MCP tool catalog

Everything a connected assistant can do, and the scope that gates each capability. Setup lives in Connect your AI.

How to read this

Scope(s) — the assistant's key must hold every listed scope or the tool is not even shown to it (tools/list filters by scope; tools/call enforces it again).
read / write / destructive — mirrors the MCP annotations clients use for their permission UI: read = readOnlyHint; destructive = destructiveHint (irreversible: sends, deletes, secret rotation) — a good client confirms these with the user.
Every tool is a thin proxy over the matching REST v2 route — same validation, scopes, audit and webhooks. Deletes are soft (recoverable) but still flagged destructive, because that is how they read to the user.
Mutating tools that support it accept an idempotency_key argument so a retried call cannot double-apply — always pass one when sending email.

Identity & teams

Tool	What it does	Scope(s)
`whoami`	Return the authenticated user and the key/scopes this connection has. The quickest way to confirm the connection works and see what it can do.	none (public)	read
`list_teams`	List the teams (organisations) this connection can act within. A team id is needed to list boards and search CRM contacts.	`boards.read`	read
`get_team`	Get a single team by id.	`boards.read`	read

Boards, lists & custom fields

Tool	What it does	Scope(s)
`list_boards`	List the boards a team owns. Pass team_id from whoami/list_teams.	`boards.read`	read
`get_board`	Get a single board by its opaque id (brd_…).	`boards.read`	read
`list_board_lists`	List a board's task lists (columns). A list id (lst_…) is where you create or move tasks.	`lists.read`	read
`list_board_members`	List a board's active members. Use a member's email as the `assignee` when assigning a task.	`boards.read`	read
`list_board_custom_fields`	List a board's custom fields with their types and (for tag/status/select) option ids — use a field id when setting values with update_task.	`customfields.read`	read
`list_tasks`	List/search tasks. Provide ONE scope: list_id, board_id, thread_id (raw Gmail hex) or contact_id (con_…). Optional filters (board/list scope): q, completed, shade, due_before, due_after, assigned_to (email/name), custom_field_id (+ custom_field_value). Cursor-paginated.	`tasks.read`	read
`create_board`	Create a shared team board.	`boards.write`	write
`update_board`	Rename a board.	`boards.write`	write
`delete_board`	Soft-delete a board (recoverable).	`boards.write`	destructive
`create_list`	Add a task list (column) to a board.	`lists.write`	write
`update_list`	Rename a list.	`lists.write`	write
`delete_list`	Soft-delete a list (recoverable).	`lists.write`	destructive
`create_custom_field`	Create a custom field on a board. Option types (select/status/tag/multiselect) take an `options` list.	`customfields.write`	write
`update_custom_field`	Update a custom field (name, options, display_on_card).	`customfields.write`	write
`delete_custom_field`	Soft-delete a custom field on a board.	`customfields.write`	destructive
`list_companies`	List/search a team's CRM companies. Pass team_id; optional q.	`contacts.read`	read
`list_email_labels`	List the mailbox's Gmail labels (system + user) for building search queries.	`email.metadata.read`	read
`list_email_drafts`	List the Gmail drafts on a thread.	`email.metadata.read`	read
`list_webhooks`	List webhook subscriptions (never the signing secret).	`webhooks.manage`	read
`list_webhook_deliveries`	List a webhook subscription's recent delivery log.	`webhooks.manage`	read

Tasks

Tool	What it does	Scope(s)
`get_task`	Get a single task by its opaque id (tsk_…), incl. colour and custom-field values.	`tasks.read`	read
`create_task`	Create a task on a list. New tasks go to the TOP by default — when adding several in sequence, pass position "bottom" (or anchor each with after_task_id) or the batch ends up in reverse order.	`tasks.write`	write
`create_task_from_email`	Turn an email thread into a task on a list — the API equivalent of dragging the email onto a board. The task title defaults to the email subject; pass `title` only to override it. `notes` and `due_at` work here just as they do on create_task. The thread stays linked to the task, so replies keep landing on it. Use add_thread_to_task to link further emails.	`tasks.write` + `email.metadata.read`	write
`add_thread_to_task`	Link another email thread to an existing task — a task can carry several. Linking a thread that is already on the task does nothing, so this is safe to repeat.	`tasks.write` + `email.metadata.read`	write
`update_task`	Update a task. Set `shade` (colour name, "none" clears) and/or `custom_fields` (array of {field_id, value}; option id(s) for tag/status/select).	`tasks.write`	write
`assign_task`	Assign a task to a board member by email, or pass an empty/omitted assignee to clear it. The email must belong to an active member of the task's board (see list_board_members). Only one assignee is supported.	`tasks.write`	write
`complete_task`	Mark a task complete.	`tasks.write`	write
`reopen_task`	Reopen a completed task.	`tasks.write`	write
`move_task`	Move a task to a DIFFERENT list. To change a task's position within the list it is already on, use reorder_task instead.	`tasks.write`	write
`reorder_task`	Change where a task sits WITHIN its current list — this is how you act on a prioritisation. Pass after_task_id to place it directly below a specific task, or position "top"/"bottom". To impose a whole new order, walk the list front to back and anchor each task to the one that should precede it. The response reports the position the server actually recorded.	`tasks.write`	write
`delete_task`	Soft-delete a task (recoverable; hidden from reads).	`tasks.delete`	destructive

