. The Enterprise row is filtered for non-admin callers by the underlying view. Read-only.

Return the calling user's identity (user_id, display_name, full_name, email, avatar_url). Use this when the user says 'me' / 'mine' / 'I' so you can resolve to their UUID before passing it to tools like updateImprovement(owner_id=…) or filtering by owner. Read-only.

Mint a single-use Stripe Customer Portal URL for self-serve billing changes. return_url defaults to https://app.stablebaseline.io/settings/billing and must be on a stablebaseline.* host.

Get the design agent's reply after calling designDeckInWhiteboard OR designIllustrationInWhiteboard: the status (thinking/building/ready) and EITHER the finished result (a deck's slide count + preview, or the placed illustration) OR a clarifying question to answer (call the SAME tool you started with, passing the sessionId + your answer). Poll until ready or a question appears. Give it the whiteboard documentId and the deckId (both returned by the tool you called). It returns the build status ('generating' while working, 'ready' when finished, 'failed' if it failed) plus, once ready, the slide count and a thumbnail image URL. IMPORTANT for the conversation: if the agent asked a CLARIFYING QUESTION instead of doing the work, this returns awaitingUser:true with pendingQuestion (and assistantMessage) — relay that question to the user, then call the SAME design tool again with the same sessionId and the user's answer as message to continue. It also returns the full conversation (history + status + pending question). While a turn is running it additionally returns live build state: stage, percent, feed (the agent's real per-step lines), slideTarget (the count it is building to), slides (the finished slides so far, each with a fetchable image url), partialHtml (the deck so far), and, when advanced deck building is on, advancedDeckBuildingProgress (the round-by-round reviewer scores; also emitted as the deprecated `jury` field for one release). Every one of those is optional and absent when there is nothing to report. A standard turn usually takes about 2 to 8 minutes, so poll every 15 to 30 seconds until it is 'ready' or awaitingUser is true; a turn running with advanced deck building takes roughly 15 to 20 minutes, so keep polling for that long before treating it as stuck. When ready, the deck or illustration has already been placed on the whiteboard; a deck can also be exported with exportFromWhiteboard. If a turn failed or produced no change, the user was not charged.

Render a diagram that ALREADY exists in a document to an IMAGE (svg/png/jpeg @1x/2x/3x) and return it — a temporary signed URL (expires in 1 hour) plus, for png/jpeg, the image inline so you can see it. Pass the diagramId (from getDocument's DIAGRAM markers or getDiagramInDocument). Reuses the diagram's cached server render when available (pixel-identical to the editor); when the diagram has no cached render yet, the fresh render is persisted back to the document (persistedRender:true in the response), so reading repairs unrendered diagrams. Use renderDiagram instead to generate from raw DSL without an existing diagram.

Get a diagram's full details including raw DSL source code. Use diagramId from DIAGRAM_OMITTED markers in getDocument output. Returns diagramCode, type, name, nlDescription, renderStatus/renderError, and versionTimestamp — the diagram's optimistic-lock token for updateDiagramInDocument (every diagram write also returns it fresh).

Get DSL writing instructions for a diagram type. Call before writing diagramCode.

Read a document's content with line numbers. content.text lines are formatted `NNNNN<TAB>content` (cat -n style); the number+tab prefix is DISPLAY ONLY — never part of the document — so when building editDocument anchor patches, copy only the text AFTER the tab. Reads paginate by lines (offset/limit, default 200): use content.totalLines and content.nextOffset to page. document.versionTimestamp is the optimistic-lock token that every mutating document tool accepts (as versionTimestamp; the older documentVersionTimestamp name also works) — and every mutating tool returns a fresh token, so you rarely need to re-read just to keep editing. Diagrams/images appear as OMITTED markers with metadata (type, diagramId, renderStatus, nlDescription) — use getDiagramInDocument(diagramId) for full DSL code, or pass includeDiagramDsl:true to inline each diagram's DSL and versionTimestamp directly into its DIAGRAM_OMITTED marker (saves a getDiagramInDocument call when you intend to read or edit diagrams).

Read the current status of an ingest job. Returns { status, stage, processedImages, totalImages, documentId, error?, lastHeartbeatAt }. Stages: pending → downloaded → extracted → draft_saved → images_processing → finalized → cleaned_up. Status: queued, running, succeeded, failed, cancelled. The associated document_id is populated immediately and progressively filled in as images are processed.

Compute a user's effective permission level on a resource (taking team grants, inheritance, and 3-state overrides into account) and the source. Asking about another user requires can_manage_perms on the org. Use when the user asks 'can X access this', 'what level of access does X have', 'why can X see this', or to debug an unexpected permission outcome.

Get the folder and document tree starting from a specific folder. Alias for getProjectHierarchy with folderId.

Get image details including a fresh signed URL (expires after 1 hour). Use storagePath from IMAGE_OMITTED markers in getDocument output.

Get full details for an improvement item including evidence, activity log, compliance context, and the `checklist` array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp — pass it to updateImprovement for optimistic locking. (For tasks specifically, use getTask + updateTask which are symmetric aliases.)

List every kg_scope row for the caller's organisation, optionally narrowed to a workspace or project subtree. Each row carries scope_type, scope_id, state (on|off|inherit), settings, and is augmented with scope_name + parent_id for tree rendering. Capped at 500 rows.

