Tool Reference
Overview
The server publishes 61 tools, but you will not see all of them. The list is filtered to the actions your identity holds in Britive, so the twelve self-service tools are the floor and everything else depends on your policy . Each table below names the Britive action that gates the group.
What you’ll learn:
- Which tools you always have, and which depend on your access
- What each tool does
- Which Britive action a tool requires
- Why a tool might be missing from your assistant
Before You Begin
- An MCP client connected and signed in — see Getting Started
- Your Britive access as an administrator would describe it, if you want to predict which administrative tools you will see
Note: You never call these tools by name. Ask for what you want in plain language and the assistant picks the tool. The names are here so you can tell what it did, and so an administrator can map a tool to the access it needs.
Self-Service Tools
You always have these twelve tools. They act only on your own access — what that access is, Britive still decides.
My Access — cloud and SaaS profiles
| Tool | What it does |
|---|---|
my_access_whoami | Return the currently authenticated identity |
my_access_list_profiles | List the profile s you are eligible to check out |
my_access_checkout | Check out a profile by profile and environment ID |
my_access_checkout_status | Poll a pending approval and finish the checkout once approved |
my_access_checkin | Check in a checked-out profile by transaction ID |
My Resources — brokered infrastructure
| Tool | What it does |
|---|---|
my_resources_list | List the resource s you are eligible for, optionally by type |
my_resources_checkout | Check out a resource by profile and resource ID |
my_resources_checkout_status | Poll a pending approval and finish the checkout once approved |
my_resources_checkin | Check in a checked-out resource by transaction ID |
my_resources_list_checked_out_profiles | List what you currently have checked out |
My Secrets
| Tool | What it does |
|---|---|
my_secrets_list | List the secrets you can access, with their paths |
my_secrets_view | Read a secret’s value by path |
my_secrets_view returns the secret into your conversation. Retrieve one only when you need it there, and prefer PyBritive when the value is headed for a script or an environment variable.
Audit Log Tools
Requires the diagnostics.audit.view action.
| Tool | What it does |
|---|---|
audit_logs_fields | List the fields available in an audit filter |
audit_logs_operators | List the operators available in an audit filter |
audit_logs_query | Retrieve audit events for a time range and filter |
audit_logs_download_csv | Export audit events as CSV for file-sized extracts |
Filters take the form field operator value, joined only by and — for example actor.displayName co bob and event.displayName eq application. A query spans at most 7 days; omitting both bounds gives you the last 7. Times accept ISO-8601, epoch seconds or milliseconds, and relative text such as now, yesterday, or 1 day ago.
Note: These tools call the v2 audit API. An identity that could query audit logs through the older v1 API is not automatically able to use them — v2 gates on
diagnostics.audit.viewwhere v1 gated ondiagnostics.audit.list.
Identity Management Tools
Users, service identity s, and tag s each have the same five tools. Gating follows what the tool does, not which identity type it acts on.
| Tool | What it does | Requires |
|---|---|---|
identity_management_users_list | List users, with optional filters | identity.user.list |
identity_management_users_search | Search users by string | identity.user.list |
identity_management_users_get | Get one user by ID | identity.user.view |
identity_management_users_enable | Enable one or more users | identity.user.manage |
identity_management_users_disable | Disable one or more users | identity.user.manage |
identity_management_service_identities_list | List service identities, with optional filters | identity.user.list |
identity_management_service_identities_search | Search service identities by string | identity.user.list |
identity_management_service_identities_get | Get one service identity by ID | identity.user.view |
identity_management_service_identities_enable | Enable one or more service identities | identity.user.manage |
identity_management_service_identities_disable | Disable one or more service identities | identity.user.manage |
identity_management_tags_list | List tags, with optional filters | identity.user.list |
identity_management_tags_search | Search tags by string | identity.user.list |
identity_management_tags_get | Get one tag by ID | identity.user.view |
identity_management_tags_enable | Enable one or more tags | identity.user.manage |
identity_management_tags_disable | Disable one or more tags | identity.user.manage |
Filters accept the operators eq, co, and sw. Filtering on type means static or federated; filtering on status means Active or Inactive.
