Core

50 entities and 207 agent-callable operations in core. Each operation is addressed as {mega_tool}/core/{entity}/{operation} and carries the same permission check over MCP and REST.

`artifact_email`

Operation	Mega-tool	What it does
`send`	`notification_send`	Email an artifact/file to the authenticated user's own email.

`audit_log`

Operation	Mega-tool	What it does
`list`	`entity_crud`	Query the system audit trail with filters
`tenant_audit_export`	`report_query`	Export the caller's TENANT audit log (SystemAuditLog) completely, in keyset-cursor pages.

`breach_incident`

Operation	Mega-tool	What it does
`get_transitions`	`workflow_action`	Get available transitions for a breach incident
`transition`	`workflow_action`	Transition breach incident to a new status

`email_config_test`

Operation	Mega-tool	What it does
`send`	`notification_send`	Send a tenant email-config verification test email to the authenticated user (no attachment).

`enforcement_preflight`

Operation	Mega-tool	What it does
`mfa`	`report_query`	Who would mfa_enforcement='enforce' deny in this organization right now?
`password_expiry`	`report_query`	Who would password_expiry_enforcement='enforce' deny in this organization right now?

`entity_voice`

Operation	Mega-tool	What it does
`render`	`smart_action`	Render a non-human 'entity voice' (e.g.

`feature_flag`

Operation	Mega-tool	What it does
`list`	`report_query`	Resolved feature-flag map for an organization with per-flag provenance (org / ancestor:<id> / tenant / default), plus the org's raw overlay.
`update`	`entity_crud`	Set or clear a per-organization feature-flag override.

`gateway_model`

Operation	Mega-tool	What it does
`invoke`	`config_manage`	Run ONE call against a hand-selected Bedrock Converse model.
`list`	`config_manage`	List the hand-selectable Bedrock Converse models (id, label, vendor, regions, per-1M pricing, context window) with each model's LIVE enabled state from the…

`llm_routing_policy`

Operation	Mega-tool	What it does
`disable`	`entity_crud`	Disable the org's LLM routing policy (revert to the Bedrock-only default).
`enable`	`entity_crud`	Enable the org's LLM routing policy (multi-provider routing takes effect).
`get`	`entity_crud`	Get the current org's LLM routing policy (returns the implicit Bedrock-only default if none is configured)
`set`	`entity_crud`	Set (create-or-replace) the org's LLM routing policy.
`update`	`entity_crud`	Update fields on the org's LLM routing policy (same semantics as set).

`llm_settings`

Operation	Mega-tool	What it does
`get`	`config_manage`	Get the tenant LLM configuration status (provider, model, key presence, inheritance source)
`list`	`config_manage`	List the curated LLM model options for a provider (gemini, local_llm or bedrock)
`set`	`config_manage`	Save tenant LLM settings (provider+model+key/url) to the root org for both service types
`test`	`config_manage`	Test the LLM connection live (uses provided or stored provider/model/key/url)

`llm_usage`

Operation	Mega-tool	What it does
`breakdown`	`report_query`	LLM usage cost BREAKDOWN for one tenant: which organizations or users inside the tenant consumed which model families, in estimated USD, calls and tokens.
`matrix`	`report_query`	LLM usage cost MATRIX: rows = tenant (platform admins), organization or user; columns = model family; each cell = estimated USD, calls, failed calls, unpriced…
`summary`	`report_query`	LLM usage and estimated cost for an organization over a time window, rolled up by model, purpose, provider or day.
`timeseries`	`report_query`	LLM usage cost per UTC day, split by model family — the daily stacked-cost series behind the LLM Cost admin page.

`mfa_enrollment`

Operation	Mega-tool	What it does
`list`	`report_query`	Paginated per-user MFA enrolment state: totp_enabled, webauthn_enabled, mfa_exempt (+ expiry), and federated identities.
`summary`	`report_query`	Per-organization MFA enrolment counts: total / active / totp_enabled / webauthn_enabled / federated-capable / neither.

