The Management MCP server exposes 35 tools: 22 reads and 13 additive writes. This page lists all of them so you can see exactly what an agent connected to your tenant is able to do.
The tool set is fixed — it is the same for every tenant and every key. What differs is what your key is allowed to call: see Authentication.
There are no delete tools, by design. The server has no way to express a destructive request — every call it can make is a read, or a create/update on a fixed allow-list checked when the server starts. No tool can delete a schema, environment, source, domain, client, or view.
Reading your tenant
Orientation
Start here when you want an agent to understand how a tenant is put together.
Source entities
Mapping schemas
Views, routes, and indexes
Deployments, logs, and metrics
Authoring schemas
This group is the reason most people connect the server. The four read tools let an agent design and prove a schema before anything is written.
The dry-run and validate tools are reads, despite sounding like they change something. A read-only key can design, test, and validate a schema end to end — it just cannot save it. That makes a read-only key a good default even for authoring work, until you are happy with the result.
deploy_mapping_schema on the hosted server only deploys to environments named dev, development, test, or staging. Anything else — including environments named prod, production, or live — is refused with a deploy_not_permitted error. Production deploys stay a deliberate action in the Management App.
Creating and updating configuration
All writes are additive: they create something new or update something that exists. None of them remove anything.
On an environment client, an empty index scope means unrestricted, not no access. A partial update that dropped the field would therefore widen the client rather than narrow it. update_environment_client avoids this by reading the current client and merging your changes onto it, so an agent cannot silently remove an index restriction by omitting it — but it is worth knowing when you review what an agent changed.
What is deliberately not exposed
Some Management API capabilities are intentionally absent from the tool set:
- Anything that deletes. No schema, environment, source, source group, domain, client, view, or index can be removed through MCP.
- Key rotation. No tool can regenerate an access key. Combined with the redaction applied to every response, that means an agent can neither read an existing key nor replace one.
- Bulk and production deploy paths. Deploying broadly, or to production, stays in the Management App.
For the update tools, the permission is the verb, not the address. Several of the allowed updates share an address with a delete operation in the underlying API — the server can reach the update and has no way to reach the delete.
Next steps
- Overview — hostname, authentication, guardrails, and client setup.
- Query MCP — query your Enterspeed data instead of your configuration.
