{ "name": "one", "title": "ONE MCP Server", "version": "2.0.0", "description": "ONE remote MCP server. One streamable HTTP route with OAuth sign-in for people and ONE API keys for approved services; every call is authorized against the signed-in identity's live role, board grants, and scopes.", "transport": { "type": "streamable-http", "url": "https://one.geotech.one/api/mcp" }, "alternateTransports": [ { "type": "streamable-http", "url": "https://geotech-crm.web.app/api/mcp", "description": "Permanent Firebase Hosting fallback" } ], "authentication": { "modes": [ { "name": "oauth", "description": "Recommended for people. Sign in with the ONE account; tools and data follow the person's live board viewer/editor grants.", "resourceMetadata": "https://one.geotech.one/.well-known/oauth-protected-resource" }, { "name": "api", "description": "For approved services. Send a permanent ONE API key as Authorization: Bearer ; visible tools follow the key's scopes." } ] }, "resources": { "humanDocs": "https://one.geotech.one/docs/api", "openapi": "https://one.geotech.one/openapi/geocrm.json", "agentIndex": "https://one.geotech.one/llms.txt" }, "usagePolicy": { "branding": [ "When the user intentionally requests the connected organization's branding, call get_brand_standards before producing or substantially revising decks, product or website design, interfaces, documents, reports, charts, diagrams, campaigns, email, social posts, or other visual work.", "Treat the returned standard as authoritative: start from approved artwork or templates, use its exact colour and typography values, preserve clear space and contrast, and never redraw, recolour, crop, stretch, distort, rotate, or rebuild the organization's mark.", "For decks, social posts, websites, one-pagers, product UI, and internal documents, follow the returned designSystem foundations, workflow, visual language, and guardrails rather than relying on remembered organization-specific rules.", "Use only the ONE/Firebase-hosted asset URLs returned by get_brand_standards; never substitute external file links for brand assets.", "Review the finished work at its actual delivery size before sharing or publishing it." ], "documents": [ "Connect a Documents / e-signature API key to the remote MCP route.", "Create or select the agreement, add recipients and actions, configure routing/message/reminders/expiration, place fields, then send only after reviewing the returned draft.", "Documents are uploaded as base64 payloads; document bytes are stored privately and signing links are never returned by internal list tools." ], "financeCategorization": [ "Create a Finance categorization only API key, connect it to the remote MCP route, and run with GPT-5.6 Sol, GPT-5.6 Terra, or OpenRouter Kimi K3.", "Start a run, classify only from the supplied compact context and taxonomy IDs, and submit structured votes without chain-of-thought.", "Every per-transaction UI exclusion, full bank records, and unrelated ONE records must never be supplied to the model.", "A human Manual Decision always wins. Unreviewed AI decisions never become retrieval examples; human-confirmed decisions do." ], "financeForecast": [ "Use finance_get_cash_forecast before discussing runway, low-cash dates, or category drivers; quote its as-of date, reporting currency, scope, scenario, and data-quality warnings.", "Cash plans are separate from booked transactions. Use a stable idempotency key when creating one and the latest updatedAt value when updating or archiving it.", "Future Flow numbers come only from dated Finance cash events, issued Accounts Receivable, and approved Accounts Payable. Historical category statistics are descriptive only, and pending Accounts Payable is non-cash exposure until approved. Never describe the outlook as an AI prediction or guaranteed outcome." ], "financeAccountScreenshots": [ "Use a finance:write or write-capable API key.", "Pass a direct ING account, ING credit-card, or Wise image to upload_account_balance_screenshot; optional as_of_date overrides a date visible in the screenshot or today's UTC date.", "Gemini extracts visible balances, but account matching and writes remain deterministic. ING investment Belegd/Gelddeel values are stored together as invested and available-cash components, and only available cash enters the cash forecast. For credit cards, only Current balance is accepted (including zero); available credit, limits, and statement values are rejected, and displayed debt is normalized as negative. Aggregate, ordinary zero, low-confidence, and ambiguous rows are skipped, and the raw screenshot is never stored." ], "financeAccountBalances": [ "Use finance_record_account_balance for a trusted dated amount without uploading an image.", "Supply integer minor-unit strings. Investment accounts require invested_value_minor plus available_cash_minor to equal balance_minor; only available cash enters Flow.", "API-key calls require finance:write or write. OAuth calls require crm.write and recheck the signed-in user's current Finance editor access on every write.", "The bounded valuation-only write preserves unrelated Finance data and does not load or reconcile the full transaction history." ], "financeInvestmentPortfolios": [ "Use finance_record_investment_portfolio only with values reconciled to broker evidence: positions plus other items equal invested value, and invested value plus available cash equals the total account balance.", "Label purchase and sale costs as disclosed, estimated, or not supplied. Never present an estimated sale cost as a broker quote.", "Flow includes only available brokerage cash. Purchase costs already reflected in the current cash/cost basis are not deducted twice; fund costs reduce NAV; optional estimated ING service costs may be forecast as cash spending." ], "developerTasks": [ "Work on a task only when a human assigns it to the virtual Codex assignee and shares the task link with you; assignment is manual pickup, there is no worker queue.", "Call get_task_context first. Before changing code, inspect every image with get_task_image, retrieve and analyze every video in full with get_task_video (including audio when present), and read every PDF or text document with get_task_attachment.", "Reload task context before each feedback iteration and pass the current revision to writes.", "Add one concise result and verification comment, set Review, and leave Done to a human reviewer.", "Use a Developer tasks only or self-service personal agent key connected to the remote MCP route for local agent development.", "For an interactive project-tracker import or calendar edit, prefer OAuth with current project editor or manager access. Project editors and managers may import any status currently configured on the target board, while every request remains limited by the caller's live ONE grants.", "When OAuth app registration is unavailable, a time-limited Member MCP key may use the same remote route and live ONE permissions. For an approved unattended import, use an exact-project service key; new tracker import keys receive tasks:read, tasks:create, tasks:milestones:write, and tasks:import_status together.", "Privacy-safe calendar sources use tasks:read and a non-empty exact allowedProjects entry. New tracker keys include tasks:calendar:write; grant that scope separately to other unattended service keys and add tasks:calendar:delete only when deletion is required.", "Use the least-privilege discovery tools, then call list_project_tasks, which automatically includes the revision-bound tracking context for exact-project tracker service keys. Read the complete context before writing, inspect import_records_total and import_records_truncated because the safe ledger is capped at 500 returned records, use resolve_project_people for input-level missing and ambiguous name diagnostics, reuse immutable import and update keys on retries, restart task pagination after a revision conflict, and never use generic mutation tools to bypass import safeguards.", "Use update_project_tasks for revision-bound exact-project task transitions that preserve comments, attachments, and hidden work-link metadata. This narrow tasks:create capability does not require tasks:import_status; leave unresolved assignees null and retain their requested names in Details.", "Personal focus is self-service: set_my_focus can select only a non-Done task assigned to the calling person, personal keys remain bound to their owner, and no service or project-tracker key can nominate focus for another person.", "Project calendar REST and MCP surfaces list overlapping milestone/event ranges and expose privacy-safe approved time-off sources as read-only overlays. Calendar details are limited to 2,000 characters and color values to 20 characters. Calendar mutations require the current project revision plus a stable idempotency key; destructive deletion additionally requires exact current-title confirmation and the separately granted tasks:calendar:delete service scope.", "Tracker discovery, People resolution, strict imports, updates, milestone upsert, and calendar operations enforce current project roles for OAuth and exact project allowlists for service keys on both MCP and REST routes." ], "logs": [ "Use GET /api/logs or the list_logs MCP tool to inspect recent app, LLM, connector, and system diagnostics before guessing at failures.", "Log history is retained for seven days and can be filtered by level, category, connector, source, time range, and text query.", "Do not write secrets, live tokens, private keys, session cookies, or credential-bearing snippets to diagnostic logs." ], "slackBot": [ "Slack users interact with the ONE app by DMing the app or mentioning it in natural language.", "Thread-to-task automation is natural language: ask ONE to turn the current conversation into project tasks or refresh tasks already linked to the thread.", "Preview task changes first, refresh the preview after human replies, and publish only the latest version after a thread participant approves through a trusted button, an explicit @one approve task command, or an enabled white_check_mark reaction.", "Persist summaries, operations, participant IDs, hashes, and Slack permalinks only; do not persist raw Slack transcripts or attachment bytes.", "Slack agents should resolve intent from chat and call ONE API or MCP tools internally for add, delete, edit, remove, search, and update requests.", "For bridge execution, prefer npm run bridge on the remote bridge host so the Codex bridge supervises the Slack bot, reuses the Codex chat bridge token, exposes status/log controls, and restarts the bot when it exits while enabled." ] }, "security": { "notes": [ "Do not place live API keys in public docs, source control, issue trackers, or agent thread records.", "Store GEOCRM_API_KEY in a local client config, password manager, or secret store.", "Revoke and rotate keys from the ONE admin drawer when access should change." ] }, "tools": [ { "name": "geocrm_health", "title": "Check ONE connection", "family": "core", "description": "Verify the remote ONE MCP connection and show the signed-in account without returning secrets.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_current_user", "title": "Get current ONE user", "family": "core", "description": "Show the signed-in ONE identity and the boards and access levels currently granted to that person.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_personal_workspace", "title": "Get Personal Workspace", "family": "core", "description": "Return the signed-in person's ONE profile, company links and calendar, ONE-calculated time-off balances and audited history, assigned hardware, request history, and lead approvals. The calendar includes approved, accepted, completed, scheduled, recorded, and taken absences from canonical or imported request fields while excluding pending, rejected, and accrual rows. Owners/admins also receive time-off administration state. Data is limited to the current identity and direct reports.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_time_off_administration", "title": "Get Time-Off Administration", "family": "operations", "description": "List ONE-managed PTO and sick-time policy settings, employee assignments, balances, and the most recent automatic accrual run. Requires ONE owner or admin access.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_person_time_off_history", "title": "Get Person Time-Off History", "family": "operations", "description": "Return one employee's complete chronological time-off ledger, including accruals, requests, carryover losses, adjustments, balances, and policy events with current balances and category totals. Requires ONE owner or admin access.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "update_time_off_policy", "title": "Update Time-Off Policy", "family": "operations", "description": "Update future ONE-managed PTO or sick-time accrual settings while preserving existing audit history. Requires ONE owner or admin access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "set_person_time_off_policy", "title": "Set Person Time-Off Policy", "family": "operations", "description": "Assign, change the start date, or remove a person's ONE-managed PTO or sick-time policy with an audit reason. Requires ONE owner or admin access.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "adjust_person_time_off_balance", "title": "Adjust Person Time-Off Balance", "family": "operations", "description": "Set a person's PTO or sick-time balance on an effective date and record the amount, date, administrator, and required reason in the ONE ledger. Requires ONE owner or admin access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "run_time_off_accruals", "title": "Run Time-Off Accruals", "family": "operations", "description": "Run the idempotent ONE PTO and sick-time accrual engine through a date. Imported BambooHR Vacation/Holiday and Sick Leave balances continue under their matching ONE policy, while unpaid leave never accrues. The normal scheduler runs daily; this owner/admin action supports review and recovery.