# MCP tools > Every tool the Stableship MCP server offers your coding agent, the scope it needs, and the CLI command that does the same. ## The server ``` https://api.stableship.ai/mcp ``` It speaks MCP over streamable HTTP and needs no local bridge. Clients sign in through the browser, or send a token as `Authorization: Bearer sst_your_token`. See [Sign-in and tokens](/docs/reference/auth). The server tells a connected agent how to use the tools when it connects. Most agents need no more than "fix the blocking Stableship findings and verify each fix". ## Scopes A connection that signs in through the browser can use every tool. A token can use the tools its scopes allow: **read** tools only read, **run** tools start work or add to your notes and rules, and **manage** tools act for you in the app. A tool that would lower protection asks a person first: see [Run Stableship from your agent](/docs/guides/run-from-your-agent). ## Tools ### Findings and fixes | Tool | Scope | What it does | |---|---|---| | `list_projects` | read | Your apps, each with its repositories, latest verdict and counts of open and blocking findings. CLI: `stableship status`. | | `get_findings` | read | An app's findings, blocking ones first. Filter by status, blocking only, or first seen since a time. CLI: `stableship findings`. | | `get_fix_brief` | read | Everything needed to fix one finding: what is wrong, the rule it breaks, where to look, how to reproduce it, when it is done, and a ready prompt. CLI: `stableship brief `. | | `explain_finding` | read | Why a finding blocks or does not, or why a run came out as it did. CLI: `stableship why `. | | `get_known_issues` | read | Accepted risks, false positives, won't-fix and in-progress items, and dismissed findings. CLI: `stableship known-issues`. | | `get_fix_plan` | read | Every open finding as ordered tasks, blocking first: STABLESHIP_FIXES.md. CLI: `stableship fix-plan`. | | `verify_fix` | run | Run again the check that found a finding, on a branch or commit, to confirm a fix. CLI: `stableship verify `. | ### Checks and audits | Tool | Scope | What it does | |---|---|---| | `run_check` | run | Start a check of a pushed commit or branch, at a scope you choose or the one the change needs. Can be narrowed to one flow, kind of user or endpoint. CLI: `stableship check`. | | `get_run_status` | read | A run's status and verdict, whether it is done, and its findings. | | `rerun_gate` | run | Run a check again with the same scope, narrowing and commit. CLI: `stableship rerun `. | | `run_audit` | run | Start a full audit of the default branch, from the app's monthly audits or a purchased one. CLI: `stableship audit`. | | `get_audit_status` | read | Whether a full audit is running or can start, without starting one. | | `retest_untested` | run | Test again what the last audit could not test, once the cause is fixed. | | `get_scope_policy` | read | The scope minimums and blocking policy, and the scope a check would pick for a set of paths. | ### Rules, notes and flows | Tool | Scope | What it does | |---|---|---| | `get_rules` | read | The app's rules and critical flows, or only the rules that concern one file. CLI: `stableship rules`. | | `get_context` | read | The rules as sentences, the kinds of user, your product notes, and what the last private copy could not test. CLI: `stableship context`. | | `add_context_note` | run | Add one lasting fact to the product notes. CLI: `stableship note ""`. | | `remove_context_note` | run | Take one product note out. CLI: `stableship note --remove ""`. | | `propose_rule` | run | Suggest who may do what, for a person to accept, instead of changing access in code. CLI: `stableship propose`. | | `add_flow` | run | Add something people do that every check clicks through. CLI: `stableship flow`. | | `get_repo_files` | read | The .gate files and the Stableship section of AGENTS.md, for your agent to commit. | ### Reports and setup | Tool | Scope | What it does | |---|---|---| | `get_report` | read | The audit report: verdict, steps, problems and what was not tested. CLI: `stableship report`. | | `get_launch_report` | read | The latest launch report. | | `get_setup` | read | The short block for CLAUDE.md or AGENTS.md that points your agent at the rules and the fix plan. CLI: `stableship setup`. | ### Your account and app | Tool | Scope | What it does | |---|---|---| | `whoami` | read | The workspace, the apps this connection can see, its scopes, and whose it is. CLI: `stableship whoami`. | | `get_next_steps` | read | The latest audit as a plan: how it went, what to fix first, and the one next step. CLI: `stableship next`. | | `get_activity` | read | What changed recently and who did it. CLI: `stableship activity`. | | `get_app_map` | read | The pages each kind of user reached and how each went, the endpoints the checks called, and the outside services and personal data the app holds. CLI: `stableship map`. | | `get_compliance` | read | How the app maps to SOC 2, ISO 27001, GDPR, PCI DSS and more: what was proven, the gaps, and what to ask a professional. | | `get_approval` | read | Whether a person approved an action, and whether Stableship carried it out. CLI: `stableship approval `. | ### Actions (manage scope) | Tool | Scope | What it does | |---|---|---| | `triage_finding` | manage | Mark a finding a false positive, an accepted risk, fixed, or open again. CLI: `stableship do triage_finding`. | | `resume_held_audit` | manage | Start again an audit that was on hold because the private copy could not be built. CLI: `stableship do resume_held_audit`. | | `ship_anyway` | manage | Let a held release go out, with a reason that is kept in the activity log. CLI: `stableship do ship_anyway`. | | `decide_rule_suggestion` | manage | Accept or dismiss a rule suggestion. CLI: `stableship do decide_rule_suggestion`. | | `set_policy` | manage | Change a policy: what blocks, what happens when Stableship cannot finish, the audit schedule, notifications. CLI: `stableship do set_policy`. | | `set_autonomy` | manage | Change how much Stableship does on its own: hands on, guided or autopilot. CLI: `stableship do set_autonomy`. | | `set_role` | manage | Add or rename a kind of user. CLI: `stableship do set_role`. | | `set_role_reach` | manage | Set whether a kind of user reaches every record or only related ones. CLI: `stableship do set_role_reach`. | | `remove_role` | manage | Remove a kind of user, so checks stop testing as it. CLI: `stableship do remove_role`. | | `remove_rule` | manage | Remove a rule, so checks stop testing it. Removing an access or money rule needs the approvers the policy names. CLI: `stableship do remove_rule`. | | `share_report` | manage | Make an audit report readable by anyone with its link. CLI: `stableship do share_report`. | | `unshare_report` | manage | Stop sharing an audit report. CLI: `stableship do unshare_report`. | | `reanalyze` | manage | Read the app again: its pages, data and flows. CLI: `stableship do reanalyze`. | | `set_notifications` | manage | Choose which emails you get. CLI: `stableship do set_notifications`. | | `create_app` | manage | Add an app from one or more repositories. CLI: `stableship do create_app`. | | `link_repo` | manage | Add a repository to an app. CLI: `stableship do link_repo`. | | `set_service` | manage | Correct how one of the app's services is built and started. CLI: `stableship do set_service`. |