Get a meeting scribe's status after startMeetingScribe: the session state (joining, in the waiting room, live in the call, paused, ending, ended, or failed), the live activity feed of what the scribe has painted, and the board it is painting. Give it the sessionId returned by startMeetingScribe. Poll every 15 to 30 seconds while the meeting runs. When the meeting ends the board holds the finished 'meeting map' (topics, decisions, actions, and a summary).

Fetch a single organisation member by user_id, enriched with profile (email + display name). Auth: org id must match the credential's organisation.

Read a single organisation by id. Returns id, name, slug, description, settings (jsonb), created_at, member_count (active members) and plan_tier (subscription_tier). The organisation must match the calling credential's organisation. Read-only.

Read an organisation's settings JSON and the derived enabled-features map (plans, documents, improvements, compliance, knowledge_graph — all booleans). The organisation must match the calling credential's organisation. Read-only.

Get full plan details including phases, items, and activity. Returns versionTimestamp — pass it to updatePlan for optimistic locking. Items include percent_complete for progress tracking.

Get the complete plan hierarchy (phases, tasks, improvements) in one call. Recommended first call for plan navigation.

Get a plan phase by ID with full details. Returns versionTimestamp — pass it to updatePlanPhase for optimistic locking.

Read the public catalog entry for a single subscription tier (free, pro, enterprise). Pro/Free pricing is publicly advertised; Enterprise pricing is custom — pricing fields are nullified for non-admin callers.

Read a single project by id. Auth via the standard project-access ladder. Returns the full v_projects row (id, workspace_id, name, description, icon, created_by/at, updated_by/at). Read-only.

Get the complete folder and document tree for a project in one call. Recommended first call for navigation.

Read the subscription state for an organisation. Returns tier, status, current billing period, seat count, member count, cancellation flag, trial end. Stripe IDs are stripped. Pair with listPaymentMethods/listInvoices for the full billing dashboard. Use when the user asks 'what plan am I on', 'how many seats do I have', 'when does my subscription renew', or to check current billing status.

Get a task by ID with full details, evidence, activity, and the `checklist` array (each item: id, text, due_date, completed_at, plus server-stamped attribution). Returns versionTimestamp; pass it to updateTask to modify. Includes percent_complete for progress tracking.

Get a single team by ID with profile-enriched member list (display_name, email, avatar_url, role, joined_at). Set `includeMembers=false` to skip the member fan-out and just return team metadata. Read-only.

Read the calling user's preferences. Self-only — no params required. Returns { notifications, grids } where `notifications` is the single notification-preferences row and `grids` is an array of per-grid view rows. Read-only.

Read a whiteboard: its metadata plus a summary of the canvas (element count, element types, and text labels on the board). Pass includeElements=true to also return the full Excalidraw scene ({elements, appState, files}) — needed if you intend to modify it and send it back via updateWhiteboardScene. FOR BEST RESULTS, also call getWhiteboardImage to render the board to an image and actually SEE it: the visual layout (positions, spacing, overlaps, colours, how shapes connect) is far easier to understand from the rendered picture than from the element list, so view it first to truly understand the board and to propose or verify edits accurately.

Get the Stable Baseline whiteboarding guide (Markdown): when to use stencils vs architecture icons vs code/BPMN diagrams vs plain shapes vs real images vs frames/presentations, how to lay out and verify a board, and how to edit a large board safely (patch by id, never replace). Call before authoring a non-trivial whiteboard.

Render a whiteboard to a raster IMAGE so you can SEE it and confirm your edits look right, then iterate — like taking a screenshot. Returns the rendered board as a viewable image attached to the result (always raster: a JPEG light variant and/or a PNG dark variant; there is no vector/SVG output, so for a vector export of a single diagram use getDiagramImage). Pass elementIds to render only specific shapes (e.g. to inspect one section/slide), region:{x,y,width,height} to capture an exact scene-coordinate window (e.g. the user's viewport), theme:'light' for the fastest single-variant render, or background to set the canvas colour. Unchanged boards return instantly from a content-keyed cache. Call this after addWhiteboardElements/updateWhiteboardScene to check layout, overlaps, labels and alignment before continuing.

Read a single workspace by id. Auth via the standard workspace-access ladder (credential org match + workspace scope + per-resource read permission). Returns the full v_workspaces row. Read-only.

Grant a team read/write/admin access to a workspace. Idempotent. Team and workspace must be in the same organisation.

Insert a new diagram into a document. Call listDiagramTypes to find your type, then getDiagramTypeGuide for DSL syntax before writing diagramCode. The diagramCode is COMPILE-CHECKED BY RENDERING at write time: broken DSL is rejected with the renderer's error (fix and retry), and valid DSL is rendered + thumbnailed immediately so the document displays instantly everywhere. The response tells you what happened: diagram.renderStatus ('rendered' | 'pending_render' with renderError when the renderer was unavailable), plus fresh optimistic-lock tokens — document.versionTimestamp and diagram.versionTimestamp — so you can keep editing without re-reading. Always set prompt (and ideally nlDescription) to describe what the diagram shows. To SEE the result inline set returnImage:true, or call getDiagramImage afterwards; if it is wrong or ugly, correct it with updateDiagramInDocument (provide the full updated diagramCode).

Insert an image into a document (max 10MB). Provide imageBase64, imageBinary, or imageUrl. For large files, call createImageUploadSession first then use the returned assetUrl.