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_brand_standards", "title": "Get GeoTech brand standards", "family": "core", "description": "Return the authoritative GeoTech logo, colour, typography, pattern, asset, and digital design-system guidance. Call this before decks, reports, websites, documents, diagrams, charts, product design, or other visual work.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_decks", "title": "List ONE decks", "family": "decks", "description": "List draft and published ONE client decks with revisions, access state, and publication timestamps. Requires Decks view access (direct or permission-group), owner/administrator access, or an authorized service key.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "migrate_decision_decks", "title": "Move legacy reports into Decks", "family": "decks", "description": "Idempotently copy the signed-in owner's legacy decision reports and their history into private deck revisions. Preserves source boards and owner-only access; never publishes a password or makes reports public.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_deck", "title": "Get a ONE deck", "family": "decks", "description": "Read one ONE deck draft and its current immutable publication metadata before editing or publishing it.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "save_deck_draft", "title": "Create or update a ONE deck draft", "family": "decks", "description": "Create or replace a structured branded deck draft without a Git checkout or Hosting deployment. On updates, pass the exact expected_revision returned by get_deck.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "set_deck_access", "title": "Set optional ONE deck passcode", "family": "decks", "description": "Choose public access or create a short-lived setup link where the user enters a passcode privately. The MCP tool never accepts or returns a raw passcode.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "upload_deck_asset", "title": "Upload a private ONE deck asset", "family": "decks", "description": "Upload one JPEG, PNG, WebP, or MP4 asset to private ONE storage. Reference the returned asset ID from a media, markup, or visual-PDF page; public bytes are served only through the deck access boundary.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "publish_deck", "title": "Publish a ONE deck", "family": "decks", "description": "Publish the exact current draft as an immutable revision, snapshot the current ONE brand contract, and generate its synchronized branded PDF. Pass the exact expected_revision from get_deck.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_deck", "title": "Delete a ONE deck", "family": "decks", "description": "After explicit confirmation, remove a deck from the library and disable its shared link. Content, assets, and revisions remain stored for recovery. Pass the exact title, draft revision, and updatedAt from get_deck. Repeating a confirmed deletion is safe; deleted slugs cannot be reused.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "unpublish_deck", "title": "Unpublish a ONE deck", "family": "decks", "description": "Remove a deck from its public route without deleting its draft, assets, or immutable revision history.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "list_boards", "title": "List ONE boards", "family": "boards", "description": "List only the ONE boards the signed-in person is currently allowed to read. Owners/admins also receive the structural directory revision and complete reorderable board ID sequence required by structure mutations.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_board", "title": "Get a ONE board", "family": "boards", "description": "Get metadata, columns, groups, item count, position, and structural concurrency revision for one board the signed-in person can read.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_board", "title": "Create a ONE board", "family": "boards", "description": "Create a standard public ONE board with the Table-only default structure. Requires a ONE owner/admin and the current directory revision returned by list_boards.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "rename_board", "title": "Rename a ONE board", "family": "boards", "description": "Rename one non-protected public board. Requires a ONE owner/admin and the exact board revision returned by get_board.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "reorder_boards", "title": "Reorder ONE boards", "family": "boards", "description": "Preview or apply the complete board order. This tool previews by default; after review, call again with dry_run false and the same current directory revision. Requires a ONE owner/admin.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_remote_machines", "title": "List Remote Machines", "family": "boards", "description": "List Remote Machines with live status, sessions, hardware temperatures, storage, network addresses, and booking conflicts.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_remote_machine", "title": "Get Remote Machine", "family": "boards", "description": "Get one Remote Machine with telemetry, temperatures, storage, network details, CPU history, and bookings.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "set_remote_machine_color", "title": "Set Remote Machine Color", "family": "boards", "description": "Set the shared scheduler color for one visible Remote Machine and all of its server-resolved aliases. Requires a signed-in ONE owner or administrator; API keys are never accepted.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "archive_remote_machine", "title": "Archive Remote Machine", "family": "boards", "description": "Hide one Remote Machine and its server-resolved aliases, clearing live presence, sessions, events, metrics, and bookings. This does not uninstall OneClient. Requires the exact current machine name as confirmation and a signed-in ONE owner or administrator; API keys are never accepted.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "list_remote_machine_bookings", "title": "List Remote Machine Bookings", "family": "boards", "description": "List Remote Machines scheduler bookings, optionally filtered by machine, time window, status, or current booking owner.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_remote_machine_booking", "title": "Create Remote Machine Booking", "family": "boards", "description": "Book an available Remote Machine. Conflicting windows are rejected and idempotency keys make Slack or agent retries safe.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_remote_machine_booking", "title": "Update Remote Machine Booking", "family": "boards", "description": "Reschedule or edit a Remote Machines booking owned by the signed-in person or integration. Administrators may update any booking.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "cancel_remote_machine_booking", "title": "Cancel Remote Machine Booking", "family": "boards", "description": "Cancel a Remote Machines booking owned by the signed-in person or integration without deleting its audit record. Administrators may cancel any booking.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_administration_audit", "title": "Get ONE Administration Audit", "family": "operations", "description": "Return a read-only owner/admin audit of access users, permission groups, materialized board and project grants, invitations, bootstrap administrators, and API-key metadata. Hashes, reusable secrets, bridge settings, and connector tokens are omitted. API keys are never accepted.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_overview", "title": "Get Finance overview", "family": "finance", "description": "Read the protected Finance overview, including account, transaction, import, category, currency, reconciliation, and review summaries.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_project_summary", "title": "Get project Finance summaries", "family": "finance", "description": "Read compact project cost and income aggregates in exact rational currency minor units and fixed EUR minor units. Requires Finance and board/project access. Returns 503 while the verified derived index is unavailable; does not fall back to the full ledger.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_project_entries", "title": "List project Finance entries", "family": "finance", "description": "Read up to 100 project allocation details with categories and a revision. Continue with nextCursor and restart if the revision changes. Requires Finance and board/project access.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_rebuild_project_summaries", "title": "Rebuild project Finance summaries", "family": "finance", "description": "Owner-only maintenance of derived project summaries. Defaults to a read-only dry run. Applying requires apply=true, confirm=REBUILD PROJECT FINANCE SUMMARIES and the exact source_digest from a fresh reviewed dry run. Holds the Finance mutation lock, rejects changed source, and preserves canonical transactions and decisions.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_get_cash_forecast", "title": "Get Finance cash flow", "family": "finance", "description": "Read the protected deterministic 13-week, 12-month, or custom monthly Finance Flow forecast, including balances, scenarios, Accounts Receivable payments, approved Accounts Payable cash outflows, A/P exposure awaiting approval, drivers, plans, FX provenance, and quality warnings. Pending A/P is visible but excluded from forecast cash until approved.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_accounts", "title": "List Finance accounts", "family": "finance", "description": "Read protected Finance account definitions, calculated account summaries, and recent valuations.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_transactions", "title": "List Finance transactions", "family": "finance", "description": "Read a bounded protected Finance transaction view with filters, manual decisions, evidence counts, and Fin Results matches.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_imports", "title": "List Finance imports", "family": "finance", "description": "Read the protected Finance import registry with source names, parsers, accounts, row outcomes, warnings, and import dates. Source hashes are omitted.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_import_statements", "title": "Import Finance statements", "family": "finance", "description": "Import up to 20 supported CSV statements or Dutch ING Portefeuilleoverzicht PDFs into Finance. ING investment PDFs and CSVs update the same dated holdings and balance, preserve available cash and cost disclosures, and deduplicate across formats and renamed downloads. Payment imports reconcile overlapping rows one-for-one, preserve genuine repeated charges, and add only missing transactions. Raw statement bytes are not retained.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_get_statement_import", "title": "Read a normalized Finance statement import", "family": "finance", "description": "Return the normalized CSV representation of one imported statement as embedded MCP resource content. This is reconstructed from canonical ledger data; ONE does not expose or retain the raw uploaded statement.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_clear_statement_imports", "title": "Clear all imported Finance statements", "family": "finance", "description": "Permanently remove every statement import, imported transaction, statement valuation, and related decision while preserving configured accounts and manual valuations. First read the current Finance overview and pass its exact counts, updated time, and generated confirmation phrase.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_update_transaction_decision", "title": "Update a Finance transaction decision", "family": "finance", "description": "Create, change, or clear the manual classification, category, allocation, and note for one Finance transaction. Pass the current decided_at value, or an empty string when no decision exists. The stored provenance records that a signed-in person approved an MCP-assisted change.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_transaction_decisions", "title": "Update Finance transaction decisions in bulk", "family": "finance", "description": "Apply one classification/category/allocation decision to up to 200 Finance transactions. Each target carries its current decided_at value so a stale batch cannot overwrite a newer decision. Provenance records a signed-in person's MCP-assisted approval.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_list_transaction_comments", "title": "List Finance transaction comments", "family": "finance", "description": "Read the private discussion on one Finance transaction. Comments are available only to signed-in ONE people and are never exposed to API keys.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_add_transaction_comment", "title": "Add a Finance transaction comment", "family": "finance", "description": "Add a private comment to one Finance transaction. Mention IDs must match active People records named in the text. Available only to signed-in ONE people.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_transaction_comment", "title": "Update a Finance transaction comment", "family": "finance", "description": "Edit a private Finance comment as its author or the ONE owner. Supply the comment's current updated_at, or its created_at when it has never been edited.