@rymi/mcp 2.6.0 → 2.8.0

package/README.md

@@ -65,7 +65,7 @@ Run the server on your own machine — it speaks **stdio** by default and talks
 
 > **Options:** `RYMI_MCP_READONLY=1` hides every mutating tool (including `create_call`, `batch_call`, `publish_agent`). `RYMI_WORKSPACE` makes the local server act in that workspace (sent as the `Rymi-Workspace` header). On the hosted endpoint, send the `Rymi-Workspace` header on the HTTP request instead. Every tool also takes an optional `workspace` argument, so one connection can act in any workspace it can reach, such as an agency's client workspaces.
 >
-> This package speaks **stdio** only. `--transport http` was removed in 2.0.0 — use the hosted endpoint above, which the local server could never match on auth (it has no OAuth, and no per-key tool gating).
+> This package speaks **stdio** only. `--transport http` was removed in 2.0.0. Use the hosted endpoint above. The local server has no OAuth. It does filter tools by the key's scopes.
 
 ## 🧰 Tools
 
@@ -136,8 +136,12 @@ Run the server on your own machine — it speaks **stdio** by default and talks
 <td><code>estimate_call_cost</code> · <code>set_auto_recharge</code> · <code>set_spend_alerts</code></td>
 </tr>
 <tr>
+<td><b>Accounts</b></td>
+<td><code>list_accounts</code> · <code>list_account_members</code> · <code>add_account_member</code> · <code>remove_account_member</code></td>
+</tr>
+<tr>
 <td><b>Workspaces</b></td>
-<td><code>list_workspaces</code> · <code>create_workspace</code> · <code>update_workspace</code> · <code>get_workspace_usage</code> · <code>list_workspace_members</code> · <code>add_workspace_member</code> · <code>remove_workspace_member</code></td>
+<td><code>list_workspaces</code> · <code>create_workspace</code> · <code>update_workspace</code> · <code>delete_workspace</code> · <code>get_workspace_usage</code> · <code>list_workspace_members</code> · <code>add_workspace_member</code> · <code>remove_workspace_member</code></td>
 </tr>
 <tr>
 <td><b>Compliance settings</b></td>
@@ -151,8 +155,9 @@ Run the server on your own machine — it speaks **stdio** by default and talks
 
 What restrains them depends on which server you're talking to.
 
-- **Hosted** `mcp.rymi.live` — tools are filtered by your **tenant role**, on both OAuth and API keys. An `owner`/`admin` sees everything; a `member` gets agent-scoped tools only, with account-scoped writes (billing, keys, numbers, DNC) never registered. `RYMI_MCP_READONLY` does not apply there.
-- **Local** `@rymi/mcp` — no role filtering. Full write surface unless you start it with `RYMI_MCP_READONLY=1`, which hides every mutating tool at once. That flag is set by whoever *starts* the server, so it guards a local run you configure, not a key you hand out.
+- **Hosted** `mcp.rymi.live` over OAuth: tools are filtered by role. Account Owner is `owner`. Account Admin and workspace Admin are `admin`. Anyone else is `member`. An `owner`/`admin` sees every tool. A `member` gets agent-scoped tools only, with account-scoped writes (billing, keys, numbers, DNC) left out. `RYMI_MCP_READONLY` does not apply there.
+- **A secret key**, hosted or local: the server calls `GET /v1/keys/self` once and lists tools whose scope the key holds. A legacy key lists every tool. A billing write from that list still returns `scope_missing`.
+- **Local** `@rymi/mcp`: no OAuth role filter. `RYMI_MCP_READONLY=1` hides every mutating tool on top of the key's scopes. That flag is set by whoever starts the server.
 
 Either way, role filtering bounds the **tool surface**, not the credential: a key or token stays valid against the REST API directly. Treat MCP access as equivalent to handing over your own account access.
 

package/dist/index.js

@@ -371,15 +371,23 @@ var require_dist = __commonJS({
     var __toCommonJS2 = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
     var index_exports = {};
     __export2(index_exports, {
+      BILLING_WRITE: () => BILLING_WRITE,
       defineTool: () => defineTool,
+      keyAllowsTool: () => keyAllowsTool2,
       opsToolCatalog: () => opsToolCatalog2,
       resolveToolDisposition: () => resolveToolDisposition,
       withWorkspaceParam: () => withWorkspaceParam2
     });
     module2.exports = __toCommonJS2(index_exports);
+    var BILLING_WRITE = "billing:write";
     function defineTool(def) {
       return def;
     }
+    function keyAllowsTool2(tool, key) {
+      if (tool.keyScopes.includes(BILLING_WRITE)) return false;
+      if (key.legacy === true) return true;
+      return tool.keyScopes.every((scope) => key.scopes.includes(scope));
+    }
     var PRIVILEGED = /* @__PURE__ */ new Set(["owner", "admin"]);
     function resolveToolDisposition(p) {
       if (p.risk === "read") return "execute";
@@ -459,6 +467,8 @@ var require_dist = __commonJS({
         description: "List all your Rymi AI voice agents.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents"],
+        keyScopes: ["agents:read"],
         input: {
           limit: import_zod.z.number().int().min(1).max(500).optional().describe("Max agents to return (default 50)"),
           offset: import_zod.z.number().int().min(0).optional().describe("Pagination offset")
@@ -470,6 +480,8 @@ var require_dist = __commonJS({
         description: "Retrieve a single Rymi voice agent by ID.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id"],
+        keyScopes: ["agents:read"],
         input: { agent_id: import_zod.z.string().uuid().describe("The agent UUID") },
         run: (client, { agent_id }) => client.agents.retrieve(agent_id)
       }),
@@ -478,6 +490,8 @@ var require_dist = __commonJS({
         description: "Fetch all available LLM models and voices you can use when creating or updating an agent. Always call this before create_agent to pick valid values.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/llm-options"],
+        keyScopes: ["agents:read"],
         input: {},
         run: (client) => client.agents.llmOptions()
       }),
@@ -486,6 +500,8 @@ var require_dist = __commonJS({
         description: "List available agent/TTS voices, optionally filtered by provider or model. Much smaller payload than list_llm_options \u2014 use this to pick a `voice` value for create_agent/update_agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/llm-options"],
+        keyScopes: ["agents:read"],
         input: {
           provider: import_zod.z.string().optional().describe('Filter to one voice provider, e.g. "elevenlabs", "sarvam", "gemini", "cartesia", "deepgram".'),
           model_id: import_zod.z.string().optional().describe("Filter to voices compatible with a given model id (matched against the voice's supported_model_ids).")