Note: Identity type is never assumed. Ask about “users”, “service identities”, or “tags” explicitly — an assistant asked to “list all identities” will ask you which type you mean rather than guess.
Application Tools
| Tool | What it does | Requires |
|---|---|---|
application_management_applications_list | List the application s onboarded to your tenant | apps.app.list |
application_management_applications_get | Get one application’s configuration | apps.app.view |
These tools read only. Onboarding and configuration stay in the console, Terraform, or the API.
Report Tools
reports_list requires reports.report.list. Every report_run_* tool requires reports.report.view.
Running a report is a two-step sequence. The assistant calls reports_list first to get the report’s ID, columns, and supported operators, then calls the matching report_run_* tool.
| Tool | Reports on |
|---|---|
reports_list | Available reports, their IDs, columns, and supported operators |
report_run_profile_historical_access | Historical profile access |
report_run_profile_accessed_tags | Tags that accessed a profile |
report_run_permissions_in_profile | Permissions contained in a profile |
report_run_permission_details | Permission details |
report_run_profiles_assigned_to_service_identities | Profiles assigned to service identities |
report_run_tag_membership | Tag membership |
report_run_service_identities_details | Service identity details |
report_run_user_secret_access | User access to secrets |
report_run_secret_last_access | Most recent secret access |
report_run_AI_identities_secret_last_access | Most recent secret access by AI identities |
report_run_resource_historical_access | Historical resource access |
report_run_resource_last_access | Most recent resource access |
report_run_resources_assigned_to_users | Resources assigned to users |
report_run_resources_assigned_to_tags | Resources assigned to tags |
report_run_resources_assigned_to_service_identities | Resources assigned to service identities |
report_run_resources_assigned_to_ai_identities | Resources assigned to AI identities |
report_run_resources_assigned_to_all_identities | Resources assigned to all identities |
Report filters use the form columnName operator value, combined with and — for example profile eq admin and application co aws. Use only the columns and operators reports_list reported for that report, and do not quote values, even when they contain spaces. Every report_run_* tool can return CSV instead of rows.
Notification Medium Tools
| Tool | What it does | Requires |
|---|---|---|
notification_mediums_list | List configured notification mediums | nm.notification.list |
notification_mediums_get | Get one notification medium | nm.notification.read |
notification_mediums_create | Create a notification medium | nm.notification.create |
notification_mediums_update | Update a notification medium | nm.notification.update |
notification_mediums_delete | Delete a notification medium | nm.notification.delete |
notification_mediums_get_channels | List the channels available on a medium | nm.channels.list |
These manage where Britive sends notifications — Slack, Teams, email, webhooks.
Active Session Tools
| Tool | What it does | Requires |
|---|---|---|
security_active_sessions_list_users | List users holding active sessions | profiles.checkout.view |
security_active_sessions_list_user_sessions | List one user’s active sessions by their ID | profiles.checkout.view |
security_active_sessions_checkin | Check in specific profiles for a user | profiles.checkout.manage |
security_active_sessions_checkin_all | Check in every active session for a user | profiles.checkout.manage |
security_active_sessions_checkin_all revokes every active session for that user, not just one. Use my_access_checkin for your own access.
Troubleshoot
| Symptom | Cause | Fix |
|---|---|---|
| An administrative tool is missing | Your identity does not hold the action that gates it | Compare your access against the tables above — if you cannot do it in the console, the tool will not appear |
| A tool is missing after you were granted access | Clients cache the tool list at connect time | Reconnect the client; in Claude start a new conversation, in Claude Code restart the session |
| Access was revoked but the tool is still listed | Same cache | The call is refused regardless — revocation applies on the next call, not on the next reconnect |
| Only the self-service tools appear, and you are an administrator | Signed in as a different identity than you expected | Ask the assistant Who am I in Britive? |
| A report returns no rows | Filter too strict, or quoted values | Retry with the co operator instead of eq, and remove quotes from values |
| An audit query is rejected | Range wider than 7 days, or an unknown field | Narrow the range; the assistant can list valid fields and operators first |
Next Steps
- Requesting Access from an Assistant — approvals, passcodes, and check-in
- Getting Started — connect another client