`oidc_authentication_log`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List OIDC authentication log entries for the current tenant
`read`	`entity_crud`	Get a single OIDC authentication log entry

`oidc_identity_provider`

Operation	Mega-tool	What it does
`activate`	`entity_crud`	Activate an OIDC identity provider (requires resolved endpoints + JWKS)
`create`	`entity_crud`	Create a new OIDC identity provider.
`deactivate`	`entity_crud`	Deactivate an OIDC identity provider
`delete`	`entity_crud`	Delete an OIDC identity provider
`discover`	`entity_crud`	Probe an OIDC discovery document without persisting (to pre-fill a create form)
`list`	`entity_crud`	List OIDC identity providers for the current tenant
`read`	`entity_crud`	Get detailed OIDC identity provider information
`refresh_discovery`	`entity_crud`	Re-fetch the OIDC discovery document, refreshing endpoints + JWKS
`update`	`entity_crud`	Update an existing OIDC identity provider

`org_voice_profile`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a non-human 'entity voice' in the active organization (e.g.
`delete`	`entity_crud`	Delete (soft) a voice profile in the active organization.
`list`	`entity_crud`	List every voice profile in the active organization's SUBTREE (self + every live descendant org, D-20) — both the org's human users' own profiles and its…
`read`	`entity_crud`	Read one voice profile in the active organization's SUBTREE (self + every live descendant org, D-20) in full — norms, relationship overlays, and…
`update`	`entity_crud`	Update a voice profile in the active organization.

`organization`

Operation	Mega-tool	What it does
`create_organization`	`entity_crud`	Create a new child organization under an existing parent
`delete_organization`	`entity_crud`	Soft-delete an organization (root protected; must have no live children; member users are soft-deleted)
`list`	`entity_crud`	List organizations the user has access to (hierarchical tree view)
`list`	`smart_action`	List organizations
`move_organization`	`entity_crud`	Move an organization to a new parent in the hierarchy
`read`	`entity_crud`	Get details of a specific organization
`reorder_organization`	`entity_crud`	Reorder an organization among its siblings (direction up\|down), swapping sort_order
`set_mfa_enforcement`	`smart_action`	Move an organization's MFA enforcement ladder (off \| monitor \| grace \| enforce).
`set_password_expiry_enforcement`	`smart_action`	Move an organization's password-expiry enforcement ladder (off \| monitor \| grace \| enforce).
`switch`	`smart_action`	Switch active organization
`update_organization`	`entity_crud`	Update organization name and/or module settings

`organization_context`

Operation	Mega-tool	What it does
`get`	`config_manage`	Get the current organization context for this MCP session
`list`	`config_manage`	List all organizations the user has access to (hierarchical tree view)
`set`	`config_manage`	Switch the current organization context for this MCP session

`page_view`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List page_views with filtering and pagination
`read`	`entity_crud`	Get detailed page view information
`search`	`entity_crud`	Search page_views with fuzzy matching

`permission`

Operation	Mega-tool	What it does
`categories`	`entity_crud`	List RBAC permissions grouped by category with metadata (mirrors the REST permission categories endpoint)
`list`	`entity_crud`	List available RBAC permissions with filtering
`list_by_app`	`entity_crud`	List RBAC permissions grouped by functional category (codename prefix)
`read`	`entity_crud`	Get details of a specific RBAC permission

`role`

Operation	Mega-tool	What it does
`bulk_activate`	`entity_crud`	Bulk activate roles (tenant + org-hierarchy scoped)
`bulk_deactivate`	`entity_crud`	Bulk deactivate roles (system roles excluded; tenant + org-hierarchy scoped)
`create`	`entity_crud`	Create a new custom role with RBAC-validated permissions
`delete_role`	`entity_crud`	Delete a custom role (system roles are protected)
`grant_permission_scope`	`entity_crud`	Wholesale-grant a role a whole catalog SCOPE of Prism permissions in one call (UNION add — never removes).
`list`	`entity_crud`	List roles in the organization hierarchy with filtering and pagination
`read`	`entity_crud`	Get detailed role information including permissions
`set_active`	`entity_crud`	Activate or deactivate a single custom role (system roles cannot be deactivated)
`update`	`entity_crud`	Update an existing custom role (name, description, and/or RBAC-validated permissions)