@@ -518,6 +534,8 @@ var require_dist = __commonJS({
         description: "Preview the resolved per-language model stack (STT/LLM/TTS), blockers, warnings, and model diffs for a set of supported languages \u2014 without saving. Use before create/update to confirm a multi-language setup is valid.",
         scope: "agent",
         risk: "read",
+        routes: ["POST /v1/agents/stack-preview"],
+        keyScopes: ["agents:write"],
         input: {
           supported_languages: import_zod.z.array(import_zod.z.string()).min(1).describe('BCP-47 languages to resolve a stack for, e.g. ["hi-IN","en-US"].'),
           language: import_zod.z.string().optional().describe("Primary BCP-47 language (defaults to the first supported language)."),
@@ -530,6 +548,8 @@ var require_dist = __commonJS({
         description: "List calls made with a specific agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/calls"],
+        keyScopes: ["agents:read"],
         input: {
           agent_id: import_zod.z.string().uuid(),
           limit: import_zod.z.number().int().min(1).max(200).optional(),
@@ -543,6 +563,8 @@ var require_dist = __commonJS({
         description: "Check whether an agent is ready to go live. Returns a validation report without persisting any changes.",
         scope: "agent",
         risk: "read",
+        routes: ["POST /v1/agents/validate-publish"],
+        keyScopes: ["agents:write"],
         input: {
           agent_id: import_zod.z.string().uuid().optional().describe("Merge validation with a persisted agent"),
           name: import_zod.z.string().optional(),
@@ -557,6 +579,8 @@ var require_dist = __commonJS({
         description: "Validate and resolve a flat key/value change-set against the AgentConfig field registry. Does NOT persist \u2014 follow up with update_agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id", "POST /v1/agents/apply-changes"],
+        keyScopes: ["agents:read", "agents:write"],
         input: {
           agent_id: import_zod.z.string().uuid().describe("Agent to load currentConfig from (recommended)"),
           changes: import_zod.z.array(import_zod.z.object({ key: import_zod.z.string(), value: import_zod.z.any() })).describe("Array of {key, value} field changes"),
@@ -579,6 +603,8 @@ var require_dist = __commonJS({
         description: "Use AI + Google Search grounding to auto-generate a company description from a website URL, suitable for an agent's persona.",
         scope: "agent",
         risk: "read",
+        routes: ["POST /v1/agents/enrich-company"],
+        keyScopes: ["agents:write"],
         input: {
           company_name: import_zod.z.string().min(1),
           website_url: import_zod.z.string().url()
@@ -590,6 +616,8 @@ var require_dist = __commonJS({
         description: "Use AI to generate an agent configuration draft from a plain-text description.",
         scope: "agent",
         risk: "read",
+        routes: ["POST /v1/agents/generate"],
+        keyScopes: ["agents:write"],
         input: {
           prompt: import_zod.z.string().min(1).describe("Description of the agent you want to create"),
           mode: import_zod.z.enum(["create", "edit"]).optional().default("create"),
@@ -603,6 +631,8 @@ var require_dist = __commonJS({
         description: 'Create a new Rymi AI voice agent. Call list_llm_options first to discover valid voice and model values. For a multi-language agent, set supported_languages (e.g. ["hi-IN","en-US"]).',
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/agents"],
+        keyScopes: ["agents:write"],
         input: {
           name: import_zod.z.string().min(1).describe("Studio label: the name shown in the sidebar/agent list only. The name the agent speaks is persona.name."),
           ...agentConfigFields
@@ -614,6 +644,8 @@ var require_dist = __commonJS({
         description: "Update an existing Rymi voice agent's configuration. Only the fields you pass are changed; nullable fields accept null to clear them.",
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "PUT /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: {
           agent_id: import_zod.z.string().uuid().describe("The agent UUID to update"),
           name: import_zod.z.string().optional().describe("Studio label (sidebar/agent list only). To change the spoken name, set persona.name."),
@@ -627,6 +659,8 @@ var require_dist = __commonJS({
         description: "Permanently delete a Rymi voice agent.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["GET /v1/agents", "DELETE /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: { agent_id: import_zod.z.string().uuid().describe("The agent UUID to delete") },
         run: async (client, { agent_id }) => client.agents.delete(await resolveAgentId(client, agent_id))
       }),
@@ -635,6 +669,8 @@ var require_dist = __commonJS({
         description: 'Duplicate an existing agent. The copy gets " (Copy)" appended to its name.',
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "POST /v1/agents/:id/clone"],
+        keyScopes: ["agents:read", "agents:write"],
         input: { agent_id: import_zod.z.string().uuid().describe("The agent UUID to clone") },
         run: async (client, { agent_id }) => client.agents.clone(await resolveAgentId(client, agent_id))
       })
@@ -646,6 +682,8 @@ var require_dist = __commonJS({
         description: "List previous and active calls across your account.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls"],
+        keyScopes: ["calls:read"],
         input: {
           limit: import_zod2.z.number().int().min(1).max(200).optional().describe("Max calls to return"),
           offset: import_zod2.z.number().int().min(0).optional().describe("Pagination offset"),
@@ -659,6 +697,8 @@ var require_dist = __commonJS({
         description: "List calls currently in progress.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/active"],
+        keyScopes: ["calls:read"],
         input: {
           limit: import_zod2.z.number().int().min(1).max(200).optional(),
           offset: import_zod2.z.number().int().min(0).optional()
@@ -670,6 +710,8 @@ var require_dist = __commonJS({
         description: "Retrieve details, participants, status, duration, and cost for a single call.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/:id"],
+        keyScopes: ["calls:read"],
         input: { call_id: import_zod2.z.string().describe("The call ID") },
         run: (client, { call_id }) => client.calls.retrieve(call_id)
       }),
@@ -678,6 +720,8 @@ var require_dist = __commonJS({
         description: "Retrieve the post-call summary for a call.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/:id/summary"],
+        keyScopes: ["calls:read"],
         input: { call_id: import_zod2.z.string().describe("The call ID") },
         run: (client, { call_id }) => client.calls.summary(call_id)
       }),
@@ -686,6 +730,8 @@ var require_dist = __commonJS({
         description: "Retrieve the full transcript for a call. May contain personal data \u2014 handle accordingly.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/:id/transcript"],
+        keyScopes: ["calls:read"],
         input: { call_id: import_zod2.z.string().describe("The call ID") },
         run: (client, { call_id }) => client.calls.transcript(call_id)
       }),
@@ -694,6 +740,8 @@ var require_dist = __commonJS({
         description: "Retrieve recording metadata (e.g. playback URL) for a call, when recording is enabled.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/:id/recording"],
+        keyScopes: ["calls:read"],
         input: { call_id: import_zod2.z.string().describe("The call ID") },
         run: (client, { call_id }) => client.calls.recording(call_id)
       }),
@@ -702,6 +750,8 @@ var require_dist = __commonJS({
         description: "Retrieve current outbound call queue statistics.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/calls/queue/stats"],
+        keyScopes: ["calls:read"],
         input: {},
         run: (client) => client.calls.queueStats()
       }),
@@ -710,6 +760,8 @@ var require_dist = __commonJS({