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_transaction_comment", "title": "Delete a Finance transaction comment", "family": "finance", "description": "Permanently remove one private Finance comment as its author or the ONE owner. The transaction and every other comment are preserved. Confirm the exact comment ID and current updated time.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_list_invoices", "title": "List Accounts Receivable invoices", "family": "finance", "description": "Search, filter, sort, and page protected ONE Accounts Receivable invoice drafts and issued, paid, or void invoices.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_invoice", "title": "Get Accounts Receivable invoice", "family": "finance", "description": "Read one complete protected Accounts Receivable invoice with its audit history and payment-match candidates.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_create_invoice", "title": "Create Accounts Receivable invoice draft", "family": "finance", "description": "Create an editable customer-invoice draft in ONE Accounts Receivable.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_invoice", "title": "Update Accounts Receivable invoice draft", "family": "finance", "description": "Change an unissued customer-invoice draft in ONE Accounts Receivable. Supply the invoice's current revision; an issued invoice is immutable and must be corrected through its own revision or void flow.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_duplicate_invoice_to_draft", "title": "Duplicate Accounts Receivable invoice into draft", "family": "finance", "description": "Copy any Accounts Receivable invoice into a new editable draft with a newly reserved sequential invoice number. The source invoice remains unchanged and its number is never reused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_transition_invoice", "title": "Move an Accounts Receivable invoice", "family": "finance", "description": "Run one Accounts Receivable state change: issue reserves the next sequential number and renders the retained immutable PDF, match links an exact incoming bank transaction, unmatch reverses a match with a reason, and paid records a manual payment without a bank receipt. Always supply the invoice's current revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_void_invoice", "title": "Void an Accounts Receivable invoice", "family": "finance", "description": "Void an unpaid issued customer invoice with a recorded reason. The invoice number stays reserved and is never reused, and an already sent or paid invoice is refused because it needs a compliant correction document.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_get_invoices_aging", "title": "Get Accounts Receivable aging", "family": "finance", "description": "Read the Accounts Receivable aging summary for issued unpaid customer invoices, bucketed as current, 1-30, 31-60, and 60+ days overdue per currency and per customer.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_rematch_invoices", "title": "Rematch Accounts Receivable invoices", "family": "finance", "description": "Re-run deterministic incoming-payment matching for every issued unmatched customer invoice. Only an exact unambiguous amount, currency, and direction match is linked; everything else is returned as candidates for a person to decide.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_get_invoice_pdf", "title": "Read an Accounts Receivable invoice PDF", "family": "finance", "description": "Return one customer-invoice PDF as embedded MCP resource content. With no revision this serves the current issued document, or an unnumbered draft preview for a draft; a revision returns that retained immutable revision instead. Documents over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_bills", "title": "List Accounts Payable bills", "family": "finance", "description": "Search, filter, sort, and page protected ONE Accounts Payable supplier bills with status counts.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_bill", "title": "Get Accounts Payable bill", "family": "finance", "description": "Read one complete protected Accounts Payable bill with its audit history and, for an open bill, its exact outgoing bank-transaction match candidates.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_bill_source_file", "title": "Read an Accounts Payable bill source file", "family": "finance", "description": "Return the private uploaded invoice that created one Accounts Payable bill as embedded MCP resource content. Bills without uploaded evidence return not found; files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_bills_aging", "title": "Get Accounts Payable aging", "family": "finance", "description": "Read the Accounts Payable aging summary for approved unpaid supplier bills, bucketed as current, 1-30, 31-60, and 60+ days overdue per currency and per vendor. Bills still awaiting approval are reported separately as pending exposure.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_create_bill", "title": "Create Accounts Payable bill", "family": "finance", "description": "Record a supplier bill in ONE Accounts Payable, including signed line-item credits and optional people, projects, hours, rates, and work allocations. The bill always starts in needs_review: it becomes payable and enters committed cash forecasting only after a person approves it. A repeated vendor and invoice number is refused as a duplicate.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_bill", "title": "Update Accounts Payable bill", "family": "finance", "description": "Change a review or approved Accounts Payable bill, including signed line-item credits and work allocations. For a paid bill created from an uploaded invoice, set work_metadata_only to correct its supplier name, issue date, due date, line people, printed projects, hours, and allocations; invoice number, descriptions, financial values, payment match, lifecycle state, and source evidence remain immutable. Supply the bill's current revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_transition_bill", "title": "Move an Accounts Payable bill", "family": "finance", "description": "Run one Accounts Payable approval change: approve makes a reviewed bill payable and committed in the cash forecast, unapprove returns an unmatched approved bill to review, reject closes a bill in review, and cancel closes an unmatched bill. Unapprove, reject, and cancel require a reason, and every action needs the bill's current revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_bulk_approve_bills", "title": "Approve Accounts Payable bills", "family": "finance", "description": "Approve up to 100 reviewed Accounts Payable bills in one audited operation. Each bill needs its own current revision, and per-bill failures are reported without stopping the rest.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_match_bill", "title": "Match an Accounts Payable payment", "family": "finance", "description": "Link one approved Accounts Payable bill to the exact outgoing Finance transaction that paid it. The amount, currency, and outgoing direction must match exactly, and internal transfers or already linked transactions are refused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_unmatch_bill", "title": "Unmatch an Accounts Payable payment", "family": "finance", "description": "Reverse a paid Accounts Payable match with a recorded reason. The bill returns to approved and the Finance transaction is released, while the full audit history is kept.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_rematch_bills", "title": "Rematch Accounts Payable bills", "family": "finance", "description": "Re-run deterministic outgoing-payment matching for every approved unmatched supplier bill. Only an exact unambiguous amount, currency, and direction match is linked; everything else is returned as candidates for a person to decide.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_bill", "title": "Delete an Accounts Payable bill", "family": "finance", "description": "Permanently delete an unmatched Accounts Payable bill that is in review, rejected, or cancelled, and release its duplicate reservation. An approved bill must be unapproved first, and a paid bill is always retained. A linked source receipt scan is preserved.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_list_drive_accounts", "title": "Get the session Google account for Finance Drive export", "family": "finance", "description": "Return Drive export readiness for the Google account that exactly matches the signed-in ONE identity. The account is not selectable.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_list_drive_exports", "title": "List Finance Drive exports", "family": "finance", "description": "List durable monthly Google Drive export jobs, including queued, running, completed, partial, and failed status. Optionally filter by month.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_drive_export", "title": "Get Finance Drive export status", "family": "finance", "description": "Read progress, counts, warnings, errors, and protected Google Drive completion links for one Finance export job.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_create_drive_export", "title": "Queue a monthly Finance Drive export", "family": "finance", "description": "Queue an immutable monthly export beneath an existing writable My Drive or Shared Drive folder. Returns immediately; poll finance_get_drive_export until complete or partial. Existing Drive content is never moved, deleted, or overwritten.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_get_overview", "title": "Get Accounting & Tax overview", "family": "finance", "description": "Read the owner-only Dutch BV tax overview, obligations, company debts, DGA controls, and BV lending facilities with interest and repayment calculations.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "accounting_tax_create_loan", "title": "Create a BV lending record", "family": "finance", "description": "Create an audited UBO, employee, external-person, or external-company loan in Accounting & Tax. Amounts are integer euro cents and interest is basis points.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_loan", "title": "Update a BV lending record", "family": "finance", "description": "Update audited loan terms or review metadata. Read the current record first and pass its expected revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_delete_loan", "title": "Delete a BV lending record", "family": "finance", "description": "Remove an active BV lending record from Accounting & Tax after reading it and supplying its exact borrower and revision. The archived record, movement history, deleting actor, and audit event remain preserved.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "accounting_tax_record_loan_movement", "title": "Record a BV loan movement", "family": "finance", "description": "Record an audited drawdown, principal repayment, interest charge, or interest payment. A drawdown may explicitly extend the agreed facility.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_signature_requests", "title": "List signature requests", "family": "documents", "description": "List protected Documents agreements with document counts and recipient routing, delivery, and completion status.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_signature_request", "title": "Get signature request", "family": "documents", "description": "Read one protected Documents agreement with documents, recipients, fields, options, and history, without private signing tokens.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "refresh_signature_request", "title": "Refresh signature request", "family": "documents", "description": "Re-read one protected Documents agreement and its current delivery, routing, and completion state without exposing private signing tokens.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_signature_request_file", "title": "Read signature request file", "family": "documents", "description": "Return one protected original source document, a PDF combining every source document, or the completed signed PDF as embedded MCP resource content. Source files default to the first document unless document_id is provided. Files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_revise_invoice", "title": "Revise an Accounts Receivable invoice", "family": "finance", "description": "Create a new retained PDF revision of an unpaid issued invoice that has never been sent. Supply the current ledger revision. Sent invoices are immutable and require a compliant correction document.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_send_invoice", "title": "Send an Accounts Receivable invoice", "family": "finance", "description": "Email the current immutable PDF of an issued unpaid invoice through ONE's connected Gmail account. Supply the current revision, an idempotency key, and confirm the exact combined To and CC recipients. A sent invoice becomes immutable.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_invoice_draft", "title": "Delete an Accounts Receivable invoice draft", "family": "finance", "description": "Permanently delete one unissued Accounts Receivable draft. Issued, sent, paid, and void invoices are retained. Supply the current revision and confirm the exact invoice ID.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_get_invoice_settings", "title": "Get Accounts Receivable invoice settings", "family": "finance", "description": "Read ONE's invoice issuer, numbering, and redacted payment-destination settings. Available only to the signed-in ONE owner; full bank account identifiers are never returned over MCP.