The agent tool families
The Model Context Protocol surface is how an agent, ours or someone else's, reaches the platform. This page is what is on it.
The naming contract
Every tool name is exactly two snake_case segments: family.verb.
^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$
That is enforced at registration rather than documented as a convention. A name that does not match is rejected, and two different families claiming one name is a fail-loud boot error rather than a silent last-one-wins.
Re-registering the same name is idempotent, so a family loaded twice is harmless. Two families disagreeing about who owns a name is not.
The surface is whole, or the cell does not boot
This is the property that makes any count of this surface trustworthy.
Tool families are registered at boot. A mandatory family that fails to import or register is treated as invisible capability loss: failures are aggregated and raised as a single error that aborts boot.
The set of families permitted to be absent is empty. Nothing is optional.
So a running cell either has the whole tool surface or is not running. A partial load that quietly shrinks what an agent can do, which is the failure mode that makes tool counts meaningless elsewhere, is not reachable here.
The families
Grouped by what they reach. Names below are the public capability names; the tool prefix is the lowercase family segment.
Data platform
| Family | Reaches |
|---|---|
| Catalog (read and write) | Catalog assets, two families so read and write authority are separable |
| Database | The database engine surfaces |
| Data | General data operations |
| Lakehouse | Iceberg and Delta tables |
| Structures | The structure engine |
| Ontology | Object, link and action types |
| Graph write-back | Writing through the graph projection |
| Semantic | The semantic layer and federated semantics |
| Ingestion | Bringing data in |
| Data Pipelines | The ETL fabric |
| Functions | User-defined functions |
| Storage | Object storage |
| Messaging | The durable bus |
| Data Exchange | Cross-organization listings |
| Clean rooms | Room-scoped operations |
| Diagrams | Generated diagrams over an estate |
Agents and intelligence
| Family | Reaches |
|---|---|
| Agents | Agent lifecycle and operation |
| Agent Teams | Crews, formations and billets |
| Orchestration and orchestration templates | The workflow graph |
| Scheduled Jobs orchestration | Leased, scheduled work |
| Cognition | Federated cognition |
| Knowledge | Knowledge fusion and canonical entities |
| The Mind | The workspace and node roll-up |
| Model Operations | The ML control plane |
| Algorithm Library | Known methods an agent can reach for |
| Coding | Governed coding runs: submit, status, cancel |
| Compute | Kernels and execution |
| Copilot | The assistant surface |
| Contracts | Entity contracts |
| Governed shell | The permission-gated shell surface |
Security and governance
| Family | Reaches |
|---|---|
| SIEM | Security events |
| SOAR | Response orchestration |
| UEBA | Behaviour analytics |
| Advanced security | The deeper security surface |
| Cyber Operations | The governed assessment surface |
| Surveillance | Observation to canonical entity |
| Audit | The audit planes |
| Activity Ledger | The per-workspace hash-chained record |
| Secrets | The secret substrate |
| Security provisioning | Provisioning security material |
| Directory | Entities, groups and roles |
| Federation | External identity providers |
| Sessions | Session administration |
| Scope | Scope resolution |
| Elections | Entity voting and quorum |
| Worker Policy | Which workers run where |
Estate and operations
| Family | Reaches |
|---|---|
| Estate | Estate-as-code |
| System | Core system operations |
| Fleet | Edge fleet and releases |
| Workspaces and workspace provisioning | Workspace lifecycle |
| Metering | Consumption and cost |
| Disaster recovery | DR policy, drills, failover |
| Discovery & Mapping | Scanning an estate in place |
Mission
| Family | Reaches |
|---|---|
| Tactical | Tactical operations |
| Tactical Communications | Spectrum and radio control plane |
Every call is governed
A tool being on the surface does not mean an agent can call it. Each invocation crosses:
- The agent's own cryptographic allowed-tools ceiling, which is per leased sub-agent, so two agents in one run can hold genuinely different powers.
- The permission gate, whose layers are identical on a cell and on a device. See chat on core and edge for the four layers and the rule that a permissive autonomy mode removes prompts, never possibility.
- The decision gate, for consequential actions.
Schema validation runs on arguments, and a path-segment validator rejects traversal.
Authentication
| Mechanism | Status |
|---|---|
| Session and bearer token | Shipping |
| OAuth 2.1 resource server | Present and off by default. The configuration block is empty unless a deployment populates it |
A token-bucket rate limiter sits in front of the surface.
Resources, not only tools
Alongside tools, the server registers MCP resources, under the same fail-loud discipline: a mandatory resource family that fails to register aborts boot rather than silently reducing what an agent can see.
Enumerate the live set, do not trust a list
This page groups the families so you know the shape of the surface. It is not the authoritative list of tools, and neither is any number written down elsewhere.
The surface is registered at runtime. The correct way to know what a given deployment exposes is to enumerate the registry on that deployment, which is also how the platform's own measured figures are produced. A count harvested from source rather than from a running registry has been wrong before.
What you can rely on structurally: registration is fail-loud and the optional set is empty, so whatever a running cell reports is the whole surface rather than a partial load.
Related
- Tools & MCP, the tool catalog and connector surface in full.
- Chat on core and edge, the permission gate every call crosses.
- Agent skills, the higher-level capability composed over tools.
- Programmatic authentication, credentials for the HTTP surface.