makermap
Get started
REFERENCE

Scopes

A token carries scopes, and they do two things: gate the call, and gate discovery - a tool whose scope you do not hold is not listed at all. Grant the narrowest set that does the job.

No scope grants everything Around thirty tools are refused to agent principals whatever their token says: creating tenants, changing membership, registering agents, resolving decisions, and every hard delete. They are marked in the tool reference.
activity:read2 tools
list_activity list_changes
activity:write1 tool
record_activity
agents:read5 tools
get_agent_run get_spend_cap get_telemetry_policy list_agent_runs list_agents
agents:write4 tools
create_agent set_spend_cap set_telemetry_policy update_agent
approvals:read1 tool
list_approvals
approvals:write2 tools
request_approval resolve_approval
assets:read11 tools
apply_setup_profile get_asset get_asset_collection_version get_asset_revision get_assets get_system_skill list_asset_collection_versions list_asset_collections list_asset_revisions list_assets list_system_library
assets:write13 tools
create_asset_collection delete_asset delete_asset_collection fork_system_skill move_asset restore_asset_revision save_assets save_skill_overlay snapshot_asset_collection unarchive_asset unarchive_asset_collection update_asset update_asset_collection
assignments:read2 tools
get_assignment_context list_assignments
assignments:write2 tools
create_assignment update_assignment
billing:read4 tools
get_billing_history get_credit_balance get_entitlements get_subscription
credentials:reveal1 tool

Returns stored secrets in plaintext. Everything else in the product goes out of its way never to do this.

reveal_credential
decisions:read7 tools
get_decision get_design_proposal get_design_variant_revision list_decisions list_design_comments list_design_proposals list_design_variant_revisions
decisions:write16 tools
archive_design_proposal archive_design_variant cast_design_vote create_decision create_design_proposal decide_decision delete_decision link_decision post_advisory post_design_comment request_gate_pass restore_design_variant retract_design_vote save_design_variant unlink_decision update_decision
documents:read8 tools
get_doc_section get_document get_log get_log_entry list_documents list_logs read_log search_docs
documents:write5 tools
append_log_entry create_log delete_document delete_log save_document
financials:read1 tool
get_financial_profile
financials:write1 tool
upsert_financial_profile
inbox:read2 tools
list_inbox poll_changes
inbox:write1 tool
mark_inbox_read
incidents:read2 tools
get_incident list_incidents
incidents:write2 tools
create_incident update_incident
infra:read12 tools

Enumerates every server the ORGANIZATION runs, across all workspaces - strictly wider than any product-level read, which is why no product scope implies it.

export_org get_infra_datastore get_infra_drift get_infra_host get_operations_context list_infra_activity list_infra_databases list_infra_datastores list_infra_hosts list_infra_platforms preflight_operation verify_deployment
infra:write16 tools
add_infra_database add_infra_datastore add_infra_host add_infra_platform archive_infra_database archive_infra_datastore archive_infra_host archive_infra_platform link_deployment_infra record_verification set_database_protection set_deployment_runtime update_infra_database update_infra_datastore update_infra_host update_infra_platform
instructions:read8 tools
apply_setup_profile get_instruction_revision get_instruction_set_version get_instructions list_instruction_revisions list_instruction_set_versions list_instruction_sets list_instructions
instructions:write11 tools
create_instruction_set delete_instruction delete_instruction_set move_instruction restore_instruction_revision save_instructions snapshot_instruction_set unarchive_instruction unarchive_instruction_set update_instruction update_instruction_set
integrations:read3 tools
get_integration_connection list_external_references list_integration_connections
integrations:write6 tools
create_integration_connection delete_integration_connection link_external_reference rotate_integration_webhook_secret unlink_external_reference update_integration_connection
intelligence:read6 tools
evaluate_scenario get_forecast get_lessons get_production_readiness get_recommendations run_portfolio_review
inventory:read4 tools
get_inventory_item get_inventory_overview list_ideas list_inventory_items
inventory:write4 tools
capture_idea convert_idea_to_product create_inventory_item report_inventory_expiry
invites:read1 tool
get_my_invites
marketing:read3 tools
get_campaign get_marketing_profile list_campaigns
marketing:write3 tools
create_campaign update_campaign upsert_marketing_profile
org_overview:read1 tool
get_org_overview
orgs:read5 tools
get_design_tokens list_invitations list_org_members list_organizations list_workspaces
orgs:write7 tools
accept_invitation create_organization create_workspace invite_member revoke_invitation save_design_tokens set_default_workspace
products:read26 tools= projects:read
generate_briefing get_assignment_context get_briefing get_gate get_initiative get_intake_plan get_lifecycle get_milestone get_operations_context get_portfolio_stream get_product get_product_context get_product_health get_release get_timeline_item get_workspace_overview list_briefings list_gate_templates list_gates list_initiatives list_milestones list_products list_products_by_band list_releases list_timeline_items search
products:write29 tools= projects:write
add_gate_condition add_gate_evidence add_temporal_dependency convert_entity create_gate create_initiative create_milestone create_product create_release create_timeline_item delete_product evaluate_gate link_deployment_infra link_repository move_product purge_product record_actual remove_temporal_dependency request_gate_pass reschedule_item restore_product rotate_repository_webhook_secret set_deployment_runtime unlink_repository update_gate_condition update_initiative update_milestone update_product update_release
profile:read1 tool
whoami
profile:write1 tool
update_settings
projects:read2 tools= products:read
get_project list_projects
projects:write13 tools= products:write
add_project_credential add_project_deployment add_project_stack_item create_project delete_project move_project remove_project_credential remove_project_deployment remove_project_stack_item update_project update_project_credential update_project_deployment update_project_stack_item
resources:read2 tools
get_resource_pool list_resource_pools
resources:write3 tools
allocate_resource record_resource_observation release_resource
setup_profiles:read5 tools
apply_setup_profile get_setup_profile get_workspace_setup list_setup_profile_revisions list_setup_profiles
setup_profiles:write3 tools
archive_setup_profile create_setup_profile update_setup_profile
site:read3 tools
get_site_card get_site_updates list_site_entries
site:write0 tools
tasks:read5 tools
get_board get_effort_profile get_task list_effort_divergence list_tasks
tasks:write18 tools
create_board_column create_epic create_task create_tasks delete_board_column delete_epic delete_task link_reference move_task record_effort_used reorder_board_columns reorder_epics set_task_deadline unlink_reference update_board_column update_epic update_task upsert_effort_profile
workspace:export3 tools

Produces a bundle of the entire workspace in one call. Every other read is narrow; this one is not.

export_org export_workspace purge_product

products:* and projects:* are equivalent - holding either satisfies the other. The projects spelling is the older name kept working; write new tokens with products.