Insert (or re-render in place) a real DIAGRAM (BPMN, Diagrams-as-Code / any DSL: mermaid, d2, plantuml, graphviz, …) on a whiteboard as an editable SB diagram element. Provide documentId, diagramType (call listDiagramTypes / getDiagramTypeGuide), and source (the DSL). The diagram is rendered to an image stored like a pasted image, and its editable source is kept in a sidecar so it stays a live, re-openable diagram (double-click on the canvas opens the BPMN / code / AI editor). Options: caption (label beneath it), width/height to size it (auto width caps at 480px; an explicit width may go up to 1200px), and x/y or align ('left'|'center'|'right') to place it (defaults to the right of existing content). Pass updateElementId to UPDATE an existing embedded diagram in place — re-render + replace its image and DSL while keeping the same element id and board position (used to live-edit a diagram as it evolves); if that id is not on the board yet it is created carrying that id. After inserting, call getWhiteboardImage to see it and verify it rendered correctly (fix the source and re-insert if it is wrong). For a plain picture (not a diagram) use insertWhiteboardImage; to generate a diagram image WITHOUT inserting use renderDiagram.

Insert a real IMAGE (photo, screenshot, logo, picture) into a whiteboard — the storage-backed equivalent of insertImageInDocument. Provide the image as imageUrl (fetched and re-hosted), imageBase64, or imageBinary; for large files call createImageUploadSession(documentId) first then pass the returned assetUrl as imageUrl. The bytes are stored in the document-images bucket and the scene only holds a reference (never base64), exactly like pasted images. Options: caption (a text label placed + grouped beneath the image), width/height in px to RESIZE (if only one is given the other follows a 4:3 ratio; ~360px wide if neither), and placement via x/y (top-left) OR align ('left'|'center'|'right', positioned just below existing content) — omit both to auto-place to the right of the current content. After inserting, call getWhiteboardImage to verify. To move or resize the image later, patch its element via updateWhiteboardScene (mode:'patch' with {id, x, y, width, height}). For curated software-architecture ICONS (AWS/Docker/etc.) use addWhiteboardElements with an {type:'image', iconPath} spec instead.

Invite a person by email to the credential's organisation. Auth: org id must match the credential AND credential must hold can_manage_members. Rate limit 10/h. Returns invitation_id, expiry, and a seat-billing-impact summary. Email-existence is opaque: the response shape never reveals whether the email is already a member, already invited, or new. Use when the user asks to invite a teammate, friend, colleague, or new user to their organisation, or to onboard someone.

Unified Knowledge Graph KNOWLEDGE retrieval — facts, themes and relationships from INSIDE document CONTENT. This is NOT an artefact finder: do NOT use it to locate a document / whiteboard / diagram / plan / task / improvement by its TITLE or friendly id (e.g. "DOC-123", "find the GTM plan"). For locating an artefact by name or id use listDocuments / listWhiteboards / listPlans / listTasks / searchImprovements (they match title + friendly id). Use kg_search only to ANSWER A QUESTION from the knowledge contained in the artefacts. PICK THE MODE THAT FITS THE QUERY: • mode='local' (default) — for SPECIFIC factual questions ("what does §15 say about deposits?", "who is the Chief Counsel?"). FTS+vector RRF over individual document chunks. Returns precise excerpts with citations. • mode='global' — for THEMATIC / OVERVIEW / SUMMARY questions ("what are the main themes", "give me an overview of the project", "what topics does this cover"). Returns Louvain community summaries + curated wiki pages — far better than 'local' for big-picture queries because community summaries already aggregate across many chunks. ALWAYS PREFER over 'local' when the user asks for themes / summary / overview / topic landscape. • mode='graph' — for RELATIONSHIP questions ("what's connected to entity X?", "who cites Section 5?"). 1-hop entity-neighbourhood walk. Pass query OR srcEntityId. • mode='path' — for CONNECTION questions ("how does X relate to Y?"). Shortest path between two entities. Pass srcEntityId AND dstEntityId. • mode='ppr' — for MULTI-HOP discovery ("what's relevant to X, even indirectly?"). Personalised PageRank over AUTHORED-vs-EXTRACTED weighted edges, seeded by query-similar entities. Best when 'local' returns too few results and the answer requires walking through several entity hops. Quick decision tree: - User asks for an overview/summary/themes → 'global' - User asks a specific question with a clear answer → 'local' - User asks 'how is X connected to Y' → 'path' (with both entity IDs) - User asks 'what's near entity X' → 'graph' (with srcEntityId) - 'local' returned nothing useful and the question is broad → retry with 'ppr'

SOFTWARE & CLOUD architecture icons ONLY (AWS, Azure, GCP, Docker, Kubernetes, databases, message queues, dev tools, etc.). This catalog has NO general/nature/science/people/business icons — so for any NON-technical topic (e.g. photosynthesis, biology, history, marketing), do NOT use this tool; instead put a relevant emoji directly in the element's label (e.g. ☀️ Sunlight, 💧 Water, 🌿 Leaf). It returns nothing for off-domain queries by design — never force an unrelated tech logo onto a non-tech concept. Each result has an `iconPath` (e.g. 'dev/docker.svg'). TWO ways to use it: (1) on a WHITEBOARD, drop it via addWhiteboardElements({ type:'image', iconPath:'dev/docker.svg', x, y, width:96, height:96, text:'Docker' }); (2) in a D2 systems-architecture diagram, use the iconPath as-is in D2 code (e.g. icon: dev/docker.svg).

