AI and integrations

MCP server

Connect AI clients to your organization's knowledge, agents and connectors over the Model Context Protocol.

Endpoint

https://mcp.cactive.com.au/mcp

The server speaks the Streamable HTTP transport, statelessly: each request is handled on its own, with no session, and answered with a JSON response rather than an event stream. It's the programmatic interface for organizations.

Authenticate

Send an MCP key as a bearer token, or sign in with OAuth:

Authorization: Bearer si_mcp_…

Owners and admins create MCP keys at https://id.cactive.com.au → organization → Keys, type MCP client (Keys). The key's scopes decide which tools the server offers. Without a valid key (missing, unknown, revoked, expired or not an MCP key) the server answers 401 with a JSON-RPC error and WWW-Authenticate: Bearer realm="mcp", resource_metadata="…" (see below; with error="invalid_token" when a key or token was sent but isn't accepted).

Clients that support MCP authorization can sign in with your account instead of a key. Add the server URL without a header; the client finds out where to sign in from the 401:

WWW-Authenticate: Bearer resource_metadata="https://mcp.cactive.com.au/.well-known/oauth-protected-resource/mcp" points to this server's metadata (RFC 9728), which names https://id.cactive.com.au as its authorization server.
The client registers itself at https://id.cactive.com.au/oauth/register (dynamic client registration, public clients with PKCE) and opens the sign-in page.
You choose the organization (one where your role can connect MCP clients: developer and above) and the permissions the client gets, from the scopes you hold there. Read scopes are preselected.

The client then sends access tokens issued for this server (1 hour, renewed with a refresh token). Role changes apply at the next renewal; remove the client on your account page under Connected apps to end its access. Tools act as you: changes they make are recorded in the audit log with you as the actor.

Caity uses this server too, with your sign-in to it and one organization per request: it gets the tools your role allows there, and its changes are recorded as you via Caity.

Connect a client

claude mcp add --transport http si https://mcp.cactive.com.au/mcp --header "Authorization: Bearer $SI_MCP_KEY"

For clients configured with an mcpServers file, such as .mcp.json:

.mcp.json

{
  "mcpServers": {
    "si": {
      "type": "http",
      "url": "https://mcp.cactive.com.au/mcp",
      "headers": { "Authorization": "Bearer ${SI_MCP_KEY}" }
    }
  }
}

curl -s https://mcp.cactive.com.au/mcp \
  -H "Authorization: Bearer $SI_MCP_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

Every key gets whoami; the others need the scope shown. Arguments and details are on MCP tools.

