AICortex MCP

Health check — confirms the connector is reachable and reports the running version.

Register/update a CalDAV endpoint as DATA (no redeploy). base_url = the calendar home (…/calendars/<user>/) or a single calendar (…/<user>/personal/).

List registered CalDAV endpoints (name — base_url — description).

Takes no parameters.

Remove a registered CalDAV endpoint by name (does NOT touch the server).

Discover the calendars under a registered endpoint (name · href). Use one of the hrefs as the calendar argument for events.

List events in a time range (summary · start · end · uid). calendar = a calendar href from caldav_list_calendars, or empty to use base_url directly.

Create an event (PUTs an iCalendar object). calendar = a calendar href (from caldav_list_calendars). start/end = ISO-8601. STATE-CHANGING — confirm with the user first.

Delete a calendar event by its event href (the last field from caldav_list_events) or a full event URL. STATE-CHANGING — confirm with the user first.

List the workspace (/data/work) or a sub-folder. Shows name · size · type, newest first. path is relative to /data/work (empty = the root).

Read a TEXT file from the workspace (truncated to max_bytes). For binary files use the transfer tools (webdav/sftp/print) instead.

SEE a workspace image or PDF with vision (not OCR). Returns the file as image content the assistant reads directly — scanned pages (scan_document), e-mail attachments (imap_fetch save_attachments), webdav/ftp downloads, print sources. Raster images are downscaled; PDFs are rendered from page…

Write (or append) a TEXT file in the workspace. Creates parent folders.

Move/rename a file or folder within the workspace.

Delete a file or folder in the workspace. STATE-CHANGING — confirm first.

Workspace usage summary, or details for one path (size, modified, type).

Register/update an FTP/FTPS endpoint as DATA (no redeploy).

List configured FTP endpoints (name — host:port — description).

Takes no parameters.

List files at path on a registered FTP endpoint.

Remove a registered FTP endpoint by name.

Upload a file from the NAS (path under /data) to the FTP endpoint.

Register/update an IMAP account as DATA (no redeploy). security: "ssl" (993, default) | "starttls" (143). password_env = NAME of a vault secret with the (app) password. Leave port=0 to use the default for the security mode.

List IMAP accounts (name — user@host).

Takes no parameters.

Remove a registered IMAP account by name.

List messages (newest first): uid · date · from · subject · size. query = a state (unseen | all | recent | seen | flagged | answered) OR free text (matched against Subject/From). Read-only — nothing is marked seen.

Read one message by its uid (from imap_search): headers + text body (truncated). Read-only (BODY.PEEK) — it is NOT marked seen. Set save_attachments=true to write attachments into /data/work — image/PDF attachments can then be viewed with fs_view (vision, not just text).

Register/update an SMTP account as DATA (no redeploy). security:

List SMTP accounts (name — from — host:port).

Takes no parameters.

Remove a registered SMTP account by name.

Send an email via a registered account. to/cc may be comma-separated.

Register/update an MQTT broker or device as DATA (no redeploy).

List configured MQTT brokers (name — host:port — description).

Takes no parameters.

Remove a registered MQTT broker by name.

Publish to a topic on a registered broker. Pass JSON via payload (a dict) OR a raw string via payload_str. STATE-CHANGING for device command topics — confirm with the user before sending commands.

Subscribe to topic and return up to max_messages messages received within timeout_s. Optionally first publish request_payload (dict) to request_topic to trigger a fresh report from devices that report on demand (a common request/report topic pattern).

Register/update a network printer as DATA (no redeploy). host = the printer's LAN IP. Most modern printers expose IPP Everywhere/AirPrint at port 631, path /ipp/print (some use /ipp or /). The IP must be inside INTERNAL_ALLOW_CIDRS or prints are blocked by the network policy.

List registered printers (name — host:port — description).

Takes no parameters.

Remove a registered printer by name.

Print a document on a registered printer via IPP. Provide EITHER file=<path under /data> OR content_base64=<the document bytes, base64> (use this to print something handed to you in chat). document_format defaults to application/pdf (use image/jpeg for photos). STATE-CHANGING / physical output —…

Register/update a network scanner as DATA (no redeploy). host = the device's LAN IP (same as the printer for a multifunction). Leave port=0 / tls="auto" to auto-detect (tries https:443 then http:80, eSCL base /eSCL).

List registered scanners (name — host — description).

Takes no parameters.

Remove a registered scanner by name.

Scan a document via eSCL and save it under /data/work. color: color|gray|bw.

Register/update an SSH host as DATA (no redeploy). Auth via EITHER password_env (name of a vault secret with the password) OR key_env (name of a vault secret holding an unencrypted private key). The host must be inside INTERNAL_ALLOW_CIDRS if it's a private/LAN IP.

List registered SSH hosts (name — user@host:port — description).

Takes no parameters.

Remove a registered SSH host by name.

Run a command on a registered SSH host; returns exit code + stdout/stderr.

Upload a local file (under /data) to the SSH host at remote path dest (SFTP).

Download a remote file (SFTP) from the SSH host into /data/work.