`saml_identity_provider`

Operation	Mega-tool	What it does
`activate`	`entity_crud`	Activate a SAML Identity Provider so it is available for SSO
`create`	`entity_crud`	Create a new SAML identity provider
`deactivate`	`entity_crud`	Deactivate a SAML Identity Provider so it is no longer available for SSO
`delete`	`entity_crud`	Delete a SAML identity provider
`import_metadata`	`entity_crud`	Import SAML IdP metadata from URL or raw XML and populate IdP fields
`list`	`entity_crud`	List SAML identity providers for the current tenant
`read`	`entity_crud`	Get detailed SAML identity provider information
`regenerate_certificate`	`entity_crud`	Regenerate IdP signing certificate.
`update`	`entity_crud`	Update an existing SAML identity provider

`saml_service_provider`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create SAML service provider configuration
`download_metadata`	`entity_crud`	Generate and return the SP SAML metadata XML for upload to the IdP
`list`	`entity_crud`	List SAML service provider configurations
`read`	`entity_crud`	Get SAML service provider configuration
`regenerate_certificate`	`entity_crud`	Regenerate the SP signing key and self-signed X.509 certificate (PEM).
`update`	`entity_crud`	Update SAML service provider configuration

`scim_attribute_mapping`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a SCIM attribute mapping
`delete`	`entity_crud`	Delete a SCIM attribute mapping
`list`	`entity_crud`	List SCIM attribute mappings for the current tenant
`read`	`entity_crud`	Get a single SCIM attribute mapping
`update`	`entity_crud`	Update a SCIM attribute mapping

`scim_configuration`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create SCIM configuration for tenant
`disable`	`entity_crud`	Disable SCIM provisioning for this tenant's configuration.
`enable`	`entity_crud`	Enable SCIM provisioning for this tenant's configuration.
`list`	`entity_crud`	List SCIM configurations for the tenant
`read`	`entity_crud`	Get SCIM configuration details
`regenerate_token`	`entity_crud`	Regenerate the SCIM bearer token (plaintext shown only once).
`update`	`entity_crud`	Update SCIM configuration

`scim_external_mapping`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List SCIM external-ID mappings for the current tenant
`read`	`entity_crud`	Get a single SCIM external-ID mapping

`scim_group_mapping`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a SCIM group mapping
`delete`	`entity_crud`	Delete a SCIM group mapping
`list`	`entity_crud`	List SCIM group mappings for the current tenant
`read`	`entity_crud`	Get a single SCIM group mapping
`update`	`entity_crud`	Update a SCIM group mapping

`scim_provisioning_log`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List SCIM provisioning log entries for the current tenant
`read`	`entity_crud`	Get a single SCIM provisioning log entry including full request/response bodies
`stats`	`entity_crud`	SCIM provisioning rollup: 24h/7d success/failure counts + by-operation + by-resource-type

`scim_sync_state`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List SCIM sync states for the current tenant
`read`	`entity_crud`	Get a single SCIM sync state

`sso_domain`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a new SSO domain
`delete`	`entity_crud`	Delete an SSO domain
`list`	`entity_crud`	List SSO domains for the tenant
`read`	`entity_crud`	Get SSO domain details
`update`	`entity_crud`	Update an SSO domain
`verify`	`entity_crud`	Verify SSO domain ownership via DNS TXT record or HTTP file lookup.

`subscription`

Operation	Mega-tool	What it does
`get_transitions`	`workflow_action`	Get available transitions for a subscription
`list`	`entity_crud`	List subscriptions for the tenant
`read`	`entity_crud`	Get details of a specific subscription
`read_current`	`entity_crud`	Get the current active subscription for the tenant
`transition`	`workflow_action`	Transition subscription to a new status
`update`	`entity_crud`	Update subscription settings

`tenant`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List tenants (platform admin only)
`read`	`entity_crud`	Get details of the current tenant or a specific tenant (platform admin)
`read_current`	`entity_crud`	Get details of the current user's tenant