         description: "Re-run post-call intelligence (summary, extraction, evaluation) for a call.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/calls/:id/reprocess"],
+        keyScopes: ["calls:write"],
         input: { call_id: import_zod2.z.string().describe("The call ID to reprocess") },
         run: (client, { call_id }) => client.calls.reprocess(call_id)
       }),
@@ -718,6 +770,8 @@ var require_dist = __commonJS({
         description: "WARNING: places a real, billable PSTN call. `from_number` is the caller ID shown to the recipient and must be a phone number registered to your account \u2014 omit it to use the agent's attached number. `identity` is the destination in strict E.164 (e.g. +15555550123).",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/calls"],
+        keyScopes: ["calls:write"],
         input: {
           agent_id: import_zod2.z.string().uuid().describe("The agent that will handle the call"),
           participants: import_zod2.z.array(import_zod2.z.object({
@@ -737,6 +791,8 @@ var require_dist = __commonJS({
         description: "Queue up to 500 outbound PSTN recipients in one request. WARNING: places real phone calls and incurs per-minute charges. `from_number` is the caller ID shown to the recipient and must be a phone number registered to your account.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/calls/batch"],
+        keyScopes: ["calls:write"],
         input: {
           agent_id: import_zod2.z.string().uuid().describe("The agent that will handle the calls"),
           to: import_zod2.z.array(import_zod2.z.string()).optional().describe("Simple list of destination phone numbers"),
@@ -758,6 +814,8 @@ var require_dist = __commonJS({
         description: "WARNING: immediately terminates an in-progress call. The call transitions to completed and post-call processing runs.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/calls/:id/end"],
+        keyScopes: ["calls:write"],
         input: { call_id: import_zod2.z.string().describe("The call ID to end") },
         run: (client, { call_id }) => client.calls.end(call_id)
       }),
@@ -766,6 +824,8 @@ var require_dist = __commonJS({
         description: "WARNING: dials/adds participants to a live call (warm transfer / conference). PSTN additions are billable.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/calls/:id/participants"],
+        keyScopes: ["calls:write"],
         input: {
           call_id: import_zod2.z.string().describe("The in-progress call ID"),
           participants: import_zod2.z.array(import_zod2.z.object({
@@ -785,6 +845,8 @@ var require_dist = __commonJS({
         description: "List all phone numbers on your Rymi account and which agent each is attached to.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/numbers"],
+        keyScopes: ["numbers:read"],
         input: {
           limit: import_zod3.z.number().int().min(1).max(500).optional(),
           offset: import_zod3.z.number().int().min(0).optional()
@@ -796,6 +858,8 @@ var require_dist = __commonJS({
         description: "Register a phone number on your account, optionally attaching it to an agent.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/numbers"],
+        keyScopes: ["numbers:write"],
         input: {
           number: import_zod3.z.string().describe("Phone number in E.164 format (e.g. +14155550123)"),
           agent_id: import_zod3.z.string().uuid().optional().describe("Agent to attach the number to on registration")
@@ -807,6 +871,8 @@ var require_dist = __commonJS({
         description: "Attach an existing number to an agent so inbound calls route to it.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/numbers/:number/attach"],
+        keyScopes: ["numbers:write"],
         input: {
           number: import_zod3.z.string().describe("Phone number in E.164 format"),
           agent_id: import_zod3.z.string().uuid().describe("Agent to route this number to")
@@ -818,6 +884,8 @@ var require_dist = __commonJS({
         description: "Remove a phone number from your account. The number stops routing to any agent.",
         scope: "account",
         risk: "sensitive",
+        routes: ["DELETE /v1/numbers/:number"],
+        keyScopes: ["numbers:write"],
         input: { number: import_zod3.z.string().describe("Phone number in E.164 format") },
         run: (client, { number }) => client.numbers.remove(number)
       })
@@ -828,6 +896,8 @@ var require_dist = __commonJS({
         description: "Report whether a telephony carrier is connected, and which provider/account.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/telephony/status"],
+        keyScopes: ["numbers:read"],
         input: {},
         run: (client) => client.telephony.status()
       }),
@@ -836,6 +906,8 @@ var require_dist = __commonJS({
         description: "List numbers available on the connected telephony carrier account.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/telephony/numbers"],
+        keyScopes: ["numbers:read"],
         input: {},
         run: (client) => client.telephony.numbers()
       })
@@ -846,6 +918,8 @@ var require_dist = __commonJS({
         description: "List publishable (browser-safe) keys and which agent/channels each is scoped to. Returns key prefixes only, never full secrets.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/keys/publishable"],
+        keyScopes: ["keys:read"],
         input: {},
         run: (client) => client.keys.listPublishable()
       })
@@ -857,6 +931,8 @@ var require_dist = __commonJS({
         description: "List the knowledge sources (RAG context) attached to an agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/knowledge-sources"],
+        keyScopes: ["knowledge:read"],
         input: { agent_id: import_zod4.z.string().uuid().describe("The agent UUID") },
         run: (client, { agent_id }) => client.agents.listKnowledgeSources(agent_id)
       }),
@@ -865,6 +941,8 @@ var require_dist = __commonJS({
         description: "List recorded configuration changes for an agent (for auditing or before an undo).",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/changes"],
+        keyScopes: ["agents:read"],
         input: {
           agent_id: import_zod4.z.string().uuid().describe("The agent UUID"),
           since: import_zod4.z.string().optional().describe("ISO timestamp \u2014 only return changes after this time")
@@ -876,6 +954,8 @@ var require_dist = __commonJS({
         description: "Add a knowledge source to an agent from raw text or a URL (the URL is fetched and ingested).",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/agents/:id/knowledge-sources"],
+        keyScopes: ["knowledge:write"],
         input: {
           agent_id: import_zod4.z.string().uuid().describe("The agent UUID"),
           kind: import_zod4.z.enum(["text", "url"]).describe("Source type"),
@@ -893,6 +973,8 @@ var require_dist = __commonJS({
         description: "Delete a knowledge source from an agent.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["DELETE /v1/agents/:id/knowledge-sources/:sourceId"],
+        keyScopes: ["knowledge:write"],
         input: {
           agent_id: import_zod4.z.string().uuid().describe("The agent UUID"),
           source_id: import_zod4.z.string().describe("The knowledge source ID to delete")
@@ -904,6 +986,8 @@ var require_dist = __commonJS({
         description: "Undo a single recorded configuration change, reverting that field to its previous value.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/agents/:id/changes/:changeId/undo"],
+        keyScopes: ["agents:write"],
         input: {
           agent_id: import_zod4.z.string().uuid().describe("The agent UUID"),
           change_id: import_zod4.z.string().describe("The change_id to undo (from list_agent_changes)")
@@ -918,6 +1002,8 @@ var require_dist = __commonJS({
         description: "Get this account's usage summary: remaining voice-runtime MINUTES, Studio AI unit usage, and post-call intelligence usage. Voice balance is reported in minutes, not dollars.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/billing/usage-summary"],
+        keyScopes: ["billing:read"],
         input: {},
         run: (client) => client.billing.usageSummary()
       }),
