--allow-writes is set. Setup examples always include that flag. HTTP MCP lists writes when the identity has Admin (org_admin).
Timestamps in tool JSON are UTC (Zulu) RFC3339 and end in Z (for example 2026-09-04T04:23:00Z). If you name a calendar day, clock time, or age, convert that UTC instant to the local machine’s timezone first. Do not say “today” or “yesterday” from the UTC date digits. That calendar day can be a day ahead of local time.
List tools return a page (default 20, max 100) plus has_more. They do not keep fetching until the full set is loaded. If has_more is true, tell the user there are more results and only pass offset=next_offset when they need the next page.
For prompts to paste into a client, see Sample queries. To connect, see Agents.
Catalog
Writes
Mutating tools are prefixed withWRITE OPERATION: in their descriptions. The stdio proxy hides them unless you pass --allow-writes. The identity still needs Admin (org_admin), not Read-only.
Destructive tools
These tools carry the MCPdestructiveHint annotation. The annotation is advisory: your client decides whether to prompt.
The two deprovision calls are rejected until the agent passes
confirm: true, and their descriptions tell it to ask you first. plan_only: true is exempt, since nothing is applied. You cannot turn this off: confirm is an argument on those two tools, not a proxy flag or a client setting.
Write tools that take role use an IAM role name from the install’s stack. Call list_available_roles first (with the matching operation_type / principal_type) and pass a returned name, or omit role to use the default. A role the install cannot assume is rejected before any workflow starts, and the error lists the names that are available.