`tenant_email_config`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create tenant email configuration
`delete`	`entity_crud`	Reset the tenant's email configuration to platform defaults (deletes the custom config row)
`get_defaults`	`entity_crud`	Get the tenant's effective email config without an id; returns system defaults when no row exists
`list`	`entity_crud`	List tenant email configurations
`read`	`entity_crud`	Get tenant email configuration details
`update`	`entity_crud`	Update tenant email configuration

`tenant_provider_credential`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a BYO LLM provider credential for the current tenant/org.
`delete`	`entity_crud`	Delete a BYO LLM provider credential
`disable`	`entity_crud`	Disable a BYO LLM provider credential
`enable`	`entity_crud`	Enable a BYO LLM provider credential (so the gateway/Studio may use it)
`get`	`entity_crud`	Get a BYO LLM provider credential (org-subtree scoped; secret never returned)
`list`	`entity_crud`	List BYO LLM provider credentials visible to the current org (org-subtree scoped; secrets never returned)
`test_connection`	`entity_crud`	Test a BYO LLM provider credential with a tiny 1-token call.
`update`	`entity_crud`	Update a BYO LLM provider credential.

`theme`

Operation	Mega-tool	What it does
`get`	`config_manage`	Get the organization's effective theme — the full appearance document with inheritance from parent orgs already resolved, including sidebarLaunchExpanded /…
`set`	`config_manage`	Partially update the organization's theme.

`theme_background`

Operation	Mega-tool	What it does
`delete_upload`	`config_manage`	Delete one of the org's uploaded background files by filename (see operation='get').
`get`	`config_manage`	Get the org's iOS home-screen wallpaper selection: current backgroundConfig, the curated catalog ids, and the org's uploaded background files.
`set`	`config_manage`	Set the org's iOS home-screen wallpaper.

`ui_preference`

Operation	Mega-tool	What it does
`delete`	`config_manage`	Delete ONE of the acting user's UI preferences for the active organization, reverting them to the client default for that key.
`get`	`config_manage`	Read ONE of the acting user's UI preferences for the active organization.
`list`	`config_manage`	List the ACTING user's own UI preferences for the active organization as {key: value}, plus the whitelist of settable keys.
`set`	`config_manage`	Create or replace ONE of the acting user's UI preferences for the active organization (upsert — the first call creates the row).

`user`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a new user in the organization
`deactivate`	`workflow_action`	Deactivate a user account: soft-delete it and revoke every live credential (sessions, JWT refresh tokens, operator impersonations, MCP tokens).
`delete`	`entity_crud`	Soft-delete a user (sets is_active=False and deleted_at) AND revoke every live credential — sessions, JWT refresh tokens, operator impersonations and MCP…
`disable_totp`	`smart_action`	Admin-disable a user's two-factor authentication (TOTP): clears totp_enabled/secret/backup codes and runs TOTPService cache cleanup.
`list`	`entity_crud`	List users in the organization hierarchy with filtering and pagination
`reactivate`	`workflow_action`	Return a deactivated user account to service, clearing BOTH tombstone fields (is_active and deleted_at).
`read`	`entity_crud`	Get detailed user information including roles and permissions
`reset_password`	`smart_action`	Email a password-reset link to a user (admin-initiated).
`revoke_webauthn_credential`	`smart_action`	Admin-revoke one of a user's WebAuthn credentials (passkey / security key), so it can no longer authenticate.
`search`	`entity_crud`	Search for users with flexible matching
`set_password`	`smart_action`	Admin-set a user's password directly (admin reset).
`update`	`entity_crud`	Update an existing user

`user_audit`

Operation	Mega-tool	What it does
`export_csv`	`report_query`	Export a user's audit logs as CSV (capped at 10,000 rows).