@@ -926,6 +1012,8 @@ var require_dist = __commonJS({
         description: "List published agent templates. Use a template's `defaults` as the starting config for create_agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agent-templates"],
+        keyScopes: ["agents:read"],
         input: {},
         run: (client) => client.templates.list()
       }),
@@ -934,6 +1022,8 @@ var require_dist = __commonJS({
         description: "List previous evaluation runs for an agent.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/evals/runs"],
+        keyScopes: ["agents:read"],
         input: { agent_id: import_zod5.z.string().uuid().describe("The agent UUID") },
         run: (client, { agent_id }) => client.agents.listEvalRuns(agent_id)
       }),
@@ -942,6 +1032,8 @@ var require_dist = __commonJS({
         description: "Retrieve a single evaluation run, including per-scenario scores.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/evals/runs/:runId"],
+        keyScopes: ["agents:read"],
         input: {
           agent_id: import_zod5.z.string().uuid().describe("The agent UUID"),
           run_id: import_zod5.z.string().describe("The evaluation run ID")
@@ -953,6 +1045,8 @@ var require_dist = __commonJS({
         description: 'Run the evaluation suite for an agent. mode="synthetic" (default) uses the offline scorer; mode="live" runs the model-driven runner (consumes Studio AI units). Set judge=true to supplement the synthetic heuristics with an opt-in LLM judge (requires a Gemini key; consumes Studio AI units).',
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/agents/:id/evals/run"],
+        keyScopes: ["agents:write"],
         input: {
           agent_id: import_zod5.z.string().uuid().describe("The agent UUID to evaluate"),
           mode: import_zod5.z.enum(["synthetic", "live"]).optional().describe("Evaluation mode (default synthetic)"),
@@ -970,6 +1064,8 @@ var require_dist = __commonJS({
         description: "Run the eval SUITE across many agents at once (agents \xD7 seeded scenarios) with bounded concurrency. One eval run is persisted per agent (visible in the per-agent eval UI); the aggregate report is returned. Set judge=true to add the LLM judge (requires a Gemini key; consumes Studio AI units).",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/agents/evals/suite"],
+        keyScopes: ["agents:write"],
         input: {
           agent_ids: import_zod5.z.array(import_zod5.z.string().uuid()).min(1).describe("Agent UUIDs to evaluate"),
           scenario_ids: import_zod5.z.array(import_zod5.z.string()).optional().describe("Optional subset of seeded scenario ids; omit to run all"),
@@ -991,6 +1087,8 @@ var require_dist = __commonJS({
         description: "Publish a Rymi voice agent to make its current saved configuration live. IMPORTANT: this immediately makes the agent callable by end users. Returns published:false with a blockers list when the config has unresolved issues.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["GET /v1/agents", "POST /v1/agents/:id/publish"],
+        keyScopes: ["agents:read", "agents:write"],
         input: {
           agent_id: import_zod6.z.string().uuid().describe("The agent UUID to publish")
         },
@@ -1008,6 +1106,8 @@ var require_dist = __commonJS({
         description: "List all numbers on your Do-Not-Call registry.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/dnc"],
+        keyScopes: ["contacts:read"],
         input: {
           limit: import_zod7.z.number().int().min(1).max(500).optional(),
           offset: import_zod7.z.number().int().min(0).optional()
@@ -1019,6 +1119,8 @@ var require_dist = __commonJS({
         description: "Check whether phone numbers are on the Do-Not-Call registry. Read-only \u2014 adds nothing.",
         scope: "account",
         risk: "read",
+        routes: ["POST /v1/dnc/check"],
+        keyScopes: ["contacts:write"],
         input: { phone_numbers: import_zod7.z.array(import_zod7.z.string()).min(1).max(500).describe("E.164 numbers to check") },
         run: (client, { phone_numbers }) => client.dnc.check({ phone_numbers })
       }),
@@ -1027,6 +1129,8 @@ var require_dist = __commonJS({
         description: "Add a phone number to the Do-Not-Call registry so outbound calls to it are blocked.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/dnc"],
+        keyScopes: ["contacts:write"],
         input: {
           phone_number: import_zod7.z.string().describe("Phone number (any format; normalized to E.164)"),
           reason: import_zod7.z.string().optional()
@@ -1038,6 +1142,8 @@ var require_dist = __commonJS({
         description: "Add up to 1000 numbers to the Do-Not-Call registry. Invalid numbers are skipped and returned in `invalid`.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/dnc/batch"],
+        keyScopes: ["contacts:write"],
         input: {
           phone_numbers: import_zod7.z.array(import_zod7.z.string()).min(1).max(1e3),
           reason: import_zod7.z.string().optional()
@@ -1049,6 +1155,8 @@ var require_dist = __commonJS({
         description: "WARNING: removes a number from the Do-Not-Call registry, re-enabling outbound calls to it.",
         scope: "account",
         risk: "sensitive",
+        routes: ["DELETE /v1/dnc/:phone"],
+        keyScopes: ["contacts:write"],
         input: { phone: import_zod7.z.string().describe("Phone number to remove") },
         run: (client, { phone }) => client.dnc.remove(phone)
       })
@@ -1061,6 +1169,8 @@ var require_dist = __commonJS({
         description: "List your registered webhook endpoints. Signing secrets are never returned.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/webhooks"],
+        keyScopes: ["webhooks:read"],
         input: {
           limit: import_zod8.z.number().int().min(1).max(500).optional(),
           offset: import_zod8.z.number().int().min(0).optional()
@@ -1072,6 +1182,8 @@ var require_dist = __commonJS({
         description: "Register a webhook to receive call lifecycle events (e.g. call.completed, transcript.ready). URL must be public https. If you omit `secret`, one is generated and shown ONCE in the response \u2014 store it to verify signatures.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/webhooks"],
+        keyScopes: ["webhooks:write"],
         input: {
           url: import_zod8.z.string().url().describe("Public https endpoint"),
           events: import_zod8.z.array(import_zod8.z.string()).min(1).describe("Event names to subscribe to"),
@@ -1089,6 +1201,8 @@ var require_dist = __commonJS({
         description: "Update a webhook endpoint. Only provided fields change. Pass `secret` to rotate it.",
         scope: "account",
         risk: "write",
+        routes: ["PATCH /v1/webhooks/:id"],
+        keyScopes: ["webhooks:write"],
         input: {
           id: import_zod8.z.string(),
           url: import_zod8.z.string().url().optional(),
@@ -1103,6 +1217,8 @@ var require_dist = __commonJS({
         description: "WARNING: stops event delivery to this endpoint.",
         scope: "account",
         risk: "sensitive",
+        routes: ["DELETE /v1/webhooks/:id"],
+        keyScopes: ["webhooks:write"],
         input: { id: import_zod8.z.string() },
         run: (client, { id }) => client.webhooks.delete(id)
       })
@@ -1114,6 +1230,8 @@ var require_dist = __commonJS({
         description: "Estimate how much balance a call will consume for a custom model stack and duration. Results are usage estimates; surface remaining balance to customers in minutes.",
         scope: "account",
         risk: "read",
+        routes: ["POST /v1/billing/estimate"],
+        keyScopes: ["agents:read"],
         input: {
           stt_model: import_zod9.z.string().optional(),
           llm_model: import_zod9.z.string().optional(),
@@ -1127,6 +1245,8 @@ var require_dist = __commonJS({
         description: "Configure auto-recharge. `pack_usd` must exceed `threshold_usd` or the API rejects it (recharge-loop guard).",
         scope: "account",
         risk: "sensitive",
+        routes: ["PUT /v1/billing/auto-recharge"],
+        keyScopes: [BILLING_WRITE],
         input: {