CRM — contacts & companies

Tool	What it does	Scope(s)
`search_contacts`	Search a team's CRM contacts (company-grouped). Pass team_id; optional q, type, stage. Requires the team's Contacts feature.	`contacts.read`	read
`get_contact`	Get a CRM contact by opaque id (con_…).	`contacts.read`	read
`create_contact`	Create a CRM contact. team_id + name required; link a company via company_id or company_name.	`contacts.write`	write
`update_contact`	Update a CRM contact (partial).	`contacts.write`	write
`delete_contact`	Soft-delete a CRM contact.	`contacts.write`	destructive
`get_company`	Get a CRM company by opaque id (cmp_…).	`contacts.read`	read
`create_company`	Create a CRM company. team_id required.	`contacts.write`	write
`update_company`	Update a CRM company (partial).	`contacts.write`	write
`delete_company`	Soft-delete a CRM company.	`contacts.write`	destructive

Email — read & thread state

Tool	What it does	Scope(s)
`get_mailbox`	Report the owner's mailbox connection state (connected / not_connected / reauth_required). Reads no mail.	`email.metadata.read`	read
`search_email_threads`	Search the mailbox with a Gmail query. Provide at least one of q / label / category. Returns thread metadata (no bodies). Cursor-paginated. Gmail only.	`email.metadata.read`	read
`get_email_thread`	Get an email thread by raw Gmail thread id (hex). Set include_messages=true to include message bodies (needs the email.body.read scope).	`email.metadata.read`	read
`set_email_thread_read_state`	Mark a thread read or unread.	`email.metadata.write`	write
`archive_email_thread`	Archive a thread (remove from Inbox).	`email.metadata.write`	write
`unarchive_email_thread`	Unarchive a thread (return to Inbox).	`email.metadata.write`	write
`apply_email_thread_labels`	Add and/or remove Gmail labels on a thread (raw label ids). At least one of add/remove.	`email.metadata.write`	write
`snooze_email_thread`	Snooze a thread until a future time (ISO-8601).	`email.metadata.write`	write

Email — drafts & sending

Tool	What it does	Scope(s)
`create_email_draft`	Create a Gmail draft reply on a thread for a human to review and send (this server never sends mail). Body required; recipients/subject optional (default Re: thread).	`drafts.write`	write
`create_draft`	Create a brand-new Gmail draft (no thread) for a human to review and send. to + subject + body required.	`drafts.write`	write
`send_email_draft`	Send a Gmail draft that already exists (from create_email_draft / create_draft / list_email_drafts). The "approve by sending" pattern: one key prepares the draft, a human or a key holding drafts.send releases it. IRREVERSIBLE — confirm with the user first.	`drafts.send`	destructive
`reply_to_email_thread`	Reply on an existing thread. You control ONLY the body — recipients are derived server-side from the conversation and cannot be supplied, so a reply can never reach anyone not already on the thread. This is the safest send for an agent. mode "reply" = sender only (honouring Reply-To), "reply_all" = keep the To/Cc audience. IRREVERSIBLE — confirm with the user first.	`email.reply`	destructive
`send_email`	Compose and send a NEW email to recipients you specify, from the connected mailbox. Optionally onto an existing thread via thread_id. This is the widest email capability — it can reach anyone — so prefer reply_to_email_thread when replying, or create_draft when a human should review first. IRREVERSIBLE — always confirm the recipients and body with the user before calling.	`email.send`	destructive

AI

Tool	What it does	Scope(s)
`classify_email`	Get Sortd's AI read on an email thread (status / urgency / sentiment / risk). Returns a cached analysis instantly or a job to poll with get_ai_job. Untrusted email content is returned only as structured labels.	`ai.classify`	read
`get_thread_analyses`	Read cached AI analyses for an email thread.	`ai.classify`	read
`get_ai_job`	Poll an async AI classification job by id (job_…) for its status/result.	`ai.classify`	read

Webhooks

Tool	What it does	Scope(s)
`create_webhook`	Subscribe an HTTPS target_url to one or more event types. The response includes the signing secret once.	`webhooks.manage`	write
`update_webhook`	Update a webhook subscription (events, target_url, status active/disabled, filters).	`webhooks.manage`	write
`delete_webhook`	Delete a webhook subscription.	`webhooks.manage`	destructive
`rotate_webhook_secret`	Rotate a webhook signing secret (returns the new secret once). Invalidates the old secret immediately — deliveries will fail signature checks until the new one is deployed.	`webhooks.manage`	destructive
`test_webhook`	Send a test ping to a webhook subscription.	`webhooks.manage`	write
`replay_webhook_delivery`	Replay a previous webhook delivery by id.	`webhooks.manage`	write

Not exposed, on purpose

Zapier helper routes — platform plumbing, not agent tools.
Anything beyond the key's scopes — there is no override; widen the key if the assistant needs more, or mint a second, wider key for a separate connection.

Next: connect a client, or read the send-scope ladder before granting send capability.