How the connection is scoped
Per person
Every call is authenticated as an individual user. There is no anonymous access and no shared company key.
Server-resolved
The server resolves your organization, membership and role from the verified token before every call — it never takes them from the model.
Rate limited
120 calls per minute per user.
Because tenancy is resolved server-side, a model cannot ask for another organization’s context however it phrases the request. It is never asked which organization it wants.
Read and write
Read tools retrieve context, and return only what your account is entitled to see — including your own private context, and nobody else’s. Write tools split by scope. Your own private context is written directly. Anything that would be true for the whole company becomes a proposal a human approves. See Governed truth.Errors you may meet
Unauthenticated
No valid token. The client should follow the OAuth flow advertised in the response.
Not a member anywhere
The user is signed in but belongs to no organization. Create or join a company in Riktra first.
Insufficient permission
The tool requires an administrator role. The role is checked in the database, not in the tool description.
Too many calls
The limit is 120 per minute per user. The response says when the window resets.
About these pages
Every tool page in this section is generated fromlib/mcp/catalog.ts, and a test asserts that the catalog matches the tools actually registered on the server. A tool cannot ship undocumented, and this reference cannot drift from the implementation — CI fails on any difference.