Skip to main content
These are hidden from a member’s tools/list entirely rather than merely refused, so nobody sees a permission they do not have.
Every one of these acts on accounts and instance settings. None of them can read another person’s brain, resumes or applications — the counts come back, never the contents. That is a property of the data layer rather than a policy these tools observe.
Where to start:
  • Something is reported broken → admin_health, then admin_recent_errors for the specifics behind an error count.
  • Somebody cannot get in → admin_user_detail, which tells you whether the problem is the account or the email, before you reset anything.
  • Where does this setting live? → admin_list_variables. It is the whole of what a self-hosted instance stores as configuration.
Every administrative change is written to the audit log against the acting admin’s name, values included — except secrets, which are recorded as having been set, never as their value. Running an instance →
The descriptions below are quoted verbatim from what the server sends a connected assistant, which is why they address it rather than you. They are reproduced rather than rewritten so this page cannot drift from what your assistant actually receives.

​
admin_instance_stats

Instance overview How many people are on this instance, how many are active, how many invites are outstanding, and how much material exists across all accounts. Aggregate counts only — never another person’s content. Admin only. No arguments.

​
admin_set_company_logos

Turn company logos on or off Controls whether the pipeline shows a company’s favicon next to its name. When on, each person’s browser asks twenty-icons.com for the logo, which means that service can see which companies are in their pipeline — turn it off for an instance where that matters and everyone gets initials on a coloured tile instead. Nothing else changes; no data is stored or deleted either way. Call admin_instance_stats to read the current state. Admin only. Overwrites or deletes.

​
admin_list_users

List members Everyone on the instance with their role, whether they are active, when they last signed in, and how much they have built. Does not expose anyone’s brain, resumes or applications. Admin only. No arguments.

​
admin_user_detail

Look up one account Everything known about a single account, for when someone asks for help: when they joined, who invited them, whether that invitation email actually went out, when they last signed in, which assistants they have connected and when each last called, whether they are being billed, how much they have built, every administrative change made to their account, and anything the instance recorded against their address — a bounced invite, a tool call that threw. Start here before admin_reset_user_password or admin_set_user_active, because it tells you whether the problem is the account or the email. Takes a user id from admin_list_users. Returns counts of what is in their workspace, never its contents: no brain, no resumes, no applications, and never a connection token. manageable says whether you are allowed to act on this account at all — it is false for the instance owner, for yourself, and for another admin when you are not the owner. Admin only.

​
admin_invite_user

Invite someone Create an invitation and email it through Resend. If email is not configured yet, the invite is still created and the reply includes a link you can send by hand — so this works before Resend is set up. Admin only. Overwrites or deletes. Reaches outside this instance.

​
admin_list_invites

List outstanding invites Invitations that have not been accepted yet, with their links and expiry. Admin only. No arguments.

​
admin_revoke_invite

Revoke an invite Cancel an outstanding invitation so its link stops working. Admin only. Overwrites or deletes.

​
admin_reset_user_password

Reset a member’s password Generate a new password for a member who is locked out, and return it once so it can be passed on. Every session they had is ended, so an old browser stays logged out. Cannot be used on the instance owner, and an admin cannot reset another admin’s password — that restriction is what stops this being a way to take over an instance. The reset is written to the audit log; the password itself never is. Admin only. Overwrites or deletes.

​
admin_audit_log

Read the admin audit log What admins have done on this instance, newest first: invitations, role changes, suspensions, deletions, password resets, billing links and changes to the instance’s own configuration, each with who did it, to whom, and when. Rows survive the deletion of the account they describe. Use it to answer ‘who suspended this person’, ‘who changed the Resend key’, or to review what happened while you were away. Narrow with group (accounts, invites, passwords, billing, settings) and search, which matches either side of a row — the admin who acted or the account acted on — and page with offset. Nothing here touches anyone’s brain, resumes or applications, and a secret is recorded as having been set, never as its value. Admin only.