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_update_invoice_settings", "title": "Update Accounts Receivable invoice settings", "family": "finance", "description": "Change ONE's legal issuer, bank destination, and sequential-number settings. Available only to the signed-in ONE owner. Confirm the exact issuer legal name; the response redacts full bank identifiers.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_get_account_payment_details", "title": "Get Finance account payment details", "family": "finance", "description": "Read a Finance account's payment destination with the IBAN or account number masked. Full bank account identifiers are never returned over MCP.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_update_account_payment_details", "title": "Update Finance account payment details", "family": "finance", "description": "Change the invoice payment destination for one operating Finance account. Available only to the signed-in ONE owner. Confirm the exact account ID; the response returns only a redacted bank identifier.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_get_market_quotes", "title": "Get Finance market quotes", "family": "finance", "description": "Retrieve bounded current quote snapshots for up to 20 ISINs used by Finance investment records. Each result reports availability and source provenance; unsupported instruments return unavailable rather than guessed prices.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_retrieval_settings", "title": "Get Finance categorization retrieval settings", "family": "finance", "description": "Read the semantic-retrieval thresholds, defaults, valid limits, and embedding index metadata used by Finance categorization.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_update_retrieval_settings", "title": "Update Finance categorization retrieval settings", "family": "finance", "description": "Change the bounded semantic-retrieval thresholds used by Finance categorization. A signed-in person must be the ONE owner; an API integration needs the exact finance:apply scope.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_signature_templates", "title": "List signature templates", "family": "documents", "description": "Read protected reusable Documents agreement templates with documents, roles, fields, messages, and options.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_hardware_inventory", "title": "List Hardware inventory", "family": "operations", "description": "Read protected Hardware assets, custody, status, costs, procurement links, and document counts from the canonical People inventory.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_hardware_asset", "title": "Get Hardware asset", "family": "operations", "description": "Read one protected Hardware asset with custody history, movements, procurement metadata, and safe document metadata.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_hardware_asset", "title": "Create Hardware asset", "family": "operations", "description": "Add a canonical Hardware inventory asset with an audited initial custodian. Requires Hardware edit access for the signed-in ONE user.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_hardware_asset", "title": "Update Hardware asset", "family": "operations", "description": "Update descriptive, acquisition, cost, or procurement fields on one Hardware asset. Custody changes use move_hardware_asset. Supply the current asset revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "move_hardware_asset", "title": "Move Hardware asset", "family": "operations", "description": "Move one Hardware asset to a person, office, or unassigned custody while appending an immutable audit movement. Requires the current revision and an idempotency key.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "archive_hardware_asset", "title": "Archive Hardware asset", "family": "operations", "description": "Archive one Hardware asset, release its current custody, and append an audit movement. Requires the current revision and exact asset-ID confirmation.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_hardware_documents", "title": "List Hardware documents", "family": "operations", "description": "List safe metadata for the private PDFs and images attached to one Hardware asset. Storage paths and download tokens are never returned.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_hardware_document", "title": "Read Hardware document", "family": "operations", "description": "Return one private Hardware PDF or image as an embedded MCP resource after checksum validation. Files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "upload_hardware_document", "title": "Upload Hardware document", "family": "operations", "description": "Upload one base64 PDF, JPEG, PNG, or WebP file to a Hardware asset in private ONE storage. The response contains safe metadata only.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_hardware_document", "title": "Delete Hardware document", "family": "operations", "description": "Permanently delete one private Hardware document. Requires the current document revision and exact file-name confirmation.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_people_documents", "title": "List People documents", "family": "operations", "description": "List safe metadata for private person-record or company-link documents. Requires the signed-in person's explicit People Documents grant; storage paths and download tokens are never returned. For person documents provide item_id and column_id.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_people_document", "title": "Read People document", "family": "operations", "description": "Return one private person-record or company-link document as an embedded MCP resource. Requires an explicit People Documents grant; files over 10 MB are refused. For person documents provide item_id and column_id.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "upload_people_document", "title": "Upload People document", "family": "operations", "description": "Atomically upload one private document and append it to a person-record or company-link folder. Requires signed-in People Documents edit access. For person documents provide item_id and column_id.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_people_document", "title": "Delete People document", "family": "operations", "description": "Permanently remove one private person-record or company-link document from both its record and ONE storage. Requires the current revision and exact file-name confirmation.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_procurement_requests", "title": "List Procurement requests", "family": "operations", "description": "List protected Procurement requests visible to the signed-in requester, approver, watcher, owner, or admin.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_procurement_request", "title": "Get Procurement request", "family": "operations", "description": "Read one protected Procurement request with its approval chain, comments, lifecycle, and safe attachment metadata when visible to the signed-in person.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_procurement_category", "title": "Create Procurement category", "family": "operations", "description": "Add one Procurement category. Requires a signed-in ONE owner or administrator with Procurement edit access; API keys are not accepted.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_procurement_request", "title": "Create Procurement request", "family": "operations", "description": "Create a Procurement request with an ordered People-board approval chain and optional initial comment. A stable idempotency key prevents duplicate requests and duplicate notification delivery. Hardware requests also require equipment and destination fields.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_procurement_request", "title": "Update Procurement request", "family": "operations", "description": "Replace the editable details of a visible Procurement request and reset its approval chain. Supply the exact updated_at returned by get_procurement_request; stale writes are refused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_procurement_request", "title": "Delete Procurement request", "family": "operations", "description": "Permanently delete an eligible Procurement request and its managed attachment objects. Requires the current updated_at and exact current request title; lifecycle and role rules are rechecked server-side.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "add_procurement_approvers", "title": "Add Procurement approvers", "family": "operations", "description": "Append active People-board members to an awaiting Procurement approval chain. Requires requester/admin authority and the current request updated_at.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "add_procurement_comment", "title": "Add Procurement comment", "family": "operations", "description": "Add an idempotent comment to a visible Procurement request and optionally mention active People-board members. Requires the current request updated_at.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_procurement_comment", "title": "Update Procurement comment", "family": "operations", "description": "Edit the signed-in person's own Procurement comment using the current request updated_at.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_procurement_comment", "title": "Delete Procurement comment", "family": "operations", "description": "Delete the signed-in person's own Procurement comment after matching the current request updated_at and exact current comment text.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "decide_procurement_request", "title": "Decide Procurement request", "family": "operations", "description": "Approve, reject, or request changes as the current approver. Requires a fresh request updated_at and an idempotency key; ONE advances the approval chain and records the decision audit.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_procurement_hardware_lifecycle", "title": "Update Procurement Hardware lifecycle", "family": "operations", "description": "After approval, update a Hardware request status or Office/Person destination and synchronize the protected Hardware inventory. ONE's named hardware-manager rule and current request updated_at are enforced.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_procurement_attachment", "title": "Read Procurement attachment", "family": "operations", "description": "Return one private Procurement attachment as an embedded MCP resource after request visibility and checksum checks. Files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "upload_procurement_attachment", "title": "Upload Procurement attachment", "family": "operations", "description": "Upload one private base64 attachment up to 8 MB to a visible Procurement request. The current request updated_at and a stable idempotency key prevent stale or duplicate writes.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_procurement_attachment", "title": "Delete Procurement attachment", "family": "operations", "description": "Delete a private Procurement attachment as its uploader or a ONE owner/administrator. Requires the current request updated_at and exact current attachment name.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "list_board_items", "title": "List ONE board items", "family": "boards", "description": "List items on one permitted board with optional text filtering and a bounded result count.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "search_items", "title": "Search ONE items", "family": "boards", "description": "Search one permitted board directly or use the bounded compact index across visible boards. Pass nextCursor back as cursor for another cross-board page.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_item", "title": "Get a ONE item", "family": "boards", "description": "Get one item, including visible fields, revision-bound updates, assets, subitems, and the item concurrency revision, from a permitted board.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_item_file", "title": "Read a private ONE item file", "family": "boards", "description": "Fetch one authenticated file from a permitted board item and return embedded MCP resource content plus filename, media type, byte size, SHA-256 checksum, source, and revision metadata. Files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "import_item_file_from_google_drive", "title": "Import a Google Drive file into ONE", "family": "boards", "description": "Copy a Google Drive or Google Docs file into private ONE-managed Firebase Storage and append it to an existing board item's file column. Google Workspace documents are exported to a durable PDF or Office file. Needs a session-bound Google Drive authorization.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_item_file", "title": "Delete a private ONE item file", "family": "boards", "description": "Permanently delete one ONE-managed file from a board item and remove its private Firebase / Google Cloud object. Requires current board edit access.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "create_item", "title": "Create a ONE item", "family": "boards", "description": "Create an item on a board where the signed-in person has edit access. Use existing column IDs or titles in fields. To create one Backlog task inside a project, pass group_id as project:; task subtasks may be supplied in fields.subtasks, details in fields.details, and note becomes the task comment.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_project_tasks", "title": "Create ONE project tasks", "family": "tasks", "description": "Create one or more Backlog tasks, with optional fields and one level of subtasks, inside an existing ONE project where the signed-in person has edit access. Exact-project tracker service keys instead submit typed, revision-bound tracker imports with immutable retry-safe import keys, enforced identically to the REST route.