Server-side searchable, paginated list of USERS and TEAMS that can be assigned as the owner of an improvement/task in a project — and the canonical source for resolving a person's user_id when @-mentioning them in a document. Returns two arrays — `users` (with user_id, display_name, email, avatar_url, has_explicit_permission) and `teams` (with team_id, name, member_count, has_explicit_permission). Sources: project-level grants + workspace members + organization members + members of teams granted access. Use BEFORE: (1) updateImprovement/updateTask when you need an `owner_id` (kind='user') or `owner_team_id` (kind='team'); (2) inserting a `<!-- REFERENCE: {"type":"user","id":"…","label":"…"} -->` mention in document content via createDocument / editDocument / findAndReplaceTextInDocument. Supports `q` for ILIKE search on names/emails (users) or team names. Pass `kind='user'` or `kind='team'` to scope to a single section, or 'all' (default) for both. Pagination via limit (1-100, default 20) + offset.

List an organisation's BRAND KITS (palette/fonts/logo), newest first. Use a returned `id` as brandKitId for a design call or setDefaultBrandKit. Auth: can_admin_org.

List credit-purchase history for an organisation, newest first. Status, credits purchased, bonus, amount paid in AUD cents, completion timestamp. Stripe IDs stripped.

List supported diagram types. Pass `query` to search by name OR intent (keyword + semantic): e.g. 'circuit diagram', 'wiring harness', 'timing waveform', 'network topology', 'database schema'. Use the returned `type` field with getDiagramTypeGuide (DSL instructions + example) and insertDiagramInDocument / renderDiagram.

List AND grep documents in a project, workspace, or folder. `query` does a full-content search across each document's body (not just the title) and returns the matching lines — like grep across your docs. Each returned document includes `contentMatches: [{line, text, context?}]` and `matchCount`; the `text` is anchor-ready (paste it straight into editDocument's oldText). Use isRegex:true for regular-expression search (e.g. "TODO\(.*\)", "ACME-\d+"), caseSensitive for exact case, and contextLines for surrounding lines (grep -C). versionTimestamp is returned per document so you can edit straight from the results without a getDocument round-trip. Also supports date filtering.

List version history for a document. Returns timestamps, creator, change summary, and content.

List folders in a project. Use parentId for nested folders. For full tree, use getProjectHierarchy instead.

List improvement categories for a project. Returns tree and flat list.

List AND grep improvements in a project. `query` searches the title, friendlyId and problem statement, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status, type, priority. For ranked semantic + text search use searchImprovements.

List organisation invitations. Auth: org id must match the credential's organisation AND the credential must hold the can_manage_members capability. Status defaults to 'pending'. Pass 'all' to disable filtering.

List invoices for an organisation, newest first. Returns hosted Stripe invoice URLs and PDF links. Stripe IDs are stripped.

List members of an organisation, enriched with email + display name. Auth: org id must match the credential's organisation. Returns paginated list, default limit 50 / max 200.

List organisations you have access to. Supports query filtering by name/slug.

List saved payment methods for an organisation. Returns masked card metadata only (brand, last4, exp month/year, default flag). NEVER returns full card numbers, CVCs, or any Stripe IDs.

List phases for a plan ordered by position.

List AND grep plans in a project. `query` searches the title, friendlyId and description, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status and priority.

List projects in a workspace. Supports query filtering by project name.

List explicit permission grants on a resource (workspace/project/folder/document/improvement/plan), including principal type (user|team), level (none|read|write|admin), and 3-state overrides for documents/improvements/plans. Read-only. Use when the user asks 'who can see this', 'who has access', 'what permissions are set on this', or to audit existing access on a resource.

List FS/SS/FF task-dependency edges in a plan (the Gantt arrows). Scope by planId, projectId, or itemId. `direction`: 'predecessors' | 'successors' | 'both' (default, only with itemId).

List AND grep tasks in a plan. `query` searches the title, friendlyId and description, not just the title (substring by default; set isRegex:true for a regular expression, caseSensitive:true for exact case). Supports filtering by status, priority and phaseId.

List teams in an organization, with optional search filter and an `includeMembers` flag that fans out to v_team_members in a single round-trip. Supply EITHER organizationId OR workspaceId (the workspace's parent org is resolved automatically). Use this when the user asks about teams generically (e.g. 'show me my teams') or before assigning a team via updateImprovement(owner_team_id=…). Read-only.

List the whiteboards in a project (hidden whiteboard-kind documents). Returns documentId, diagramId, title and timestamps for each.