Tool	Scope	Description
`whoami`	none	Identity and scopes of the current key, and the language of the person behind it (`locale`: en-AU writes Australian spelling and day/month/year dates, en-US US spelling and month/day/year).
`weather_forecast`	`weather:read`	Weather for a place: current conditions, today's high and low, sunrise and sunset, hourly (from now) and daily forecasts, and air quality where there is some.
`weather_places_search`	`weather:read`	Places by name or postcode, best first, with coordinates and time zone (to ask weather_forecast for).
`food_recipes_search`	`food:read`	The person's recipes (and ones their household shares) as short summaries: title, minutes, servings, rating, calories per serving, cuisines, courses, diets met, allergens.
`food_recipe_get`	`food:read`	One recipe in full: ingredients (scaled to `servings` when given), numbered steps, notes and its source.
`food_suggestions`	`food:read`	Recipe ideas from the person's own recipes, best first, each with why: what they cook and rate, what's in season in Australia, what's in their pantry (and about to go off), how long since they made it.
`food_what_can_i_cook`	`food:read`	Recipes the person can make with what's in their pantry, fridge and freezer, best covered first, with what's missing and what's about to go off.
`food_plan_get`	`food:read`	The household's meal plan between two days (at most 92): each meal's day, meal (breakfast, lunch, dinner, snack), title and recipe.
`food_substitute`	`food:read`	Substitutes for an ingredient (e.g.
`food_use_soon`	`food:read`	What in the household's pantry needs using soon (within `days`, 3 by default; leftovers included) and the person's recipes that use the most of it ("what should I cook with what's expiring?").
`food_spending`	`food:read`	The household's grocery spending by month, from the receipts it added to Food (Coles and Woolworths e-receipts), and what it last paid for things when asked about one (`item`).
`food_plan_meals`	`food:read`	Plans meals for the days ahead from the person's recipes (e.g.
`food_plan_add`	`food:read`	Puts a meal on the household's plan: a recipe (by id) or a note such as "Leftovers" or "Eating out".
`food_shopping_list`	`food:read`	Makes a shopping list ("turn this into a shopping list"): from the plan between two days, or from recipes at given servings.
`food_list_add`	`food:read`	Adds things to a shopping list (the most recent one unless `listId` says), one item per string ("2 L milk", "dishwashing liquid").
`food_pantry_add`	`food:read`	Records what the household has in: one item per string ("2 L milk", "spinach"), placed where it keeps and given an estimated use-by unless `useBy` (YYYY-MM-DD) says, added to the same thing when it's there already.
`food_recipe_save`	`food:read`	Saves a recipe to the person's Food: from a web page (`url`, read from its recipe data), or written out (`title`, `ingredients` one per line, `steps` one per line or paragraph).
`drive_search`	none
`drive_list`	none
`drive_get`	none	Details of a file or folder: where it is, size, type, versions, who it's shared with (for editors) and its link setting.
`drive_read`	none	Read a text file (plain text, Markdown, CSV, JSON, code…), up to 1 MB.
`drive_download_url`	none	A link to download a file, valid for an hour.
`drive_folder_create`	none	Create a folder.
`drive_file_write`	none	Save a small text file (up to 1 MB).
`drive_share`	none	Share a file or folder with a member (by email) or a team (by name), as viewer, commenter or editor.
`document_create`	none	Create a document (Documents), optionally with content in Markdown (headings, lists, tables, links).
`document_read`	none	Read a document: as Markdown (`format: "markdown"`, the default) or its outline of headings (`"outline"`).
`document_edit`	none	Change a document.
`document_comment`	none	Comment on a document: on the text quoted (`quote`, a short passage as it appears) or on the whole document.
`sheet_create`	none	Create a spreadsheet (Sheets), optionally with sheets of rows: strings starting with "=" are formulas (A1 references), numbers and dates as typed.
`sheet_read`	none	Read cells of a spreadsheet: `range` in A1 form with an optional sheet ("Budget!A1:D20"; the first sheet without one).
`sheet_write`	none	Write cells from the top-left of `range` ("Sheet1!B2"): `values` as rows; strings starting with "=" are formulas.
`sheet_add_chart`	none	Add a chart over a range (headers in its first row, categories in its first column): column, bar, line, area, pie, donut or scatter.
`slides_create`	none	Create a presentation (Slides) from an outline: a title slide, then one slide per entry (bullets make a title-and-body slide, none a section slide), with speaker notes.
`slides_read`	none	Read a presentation: each slide's title, text and speaker notes, in order.