List a remote directory on the SSH host (SFTP).

Register/update a WebDAV endpoint as DATA (no redeploy). base_url = the WebDAV root, e.g. Nextcloud https://<host>/remote.php/dav/files/<user>/ .

List registered WebDAV endpoints (name — base_url — description).

Takes no parameters.

Remove a registered WebDAV endpoint by name (does NOT touch remote files).

List a folder on the endpoint (name · size · type). path is relative to base_url, e.g. "Shared/Reports".

Upload a local file (under /data, e.g. /data/work/scan.pdf) to the endpoint at dest (relative to base_url, e.g. "Shared/Reports/scan.pdf").

Download a file from the endpoint (path relative to base_url) into /data/work. dest = optional filename; defaults to the remote file name.

Create a folder on the endpoint (MKCOL). path relative to base_url.

Delete a file/folder on the endpoint. STATE-CHANGING — confirm first.

Register an INBOUND webhook receiver as DATA. Its public URL is `https://<host>/hooks/<name>`. Configure at least one auth method:

List inbound webhooks (name — path — how it authenticates — notify).

Takes no parameters.

Remove a registered inbound webhook by name.

OUTBOUND — POST json_body to url (a notification/outgoing webhook).

Register/update an upstream MCP server as DATA (no redeploy).

List registered upstream MCP servers (name — url — description).

Takes no parameters.

Remove a registered upstream MCP server by name.

List the tools a registered upstream MCP server exposes (discovery).

Call a tool on a registered upstream MCP server. STATE-CHANGING tools on the remote side — confirm with the user before invoking actions.

Post a message to an agent (or 'user' / 'all'). Append-only.

Read messages addressed to agent (also matches 'all'), newest last.

Mark a message as read/handled by id.

Delete one message by id, or purge all read messages (purge_read=True).

Add a task to the shared board (status=open) for any agent to claim.

List the tasks on the shared agent board — work handed between agents — oldest first, every match (id, status, owner, title). Check it before adding or claiming one (task_add / task_claim via integration_call).

Recommend the best open task(s) for owner to pick up next (then claim with task_claim). Ranking: tasks assigned to you → tasks whose needs match your capabilities → unassigned/unspecific. caps = extra capability tags (your registered agent capabilities are included automatically).

Claim an open task for owner (sets status=claimed). A claim holds for lease_minutes; until then other agents can't take the task over (the same owner may re-claim to extend it). After the lease runs out the task is free again, so a crashed agent can't block it forever.

Hand a task to another agent (or release it: to=""). Sets the new owner, appends a note, and drops the recipient an inbox message with the linked session_id so they can pick up exactly where you left off.

Update a task's status (open/claimed/blocked/done) and/or append a progress note.

Delete a task from the board by id.

Register or refresh an agent (upsert by name); updates last_seen — this IS your presence heartbeat, so call it at the start of every session and whenever you resume. capabilities = comma/space tags used to route tasks (e.g. "mql5, build, vision"). status = a free-text note (e.g. "idle", "busy").

List registered agents with live presence (online/idle/away), online first — so you can see who's available to take work right now. You see your own agents (an admin: everyone's).

Takes no parameters.

Remove one of your agents from the registry by name.

Create/update a scheduled job (stored as DATA on the NAS).

List scheduled jobs (id — schedule — enabled — last run). A non-admin sees only their OWN jobs; an admin sees all.

Takes no parameters.

Delete a scheduled job by name/id. A non-admin may delete only their OWN jobs; an admin may delete any.

For the NAS runner: switch the connector to run AS a job's owner, using the short-lived capability token from cron_due. Every following tool call in this run is scoped + gated as the owner (their memory / vault / services / skills) until act_as_end. Runner/admin only, and not while another act-as…

For the NAS runner: end the current act-as run and INVALIDATE its token (single-use), so the next job runs under the correct identity. Runner/admin;

Takes no parameters.

For the NAS runner: return enabled jobs that are due now, or were due in the last few minutes (a missed tick), and have not run since, as JSON [{id, prompt, notify, owner, act_as_token}]. Run each, then call cron_mark_run(id).

Takes no parameters.

For the runner: mark a job as run this minute (prevents double execution);

What this connector is and how to use it (DE + EN): memory, skills, services, secrets, the confirm-before-actions rule, and the workflow.

Takes no parameters.

Save a durable, TYPED memory and write it back to the brain.

Stage a CANDIDATE memory (not live) for later review — for 'might be worth remembering' facts you're unsure about. It lands in the candidates queue (shown in bootstrap); promote it with memory_promote or drop it with memory_reject. For facts you're sure about, use memory_write directly.

List saved memories in a scope (each line: name — [type] title).

Read a memory's full content and version by its name — find the name with memory_search. An unknown name returns "No memory named …".

Find memories by words (any order); best matches first — a hit in the title counts most, then tags/project, then the text. Returns name, title and a snippet; memory_read gives the full text.

Delete a memory by its name.

List memory candidates awaiting review (auto-captured or staged via memory_note). Promote the keepers (memory_promote), reject the rest (memory_reject) — this is how the brain learns without polluting itself.

