Tool Sources

GET /api/orgs/{org_id}/tool-sources

List Tool Sources

List available tool sources for an org.

Returns built-in AgentDepot/system sources and any upstream MCP servers the caller can use: org-shared ones plus their own private connections (:func:_viewer_user_id). IntegrationService.list_integrations applies no visibility filter of its own, so without the check below this endpoint listed other members’ private connections as tool sources — the mirror image of the tools listing, which used to hide the caller’s own. Requires org membership.

Parameters

Name	In	Type	Required	Description
org_id	path	string (uuid)	yes

Responses

Status	Description	Body
200	Successful Response	ToolSourcesResponse
422	Validation Error	HTTPValidationError

GET /api/orgs/{org_id}/tool-sources/scopes

List Grantable Scopes

Return the set of coarse capability/integration scopes grantable to an agent.

Enumerates all org tools via the same gateway discovery path used by
``GET /tool-sources/tools``, then groups them by ``core``/``scope`` to
produce a short list of toggles the UI renders in the agent scope selector.

**Core group** — always-on tools (``ToolDefinition.core == True``). Shown
read-only; never stored in ``Agent.allowed_tools``.

**Scope items** — one item per distinct non-null scope string encountered
across all non-core tool definitions. Each item carries the scope string
(the value to store in ``Agent.allowed_tools`` when toggled on), a human
label, the source kind discriminator, and the tool count + slug list for
tooltip/expand.

agent_id (uuid or slug) scopes the answer to one agent. Pass it whenever the caller is configuring a specific agent: the catalog then reflects what that agent can reach, including its owner’s private connections when it runs as its owner. Omit it for the org-wide catalog, which sees shared connections only.

Requires org membership (JWT bearer or ``agd_*`` API token).

Parameters

Name	In	Type	Required	Description
agent_id	query	string	no
org_id	path	string (uuid)	yes

Responses

Status	Description	Body
200	Successful Response	GrantableScopesResponse
422	Validation Error	HTTPValidationError

GET /api/orgs/{org_id}/tool-sources/tools

List Tools

List all individual tools available for an org.

Delegates to :class:~agentdepot_agents.tool_gateway.gateway.ToolGateway for unified discovery across system, custom, upstream MCP, and native integration tool sources. Requires org membership.

The catalog covers the connections the caller can actually use: org-shared ones plus their own private ones (:func:_viewer_user_id). It is what the connections page filters by source_key to fill a connection’s Tools card, so a viewer-blind read here renders as “No tools exposed” on a healthy private connection.

The response is additive-compatible: name, source, and description are byte-identical to the pre-gateway shape; slug, backend_ref, access_level, is_terminal, and is_pausable are new additive fields.

Parameters

Name	In	Type	Required	Description
org_id	path	string (uuid)	yes

Responses

Status	Description	Body
200	Successful Response	ToolListResponse
422	Validation Error	HTTPValidationError

POST /api/orgs/{org_id}/tool-sources/tools/refresh

Refresh Tools

Force-refresh the org’s upstream MCP tool cache and return the full tool list.

Reconnects to all the org’s upstream MCP servers, re-enumerates their tools, and persists the refreshed definitions to the per-integration cache. Returns the same tool list shape as GET /tool-sources/tools.

Per-server failures inside enumeration are isolated — a dead server simply contributes no tools and its prior cache is left untouched; the endpoint still returns 200 with whatever tools resolved. refreshed therefore carries the per-server account: which servers were dialed, which answered, and what each contributed. An empty refreshed means nothing was contacted, which a bare 200 cannot say.

Unlike background discovery, this path ignores the stored health verdict and dials every upstream: a human pressing “refresh” is asking for exactly the re-test the verdict would suppress. A server that answers has its verdict corrected to ok on the spot.

“Every upstream” means every one the caller can see — org-shared plus their own private connections (:func:_viewer_user_id). Passing no viewer is what made this endpoint a no-op on a private connection: the row was filtered out before anything dialed, so the button reported success having contacted nothing and the Tools card stayed empty.

Requires org membership (JWT bearer or agd_* API token).

Parameters

Name	In	Type	Required	Description
org_id	path	string (uuid)	yes

Responses

Status	Description	Body
200	Successful Response	ToolRefreshResponse
422	Validation Error	HTTPValidationError