`slides_add`	none	Add slides to a presentation after the slide `after` (a slide id from slides_read; the end without it).
`office_search`	none	Find documents, spreadsheets and presentations by what's in them (every word must appear), with a snippet each.
`office_export`	none	A download link (an hour) for a document, spreadsheet or presentation in another format: md or txt for documents, csv or tsv for spreadsheets, txt for presentations; docx, xlsx, pptx and pdf where the platform has them on.
`video_read`	none	Read a video project (Video): its sequences with size, rate and length; tracks with their clips (media names, start and end as timecode, where each starts in its media); markers; caption tracks with their text and times; and the media.
`video_create`	none	Make a video project (Video) from Drive files in order: a rough cut on one sequence, each clip optionally trimmed (`in` and `out` in seconds of its file).
`video_transcribe`	none	Transcribe one media item of a video project into a new caption track (Amazon Transcribe; speakers labelled).
`photos_albums`	none	List the albums in your photo library (title, number of photos, id).
`photos_album`	none	The photos in one album, in the album's order (up to 200).
`photos_search`	none	Find photos and videos by when they were taken (from/to: 2024-06-12 or ISO date-times), where (near a latitude/longitude within km, or a box), words in names and descriptions, type, favourites.
`photos_get`	none	A photo's details: when and where it was taken, camera, size, description, albums, and a link to see it (an hour).
`mirage_servers`	none	The person's Mirage servers (Discord-style communities), in their order, with unread and mention counts and the channels they can see (ids for the other Mirage tools).
`mirage_inbox`	none	What needs the person's attention in Mirage: recent messages that mention them (by name, their roles or @everyone), newest first, and the channels they haven't read, by server, with mention counts.
`mirage_messages`	none	A Mirage channel's or thread's recent messages, oldest first (`before`: a message id, for the ones before it).
`mirage_search`	none	Search a Mirage server's messages the person can read: words, and optionally who sent them (`from`, a user id), where (`in`, a channel id) or what they have (link, file, image, video).
`mirage_send`	none	Send a message in a Mirage channel or thread as the person (Markdown; mention someone as <@userId>).
`health_summary`	none	The person's Health summary for today and this week: each metric they let you read (steps, sleep, heart rate and so on) with today's value, the week's daily average, the trend against the week before and the latest reading.
`health_metric`	none	One Health metric's daily values between two days (at most a year), with the average and best day.
`context_get`	`knowledge:read`	Read a context entry by namespace and key.
`context_list`	`knowledge:read`	List context entries in a namespace, optionally filtered by key prefix.
`pages_list`	`knowledge:read`	List Notes pages (the organization's pages and databases) under a parent (default: top level).
`page_get`	`knowledge:read`	Read a Notes page as Markdown with front matter (title, version, ...).
`page_search`	`knowledge:read`	Search Notes pages by title and text.
`context_put`	`knowledge:write`	Create or replace a context entry.
`context_delete`	`knowledge:write`	Delete a context entry.
`page_upsert`	`knowledge:write`	Create a Notes page from Markdown, or replace an existing page's content.
`agent_job_create`	`agents:run`	Queue work for one of the organization's self-hosted agents.
`agent_job_cancel`	`agents:run`	Cancel an agent job: a queued job is canceled at once; a running job stops at its device's next check (status canceling, then canceled).
`agent_job_get`	`agents:read`	Status of an agent job, with a temporary results URL once done.
`issues_meta`	`issues:read`	Issue tracking catalogs: spaces (keys), issue types, statuses, priorities, resolutions, link types, custom fields and people.
`issues_search`	`issues:read`	Search issues with the query language (JQL-compatible), e.g.
`issues_report`	`issues:read`	Report over the issues a query matches.
`issues_agenda`	`issues:read`	Your Tasks dates between `from` and `to` (YYYY-MM-DD, at most 100 days): issues assigned to you by due and start date, and sprint starts, sprint ends and releases of the spaces you work in.
`issue_get`	`issues:read`	One issue by key (e.g.
`boards_list`	`issues:read`	Boards with their type (scrum or kanban), spaces and columns, plus the open sprints of scrum boards.
`board_get`	`issues:read`	A board's cards by column: the active sprint for scrum boards, the flow for kanban boards.
`filters_list`	`issues:read`	Saved filters shared with the organization or with this key's teams: name and query (run one with issues_search).