           enabled: import_zod9.z.boolean().optional(),
           pack_usd: import_zod9.z.number().min(1).max(1e3).optional(),
@@ -1139,6 +1259,8 @@ var require_dist = __commonJS({
         description: "Configure spend-alert thresholds and low-balance / email preferences.",
         scope: "account",
         risk: "write",
+        routes: ["PUT /v1/billing/alerts"],
+        keyScopes: [BILLING_WRITE],
         input: {
           thresholds_usd: import_zod9.z.array(import_zod9.z.number()).max(10).optional(),
           low_balance_pct: import_zod9.z.number().min(0).max(100).optional(),
@@ -1155,6 +1277,8 @@ var require_dist = __commonJS({
         description: "List campaigns for the authenticated tenant, paginated.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns"],
+        keyScopes: ["campaigns:read"],
         input: {
           limit: import_zod10.z.number().int().min(1).max(200).optional().describe("Max campaigns to return"),
           offset: import_zod10.z.number().int().min(0).optional().describe("Pagination offset"),
@@ -1169,6 +1293,8 @@ var require_dist = __commonJS({
         description: "Retrieve a single campaign by id, including its goal, policies, status, and stat counters.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns/:id"],
+        keyScopes: ["campaigns:read"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID") },
         run: (client, { campaign_id }) => client.campaigns.get(campaign_id)
       }),
@@ -1177,6 +1303,8 @@ var require_dist = __commonJS({
         description: "Retrieve the campaign report: stat_* summary counters plus outcome/sentiment/hourly/snapshot distributions. Cost is reported in credits, durations in minutes.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns/:id/report"],
+        keyScopes: ["campaigns:read"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID") },
         run: (client, { campaign_id }) => client.campaigns.report(campaign_id)
       }),
@@ -1185,6 +1313,8 @@ var require_dist = __commonJS({
         description: "List a campaign's dial attempts, paginated.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns/:id/attempts"],
+        keyScopes: ["campaigns:read"],
         input: {
           campaign_id: import_zod10.z.string().describe("The campaign ID"),
           limit: import_zod10.z.number().int().min(1).max(200).optional(),
@@ -1198,6 +1328,8 @@ var require_dist = __commonJS({
         description: "List a campaign's improvement suggestions (from the detectors + LLM proposal engine), paginated.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns/:id/suggestions"],
+        keyScopes: ["campaigns:read"],
         input: {
           campaign_id: import_zod10.z.string().describe("The campaign ID"),
           limit: import_zod10.z.number().int().min(1).max(200).optional(),
@@ -1211,6 +1343,8 @@ var require_dist = __commonJS({
         description: "List tenant-level contacts, paginated.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/contacts"],
+        keyScopes: ["contacts:read"],
         input: {
           limit: import_zod10.z.number().int().min(1).max(200).optional(),
           offset: import_zod10.z.number().int().min(0).optional()
@@ -1223,6 +1357,8 @@ var require_dist = __commonJS({
         description: "Create a new campaign in draft status against a published agent. Does not launch it or place any calls.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/campaigns"],
+        keyScopes: ["campaigns:write"],
         input: {
           agent_id: import_zod10.z.string().uuid().describe("The agent that will handle campaign calls"),
           type: import_zod10.z.enum(["outbound", "inbound"]).describe("Campaign type"),
@@ -1248,6 +1384,8 @@ var require_dist = __commonJS({
         description: "Import inline contact rows (JSON or CSV) into a campaign: creates/merges contacts and attaches them as campaign members in one call.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/campaigns/:id/members/import"],
+        keyScopes: ["campaigns:write"],
         input: {
           campaign_id: import_zod10.z.string().describe("The campaign ID"),
           contacts: import_zod10.z.array(import_zod10.z.record(import_zod10.z.any())).optional().describe("Inline contact rows as JSON objects"),
@@ -1260,6 +1398,8 @@ var require_dist = __commonJS({
         description: "WARNING: launches a campaign, which places real outbound PSTN calls at scale and incurs per-minute charges for every recipient dialed. Validates launch blockers first (published snapshot, valid members, caller ID, DNC, credits, follow-up connectors); if blockers fail, no calls are placed.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/campaigns/:id/launch"],
+        keyScopes: ["campaigns:write"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID to launch") },
         run: (client, { campaign_id }) => client.campaigns.launch(campaign_id)
       }),
@@ -1268,6 +1408,8 @@ var require_dist = __commonJS({
         description: "Pause a running campaign. In-flight calls finish naturally; no new attempts are scheduled until resumed.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/campaigns/:id/pause"],
+        keyScopes: ["campaigns:write"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID to pause") },
         run: (client, { campaign_id }) => client.campaigns.pause(campaign_id)
       }),
@@ -1276,6 +1418,8 @@ var require_dist = __commonJS({
         description: "Resume a paused campaign. WARNING: resuming re-enables outbound dialing and will incur further per-minute charges as attempts continue.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/campaigns/:id/resume"],
+        keyScopes: ["campaigns:write"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID to resume") },
         run: (client, { campaign_id }) => client.campaigns.resume(campaign_id)
       }),
@@ -1284,6 +1428,8 @@ var require_dist = __commonJS({
         description: "Accept an improvement suggestion. Agent-editing suggestions create an agent-changes draft for review; campaign-policy suggestions patch the campaign directly.",
         scope: "agent",
         risk: "write",
+        routes: ["POST /v1/campaigns/:id/suggestions/:suggestionId/accept"],
+        keyScopes: ["campaigns:write"],
         input: {
           campaign_id: import_zod10.z.string().describe("The campaign ID"),
           suggestion_id: import_zod10.z.string().describe("The suggestion ID to accept")
@@ -1295,6 +1441,8 @@ var require_dist = __commonJS({
         description: "Get a campaign's lead-intake URL settings (consent and default-country handling, last used). Returns intake: null if none. The URL itself is only shown when created or rotated.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/campaigns/:id/intake"],
+        keyScopes: ["campaigns:read"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID") },
         run: (client, { campaign_id }) => client.campaigns.intake.get(campaign_id)
       }),
@@ -1303,6 +1451,8 @@ var require_dist = __commonJS({
         description: 'Create a lead-intake URL for a campaign, or update its settings. Lead sources (website forms, Typeform, Google Apps Script, Zapier/Make) POST leads to the URL with no API key; a running campaign dials them within its calling window. The URL is returned ONCE on create (url: null on later updates) and anyone holding it can add numbers to the campaign. assume_voice_consent=true treats every posted lead as consenting to calls; default_country (e.g. "IN") makes local numbers without +<code> dialable.',
         scope: "agent",
         risk: "sensitive",
+        routes: ["PUT /v1/campaigns/:id/intake"],
+        keyScopes: ["campaigns:write"],
         input: {
           campaign_id: import_zod10.z.string().describe("The campaign ID"),
           assume_voice_consent: import_zod10.z.boolean().optional().describe("Treat every posted lead as having voice consent"),
@@ -1315,6 +1465,8 @@ var require_dist = __commonJS({
         description: "Issue a new lead-intake URL for a campaign. The old URL stops accepting leads immediately, so every lead source must be updated.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/campaigns/:id/intake/rotate"],