​
admin_health

Check whether the instance is working This is the FIRST tool to call when something is reported broken, and the one to call on a schedule if you check on this instance at all. Returns a short list of checks — database reachability and response time, whether every migration finished, whether email is configured and whether the last send actually succeeded, whether Stripe is still calling the webhook, when an assistant last made a tool call, and how many errors were recorded in the last 24 hours. Each check has a status of ok, warn or down plus a plain-language summary you can read out as-is. Nothing here touches anyone’s brain, resumes or applications. A ‘down’ on billing usually means the signing secret in Admin → Configuration → Billing is wrong; a billing check that says Stripe has never called means the webhook endpoint was never added on Stripe’s side. Follow up with admin_recent_errors for the specifics behind an error count. Admin only. No arguments.

​
admin_recent_errors

Read what has failed recently The instance’s own event stream, newest first: failed emails, Stripe webhooks that did not verify or did not sync, tool calls that threw, and pages that errored. Use it after admin_health reports errors, or to answer ‘did that invite actually send’. Each entry has a level (INFO, WARN or ERROR), a source, a one-line message, and the address of whoever’s request hit it. Pass level ERROR for failures only — the default includes INFO entries such as successful webhook deliveries, which are what prove Stripe is still reaching this instance at all. Entries older than 30 days are removed automatically. This never contains anyone’s content: the arguments that caused a failure are deliberately not recorded, only the failure. Admin only.

​
admin_list_waitlist

See who asked for access People who requested access from the marketing site and have not been invited yet. Start here when you’re deciding who to let in next: each entry has the address, what they said they’re looking for, which site they came from, and when they asked. Entries already turned into invites are included with an invitedAt date, so you can see the whole history — pass pendingOnly true for just the queue. Reading this does not tell anyone anything; use admin_invite_waitlist_signup to actually let someone in. Admin only.

​
admin_invite_waitlist_signup

Invite someone off the waitlist Turn a waitlist request into a real invitation: creates the invite, emails it through Resend, and marks the request as invited so it leaves the queue. Takes the signup id from admin_list_waitlist, not an email address. If email is not configured the invite is still created and the reply carries a link you can send by hand. The request stays on the list afterwards, stamped with the date, so the list remains a record of who asked and when. Admin only. Overwrites or deletes. Reaches outside this instance.

​
admin_remove_waitlist_signup

Remove a waitlist request Delete a request from the waitlist for good — spam, a duplicate, or someone who asked to be taken off. This does not revoke an invitation that was already sent; use admin_revoke_invite for that. Irreversible, so read admin_list_waitlist first and remove by id. Admin only. Overwrites or deletes.

​
admin_set_user_role

Change someone’s role Promote a member to admin or demote an admin to member. The super admin cannot be changed, and admins can only act on members. Admin only. Overwrites or deletes.

​
admin_set_user_active

Activate or suspend someone Suspending signs the person out everywhere and blocks their login and their MCP connection. Their data is kept. Admin only. Overwrites or deletes.

​
admin_delete_user

Delete someone PERMANENT. Removes the account and everything it owns: brain, resumes, applications. Confirm with the person you are talking to before calling this. Admin only. Overwrites or deletes.

​
admin_get_email_config

Check email configuration Whether Resend is wired up, and the from address invitations will come from. The API key is returned masked. Admin only. No arguments.

​
admin_set_email_config

Configure email Set the Resend API key and the address invitations are sent from. Only the fields you pass are changed. Follow with admin_send_test_email to prove it works. instanceName and publicUrl are instance-wide rather than email-only — they are what the sign-in page, invitation links and the Stripe webhook URL are built from — and they can also be set on their own with admin_set_variable. Admin only. Overwrites or deletes.

​
admin_send_test_email

Send a test email Proves the Resend configuration actually delivers. Returns the exact error if it does not. Admin only. Reaches outside this instance.

​
admin_get_google_config

Check Google sign-in Whether people can sign in with Google, who is allowed to, and the exact redirect URI to register in the Google Cloud console — the value that causes redirect_uri_mismatch when it does not match exactly. The client secret comes back masked. allowSignup false means Google only signs in people who already have an account or an outstanding invitation, which is the default and keeps the instance invite-only. Admin only. No arguments.