`sprint_create`	`issues:write`	Create a future sprint on a scrum board (see boards_list for board ids).
`sprint_plan`	`issues:write`	Put issues (keys) into a sprint, or back into the backlog with sprintId null.
`sprint_start`	`issues:write`	Start a future sprint.
`sprint_complete`	`issues:write`	Complete an active sprint.
`issue_create`	`issues:write`	Create an issue.
`issue_update`	`issues:write`	Change an issue's fields (not its status: use issue_transition).
`issue_transition`	`issues:write`	Move an issue through its workflow by transition or target status name (see issue_get for the available ones).
`issue_comment`	`issues:write`	Add a Markdown comment to an issue.
`issue_link`	`issues:write`	Link two issues, e.g.
`issue_worklog`	`issues:write`	Log work on an issue, e.g.
`issues_rank`	`issues:write`	Reorder issues in the backlog: put `issues` (keys, in order) right before or right after another issue.
`issue_move`	`issues:write`	Move an issue (and its subtasks) to another space.
`issue_delete`	`issues:write`	Delete an issue with its comments, attachments, work logs and subtasks.
`space_create`	`issues:write`	Create a space (project) from a template: scrum, kanban, bugs, service or basic.
`crm_objects`	`crm:read`	The objects in Customers (accounts, contacts, leads, opportunities, activities and custom ones) with their fields: ids, types, picklist values and lookups' targets, and the pipelines with their stages.
`crm_search`	`crm:read`	Find records in Customers by words of their name, company, email, phone or website (prefixes match), or by id.
`crm_records_list`	`crm:read`
`crm_record_get`	`crm:read`	Read a record in Customers by id: its fields (lookups and owners by name), what the caller may do with it, its related records and its latest activities.
`crm_record_create`	`crm:write`	Create a record in Customers: the object id and field values by field id (crm_objects lists them; picklists take a value or its label, lookups a record id, dates YYYY-MM-DD).
`crm_record_update`	`crm:write`	Change a record's fields in Customers (by field id; null clears one) or owner.
`crm_activity_log`	`crm:write`	Log an activity on records in Customers: a task (open, with a due date), call, meeting, note or email, related to one or more records (contacts, accounts, opportunities, leads).
`crm_pipeline_summary`	`crm:read`	The sales pipeline at a glance: open opportunities by stage (count, amount, weighted), won and lost this month and the last six months, per pipeline, and how many records each object has.
`marketing_segments_list`	`marketing:read`	The organization's Marketing segments (saved audiences over contacts and leads): ids, names, their groups' filters and the last size estimate.
`marketing_segment_get`	`marketing:read`	One segment: its groups (Customers filters, engagement and list conditions) and the last size estimate.
`marketing_segment_estimate`	`marketing:read`	Counts a segment's people (each address once) in the background and returns the segment: `counting` while it runs, then `estimate`.
`marketing_lists_list`	`marketing:read`	Marketing lists: static lists and suppression lists (never sent to), by channel, with member counts.
`marketing_campaigns_list`	`marketing:read`	Marketing campaigns, newest first: status (draft, waiting for approval, scheduled, sending, sent, paused, cancelled), topic, schedule and, once sending started, their numbers.
`marketing_campaign_get`	`marketing:read`	One campaign and its results: audience, topic, approval, schedule, send progress and numbers (sent, delivered, opened, clicked, bounced, complained, unsubscribed, skipped, conversions, revenue).
`marketing_journeys_list`	`marketing:read`	Marketing journeys: status (draft, running, paused, stopped), the live version and how many people entered, are in them, completed and reached the goal.
`marketing_journey_get`	`marketing:read`	One journey: its draft (entry, re-entry, goal and steps), versions, approval, and its numbers: totals, each step's (entered, completed, exited, goal) and each email and text step's sends.
`marketing_consent_get`	`marketing:read`	An email address's or mobile number's Marketing consent: status (subscribed, pending, unsubscribed, bounced, complained), each topic's choice, and the history of changes with their evidence.
`marketing_stats_daily`	`marketing:read`	The organization's Marketing numbers per UTC day and their totals: emails sent, delivered, opened, clicked, bounced, unsubscribed, conversions and revenue, texts, form submissions, journey entries and page views.
`marketing_forms_list`	`marketing:read`	Marketing forms (web-to-lead): what they create, whether they're open, and their submissions and the spam they turned away.