`user_identity`

Operation	Mega-tool	What it does
`delete`	`entity_crud`	Revoke a linked identity.
`list`	`entity_crud`	List linked upstream identities (password / OAuth / SAML / OIDC) for users in the caller's organization subtree
`read`	`entity_crud`	Get a single linked identity

`user_mcp`

Operation	Mega-tool	What it does
`add_override`	`config_manage`	Add a per-user MCP override (tool or category enable/disable)
`clear_overrides`	`config_manage`	Clear all per-user MCP overrides (revert to inheritance)
`disable_customization`	`config_manage`	Disable per-user MCP customization (clear all user-level configs, revert to inheritance)
`enable_customization`	`config_manage`	Enable per-user MCP customization (overrides become active once added)
`get`	`config_manage`	Get a user's effective MCP configuration (servers/categories/tools + overrides) with inheritance
`remove_override`	`config_manage`	Remove a single per-user MCP override by override_id
`toggle_category`	`config_manage`	Toggle an entire MCP tool category on/off for a user
`toggle_tool`	`config_manage`	Toggle a single MCP tool on/off for a user

`user_modules`

Operation	Mega-tool	What it does
`explain`	`config_manage`	Explain a user's home screen: per-module decision trace (which layer decided — enabled_modules tier / custom-app grant / tenant hide ceiling) for the target…
`get`	`config_manage`	Get a user's per-user app/module access settings with inheritance metadata.
`revert`	`config_manage`	Revert a user's app/module access to organization inheritance (delete per-user override)
`set`	`config_manage`	Set a user's per-user app/module access (enabled apps + default app); enables customization.

`user_permission_override`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a user permission override
`delete`	`entity_crud`	Delete a user permission override
`list`	`entity_crud`	List user permission overrides
`read`	`entity_crud`	Get user permission override details
`update`	`entity_crud`	Update a user permission override

`user_permissions`

Operation	Mega-tool	What it does
`apply_bulk`	`config_manage`	Apply multiple per-user permission overrides at once (bulk grant/deny)
`clear_all`	`config_manage`	Clear all per-user permission overrides (revert to purely role-based permissions)
`disable_customization`	`config_manage`	Disable per-user permission customization (clears ALL overrides, reverts to role-based)
`enable_customization`	`config_manage`	Enable per-user permission customization (marks the user as having custom overrides)

`user_role`

Operation	Mega-tool	What it does
`assign_role`	`entity_crud`	Assign a role to an existing user (RBAC anti-escalation enforced)
`remove_role`	`entity_crud`	Remove a role from an existing user

`user_voice_profile`

Operation	Mega-tool	What it does
`get`	`config_manage`	Read the ACTING user's own voice profile for the active organization — register/format/vocabulary norms, the on/off switches, the version counter, and every…
`record_edit`	`smart_action`	Record one human edit of an AI draft against the ACTING user's voice profile — the draft you produced and the text the human actually sent.
`render`	`smart_action`	Render user voice profile.
`set`	`config_manage`	Create or update the ACTING user's own voice profile (upsert — the first call creates it, so there is no separate 'create').

`utility`

Operation	Mega-tool	What it does
`audit_logs`	`smart_action`	Get audit logs
`org_statistics`	`smart_action`	Get organization statistics
`user_activity`	`smart_action`	Get user activity log

`voice_feedback`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List the ACTING user's draft-edit feedback rows, newest first, optionally filtered by status.
`read`	`entity_crud`	Read one of the ACTING user's draft-edit feedback rows in full, including the verbatim draft and final texts.
`update`	`entity_crud`	Triage one of the ACTING user's draft-edit feedback rows: set its `status` and/or write the `lesson` distilled from it.

`voice_relationship`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a per-recipient voice overlay for the ACTING user.
`delete`	`entity_crud`	Delete one of the ACTING user's voice overlays.
`list`	`entity_crud`	List the ACTING user's per-recipient voice overlays in the active organization.
`read`	`entity_crud`	Read one of the ACTING user's voice overlays by id.
`update`	`entity_crud`	Update one of the ACTING user's voice overlays.

`webauthn_credential`

Operation	Mega-tool	What it does
`list`	`report_query`	List a user's live WebAuthn credentials (passkeys / security keys): id, name, created_at, last_used_at, transports, attachment, backup_eligible.

`webhook_event`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List every webhook event_type registered in the platform (document.uploaded, agent.completed, mission.started, etc.).

Parameter schemas and permission codenames are in the full reference — sign in — or call prism_introspect(dimension="capability_search", query="…") with your key.

In the full reference this application appears under config_manage, entity_crud, notification_send, report_query, smart_action, workflow_action.