Takes no parameters.

Promote a reviewed candidate into live memory (default scope 'shared').

Reject (delete) a memory candidate without promoting it.

List the playbook library: multi-stage workflows (e.g. an AI-native software

Find playbooks whose title, description, stages or guidance match the words of query (best first).

A playbook in full: every stage with goal, artifact, template and approval, the plays and the guidance.

Create or update a playbook. stages = list of {id, name, goal, artifact, template, approval: webui|chat|none, approver} in order; plays (optional) = list of {id, stage, title, requires: [ids]}. A shared playbook is changed only by an admin or its author.

Delete a playbook from the library (admin or its author). Runs keep working.

Start a run of playbook for project. Returns the first stage: its goal, the artifact to write and its template.

Where a run stands and what to do next — one run by id, or the active runs of a project (or all of yours).

List playbook runs (status active, done, cancelled or all).

Submit the current stage's artifact (text, and/or a reference to the repo file and commit or a URL). A stage with approval 'none' moves on; otherwise it waits for the person's decision.

Record the person's own decision given in this conversation — only for a stage whose approval is 'chat'. Never decide on the person's behalf.

Cancel a run (its history is kept).

List the runners you may give a scheduled job to (id — name — kind — on/off).

Takes no parameters.

Store a secret on the NAS, encrypted at rest. Reference it by name as a service's token_env. The value is never shown back. ADMIN-ONLY.

List the NAMES of stored secrets (never the values). A confined user sees only the shared secrets plus the ones in their OWN namespace; an admin sees all (tagged by owner).

Takes no parameters.

Delete a stored secret by name. ADMIN-ONLY. owner = a user's Pocket ID sub to delete from that user's private vault; empty for a shared secret.

Show whether per-user data isolation is active and how many users are configured. Isolation is on whenever AUTH_ENFORCE is on (the default);

Takes no parameters.

Set a user's data area in policy.json (create or update). identity = the person's Pocket ID sub (or a client_id).

Show one user's stored area config and how it resolves. (Admin-only.)

List all users with a configured area + their resolved scope. (Admin-only.)

Takes no parameters.

Remove a user's per-user area override (they revert to the default).

Mint an agent key for identity (a Pocket ID sub / client_id). The same key works as a bearer token on /mcp (Hermes, OpenClaw, Codex, Agents SDK, LM Studio, ...) and on the REST layer (POST /api/v1/tools/<name>). name labels the agent (e.g. "hermes"). The key runs through the SAME authz +…

List API keys — keyid prefix, identity, scopes, expiry, status (NEVER the secret). (Admin-only.)

Takes no parameters.

Revoke (delete) an API key by its keyid (the ak_<keyid> prefix from apikey_list). Takes effect immediately. (Admin-only.)

Call this first in every conversation. Returns a briefing: who the user is and how they want you to work; for project its notes, open tasks and last session (a project with no notes yet says so); for task matching skills and integrations. Without arguments: that profile and the known projects.…

Start-of-conversation briefing, identical to cortex_start: who the user is, how they want you to work and the project's notes, tasks and last session.

Everything registered that you may use: your memories by type, skill categories, services, devices, scheduled jobs, webhooks, agents, the task board and recent sessions. Longer than cortex_start — call it when you need the full picture.

Takes no parameters.

Find a tool beyond the core set — devices, services, files, mail, calendars, printing, scanning, SSH, webhooks, scheduling, playbooks, agents and administration. Returns matches best first, each with its parameters (* = required); no match says so. Run one with integration_call. For how-to…

Run a tool found with integration_search and return its result unchanged — its own errors too; a name you may not call is refused with a pointer to integration_search. Same permissions as calling the tool directly: one that changes or deletes data does so here as well, so confirm such steps as you…

Register/update a callable service (stored as DATA — no redeploy).

List configured services, grouped by category (name — base_url — description).

Takes no parameters.

Remove a registered service by name.

Call a registered service's API. Only configured services can be reached;

Append a checkpoint to a work session so another LLM/device can resume it — for handing over work in progress; durable facts belong in memory_write.

List work sessions (id — title · updated · status · last model), newest first.

Takes no parameters.

Load a session's full checkpoint history. Without an id, loads the most recently updated session — i.e. 'where we left off'.

Delete one of your sessions by id.

Remove sessions not updated within max_age_days (0 = use the configured SESSION_RETENTION_DAYS default). Runs automatically on save/list too. With enforcement on, a non-admin prunes only their own sessions.

Find skills for a task: up to 10 lines "name — description", best first (a word in the name counts most, then description, tags, text); no match says so.

Without a category: list the CATEGORIES with a skill count each (compact, scales to hundreds of skills). With a category: list the skills in it (name — description). Use skill_search to find a skill across all categories.

Load a skill's full instructions (its whole SKILL.md) by name — find the name with skill_search. An unknown name, or a skill outside your allowed set, gets a message saying so.

Read a resource file bundled with a skill.

Create or update a skill: writes <name>/SKILL.md with frontmatter (name, description, category, tags + Markdown instructions).

Delete a skill and its folder by name.