`marketing_campaign_create`	`marketing:write`	Drafts a campaign: a name, a topic id (from the settings' topics), an audience (segments and lists to include and exclude) and content (a block document, or a template id).
`marketing_campaign_request_approval`	`marketing:write`	Asks the organization's approvers to approve a draft campaign as it stands (when the organization requires approvals).
`marketing_journey_create`	`marketing:write`	Drafts a journey with a name and description (and optionally a definition: entry, re-entry, goal and steps).
`aircraft_find`	`maps:read`	Where is an aircraft now: by ICAO hex (7C6B2D), registration (VH-ABC) or callsign (QFA1).
`aircraft_track`	`maps:read`	Recorded track of a watched aircraft over the last hours (positions every ~10 s while a watch covers it): start, end, distance and sampled points.
`flight_watches_list`	`maps:read`	Flight watches you can see, with targets, areas, which events notify, and when each last fired.
`flight_logs_list`	`maps:read`	Flights a watch logged (each airframe by ICAO hex): when, start and end, distance, highest altitude, roads followed and events.
`flight_log_get`	`maps:read`	One logged flight: its events and road spans with a sampled track, or the whole track as a GPX, KML or CSV file (format).
`flight_watch_events`	`maps:read`	Recent events of a flight watch (takeoffs, landings, signal lost or back, areas, orbits, roads followed, thresholds), newest first.
`maps_locations_list`	`maps:read`	The org's alert locations (bases, hospitals, airfields): name, position and on-site radius.
`my_location_status`	`maps:read`	Whether your phone shares its location with Maps for near-me alerts (from the Maps app): phones, background or not, and until when the current fix counts.
`flight_watch_create`	`maps:write`
`circling_alert_create`	`maps:write`	Alert when aircraft circle or hold somewhere (searching, orbiting, holding), below 5,000 ft and ignoring airfield circuits within 3 km.
`maps_location_create`	`maps:write`	Add an org alert location (a base, a hospital, an airfield): name, lat, lon and the on-site radius in metres (50–5,000; default 300).
`maps_location_update`	`maps:write`	Change an org alert location (its owner or an org admin).
`maps_location_delete`	`maps:write`	Delete an org alert location (its owner or an org admin).
`my_location_delete`	`maps:write`	Delete your location from Maps: every phone's current fix, the phones sharing and their keys.
`flight_watch_pause`	`maps:write`	Pause a flight watch (nothing is evaluated or sent) or resume it with paused: false.
`flight_watch_restart`	`maps:write`	Start an ended flight watch again (after its end time, notification or flight limit) with its counters at zero.
`incidents_list`	`maps:read`	Current emergency incidents and warnings in Australia from the state agencies' public feeds (VicEmergency, NSW RFS, Queensland Fire Department, ACT ESA): Australian Warning System level, hazard, status, what to do and the agency's page.
`incident_get`	`maps:read`	One incident or warning by id (from incidents_list): everything the agency says, and its history of level and status changes.
`watch_zones_list`	`maps:read`	Watch zones in Maps: areas where emergency incidents and warnings alert people (by push, email or text), with their hazards, minimum level and status.
`watch_zone_events`	`maps:read`	Recent alerts of a watch zone, newest first, with what was sent.
`watch_zone_create`	`maps:write`	Make a watch zone that alerts on emergency incidents and warnings in Australia: areas (a circle around a point, an org location, your phone's location with near_me, a drawn polygon or a whole state), hazards, minimum warning level and which changes alert (new, escalated, downgraded, closed, updated).
`watch_zone_update`	`maps:write`	Change a watch zone (its owner, or an org admin for org zones): fields given replace the current ones.
`watch_zone_pause`	`maps:write`	Pause a watch zone (no alerts) or resume it with paused: false.
`watch_zone_delete`	`maps:write`	Delete a watch zone (its owner, or an org admin for org zones).
`tenant_overview`	`tenant:read`	The organization's tenant overview: properties, member counts, the sign-in policy and security recommendations (members without a passkey or two-step sign-in, old invites, expiring keys and secrets).
`tenant_users_list`	`tenant:read`	List the organization's members with role, title, department, status (active or blocked), guest access, groups, passkeys and last sign-in; and pending invites.
`tenant_user_get`	`tenant:read`	One member in detail: groups, browser sessions, keys they created, app assignments and recent sign-ins.
`tenant_groups_list`	`tenant:read`	List the organization's groups with their size, owners and the roles they grant.
`tenant_group_get`	`tenant:read`	One group: members and owners, granted roles, Serverless App Service and repository access, and app assignments.
`tenant_roles_list`	`tenant:read`	Built-in and custom roles with their scopes, and the members and groups holding each.
`tenant_sign_ins`	`tenant:read`	Members' sign-ins and failed sign-ins, newest first: method, address, approximate place and device.
`tenant_policy_get`	`tenant:read`	The organization's sign-in policy and the members it would leave without access.
`tenant_invite`	`tenant:write`	Invite someone to the organization by email.
`tenant_user_update`	`tenant:write`	Change a member's role, title or department.
`tenant_user_block`	`tenant:write`	Block a member's sign-in to this organization: no new tokens, and current ones stop within 30 seconds.
`tenant_user_unblock`	`tenant:write`	Unblock a member's sign-in; they sign in again to reach the organization.
`tenant_user_revoke_sessions`	`tenant:write`	End a member's sessions for this organization (they sign in again) and disconnect their MCP clients here; `keys` also revokes keys they created here.
`tenant_group_member_set`	`tenant:write`	Add a member to a group, make them a group owner, or take them out (`role` null).
`databases_list`	`resources:read`	The organization's databases (DynamoDB tables): id, name, region and linked Serverless App Service.
`database_describe`	`resources:read`	Key schema, indexes, status and approximate item count of a database.
`database_query`	`resources:read`	Query a database (or one of its indexes) by partition key, with an optional sort key condition and filters.
`database_scan`	`resources:read`	Scan a database page by page, optionally with filters.
`database_item_get`	`resources:read`	Read one item by its key (strongly consistent).
`buckets_list`	`resources:read`	The organization's buckets (S3): id, name, region and linked Serverless App Service.
`bucket_list`	`resources:read`	List one folder of a bucket: subfolders and files (key, size, last modified).
`bucket_download_url`	`resources:read`	A link that downloads one file for the next 5 minutes.
`database_item_put`	`resources:write`	Create an item (an existing key is an error), or with `replace` replace the existing item with the same key (a missing one is an error).
`database_item_delete`	`resources:write`	Delete one item by its key.
`bucket_upload_url`	`resources:write`	A link (15 minutes) to upload one file with an HTTP PUT, up to 5 GB.
`bucket_delete`	`resources:write`	Delete files (keys) and folders (prefixes ending in /, with everything in them).
`project_traffic`	`analytics:read`	Traffic of the organization's deployments (or one Serverless App Service's): requests, bandwidth, status classes, cache hits, p50/p95 latency, a series over the range and top paths, countries and deployments.
`keys_list`	none	Keys that protect the organization's data (with keys:read: Drive, secrets, connectors and integrations too) and its own keys for encrypting and signing: id, name, what it protects, algorithm, current version, uses in the last 30 days.
`key_get`	none	One key by id (ck_…) or name: versions still in use, created, last rotated, last used, uses in the last 30 days, rotation schedule and recent re-encryption jobs.
`keys_encrypt`	`keys:use`	Encrypts up to 64 KB with one of the organization's aes-256-gcm keys.
`keys_decrypt`	`keys:use`	Decrypts a ciphertext (k1.…) made with one of the organization's keys, with the context it was encrypted with.
`keys_sign`	`keys:use`	Signs up to 64 KB with one of the organization's ed25519 or ecdsa-p256 keys.
`keys_verify`	`keys:use`	Checks a signature (k1s.…) from keys_sign against a message.
`secrets_list`	`env:read`	Secrets (sensitive environment variables) of a Serverless App Service, or the organization's shared ones: name, environments, version, rotation reminder and when it's due.
`secret_get`	`env:read`	A secret's value, only if its access rule lets the caller read it (owners and admins, plus the roles and groups it names).
`secret_set`	`env:write`	Sets a secret (a sensitive environment variable) to a new value: a new version, for the given environments (default all three).
`connectors_list`	`connectors:read`	Remote MCP servers connected to this organization and the tool names they add here.

Keys with connectors:read also get the tools of the organization's enabled connectors, named <slug>__<tool>.

Database and bucket tools (resources:read to read, resources:write to change) work on the organization's own databases and buckets by resource id, with typed DynamoDB JSON for items and short-lived links for file downloads and uploads. project_traffic (analytics:read) returns the same numbers as Analytics.

Activity

Tools that change data (context_put, context_delete, page_upsert, agent_job_create, database_item_put, database_item_delete, bucket_delete) are recorded in the audit log with the key as the actor. Requests time out after 60 seconds.