​
admin_set_google_config

Configure Google sign-in Set the Google OAuth client id and secret, and decide who may sign up. Only the fields you pass are changed. Setting a client id and secret puts a Continue with Google button on the sign-in page; clearing the client id takes it away and changes nothing else, so it is a safe thing to undo. allowSignup is the one with consequences: true lets ANYONE with a Google account create an account on this instance, so pair it with allowedDomains unless you really mean the whole internet. False — the default — still lets existing members and anyone holding an unexpired invitation sign in with Google; it only turns away strangers. Follow with admin_get_google_config for the redirect URI to register. Admin only. Overwrites or deletes.

​
admin_get_billing_config

Check billing configuration Whether Stripe billing is wired up for hosting other people on this instance for a fee, how many users currently pay, and the exact webhook URL to paste into the Stripe Dashboard. Keys come back masked. Billing only governs users who arrived through a Stripe checkout — the owner and free invitees are never touched by it. Admin only. No arguments.

​
admin_set_billing_config

Configure billing Set the Stripe API key, the webhook signing secret, and the public Payment Link for this instance. Only the fields you pass are changed. Prefer a RESTRICTED key (rk_…) with read-only Customers and Subscriptions over the full secret key — reading those two things is all this app ever does with Stripe, and a restricted key that leaks cannot move money or alter the Stripe account. Follow with admin_get_billing_config to see the webhook URL to register in Stripe. Admin only. Overwrites or deletes.

​
admin_sync_billing

Resync billing from Stripe Asks Stripe for the current subscription state and reconciles this instance against it — the recovery path for a missed webhook. Pass an email to sync one billed user, or nothing to sync everyone with a Stripe customer attached. Reports what changed per person: activated, suspended, or unchanged. Safe to run any time. Admin only. Overwrites or deletes. Reaches outside this instance. Link or unlink a member and their Stripe customer Attaches an EXISTING member to their Stripe customer so billing starts governing their access. This never happens automatically: a checkout email is whatever the payer typed, so the unattended webhook only ever invites strangers — connecting a current member to a subscription is a deliberate admin act, and this tool is that act. Pass their email; their Stripe customer is found by the same email in Stripe’s records, or pass customerId when Stripe holds several. Pass unlink true to detach someone from billing entirely — the recovery hatch if a link was wrong; it also ends billing’s authority over their account. The owner can never be linked. Admin only. Overwrites or deletes. Reaches outside this instance.

​
admin_list_variables

List instance variables Every configurable value on this instance in one list: its key, what it does, what it is set to now, and whether it is still on the built-in default. This is the whole of what a self-hosted instance stores as configuration, so start here when someone asks where a setting lives or why the app is behaving a certain way. Secrets come back masked — no tool ever returns a raw key. Variables an admin added by hand are marked known:false; they have no form in the app and are read by whatever feature asked for them. Admin only. No arguments.

​
admin_set_variable

Set an instance variable Changes one instance setting by key — the general way in, for anything without a tool of its own. Take the key from admin_list_variables and send the new value as a string; an on-off variable takes “1” or “0”. Prefer admin_set_email_config or admin_set_billing_config where they apply, because they also report whether that area now works. Sending an empty value for a secret leaves it alone rather than clearing it — admin_delete_variable is how you clear one. A key nothing recognises creates a new variable, which is how a setting exists before it has a screen: lowercase letters, numbers and underscores. Every change is written to the audit log against your name, values included, so never put a secret in a key that is not declared as one. Admin only. Overwrites or deletes.

​
admin_delete_variable

Clear an instance variable Removes a variable’s stored value. A setting the app declares falls back to its built-in default — clearing the Resend key stops every invitation email, clearing company_logos turns logos back on — and a variable an admin added disappears entirely. Call admin_list_variables first to see what the default would be, because this is the one settings call with no undo. Recorded in the audit log. Admin only. Overwrites or deletes.