MCP tools

Every account tool the upAPI MCP server exposes, generated from the tool registry.

upAPI exposes every public catalog operation through search_ops and call_op (or one tool per operation with ?tools=full), plus 55 account tools that do everything the dashboard does. The hosted server and the local @upapi/mcp server serve the same list.

You choose which permission tiers a connection holds on the consent screen. Read + write are on by default; the account tiers are opt-in, and request_scopes returns a link to widen them later.

Read your data (`read`)

Tool	What it does
`billing_status`	Current plan, renewal date, trial, quota used and remaining.
`list_plans`	Plans with price, monthly quota and limits.
`get_profile`	Your name, email, workspace and role.
`get_account_summary`	Plan, role, usage and workspace summary.
`get_usage`	Monthly units used and remaining, per-minute limits, trial cap, compute and hosted-function usage, broken down by key and connected client.
`list_call_logs`	Recent operation calls with status, caller and cost.
`list_members`	Workspace members and roles.
`list_invites`	Pending invitations.
`list_support_tickets`	Your earlier support requests.
`list_api_keys`	Keys with name, prefix, scopes, last used.
`list_granted_scopes`	Tiers and scopes this connection holds.
`request_scopes`	Returns a click-ready link where the user grants more permission tiers to this connection.
`list_connections`	AI apps connected to this account and when each last ran.
`list_user_apis`	Remote-URL APIs you published to your workspace.
`get_proxy_config`	Proxy URLs used for outbound requests.
`list_hosted_functions`	Your deployed functions.
`get_hosted_function`	One function including its code.
`list_products`	Products and the operations in each.
`get_referral`	Your referral link and earnings.

Create and edit (`write`)

Tool	What it does
`create_user_api`	Publish a remote HTTP API as an operation.
`update_user_api`	Change one of your published APIs. Fields you leave out of the patch keep their stored value, including secret headers.
`set_proxy_config`	Replace the proxy URL list.
`test_proxy_config`	Check that a proxy URL works.
`deploy_hosted_function`	Create a function from code.
`update_hosted_function`	Change code, description, secrets, input fields, category, tags or timeout. Secrets you leave out of the patch are kept.
`create_product`	Group operations into a product.
`update_product`	Rename or redescribe a product.
`assign_operation_to_product`	Add an operation to a product, or send it back to the default product.
`create_upload_url`	A presigned upload URL for a file input of an operation.

Delete, publish or send (`destructive`)

Tool	What it does
`delete_user_api`	Deletes a published API. Needs a confirmToken.
`delete_hosted_function`	Deletes a function. Needs a confirmToken.
`delete_product`	Deletes a product; its operations move to the default product. Needs a confirmToken.

Billing and subscription (`billing`)

Tool	What it does
`upgrade_plan`	Returns a one-click checkout link for a plan. Ask the user which plan; never choose for them.
`manage_subscription`	cancel (at period end), refund (last payment, revokes access) or open the billing portal. cancel and refund need a confirmToken.

Profile, preferences, account deletion (`account`)

Tool	What it does
`update_profile`	Change your display name or avatar URL.
`update_workspace`	Rename the workspace (admin or owner).
`change_password`	Set a new password. Accounts that already have one must also pass currentPassword.
`update_notification_prefs`	Read or change in-app tips and prompts. Omit the field to just read.
`register_push_token`	Register a device push token for notifications.
`remove_push_token`	Unregister a device push token.
`export_data`	Profile, workspace, members, keys (prefixes only), BYO APIs, hosted functions, products and 90 days of call logs as JSON. Large exports return a download link.
`delete_account`	Ask the user to confirm the workspace name before calling; never decide for them. Permanently closes the account and deletes the workspace, its keys, APIs, functions and data (support can restore from backups on request). Cancels the paid plan first; a plan bought through Apple, Google or Amazon only the user can cancel, so when the answer has storeNotice, show it to them word for word. Needs a confirmToken; owner only.
`complete_onboarding`	Mark the welcome checklist done.
`update_referral_ui_state`	Dismiss or answer the referral prompts.

Members and invites (`team`)

Tool	What it does
`invite_member`	Ask the user who to invite and with which role; never choose for them. Emails an invitation (admin or owner).
`update_member_role`	Change a member between member and admin.
`remove_member`	Remove a member from the workspace. Needs a confirmToken.
`revoke_invite`	Cancel a pending invitation.
`accept_invitation`	Accept an invitation addressed to your email.

Connected services (`connections`)

Tool	What it does
`get_connect_links`	Install links for Claude, Cursor, VS Code, Claude Code, Codex and OpenCode.
`disconnect`	Revokes a connected app immediately. Needs a confirmToken.

Support tickets (`support`)

Tool	What it does
`create_support_ticket`	Send a support request; the team replies by email.

API keys (`keys`)

Tool	What it does
`create_api_key`	Ask the user which permissions the key needs; never choose for them. Creates a key and returns the secret once. Omit tiers for all.
`rotate_api_key`	Creates a replacement with the same scopes and returns the secret once; the old key keeps working until you revoke it.
`revoke_api_key`	Deletes a key immediately. Needs a confirmToken.

Destructive tools answer once with CONFIRMATION_REQUIRED and a confirmToken. Repeat the call with the token to proceed. Every refusal is { code, message, next }, and next names the tool to call.

On this page