+        keyScopes: ["campaigns:write"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID") },
         run: (client, { campaign_id }) => client.campaigns.intake.rotate(campaign_id)
       }),
@@ -1323,6 +1475,8 @@ var require_dist = __commonJS({
         description: "Remove a campaign's lead-intake URL. Leads already accepted stay in the campaign.",
         scope: "agent",
         risk: "write",
+        routes: ["DELETE /v1/campaigns/:id/intake"],
+        keyScopes: ["campaigns:write"],
         input: { campaign_id: import_zod10.z.string().describe("The campaign ID") },
         run: async (client, { campaign_id }) => {
           await client.campaigns.intake.disable(campaign_id);
@@ -1471,6 +1625,8 @@ var require_dist = __commonJS({
         description: "List an agent's tool bindings (API tools / call_webhook, handoff, calendar, \u2026). Header values are shown only as {{secrets.NAME}} references; literal values are [redacted].",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents", "GET /v1/agents/:id"],
+        keyScopes: ["agents:read"],
         input: { agent_id: import_zod11.z.string().describe("The agent UUID") },
         run: async (client, { agent_id }) => {
           const agentId = await resolveAgentId(client, agent_id);
@@ -1483,6 +1639,8 @@ var require_dist = __commonJS({
         description: `Add an API tool (call_webhook) to an agent, keeping its existing tools. The agent can then call the endpoint mid-call with the fields you define. ${LIVE_NOTE}`,
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "GET /v1/agents/:id", "PUT /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: addShape,
         run: async (client, params) => {
           const p = import_zod11.z.object(addShape).parse(params);
@@ -1515,6 +1673,8 @@ var require_dist = __commonJS({
         description: `Change one API tool (call_webhook) on an agent by name. Only the settings you pass change; fields replaces the whole list, headers merge by name. ${LIVE_NOTE}`,
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "GET /v1/agents/:id", "PUT /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: updateShape,
         run: async (client, params) => {
           const p = import_zod11.z.object(updateShape).parse(params);
@@ -1554,6 +1714,8 @@ var require_dist = __commonJS({
         description: `Remove one API tool (call_webhook) from an agent by name, keeping its other tools. ${LIVE_NOTE}`,
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "GET /v1/agents/:id", "PUT /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: { agent_id: import_zod11.z.string().describe("The agent UUID"), name: import_zod11.z.string().describe("Name of the API tool to remove.") },
         run: async (client, { agent_id, name }) => {
           const { agentId, tools } = await writeTools(client, agent_id, (tools2) => {
@@ -1568,6 +1730,8 @@ var require_dist = __commonJS({
         description: `Switch built-in tools on or off for one agent: calendar (check/list/create/update/delete), lookup_customer, lookup_ticket/create_ticket, send_whatsapp_message, send_telegram_message, send_asset, handoff_to_human, schedule_callback, and the always-on ones (end_call, forget_me, knowledge_search, get_caller_history, datetime_now). Groups: "calendar" (all five calendar tools), "tickets". Connected-app tools are opt-in per agent: connecting the app for the workspace makes them available, and an agent gets one only when switched on here or in Studio; it also needs the app connected (Settings \u2192 Connectors) to work on calls. Other agents are not affected. ${LIVE_NOTE}`,
         scope: "agent",
         risk: "write",
+        routes: ["GET /v1/agents", "GET /v1/agents/:id", "PUT /v1/agents/:id"],
+        keyScopes: ["agents:read", "agents:write"],
         input: {
           agent_id: import_zod11.z.string().describe("The agent UUID"),
           tools: import_zod11.z.array(import_zod11.z.string()).min(1).describe('Tool ids or groups, e.g. ["calendar"] or ["send_whatsapp_message", "send_asset"].'),
@@ -1584,6 +1748,8 @@ var require_dist = __commonJS({
         description: "List the workspace's API-tool secret names and the host each is pinned to. Values are never returned.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/tool-secrets"],
+        keyScopes: ["connections:read"],
         input: {},
         run: (client) => client.toolSecrets.list()
       }),
@@ -1592,6 +1758,8 @@ var require_dist = __commonJS({
         description: 'Create or replace a workspace secret for API-tool headers, referenced as "{{secrets.NAME}}" (e.g. header x-api-key: "{{secrets.RESERVATIONS_API_KEY}}"). The value is encrypted, write-only, and only ever sent to `host`. Replacing an existing name changes it for every agent that references it.',
         scope: "account",
         risk: "sensitive",
+        routes: ["PUT /v1/tool-secrets/:name"],
+        keyScopes: ["connections:write"],
         input: {
           name: import_zod11.z.string().describe("UPPER_SNAKE_CASE, 2\u201364 characters."),
           value: import_zod11.z.string().min(1).max(4096).describe("The secret value. Never echoed back."),
@@ -1611,6 +1779,8 @@ var require_dist = __commonJS({
         description: "Get an agent's public share link (URL, limits, minutes used). Returns link: null if none exists yet.",
         scope: "agent",
         risk: "read",
+        routes: ["GET /v1/agents/:id/testers"],
+        keyScopes: ["agents:read"],
         input: { agent_id: import_zod12.z.string().uuid().describe("The agent UUID") },
         run: (client, { agent_id }) => client.agents.getShareLink(agent_id)
       }),
@@ -1619,6 +1789,8 @@ var require_dist = __commonJS({
         description: "Create an agent's public share link, or update its settings. Anyone with the URL can talk to the agent in a browser, billed to this workspace. Defaults on create: 30-minute pool, 300 s per call, 2 concurrent calls, 3 calls per IP per hour. Set enabled=false to switch the link off.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["PUT /v1/agents/:id/share-link"],
+        keyScopes: ["agents:write"],
         input: {
           agent_id: import_zod12.z.string().uuid().describe("The agent UUID"),
           enabled: import_zod12.z.boolean().optional().describe("Turn the link on or off"),
@@ -1634,6 +1806,8 @@ var require_dist = __commonJS({
         description: "Issue a new URL for an agent's share link. The old URL stops working immediately.",
         scope: "agent",
         risk: "sensitive",
+        routes: ["POST /v1/agents/:id/share-link/regenerate"],
+        keyScopes: ["agents:write"],
         input: { agent_id: import_zod12.z.string().uuid().describe("The agent UUID") },
         run: (client, { agent_id }) => client.agents.regenerateShareLink(agent_id)
       })
@@ -1645,26 +1819,32 @@ var require_dist = __commonJS({
         description: "List the workspaces this credential can act in, marking the current one. Client workspaces show their agency in parent_id. Act in another by setting RYMI_WORKSPACE (local MCP) or the Rymi-Workspace header.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/workspaces"],
+        keyScopes: [],
         input: {},
         run: (client) => client.workspaces.list()
       }),
       defineTool({
         name: "create_workspace",
-        description: "Create a standalone workspace you own, or, with parent, a client workspace of an agency workspace you run. The agency pays for a client workspace's calls. Neither gets the free monthly credit.",
+        description: "Create a workspace in an account you own or administer. The account pays for its calls. New workspaces don't get the free monthly credit.",
         scope: "account",
         risk: "write",
+        routes: ["POST /v1/workspaces"],
+        keyScopes: ["workspaces:write"],
         input: {
           name: import_zod13.z.string().min(1).max(80).describe("Workspace name"),
           operating_country: import_zod13.z.string().length(2).optional().describe('ISO-3166 alpha-2 country, e.g. "IN"'),
-          parent: import_zod13.z.string().optional().describe("Agency workspace id. Makes this a client workspace the agency pays for.")