Search the built-in library of structural whiteboard stencils — ready-made hand-drawn graphics: flowchart/UML/ER/BPMN symbols, scrum columns, org-chart nodes, gantt, lo-fi/UX wireframe widgets (buttons, forms, tables, alerts, navs), charts, device frames, stick figures. A stencil is a MINI-WHITEBOARD (a collection of elements), NOT a single shape. Each result returns: `key`, `title` (a real human name e.g. 'Alerts', not an index), `kind` ('symbol' | 'template'), `labels` (the TEXT it actually contains — its real content, e.g. an Alerts template's variant messages), `size` ({w,h} px), `summary`, `pack`, `category`; plus the full pack/category lists. The two kinds are used DIFFERENTLY: • SYMBOL = one atomic labelled node (flowchart Process/Decision, BPMN task, org node). Place + label + connect: addWhiteboardElements({type:'stencil', stencilKey, id:'n1', text:'Review', width, height}) — the text auto-fits its single slot and an arrow's start/end {id:'n1'} binds to it like any shape. A few symbols are text-less FRAMES (e.g. a UML class box = rectangle + divider line): place create-only, then use the placement result's `children` (shapes + x/y/w/h) and `groupId` to add type:'text' specs INTO the regions — pass that groupId so the text is one unit with the frame. • TEMPLATE = a multi-component layout (Alerts, Forms, Tables, Charts, device frames). Place the WHOLE thing: addWhiteboardElements({type:'stencil', stencilKey, x, y, width?, height?}); the placement RESULT returns `stencils[].children` (each child's id + text + colour + position x/y/w/h, so you can group children into rows/sections) so you then keep / retext / recolour / DELETE specific parts via updateWhiteboardScene (e.g. delete the info + error rows to keep only the green success alert). Do NOT pass a single `text` to a template — read its `labels` to see its parts, then edit them by id. To make several similar items, build one then duplicateWhiteboardElements({groupId, dx}) to stamp consistent copies (like copy-paste in the UI). SEARCH TIPS: prefer BROAD single words ('decision','alert','form','phone','process'); content words match the embedded `labels` too (searching 'success' finds the Alerts template). If nothing exact matches, results auto-broaden (broadened:true); pass pack/category to browse. For cloud/architecture ICONS (AWS/Azure/GCP/Docker/Kubernetes/databases) use listArchitectureIcons; for a sticky/post-it use addWhiteboardElements({type:'sticky'}), not a stencil.

List workspaces you have access to. Supports query filtering by name/slug.

Poll the status of a signup begun via `startSignup`. Anonymous-callable. Possible status values: `pending` (user has not yet authorized — keep polling), `authorized` (success — response includes `api_key`, `organization_id`, `user_id`, `user_email`; the api_key is returned ONCE), `consumed` (already returned the api_key on a previous poll — stop polling), `denied` (user clicked Deny), `expired` (10-minute TTL exceeded — call startSignup again), `not_found` (invalid device_code), `slow_down` (you're polling faster than the interval — back off).

Preview the cost / coverage / ETA of a full KG rebuild for the org (optionally narrowed to a workspace or project). Returns confirmation_token (10-min TTL). Rate limit 20/h.

Preview the credit cost, source counts, and ETA of including or excluding KG scope rows. Returns confirmation_token (10-min TTL) plus delta of newly-in-scope vs newly-out-of-scope sources. Rate limit 20/h.

Preview the consequences of cancelling. Returns confirmation_token plus summary {remaining_credits, prepaid_days, prepaid_value_aud, feature_loss[], at_risk_seats}. Soft cancel only. Rate limit 30/h. Use when the user asks to cancel, end, or stop their subscription — ALWAYS call this first to show the cost of cancelling before passing the token to cancelSubscription.

Preview a subscription tier or seat change. Returns confirmation_token (10-min TTL) plus proration and next-invoice math. Cross-tier upgrades from Free return requires_checkout=true; the apply step creates a hosted Stripe Checkout session. Rate limit 30/h. Use when the user asks to upgrade their plan (free→pro), downgrade, add seats, increase seats, or change subscription tier — ALWAYS call this preview first, then applySubscriptionChange with the returned token after the user confirms.

Dry-run of `applyTaskDependencyCascade` — returns the diff without writing. Empty items array means the plan is already consistent. Accepts the same `pinnedItemIds` and `forwardOnly` params.

Apply a credit-package quote by creating a hosted Stripe Checkout session. Returns checkout_url + session_id. Refuses if catalogued price has drifted. Rate limit 5/h. Use only AFTER quoteCreditPackage and after the user confirms — never start a checkout without the quote step first.

Quote a credit-package purchase (first half of the human-in-the-loop ritual). Returns quote_token (10-min TTL) plus package + total_aud. Caller must invoke purchaseCreditPackage(quote_token) within the TTL. Use when the user asks to buy credits, purchase credits, top up credits, or add more credits — ALWAYS call this first then purchaseCreditPackage after the user confirms.

Reactivate a subscription that was scheduled to cancel at period end (clears cancel_at_period_end). Rate limit 5/h. Use when the user asks to reactivate, uncancel, restore, or keep their subscription after they previously cancelled but before the period ends.

Internal maintenance (requires write). Syncs gte-small (384-dim) vector embeddings for every platform catalog (MCP tools, whiteboard stencils, architecture icons, infographic templates, whiteboard design components, and open-design skills) into platform_catalog_embeddings, so the semantic search behind searchTools, listWhiteboardStencils, listArchitectureIcons, and the design-skill / component browsers stays current. Incremental: scans every catalog, diffs by content hash, and re-embeds ONLY changed rows (cheap no-op when nothing changed). This normally runs automatically every hour (the platform-catalog-sync cron), so manual calls are rarely needed; use it to force an immediate sync after changing any catalog. Embeds up to ~120 changed rows per call; if more changed, call again until allDone is true. Not part of normal authoring flows.

Find other sources that share entities with the given source.

Hard-remove a member from an organisation, cascading to workspace and team memberships and resource permissions. Refuses self-removal and last-owner removal. Stripe seat downgrade is NOT performed here — pair with a Phase 6 billing tool. Rate limit 5/min. Use when the user asks to remove, kick out, fire, offboard, or fully terminate a member's access to the organisation.

Remove a user from a team. Idempotent — returns removed=false if not on the team.

Remove a member from a workspace. Caller must be a workspace owner or admin. Refuses to remove the last remaining workspace owner.

Generate a diagram from its DSL/code and get the IMAGE back — WITHOUT inserting it into any document or whiteboard. For acting as a pure diagram generator. Provide diagramType (e.g. 'mermaid', 'd2', 'plantuml', 'graphviz', 'bpmn', 'vegalite'; call listDiagramTypes for the full set) and source (the diagram code). Choose format 'png' (default), 'jpeg', or 'svg'; for raster choose scale 1/2/3 for 1x/2x/3x; optional background (png only). Returns a TEMPORARY signed imageUrl that expires in 1 hour (then auto-deleted), and for png/jpeg the image inline so you can see it. To render a diagram that already lives in a document/whiteboard use getDiagramImage; to persist a new one use insertDiagramInDocument or insertWhiteboardDiagram.

Batch-reorder documents within a folder (or project root) by setting sibling positions. Pass [{documentId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. Position-only update — does not bump version or create a snapshot. To MOVE a document to a different folder, use editDocument({folderId, position}) instead.

Batch-reorder folders within a parent (or project root) by setting sibling positions. Pass [{folderId, position}, ...] where position is a non-negative integer; usually you renumber siblings sequentially as 0, 1, 2…. To MOVE a folder to a different parent and set its position there, use updateFolder({parentId, position}) instead.

Reorder improvement categories by setting sort_order values.

Reorder plan phases by setting position values. WBS codes are recalculated.

Resend a pending invitation: extends expires_at by 7 days and re-triggers the invitation email. Server resolves the organisation_id from the invitation row. Rate limit 6/h per invitation_id. Use when the user asks to resend, re-send, or re-trigger an invitation email — typically because the recipient lost it or the original expired.

Wipe + re-ingest a single document in the KG. Drops chunks/mentions/entities, clears pending lazy-extraction, and enqueues a fresh extract pass. Requires can_manage_kg + document write. Rate limit 30/min.

Revoke a team's workspace access. Idempotent — returns revoked=false if no grant exists.

Check whether Knowledge Graph is in-scope for a given target.

Locate any artefact (document / whiteboard / diagram / plan / task / improvement / compliance) by name or friendly id — AND ranked semantic search over improvements. • CROSS-ARTEFACT FINDER MODE (pass `types`): matches title + friendly id (e.g. "DOC-123", "WBD-9", "PLN-4", "TAS-7", "IMP-2") + description across every artefact type. Returns a typed navigable list ({ artefacts: [{ result_type, id, friendly_id, title, snippet, document_id, project_id, href }] }). This is the tool to use to find an artefact by its name or id — NOT kg_search (which retrieves knowledge from inside content). Pass types:["document","whiteboard","plan","task","improvement","compliance"] (or a subset) to search those types; an empty or all-inclusive list searches everything. • IMPROVEMENT SEMANTIC MODE (omit `types`): hybrid full-text + vector search over improvements only. Returns ranked { improvements }.

Semantic search over the 276 AntV Infographic templates — call this FIRST when building an `infographic` diagram so you pick the right structure for the content. Describe the intent (e.g. 'compare two options', 'show a process timeline', 'pyramid of priorities', 'org hierarchy', 'flow between systems', 'parts of a whole'); results are vector-ranked. Each result has `key` (use as line 1 `infographic <key>`), `name`, `family` (list|sequence|compare|relation|chart|hierarchy|quadrant), and `description`. The result's `usage` explains the family→data-field mapping for writing the DSL.

Search available tools by keyword or category. Returns matching tool names and descriptions.

Set or clear the default BRAND KIT at a scope: organization, workspace, or project. Defaults cascade most-specific-first (a per-board/document override beats project beats workspace beats organization). Pass brandKitId:null to clear. Auth: org owner/admin.

Toggle KG-scope override for a single document (on/off/inherit). Documents default to inheriting their folder/project gate. Requires can_manage_kg + document write. Rate limit 30/min.

Toggle KG-scope override for a folder (on/off/inherit). Folders default to inheriting their project's scope. Requires can_manage_kg + folder write. Rate limit 30/min.

Set the KG visibility mode for a project: 'strict' (multi-source rows hidden unless user can read every source), 'permissive' (one source suffices), or 'open' (any org member). Controls WHO can see the project's KG rows. Requires can_manage_kg + project write. Rate limit 30/min.

Toggle whether a workspace is in the Knowledge Graph (on/off/inherit). 'on' enables the workspace as a gate for indexing its projects; 'off' excludes everything under it; 'inherit' removes the explicit override. No re-ingest happens here. Requires can_manage_kg + workspace write. Rate limit 30/min.

Soft-deactivate or reactivate an organisation member. Refuses self-deactivation, last-admin/owner deactivation, and deactivation of an owner. Rate limit 30/min. Use when the user asks to deactivate, suspend, freeze, reactivate, or unfreeze a member without fully removing them.

Set or clear the WBS parent-child nesting of a task/improvement (outline hierarchy, no scheduling effect). Same plan and phase required. Max depth: 5.

Set a single 3-state override on a permission row: null=inherit, true=allow, false=deny. Per-axis (read/write/delete) and per-kind (documents/improvements/plans), matching the OverrideAccessSection UI. Rate limit 30/min.

Invite the Stable Baseline Meeting Scribe bot to a LIVE meeting (Zoom, Google Meet, Microsoft Teams, or Webex) so it paints a live, editable whiteboard of the conversation as it happens: sticky notes and topic clusters, an agenda that ticks itself off, and decisions and actions pinned to rails, on a real board the team keeps working in afterwards. The bot transcribes only and stores no recording. WHITEBOARD IS REQUIRED: the scribe always paints an existing whiteboard, so documentId (the whiteboard's id) is required. If you do not have a whiteboard id, ASK THE USER which whiteboard to use; do not create one automatically. COST + APPROVAL: it bills 2 credits per minute in 5-minute blocks while it runs (a 60-minute meeting is about 120 credits; hard cap 180 minutes), and it needs the user's explicit approval. Call FIRST without confirm to get the exact quote plus the workspace balance, show that to the user, and only call again with confirm:true once they agree. Available on the Pro and Enterprise plans. It returns immediately with a sessionId; poll getMeetingScribeStatus to watch it join and paint, and stopMeetingScribe to end it. The user can also just remove the bot from the meeting to stop it.

Begin an agent-driven sign-up to Stable Baseline. Anonymous-callable. Returns a `verification_url` and a 6-character `user_code` that the agent must show to the user. The user opens the URL in their browser, signs in or signs up if necessary, enters the code, and clicks Authorize. The agent meanwhile polls `pollSignupStatus({device_code})` every `poll_interval_seconds` until the status changes to `authorized`, at which point it receives an `api_key` it can use for subsequent MCP calls. The whole flow has a 10-minute TTL.

Stop a running meeting scribe: the bot leaves the meeting and the board is finalised (tidy pass plus a summary frame). Give it the sessionId returned by startMeetingScribe. Billing stops at the current block; the user can also stop the scribe simply by removing the bot from the meeting.

3 template + 3 LLM-generated sample questions for the knowledge-graph playground.

Turn a raster image into hand-drawn freedraw strokes on a whiteboard, deterministically. Pass an image (imageUrl OR imageBase64) plus a style; the server fetches and vectorises it server-side and draws the strokes, so you do NOT emit any coordinates yourself (LLMs are poor at that and it wastes tokens). Use this for requests like 'sketch this image onto the board', portraits, or turning a logo into line art. style: 'sketch' (~3 colors, clean line art; default), 'color' (~8 colors), 'poster' (~12 colors). Returns a compact summary (stroke count), never the raw coordinates. Auto-places to the right of existing content unless x/y are given.

Apply a previously previewed KG rebuild. Dispatches the build batch via kg-rebuild and returns batch_id. Rate limit 5/h.

Update the org's billing email. Validates format, writes private.organizations.billing_email, syncs to Stripe customer. Rate limit 30/h.

Update a diagram's code, description, or properties. Call getDiagramTypeGuide for DSL syntax. New diagramCode is COMPILE-CHECKED BY RENDERING at write time — broken DSL is rejected with the renderer's error — and a valid change is re-rendered + re-thumbnailed immediately (response diagram.renderStatus tells you the outcome). Provide a version lock: diagramVersionTimestamp (from getDiagramInDocument, getDocument with includeDiagramDsl:true, or any diagram write's response — PREFERRED: locks just this diagram, so concurrent edits elsewhere in the document don't conflict; bare versionTimestamp is accepted as an alias) OR documentVersionTimestamp (locks the whole document). The response returns BOTH fresh tokens for chaining. Documents carrying a legacy marker (no embedded diagramId) are upgraded automatically on update. IMPORTANT: to change what the diagram visually shows you MUST provide diagramCode with the full updated DSL source — prompt/nlDescription are metadata only. After updating, view it with getDiagramImage and keep prompt/nlDescription in step with what the diagram now shows.

Update a folder (rename/move/reorder). Supports nesting changes via parentId.

Update image metadata (alt, caption, dimensions, alignment). Requires the document's versionTimestamp (from getDocument or any mutating tool's response) for optimistic locking.

Update an improvement (or a task — tasks share this row, but prefer the symmetric updateTask alias when working from getTask). Supports the full field set including `checklist` (tick-boxes with due dates + completion attribution) and `acceptance_criteria` (objects with per-row updated_by/at attribution). Requires versionTimestamp from getImprovement for optimistic locking. Status transitions: blocked needs blocked_comment, rejected needs rejection_comment, done needs completion_comment. Assignment: pass `owner_id=<uuid>` to assign to a user, `owner_team_id=<uuid>` to assign to a team (mutually exclusive — a DB CHECK constraint enforces this). To unassign, pass `owner_id=null` AND `owner_team_id=null`. To switch from a user owner to a team owner, send `owner_id=null, owner_team_id=<uuid>` in the SAME call (sending only one side leaves the stale value and triggers the XOR check). Use listAssignablePrincipals or listTeams to discover valid IDs.

Update an improvement category. Cannot modify system categories.

Update a comment on an improvement. Requires the comment's updated_at as versionTimestamp.

Update an organisation member's role (admin or member). Owners cannot be changed via this tool. Refuses self-promotion. Rate limit 30/min. Use when the user asks to promote someone to admin, demote an admin to member, or change a teammate's role.

Update an organisation's name and/or description. Auth: ceiling — credential must hold `can_admin_org` capability AND user must be org owner/admin. Rate limit 30/min. At least one of name/description required. Returns updated row.

Toggle feature flags on settings.enabledFeatures (plans, improvements, compliance, knowledge_graph, documents). Auth: can_admin_org + org admin. Rate limit 30/min. Plan-tier gated: enabling knowledge_graph requires Pro/Enterprise.

Update an organisation's `settings` JSONB via deep merge. Auth: ceiling — credential must hold can_admin_org AND user must be org owner/admin. Rate limit 30/min. Patches that touch `enabledFeatures` are rejected — use updateOrgFeatureFlags instead.

Update a plan. Requires versionTimestamp from getPlan.

Update a comment on a plan. Requires the comment's updated_at as versionTimestamp.

Update a plan phase. Requires versionTimestamp from getPlanPhase (not getPlan).

Update a user's profile name and/or display email. Self-updates do not require organisation_id; updates to other users require organisation_id and the can_manage_members capability. Self login-email changes must be done via the UI (verification round-trip).

Update a project's name, description, and/or icon. Mirrors the UI Project General Settings page. Auth: admin on the project (cascades from workspace owner/admin and org admin). Partial updates; at least one of name/description/icon must be supplied. Rate limit 60/min.

Update the access level on an existing permission row. Override flags are NOT touched — use setResourcePermissionOverride for those. Refuses self-escalation. Rate limit 30/min.

Update a task. Tasks share a row with improvements (`improvement_items` with `is_task=true`), so this is a thin alias over updateImprovement — every field on updateImprovement is supported, including `checklist`, `acceptance_criteria`, status transitions (blocked/rejected/done need their respective comments), dates, owner, percent_complete, etc. Requires versionTimestamp from getTask for optimistic locking. To edit checklist items: call getTask, modify the `checklist` array (preserving each row's `id` to keep its attribution stamps), and pass the full array back here — array order is the sort order. Assignment: pass `owner_id=<uuid>` to assign to a user, `owner_team_id=<uuid>` to assign to a team (mutually exclusive — the DB enforces with a CHECK constraint). To unassign, pass `owner_id=null` AND `owner_team_id=null`. To switch owner kind, send the new value AND null the old one in the SAME call.

Change the type (FS/SS/FF) or lag/lead of an existing task-dependency. Doesn't move dates directly; flags the successor with `needs_dependency_review=true` and fills `suggested_start_date`/`suggested_end_date` if the change implies a different schedule.

Update a team's name, description, and/or colour. At least one field required. Slug is intentionally not editable. Rate limit 60/min.

Update an existing team's workspace access level. Refuses if no grant exists — call grantTeamWorkspaceAccess first. No-op when level matches.

Update the calling user's preferences. Self-only. Rate limit 60/min. Partial: only fields supplied are updated. notifications upserts a single row; grids upserts per-row keyed by (user_id, project_id, grid_key, view_name).

Edit elements on a whiteboard's canvas WITHOUT dropping the rest of the scene. A board may hold many diagrams/elements, so prefer surgical edits: mode='patch' (DEFAULT) shallow-merges each incoming object into the existing element with the same `id` (send just {id, backgroundColor:'blue'} to recolour one box, or {id, x, y} to move one) and appends any elements whose id is new/absent — everything else is left untouched. `deleteIds` removes specific elements by id. mode='append' only adds. mode='replace' overwrites the ENTIRE scene — to rebuild or edit only PART of a board, still use 'patch', because replace DELETES every element you don't resend (of ANY type). As a safeguard, a replace that would drop ANY existing element not in your payload is REJECTED unless you pass confirmReplace:true (or include those ids); diagrams/images/frames are flagged specially since they're inserted separately and costliest to lose. To author NEW shapes/connectors from a high-level spec, prefer addWhiteboardElements — and prefer library stencils / sticky notes / architecture icons over plain rectangles wherever a standard form fits (sticky notes, kanban/scrum, flowcharts, UML/ER, BPMN, org charts, wireframes). Optional appState/files are merged in. PROCESS: for a non-trivial edit call getWhiteboardGuide FIRST; after editing, ALWAYS call getWhiteboardImage to confirm the board still looks right (layout, labels, overlaps), and patch again if it doesn't.

Update a workspace's name. Auth: standard workspace-write ladder + user must be workspace owner or admin. Slug is intentionally not editable (URL-embedded). Rate limit 60/min.

Change an existing workspace member's role. Caller must be a workspace owner or admin. Cannot self-demote from owner/admin to editor/viewer — transfer the role first.

Insert or update a resource_permissions row for a user OR team on a workspace/project/folder/document/improvement/plan. Refuses self-escalation. Rate limit 30/min. Use when the user asks to give access to, share with, grant access, add a permission, make accessible, or invite someone to a specific workspace/project/folder/document — i.e. resource-level access (not org-level membership; that's inviteMember).

Fetch a community wiki page (LLM-curated CDMD).