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "import_project_tasks", "title": "Import ONE project tasks", "family": "tasks", "description": "Import typed project tracker tasks using a fresh project revision and immutable retry-safe import keys. Project editors and managers may use any task status currently configured on the project.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_project_source_control", "title": "Update ONE project source control", "family": "tasks", "description": "Replace or clear the one GitHub or Perforce configuration used for project-to-work inference. This internal, person-bound configuration write requires a fresh project revision; credentials and webhook secrets are never accepted.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "manage_project_status", "title": "Manage ONE project task statuses", "family": "tasks", "description": "Create, rename, or delete one task-status column for a project. Renames move matching tasks; deletes require the exact status name and an existing fallback. Every action requires the current project revision.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "manage_project_sprint", "title": "Manage ONE project sprints", "family": "tasks", "description": "Create, update, finish, or delete a project sprint with task migration and a current project revision. Finish/delete require the exact sprint name; unfinished tasks move to the specified sprint or Backlog.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "decide_task_automation_suggestion", "title": "Decide a ONE task automation suggestion", "family": "tasks", "description": "Accept or reject one pending source-link suggestion as a signed-in project editor. A fresh task revision prevents decisions against changed task context.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "undo_task_automation", "title": "Undo ONE task automation", "family": "tasks", "description": "Restore only fields still owned by the last automation run; human-edited fields are skipped. Requires a signed-in project editor and the current task revision.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "edit_project_task_comment", "title": "Edit a ONE project task comment", "family": "tasks", "description": "Edit a task comment as its author or a ONE owner/administrator. Requires both the current task revision and the comment's current updated time.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_project_task_comment", "title": "Delete a ONE project task comment", "family": "tasks", "description": "Delete a task comment as its author or a ONE owner/administrator. Requires current task/comment versions and the exact current comment text; managed attachment objects are removed too.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "delete_project_task_attachment", "title": "Delete a ONE project task attachment", "family": "tasks", "description": "Delete one description or comment attachment as its uploader or a ONE owner/administrator. Requires the current task revision and exact attachment name; managed Storage data is removed.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "delete_project_task", "title": "Delete a ONE project task", "family": "tasks", "description": "Soft-delete one project task after matching its current revision and exact current title. Managed task and comment attachment objects are removed while deletion audit metadata is retained.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "update_project_tasks", "title": "Update ONE Project Tracker Tasks", "family": "tasks", "description": "Atomically replace the exact tracker-managed fields of 1-12 existing project tasks. Requires the current project revision and a new immutable retry-safe update import key per task; exact replays are safe, changed replays and stale new writes return conflicts. Supply subtask_id when renaming an existing subtask so its stable identity and server-managed metadata are preserved; ambiguous remove-and-add replacements return conflicts. Comments, attachments, hidden work-link metadata, and other server-managed fields are preserved.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_item", "title": "Update a ONE item", "family": "boards", "description": "Update an item name or field values on a board where the signed-in person has edit access. To update a task inside a project, pass item_id as project:/task:.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "add_item_update", "title": "Add a ONE item update", "family": "boards", "description": "Add a comment or update note to an item on a board where the signed-in person has edit access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "move_board_items", "title": "Move ONE board items", "family": "boards", "description": "Preview or move matching items to another group on a board where the signed-in person has edit access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_item", "title": "Delete a ONE item", "family": "boards", "description": "Soft-delete one item after the caller supplies the exact current item name as confirmation.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "get_task_context", "title": "Get ONE Developer Task Context", "family": "tasks", "description": "Resolve a canonical ONE task URL, including /boards/{board}/trackers/{project}?task={task}, and return all task text, fields, comments, attachment metadata with authenticated retrieval paths, image-only metadata, and a concurrency revision. Before implementing the task, call get_task_image for every image, get_task_video for every video, and get_task_attachment for every PDF or text document.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_task_image", "title": "View ONE Task Image", "family": "tasks", "description": "Fetch one authenticated parent-task or subtask image and return it as visual MCP content.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_task_video", "title": "Read ONE Task Video", "family": "tasks", "description": "Fetch one authenticated parent-task or subtask MP4, MOV, or WebM video directly from a canonical ONE task URL or explicit IDs and return it as embedded MCP resource content. Inspect and analyze the full visual sequence and audio when present before implementing the task; do not rely only on metadata or a thumbnail, and do not fall back to computer-use or browser UI for retrieval.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_task_attachment", "title": "Read ONE Task Document", "family": "tasks", "description": "Fetch one authenticated parent-task or subtask PDF or UTF-8 text document and return it as embedded MCP resource content.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "add_task_attachment", "title": "Attach ONE Task Document", "family": "tasks", "description": "Upload one PDF or UTF-8 text document to a parent task and return safe attachment metadata. Provide the document as text or base64 data; use an idempotency key for safe retries.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "add_task_comment", "title": "Add ONE Developer Task Comment", "family": "tasks", "description": "Add one concise agent-attributed comment to a nested task in ONE. Include what changed and verification performed. Use an idempotency key for safe retries.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_task_subtask", "title": "Get ONE Developer Subtask", "family": "tasks", "description": "Read one subtask of a nested ONE task, including its fields, revision, comments, and attachments.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "update_task_subtask", "title": "Update ONE Developer Subtask", "family": "tasks", "description": "Update one subtask's name, fields, or details. Use expected_revision for optimistic concurrency. Agents cannot mark a subtask Done; a human reviewer owns completion.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "add_task_subtask_comment", "title": "Add ONE Developer Subtask Comment", "family": "tasks", "description": "Add one concise agent-attributed comment to a subtask. Include what changed and verification performed. Use an idempotency key for safe retries.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "set_task_review_state", "title": "Set ONE Developer Task Review State", "family": "tasks", "description": "Move a nested task to In Progress or Review. Agents cannot mark tasks Done; a human reviewer owns completion.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_project_task", "title": "Update ONE Project Task", "family": "tasks", "description": "Update a project task with revision safety; details and comments are appended and human-edited fields are preserved.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_project_tasks", "title": "List ONE Project Tasks", "family": "tasks", "description": "List the tasks of one ONE project with optional text, Slack-link, people, and pagination filters. Exact-project tracker service keys automatically receive the revision-bound tracking context (project revision, import ledger, milestones, completeness flags); inspect import_records_total and import_records_truncated before reconciling.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_app_info", "title": "Get ONE App Info", "family": "core", "description": "Return canonical ONE app URLs, API/docs links, and short answer hints. Use this for questions like what is the ONE website, web page, login URL, API URL, or docs page.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_logs", "title": "List ONE Diagnostic Logs", "family": "operations", "description": "List recent app, LLM, connector, and system diagnostic logs from the short-lived ONE log history with time, level, category, connector, source, and text filters.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "write_log", "title": "Write ONE Diagnostic Log", "family": "operations", "description": "Write one concise app, LLM, connector, or system diagnostic log entry. Never log secrets, tokens, or credential material.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "upsert_contact", "title": "Upsert ONE Contact", "family": "boards", "description": "Create or update a Contacts record by email/name and link it to an existing or newly created Companies record.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "find_contact_duplicates", "title": "Find ONE Contact Duplicates", "family": "boards", "description": "Find likely duplicate Contacts records by exact and similar names or shared emails.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "merge_contact_duplicates", "title": "Merge ONE Contact Duplicates", "family": "boards", "description": "Merge duplicate Contacts records into one primary record, preserving secondary emails and merged-candidate history. Supports dry runs.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "find_board_item_duplicates", "title": "Find ONE Board Item Duplicates", "family": "boards", "description": "Find likely duplicate records on one board by exact and similar names.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "merge_board_item_duplicates", "title": "Merge ONE Board Item Duplicates", "family": "boards", "description": "Merge duplicate records on one board into a primary record with merged-candidate history. Supports dry runs.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "ensure_board_column", "title": "Ensure ONE Board Column", "family": "boards", "description": "Return an existing board column or create it when it does not exist. Requires a ONE owner/admin and the exact board revision returned by get_board.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "rename_board_column", "title": "Rename ONE Board Column", "family": "boards", "description": "Rename one non-protected stored board column and synchronize its embedded item-cell labels. Requires a ONE owner/admin and the exact board revision returned by get_board.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "archive_board_column", "title": "Archive ONE Board Column", "family": "boards", "description": "Archive a non-core board column while preserving item cell data. Requires a ONE owner/admin, the exact board revision returned by get_board, and the exact current column title as confirm_title.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "delete_board", "title": "Delete ONE Board", "family": "boards", "description": "Soft-delete one non-protected board into the recoverable deleted-boards archive. Requires a ONE owner/admin, the exact board revision returned by get_board, and the exact current board name as confirmation.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "set_item_file_field", "title": "Set ONE Item File Field", "family": "boards", "description": "Set a legacy non-Drive external file or image link on an item in ONE. Google Drive URLs are rejected; use import_item_file_from_google_drive to retain business documents privately in ONE.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_slack_channel_project", "title": "Get Slack Channel Project Mapping", "family": "tasks", "description": "Return the ONE project mapped to a Slack workspace/channel pair.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "set_slack_channel_project", "title": "Set Slack Channel Project Mapping", "family": "tasks", "description": "Associate a Slack workspace/channel pair with one project board in ONE for later task commands.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_slack_task_proposals", "title": "List Slack Task Proposals", "family": "tasks", "description": "List persisted Slack task previews by workspace, channel, thread, or status.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_slack_task_proposal", "title": "Create Slack Task Proposal", "family": "tasks", "description": "Persist a summary-only, versioned Slack task proposal without storing the raw transcript.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "refresh_slack_task_proposal", "title": "Refresh Slack Task Proposal", "family": "tasks", "description": "Replace a pending proposal preview with a new version after a thread reply or revision, or supersede it when its target was deleted. The proposal must include its current positive-integer expectedVersion.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "approve_slack_task_proposal", "title": "Approve Slack Task Proposal", "family": "tasks", "description": "Apply one exact proposal version after validating participant approval and the current thread snapshot hash.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "cancel_slack_task_proposal", "title": "Cancel Slack Task Proposal", "family": "tasks", "description": "Cancel one exact visible proposal version without changing ONE tasks after validating the trusted Slack message binding and requester-or-owner authorization.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_task_project_boards", "title": "List ONE Task Project Boards", "family": "tasks", "description": "List the project boards the signed-in credential may use for task work.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_task_projects", "title": "List ONE Task Projects", "family": "tasks", "description": "List the projects of one permitted task project board.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_task_project", "title": "Get ONE Task Project", "family": "tasks", "description": "Get one permitted task project with its compact tracking metadata.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_project_calendar", "title": "Get ONE Project Calendar", "family": "tasks", "description": "List milestones and durable calendar events whose inclusive date ranges overlap the requested range.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_project_calendar_sources", "title": "List ONE Project Calendar Sources", "family": "tasks", "description": "List privacy-safe, roster-scoped People time-off and company events that can be surfaced on a project calendar.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "create_project_calendar_item", "title": "Create ONE Project Calendar Item", "family": "tasks", "description": "Create one revision-bound milestone or durable calendar event. Put the action-specific item_type and fields in item. Details are limited to 2,000 characters and color to 20 characters. A source_key copies the current approved safe source as an independent snapshot.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_project_calendar_item", "title": "Update ONE Project Calendar Item", "family": "tasks", "description": "Rename, move, resize, or otherwise update one stable revision-bound project calendar item. Put item_type and at least one action-specific mutable field in item. Details are limited to 2,000 characters and color to 20 characters.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_project_calendar_item", "title": "Delete ONE Project Calendar Item", "family": "tasks", "description": "Permanently delete one stable project calendar item after exact current-title confirmation. Milestone deletion also clears matching task and subtask milestone fields.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "resolve_project_people", "title": "Resolve ONE Project People", "family": "tasks", "description": "Reconcile the exact requested People names for one permitted project. Returns one result for every input occurrence plus exact requested, matched, no-match, and multiple-match counts. No ID is returned unless exactly one active People record matches.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "upsert_project_milestones", "title": "Upsert ONE Project Milestones", "family": "tasks", "description": "Add revision-bound project tracker milestones with immutable retry-safe import keys.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "upload_item_file", "title": "Upload a File to a ONE Item", "family": "boards", "description": "Upload a PDF, image, Office, CSV, JSON, text, or ZIP document into private ONE-managed Firebase Storage and append it to an item file column. Supply the file as base64 data. Requires current board edit access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_signature_request", "title": "Create signature request", "family": "documents", "description": "Create a draft ONE agreement from 1-10 base64 PDF, PNG, JPEG, or WebP documents. Adds signing and copy recipients, routing, message, reminders, expiration, recipient download access, and the opt-in AI assistant; call prepare_signature_request before sending.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_signature_request_from_template", "title": "Create signature request from template", "family": "documents", "description": "Create a draft agreement from a stored Documents template by filling each recipient role in template order.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "edit_item_update", "title": "Edit a ONE item update", "family": "boards", "description": "Edit a general item comment/update using the exact update revision returned by get_item. Only the original author or a ONE owner/admin may edit it.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_item_update", "title": "Delete a ONE item update", "family": "boards", "description": "Delete a general item comment/update using its exact revision and exact current text as confirmation. Only the original author or a ONE owner/admin may delete it.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "duplicate_item", "title": "Duplicate a ONE item", "family": "boards", "description": "Duplicate one current board item with a new identity and cleared update history. Requires the exact item revision returned by get_item. Private ONE-managed file references are deliberately skipped so the copy never depends on the source item's protected file paths.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_signature_request", "title": "Update signature request draft", "family": "documents", "description": "Update a draft agreement's name, recipients, routing, subject, message, reminders, expiration, recipient download access, or opt-in AI assistant. Read the request first and pass its updatedAt value for optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "add_signature_document", "title": "Add signature document", "family": "documents", "description": "Add one base64 PDF, PNG, JPEG, or WebP document to a draft agreement. Read the request first and pass its updatedAt value for optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "remove_signature_document", "title": "Remove signature document", "family": "documents", "description": "Permanently remove one document and its placed fields from a draft agreement. The agreement must retain at least one document. Requires the current status, updatedAt value, and exact file-name confirmation.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "prepare_signature_request", "title": "Place signature fields", "family": "documents", "description": "Save placed fields on a draft agreement. Every signing recipient needs a signature field before send_signature_request.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "save_signature_template", "title": "Save signature template", "family": "documents", "description": "Save a prepared draft's documents, recipient roles, fields, message, and delivery options as a reusable Documents template.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_signature_template", "title": "Delete signature template", "family": "documents", "description": "Permanently delete one reusable Documents template and its private document copies. Requires the template's current updatedAt value and exact name confirmation.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "delete_signature_request", "title": "Delete signature request", "family": "documents", "description": "Permanently delete a draft or terminal agreement and its private files. Live sent or delivered agreements must be voided first. Requires current status, updatedAt, and exact agreement-name confirmation.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "send_signature_request", "title": "Send signature request", "family": "documents", "description": "Send a prepared draft using its parallel or sequential routing order. Private signing links are emailed only to the active routing group. Requires Documents send access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "resend_signature_request", "title": "Resend a signature link", "family": "documents", "description": "Resend one live agreement recipient's private signing email. The previous link is rotated and invalidated. Requires Documents send access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "void_signature_request", "title": "Void signature request", "family": "documents", "description": "Void a live agreement and invalidate every private signing link. Requires Documents send access.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "upload_receipt_scan", "title": "Upload Receipt Scan", "family": "finance", "description": "Upload a base64 receipt or invoice document (JPEG, PNG, WebP, GIF, AVIF, BMP, TIFF, HEIC, or PDF, up to 20 MB) for AI recognition and Finance transaction matching. Returns the scan status, extraction, matched transaction, and candidates.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_receipt_scans", "title": "List Receipt Scans", "family": "finance", "description": "List the 50 most recent receipt scans with status, extraction summaries, matched transactions, and duplicate flags.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "attach_receipt_scan", "title": "Attach Receipt Scan", "family": "finance", "description": "Manually attach an unmatched receipt scan to a chosen Finance transaction as pending evidence that a person must still verify.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "reprocess_receipt_scan", "title": "Reprocess Receipt Scan", "family": "finance", "description": "Re-run AI recognition and transaction matching on a retained unmatched or error receipt scan. Attached scans are refused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_transaction_from_scan", "title": "Create Transaction From Receipt Scan", "family": "finance", "description": "Create a canonical Finance transaction from an unmatched scan's extraction and attach the scan as pending evidence. When the account cannot be resolved the response returns the account list so a follow-up call can pass account_id.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_remap_receipt_scans", "title": "Rematch Unmatched Receipt Scans", "family": "finance", "description": "Re-run deterministic transaction matching for every still-unmatched receipt scan, reusing each stored extraction without calling recognition again. Only a unique confident match attaches; scans with an incomplete extraction are skipped for an explicit retry.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_purge_receipt_scans", "title": "Purge Failed Receipt Scans", "family": "finance", "description": "Permanently delete every receipt scan with the given status and its retained file. Only failed and unmatched scans can be purged; processing, matched, and attached scans are never removed. First count the matching scans, then pass that exact count and the confirmation phrase PURGE RECEIPT SCANS.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_list_receipt_email_accounts", "title": "List Receipt Mailbox Accounts", "family": "finance", "description": "List the connected Google accounts whose mailboxes can be scanned for receipts and invoices. Mailbox access requires a signed-in ONE user; API keys are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_scan_receipt_email", "title": "Scan A Mailbox For Receipts", "family": "finance", "description": "Import likely receipt and invoice attachments from one connected Gmail account over an inclusive date range of at most 92 days. Each batch is bounded; continue with the returned next_message_offset and next_candidate_offset until complete is true. Mailbox access requires a signed-in ONE user; API keys are refused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_create_category", "title": "Create A Finance Category", "family": "finance", "description": "Create a Finance category. The name must be unique among active categories. Category changes require a signed-in ONE user with Finance edit access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_category", "title": "Update A Finance Category", "family": "finance", "description": "Rename a Finance category or change its default classification and project mode. Saving an archived category restores it.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_category", "title": "Delete A Finance Category", "family": "finance", "description": "Archive a Finance category and every subcategory under it. Existing transactions, decisions, and their recorded category names are preserved; the category simply stops being available for new assignments.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_create_subcategory", "title": "Create A Finance Subcategory", "family": "finance", "description": "Create a subcategory under an active Finance category. The name must be unique within that category.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_subcategory", "title": "Update A Finance Subcategory", "family": "finance", "description": "Rename a Finance subcategory or change its default classification. Saving an archived subcategory restores it.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_subcategory", "title": "Delete A Finance Subcategory", "family": "finance", "description": "Archive one Finance subcategory. Existing transactions and decisions keep the category names they recorded; the subcategory simply stops being available for new assignments.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_preview_fin_results", "title": "Preview A Fin Results Import", "family": "finance", "description": "Parse a Fin Results CSV (up to 2 MB and 5,000 rows) and report how its rows match existing Finance transactions and categories. Nothing is stored.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_import_fin_results", "title": "Import Fin Results", "family": "finance", "description": "Store a Fin Results CSV import and its matched rows. Imports are content-addressed, so re-importing identical bytes returns the existing record instead of duplicating it.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_review_fin_results_match", "title": "Confirm A Fin Results Match", "family": "finance", "description": "Confirm or withdraw the imported Fin Results category for one transaction. Confirming records a human-approved decision and refreshes its vector memory; only a safe mapping can be confirmed.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_list_transaction_evidence", "title": "List Transaction Evidence", "family": "finance", "description": "List the private evidence files attached to one Finance transaction, newest first, with their type, size, checksum, uploader, and human-verification state.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_transaction_evidence", "title": "Read One Transaction Evidence File", "family": "finance", "description": "Return one private evidence file as embedded MCP resource content. TIFF and HEIF images are converted to JPEG unless preview is false; files over 10 MB are refused.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_upload_transaction_evidence", "title": "Upload Transaction Evidence", "family": "finance", "description": "Attach a base64 PDF, JPEG, PNG, WebP, TIFF, or HEIF file (up to 20 MB, 20 files per transaction) as private evidence. The content type is verified from the bytes. Repeating an idempotency key with the same bytes reuses the stored record; the same key with different bytes is refused.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_delete_transaction_evidence", "title": "Delete Transaction Evidence", "family": "finance", "description": "Permanently delete one evidence file, its stored object, and any receipt scan that produced it. The transaction, its decisions, its import history, and its other evidence are preserved.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_verify_transaction_evidence", "title": "Verify Transaction Evidence", "family": "finance", "description": "Mark one pending evidence record as human-verified and stamp who verified it. A linked receipt scan is updated to match.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_export_journal_csv", "title": "Export The Finance Journal CSV", "family": "finance", "description": "Return the bounded accounting journal export as CSV resource content. The range is limited to 24 months and 50,000 rows, amounts stay in their recorded currencies, and every cell is protected against spreadsheet formula injection.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_record_valuation", "title": "Record A Manual Account Valuation", "family": "finance", "description": "Record a dated manual valuation for one Finance account in integer minor units. The currency must match the account, and repeating the same account, date, and currency updates that valuation instead of adding another.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_record_balance", "title": "Record A Manual Account Balance", "family": "finance", "description": "Record a dated manual balance for one Finance account in integer minor units. Investment accounts may split the total into invested value plus available cash, which must add up exactly to the balance.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_reconcile", "title": "Reconcile Finance Transactions", "family": "finance", "description": "Recompute internal transfer matching, effective classifications, open reconciliation reviews, and account summaries from the stored transactions. No transaction, decision, or evidence record is removed.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_record_investment_cash", "title": "Record available investment cash", "family": "finance", "description": "Record the absolute uninvested cash balance as of a date in integer minor units. Preserves the latest holdings on or before that date and updates total balance and liquid Flow cash. Repeating the same account/date/amount is idempotent; corrections retain balance history. This does not create income, a contribution, or a trade.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_time_off_request", "title": "Create Time-Off Request", "family": "operations", "description": "File a time-off request for the signed-in person. The range must contain at least one working day. Returns the updated personal workspace. Only a signed-in user or that person's own personal agent key can use this.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_time_off_request", "title": "Update Time-Off Request", "family": "operations", "description": "Change the signed-in person's own pending time-off request. A request that has already been approved or denied cannot be changed.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "cancel_time_off_request", "title": "Cancel Time-Off Request", "family": "operations", "description": "Withdraw the signed-in person's own pending time-off request. A request that has already been approved or denied cannot be cancelled here.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "update_personal_profile", "title": "Update Personal Profile", "family": "operations", "description": "Update the signed-in person's own personal contact details, address, and emergency contact on their People record. Work email, name, job title, and department are not editable here.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_hardware_request", "title": "Create Hardware Request", "family": "operations", "description": "File a personal hardware request for the signed-in person. The request is routed to the approval chain that matches its amount and notifies the approvers.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "decide_direct_report_time_off", "title": "Decide Direct-Report Time Off", "family": "operations", "description": "Approve or deny a pending time-off request belonging to one of the signed-in person's own direct reports. Anyone who is not that person's team lead is refused.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "get_cloud_costs_summary", "title": "Get Cloud Costs Summary", "family": "operations", "description": "Read the protected Cloud Costs dashboard for one month: Google billing and OpenRouter spend, daily totals, top drivers, provider health, and recommendations. Refresh bypasses the cache and needs Cloud Costs edit access.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "upload_account_balance_screenshot", "title": "Upload Account Balance Screenshot", "family": "finance", "description": "Upload one base64 ING account, ING credit-card, or Wise screenshot for recognition, deterministic account matching, and automatic dated balance updates. Converted aggregate totals and ambiguous rows are skipped, and the raw screenshot is never stored.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "delete_finance_transactions", "title": "Delete Finance Transactions", "family": "finance", "description": "Delete guarded Finance transactions by ID (1-200 per call). Rows with evidence, transfer matches, or Fin Results links are always skipped with a reason; a saved Manual Decision blocks deletion unless force is true, which also removes the decision record and its vector-memory links.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "create_backup", "title": "Create ONE Backup", "family": "operations", "description": "Queue a protected compact or full ONE backup and return the queued job. Poll get_backup_job until it completes. Compact omits bulky table attachments; full preserves every protected JSON root.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_backup_job", "title": "Get ONE Backup Job", "family": "operations", "description": "Return the current state and completed backup metadata for a job created by this credential.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "list_backups", "title": "List ONE Backups", "family": "operations", "description": "List newest-first safe metadata for protected ONE backup snapshots without returning workspace or data-root payloads. Use the opaque nextCursor to continue. Requires a backup-read credential or a signed-in owner.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_backup_metadata", "title": "Get ONE Backup Metadata", "family": "operations", "description": "Return safe metadata, coverage statistics, content policy, and protected root names for one saved backup without returning its workspace or data-root payloads.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "export_backup", "title": "Export ONE Backup", "family": "operations", "description": "Download one saved backup as an application/json MCP resource using the same ONE import-compatible envelope as the Backups panel. This sensitive data export is visible only to a signed-in ONE owner and is limited to 10 MiB over MCP; larger snapshots must be downloaded in ONE.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_get_categorization_context", "title": "Get Finance Categorization Context", "family": "finance", "description": "Retrieve privacy-minimized Finance targets, valid taxonomy IDs, deterministic history votes, and similar human-approved examples. Rows checked Exclude from AI and rows that already have a decision are removed from the target context. Omit month to work through all transactions in batches.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_start_categorization_run", "title": "Start Finance Categorization Run", "family": "finance", "description": "Create an audited, idempotent categorization run for the selected approved model and return its bounded retrieval context. Classify each target using only the supplied taxonomy and examples, then submit structured votes.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_submit_ai_decisions", "title": "Submit Finance AI Decisions", "family": "finance", "description": "Submit schema-constrained category votes from a categorization run. ONE validates model identity, target and version hashes, taxonomy IDs, current exclusions, and existing decisions. Unless the run is dry-run, eligible votes fill Manual Decision with AI provenance and stay excluded from training until a person confirms them.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_review_ai_decision", "title": "Review Finance AI Decision", "family": "finance", "description": "Mark an AI-filled Finance category correct or incorrect, or add and remove the same per-transaction Exclude from AI gate the ONE UI uses. Excluding removes that transaction's derived vector memory; re-including queues a fresh replacement when the decision is human-approved.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_get_vector_memory_stats", "title": "Get Finance Vector Memory Stats", "family": "finance", "description": "Return the active Finance embedding namespace, model, dimensions, vector count, and latest sync or reset status.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "finance_clear_vector_memory", "title": "Clear Finance Vector Memory", "family": "finance", "description": "Permanently remove every generated Finance embedding vector and decision-vector link while preserving transactions, categories, decisions, imports, and reset audit history. Requires the exact destructive confirmation phrase.", "scopes": [ "crm.write" ], "readOnly": false, "destructive": true }, { "name": "finance_sync_vector_memory", "title": "Sync Finance Vector Memory", "family": "finance", "description": "Create or reuse embeddings for explicit human-approved transactions or one YYYY-MM page. Pass replace_existing with exactly one transaction ID to remove its prior decision vector and link and generate a fresh replacement.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_create_cash_plan", "title": "Create Finance Cash Plan", "family": "finance", "description": "Create a retry-safe planned inflow, outflow, or security-linked investment purchase. Committed plans affect all scenarios; expected and possible plans enter only their defined Base, Upside, or Downside paths.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_cash_plan", "title": "Update Finance Cash Plan", "family": "finance", "description": "Update or restore one cash plan using its latest updatedAt value as an optimistic-concurrency guard. Omitted fields remain unchanged.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_archive_cash_plan", "title": "Archive Finance Cash Plan", "family": "finance", "description": "Reversibly archive one cash plan using its latest updatedAt value. Archived plans stop affecting forecasts and can be restored with finance_update_cash_plan.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_update_cash_forecast_settings", "title": "Update Finance Cash Forecast Settings", "family": "finance", "description": "Update the global minimum-cash threshold and default Flow scope and horizon with optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_import_invoice", "title": "Import Invoice into Accounts Receivable", "family": "finance", "description": "Upload a base64 PDF or invoice image, extract it, and create an editable review-required draft directly in ONE Accounts Receivable. Duplicate source files reuse the existing draft.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_record_investment_portfolio", "title": "Record Finance Investment Portfolio", "family": "finance", "description": "Record one reconciled investment-account snapshot with executed positions, cost basis, uninvested cash, disclosed purchase costs, annual cost rates, and estimated sale costs. Positions plus other items must equal invested_value_minor, and invested value plus available cash must equal balance_minor.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "get_my_work", "title": "Get My ONE Work", "family": "tasks", "description": "Return the signed-in person's current focus tasks by project, their open assignments across permitted projects, and company-wide active-internal focus for internal accounts. Project-only accounts remain restricted to permitted projects.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "get_my_focus", "title": "Get My Current ONE Tasks", "family": "tasks", "description": "Return the calling person's own validated current focus tasks, limited to one per project. Personal keys remain bound to their owner.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "set_my_focus", "title": "Set My Current ONE Task", "family": "tasks", "description": "Set one of the calling person's own assigned, non-Done tasks as current for its project, replacing only that project's prior focus. This tool cannot nominate focus for another person.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "clear_my_focus", "title": "Clear My Current ONE Task", "family": "tasks", "description": "Clear the calling person's own focus for one project when both IDs are supplied, or clear all of that person's focus entries when they are omitted.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "create_items", "title": "Create ONE Items In Bulk", "family": "boards", "description": "Create up to 50 items on one board in a single call. Each entry uses the create_item body shape; results are returned per entry with individual errors, so one bad row never blocks the rest.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "update_items", "title": "Update ONE Items In Bulk", "family": "boards", "description": "Update up to 50 items on one board in a single call. Each entry needs item_id plus optional name and fields; item IDs must be distinct and results are returned per entry with individual errors.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "list_tool_families", "title": "List ONE Tool Families", "family": "core", "description": "Show the tool families available to this sign-in, their visible tool counts, and the current listed selection. Account-permitted Boards and core tools always stay discoverable; large accounts auto-focus the remaining listed set.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "set_tool_families", "title": "Set ONE Tool Families", "family": "core", "description": "Pin additional tool families this account lists by default, overriding the automatic focus. Account-permitted Boards and core tools always stay discoverable, and every role-allowed tool remains callable. Omit families to return to automatic behavior.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_record_account_balance", "title": "Record Finance account balance", "family": "finance", "description": "Record or replace one dated Bank balance through a bounded valuation-only write. Investment components must equal the total. Requires current Finance editor access.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_issue_invoice", "title": "Issue Accounts Receivable invoice", "family": "finance", "description": "Issue an Accounts Receivable draft as an immutable PDF after atomically reserving its requested custom number or the next configured sequence.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "finance_import_bill", "title": "Import a bill into Accounts Payable", "family": "finance", "description": "Upload a base64 PDF or invoice image through the shared receipt scanner and create a review-required Accounts Payable bill. Uniquely matching printed active Production projects are allocated automatically.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_get_audit_trail", "title": "Get Accounting & Tax audit trail", "family": "finance", "description": "Read a bounded append-only mutation and reviewer history plus versioned formulas, inputs, exclusions, official sources, and snapshot behavior.", "scopes": [ "crm.read" ], "readOnly": true }, { "name": "accounting_tax_create_audit_review", "title": "Add an Accounting & Tax audit review", "family": "finance", "description": "Append an immutable editor note, question, or resolution linked to a methodology section, resource, and optional prior event.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_save_scenario", "title": "Save a corporate-tax scenario", "family": "finance", "description": "Save the tax scenario source and validation state, then mark the persisted ledger bridge stale without recalculating it.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_save_balance_close", "title": "Save a balance-sheet close", "family": "finance", "description": "Create or update audited balance totals, source provenance, close controls, validation state, and accountant evidence using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_balance_close_exception", "title": "Create a balance-close exception", "family": "finance", "description": "Create an audited account-level balance, sign, classification, prior-result, or missing-tax-provision exception.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_balance_close_exception", "title": "Update a balance-close exception", "family": "finance", "description": "Update, resolve, or accept a balance-close exception using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_rollforward", "title": "Create a tax-account rollforward", "family": "finance", "description": "Create an audited tax-account rollforward for one legal entity, tax type, and assessment year without netting unrelated positions.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_rollforward", "title": "Update a tax-account rollforward", "family": "finance", "description": "Update or reconcile a tax-account rollforward using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_book_to_tax_adjustment", "title": "Create a GL book-to-tax adjustment", "family": "finance", "description": "Create an audited GL-level tax addition or deduction and invalidate the existing snapshot without recalculation.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_book_to_tax_adjustment", "title": "Update a GL book-to-tax adjustment", "family": "finance", "description": "Update, approve, or reject a GL-level adjustment using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_tax_loss", "title": "Create a tax-loss register row", "family": "finance", "description": "Create an audited tax-loss register row by origin year with evidence, owner, and review state.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_tax_loss", "title": "Update a tax-loss register row", "family": "finance", "description": "Update or approve a tax-loss row using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_book_to_tax_bridge", "title": "Refresh the book-to-tax bridge snapshot", "family": "finance", "description": "Explicitly recalculate and persist the selected-year bridge from saved scenarios and approved adjustment and loss rows.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_related_party_reconciliation", "title": "Create a related-party reconciliation", "family": "finance", "description": "Create an audited related-party or current-account GL control and invalidate the persisted snapshot.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_related_party_reconciliation", "title": "Update a related-party reconciliation", "family": "finance", "description": "Update, approve, or resolve a related-party GL control using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_related_party_snapshot", "title": "Refresh the related-party snapshot", "family": "finance", "description": "Explicitly join approved GL controls to lending and current-account records and persist the reconciliation snapshot.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_open_item_control", "title": "Create an AP/AR ageing control", "family": "finance", "description": "Create a reconciliation overlay for an existing Finance bill or invoice, credit, or accrual.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_open_item_control", "title": "Update an AP/AR ageing control", "family": "finance", "description": "Update credits, payments, FX, disputes, ownership, evidence, or review data using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_open_item_ageing", "title": "Refresh the AP/AR ageing snapshot", "family": "finance", "description": "Explicitly calculate historical ageing from Accounting & Tax controls and existing Finance AP and AR records.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_treasury_control", "title": "Create a treasury control", "family": "finance", "description": "Create an audited GL, FX, interest, book-result, tax-treatment, owner, and evidence control for a Finance account.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_treasury_control", "title": "Update a treasury control", "family": "finance", "description": "Update or approve a treasury reconciliation and corporate-tax overlay using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_fixed_asset", "title": "Create a fixed-asset control", "family": "finance", "description": "Create an audited fixed-asset and straight-line depreciation control in Accounting & Tax.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_fixed_asset", "title": "Update a fixed-asset control", "family": "finance", "description": "Update or approve asset, depreciation, impairment, GL, owner, and evidence controls using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_treasury_asset_snapshot", "title": "Refresh the treasury and asset snapshot", "family": "finance", "description": "Explicitly persist a reusable treasury, FX, investment, tax-treatment, and fixed-asset snapshot.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_save_annual_accounts_filing", "title": "Save annual-accounts filing readiness", "family": "finance", "description": "Save audited KVK preparation, business-class evidence, deadlines, filing channel, validation, owner, dossier, and receipt data without submitting a filing.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_annual_accounts_readiness", "title": "Refresh annual-accounts readiness", "family": "finance", "description": "Explicitly evaluate saved close snapshots and the filing control, then persist statutory deadlines and readiness gates.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_save_equity_position", "title": "Save an equity position", "family": "finance", "description": "Save legal-equity composition, reserves, ledger reconciliation, articles review, shareholder register, owner, and evidence.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_dividend_decision", "title": "Create a dividend decision", "family": "finance", "description": "Create a proposed distribution with shareholder, board, liquidity, beneficial-owner, withholding, payment, and tax evidence.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_dividend_decision", "title": "Update a dividend decision", "family": "finance", "description": "Update a dividend decision and approval or dividend-tax evidence using optimistic concurrency.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_equity_dividend_snapshot", "title": "Refresh the equity and dividend snapshot", "family": "finance", "description": "Explicitly evaluate distributable equity, active decisions, payment capacity, authorization, withholding, and tax follow-up.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_save_dga", "title": "Save a DGA tax record", "family": "finance", "description": "Owner-only person-OAuth replacement of the selected-year DGA salary, current-account, Box 1, Box 2, Box 3, dividend, evidence, and control record. Read it first and send the complete record with its revision; amounts are integer euro cents and percentages are basis points.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_obligation", "title": "Create a tax obligation", "family": "finance", "description": "Owner-only person-OAuth creation of an audited payable or receivable tax obligation for one fiscal year. Amounts are integer euro cents and receivables remain separate from company debts.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_obligation", "title": "Update a tax obligation", "family": "finance", "description": "Owner-only person-OAuth update of a tax obligation. Read the current record first and pass its fiscal year and expected revision; an obligation cannot be moved between fiscal years.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_create_debt", "title": "Create a company debt", "family": "finance", "description": "Owner-only person-OAuth creation of an audited gross company-debt position. Amounts are integer euro cents and tax receivables are never netted into debt.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_update_debt", "title": "Update a company debt", "family": "finance", "description": "Owner-only person-OAuth update of an audited company-debt position. Read the current gross position first and pass its expected revision.", "scopes": [ "crm.write" ], "readOnly": false }, { "name": "accounting_tax_refresh_corporate_tax_forecast", "title": "Refresh the corporate-tax forecast", "family": "finance", "description": "Owner-only person-OAuth explicit refresh of the persisted Finance-derived corporate-tax forecast for one fiscal year. This deterministic snapshot is not a filing or tax advice.", "scopes": [ "crm.write" ], "readOnly": false } ] }