+          parent: import_zod13.z.string().optional().describe("Any workspace in the account to create it in (defaults to the current account).")
         },
         run: (client, params) => client.workspaces.create(params)
       }),
       defineTool({
         name: "get_workspace_usage",
-        description: "Calls, minutes and credits for one workspace in a calendar month (UTC). Use it to invoice a client workspace. Credits are left out for client-role users.",
+        description: "Calls, minutes and credits for one workspace in a calendar month (UTC). Use it to bill a customer for one workspace. Credits are left out for the client and viewer roles.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/workspaces/:id/usage"],
+        keyScopes: ["analytics:read"],
         input: {
           workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces"),
           month: import_zod13.z.string().regex(/^\d{4}-\d{2}$/).optional().describe("YYYY-MM; default this month")
@@ -1673,42 +1853,60 @@ var require_dist = __commonJS({
       }),
       defineTool({
         name: "update_workspace",
-        description: "Rename a workspace, change its operating country, or set a client workspace's monthly spend cap in credits (1 credit = $0.01; null removes the cap). Calls in that client workspace stop at the cap until next month.",
+        description: "Rename a workspace, change its operating country, or set its monthly spend cap in credits (1 credit = $0.01; null removes the cap). Calls in that workspace stop at the cap until next month. The cap needs an account Owner or Admin.",
         scope: "account",
         risk: "write",
+        routes: ["PATCH /v1/workspaces/:id"],
+        keyScopes: ["workspaces:write"],
         input: {
           workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces"),
           name: import_zod13.z.string().min(1).max(80).optional().describe("New name"),
           operating_country: import_zod13.z.string().length(2).nullable().optional().describe('ISO-3166 alpha-2 country, e.g. "IN"; null clears it'),
-          spend_cap_cents_monthly: import_zod13.z.number().int().min(0).nullable().optional().describe("Client workspaces only: monthly cap in credits; null removes it")
+          spend_cap_cents_monthly: import_zod13.z.number().int().min(0).nullable().optional().describe("Monthly cap in credits; null removes it")
         },
         run: (client, { workspace_id, ...patch }) => client.workspaces.update(workspace_id, patch)
       }),
+      defineTool({
+        name: "delete_workspace",
+        description: "Delete an empty workspace: no agents, numbers, calls or campaigns left in it. Only the account Owner may. The account's primary workspace can't be deleted.",
+        scope: "account",
+        risk: "sensitive",
+        routes: ["DELETE /v1/workspaces/:id"],
+        keyScopes: ["workspaces:write"],
+        input: { workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces") },
+        run: (client, params) => client.workspaces.delete(params.workspace_id)
+      }),
       defineTool({
         name: "list_workspace_members",
-        description: "People in a workspace and their roles (owner, admin, client).",
+        description: "People in a workspace and their roles (admin, editor, client, viewer).",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/workspaces/:id/members"],
+        keyScopes: ["workspace_members:read"],
         input: { workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces") },
         run: (client, params) => client.workspaces.listMembers(params.workspace_id)
       }),
       defineTool({
         name: "add_workspace_member",
-        description: "Add a person by email. A client workspace takes the client role (sees calls and minutes, edits contacts, the do-not-call list, knowledge and the transfer number); other workspaces take admin. Someone without a Rymi account gets an invite email.",
+        description: "Add a person by email with a workspace role: admin, editor, client (sees calls and minutes, edits contacts, the do-not-call list, knowledge and the transfer number) or viewer (reads what a client sees). The role defaults to client. Someone without a Rymi account gets an invite email.",
         scope: "account",
         risk: "sensitive",
+        routes: ["POST /v1/workspaces/:id/members"],
+        keyScopes: ["workspace_members:write"],
         input: {
           workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces"),
           email: import_zod13.z.string().email().describe("Their email address"),
-          role: import_zod13.z.enum(["admin", "client"]).optional().describe("Defaults to the role the workspace takes")
+          role: import_zod13.z.enum(["admin", "editor", "client", "viewer"]).optional().describe("Workspace role; default client")
         },
         run: (client, { workspace_id, ...member }) => client.workspaces.addMember(workspace_id, member)
       }),
       defineTool({
         name: "remove_workspace_member",
-        description: "Remove a person's access to a workspace. The owner can't be removed.",
+        description: "Remove a person's role in a workspace.",
         scope: "account",
         risk: "sensitive",
+        routes: ["DELETE /v1/workspaces/:id/members/:userId"],
+        keyScopes: ["workspace_members:write"],
         input: {
           workspace_id: import_zod13.z.string().describe("Workspace id from list_workspaces"),
           user_id: import_zod13.z.string().describe("user_id from list_workspace_members")
@@ -1731,6 +1929,8 @@ var require_dist = __commonJS({
         description: "Read the workspace's compliance settings: operating country, callee-local calling hours, do-not-call check, voice consent, recording-notice default and allowed destination countries. Compliance is the customer's responsibility; these settings help.",
         scope: "account",
         risk: "read",
+        routes: ["GET /v1/compliance/settings"],
+        keyScopes: ["compliance:read"],
         input: {},
         run: (client) => client.compliance.getSettings()
       }),
@@ -1739,6 +1939,8 @@ var require_dist = __commonJS({
         description: "Change the workspace's compliance settings. Setting operating_country fills every setting not already edited from that country's preset. Blocked calls fail with destination_not_allowed, outside_calling_hours or no_voice_consent.",
         scope: "account",
         risk: "write",
+        routes: ["PUT /v1/compliance/settings"],
+        keyScopes: ["compliance:write"],
         input: {
           operating_country: import_zod14.z.string().length(2).nullable().optional().describe('ISO country, e.g. "IN"'),
           rules: rules.optional()
@@ -1746,6 +1948,57 @@ var require_dist = __commonJS({
         run: (client, params) => client.compliance.updateSettings(params)
       })
     ];
+    var import_zod15 = require("zod");
+    var accountId = import_zod15.z.string().describe("Account id from list_accounts");
+    var accountTools = [
+      defineTool({
+        name: "list_accounts",
+        description: "List the accounts you belong to and your role in each (owner, admin, or billing).",
+        scope: "account",
+        risk: "read",
+        routes: ["GET /v1/accounts"],
+        keyScopes: [],
+        input: {},
+        run: (client) => client.accounts.list()
+      }),
+      defineTool({
+        name: "list_account_members",
+        description: "List people in an account and their roles (owner, admin, billing).",
+        scope: "account",
+        risk: "read",
+        routes: ["GET /v1/accounts/:id/members"],
+        keyScopes: ["account_members:read"],
+        input: { account_id: accountId },
+        run: (client, { account_id }) => client.accounts.members.list(account_id)
+      }),
+      defineTool({
+        name: "add_account_member",
+        description: "Add a person to an account by email, with role owner, admin, or billing. An owner can grant owner. An admin can grant admin or billing.",
+        scope: "account",
+        risk: "sensitive",
+        routes: ["POST /v1/accounts/:id/members"],
+        keyScopes: ["account_members:write"],
+        input: {
+          account_id: accountId,
+          email: import_zod15.z.string().email().describe("Their email address"),
+          role: import_zod15.z.enum(["owner", "admin", "billing"]).describe("Account role")
+        },
+        run: (client, { account_id, email, role }) => client.accounts.members.add(account_id, { email, role })
+      }),
+      defineTool({
+        name: "remove_account_member",
+        description: "Remove a person from an account. The last owner stays.",
+        scope: "account",
+        risk: "sensitive",
+        routes: ["DELETE /v1/accounts/:id/members/:userId"],
+        keyScopes: ["account_members:write"],
+        input: {
+          account_id: accountId,
+          user_id: import_zod15.z.string().describe("User id from list_account_members")
+        },
+        run: (client, { account_id, user_id }) => client.accounts.members.remove(account_id, user_id)
+      })
+    ];
     var import_agentTools2 = (init_agentTools(), __toCommonJS(agentTools_exports));
     var REDACTED = "[redacted]";
     function redactToolSecrets(value) {
@@ -1765,31 +2018,38 @@ var require_dist = __commonJS({
       }
       return out;
     }
+    function publish(tools) {
+      return tools.map((t) => ({
+        ...t,
+        run: async (client, params) => redactToolSecrets(await t.run(client, params))
+      }));
+    }
     var opsToolCatalog2 = [
-      ...agentTools,
-      ...agentToolBindingTools,
-      ...callTools,
-      ...numberTools,
-      ...telephonyTools,
-      ...keyTools,
-      ...knowledgeTools,
-      ...insightTools,
-      ...publishTools,
-      ...dncTools,
-      ...webhookTools,
-      ...billingTools,
-      ...campaignTools,
-      ...shareLinkTools,
-      ...workspaceTools,
-      ...complianceTools
-    ].map((t) => ({ ...t, run: async (client, params) => redactToolSecrets(await t.run(client, params)) }));
+      ...publish(agentTools),
+      ...publish(agentToolBindingTools),
+      ...publish(callTools),
+      ...publish(numberTools),
+      ...publish(telephonyTools),
+      ...publish(keyTools),
+      ...publish(knowledgeTools),
+      ...publish(insightTools),
+      ...publish(publishTools),
+      ...publish(dncTools),
+      ...publish(webhookTools),
+      ...publish(billingTools),
+      ...publish(campaignTools),
+      ...publish(shareLinkTools),
+      ...publish(workspaceTools),
+      ...publish(complianceTools),
+      ...publish(accountTools)
+    ];
     var names = /* @__PURE__ */ new Set();
     for (const tool of opsToolCatalog2) {
       if (names.has(tool.name)) throw new Error(`Duplicate ops tool name: ${tool.name}`);
       names.add(tool.name);
     }
-    var import_zod15 = require("zod");
-    var WORKSPACE = import_zod15.z.string().optional().describe("Act in this workspace, e.g. one of your client workspaces (id from list_workspaces). Default: the workspace this connection uses.");
+    var import_zod16 = require("zod");
+    var WORKSPACE = import_zod16.z.string().optional().describe("Act in this workspace, e.g. one of your client workspaces (id from list_workspaces). Default: the workspace this connection uses.");
     function withWorkspaceParam2(tool) {
       return {
         ...tool,
@@ -1829,7 +2089,7 @@ function withToolErrors(handler) {
 // package.json
 var package_default = {
   name: "@rymi/mcp",
-  version: "2.6.0",
+  version: "2.8.0",
   description: "Rymi MCP server \u2014 manage AI voice agents via Model Context Protocol",
   license: "MIT",
   author: "Rymi AI <engineering@rymi.live>",
@@ -1890,16 +2150,38 @@ var package_default = {
 };
 
 // src/server.ts
-function createServer(apiKey2) {
+var RETRY_DELAYS_MS = [500, 1500];
+async function readKeyScopes(rymi, delays) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const self = await rymi.keys.self();
+      return { scopes: self.scopes ?? [], legacy: self.legacy === true };
+    } catch (err) {
+      const status = err.status;
+      const final = status !== void 0 && status >= 400 && status < 500;
+      if (final || attempt >= delays.length) {
+        process.stderr.write(
+          `Warning: could not read this key's scopes from GET /v1/keys/self (${err instanceof Error ? err.message : String(err)}). Serving read-only tools. Restart once the API is reachable; @rymi/mcp needs a Rymi API with /v1/keys/self.
+`
+        );
+        return null;
+      }
+      await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
+    }
+  }
+}
+async function createServer(apiKey2, options = {}) {
   const rymi = new import_node.default({ apiKey: apiKey2 });
-  const server2 = new import_mcp.McpServer({
+  const key = await readKeyScopes(rymi, options.retryDelaysMs ?? RETRY_DELAYS_MS);
+  const server = new import_mcp.McpServer({
     name: "rymi",
     version: package_default.version
   });
-  const isReadOnly = process.env.RYMI_MCP_READONLY === "1";
+  const isReadOnly = process.env.RYMI_MCP_READONLY === "1" || key === null;
   for (const tool of import_ops_tools.opsToolCatalog.map(import_ops_tools.withWorkspaceParam)) {
     if (isReadOnly && tool.risk !== "read") continue;
-    server2.tool(
+    if (key && !(0, import_ops_tools.keyAllowsTool)(tool, key)) continue;
+    server.tool(
       tool.name,
       tool.description,
       tool.input,
@@ -1909,14 +2191,14 @@ function createServer(apiKey2) {
       })
     );
   }
-  return server2;
+  return server;
 }
 
 // src/transport/stdio.ts
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
-async function runStdio(server2) {
+async function runStdio(server) {
   const transport2 = new import_stdio.StdioServerTransport();
-  await server2.connect(transport2);
+  await server.connect(transport2);
 }
 
 // src/index.ts
@@ -1936,9 +2218,8 @@ if (!apiKey) {
   process.stderr.write("Error: RYMI_API_KEY environment variable is required.\n");
   process.exit(1);
 }
-var server = createServer(apiKey);
-runStdio(server).catch((err) => {
-  process.stderr.write(`Fatal: ${err.message}
+createServer(apiKey).then((server) => runStdio(server)).catch((err) => {
+  process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}
 `);
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rymi/mcp",
-  "version": "2.6.0",
+  "version": "2.8.0",
   "description": "Rymi MCP server — manage AI voice agents via Model Context Protocol",
   "license": "MIT",
   "author": "Rymi AI <engineering@rymi.live>",
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.11.1",
-    "@rymi/node": "^2.5.0",
+    "@rymi/node": "^2.7.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {