MCP Beyond Tools

With the Codex or Claude plugins, your agent cannot buy credits, manage auto-recharge, retry payments, purchase or renew domains, or create Link spend requests and retrieve card details. Use the CLI dashboard for these actions; missing domain, retry, and Link flows will be available soon. The CLI and general /mcp retain these tools.

Tools are most of the MCP surface, but not all of it. Your agent can also read resources on demand, pick up prompts as slash commands, and open the CRM board and the domain purchaser.

The default /mcp endpoint serves the full tool catalog, including media generation. /mcp/claude serves that catalog without media_generate or the generate-image/generate-video prompts; media_get remains available to read existing jobs. /mcp/openai is a curated catalog for coding agents: the company-operations core covering identity and membership, company setup, code and repositories, database, hosting, domains the company already owns, playbooks, events, support, research, and billing. Bulk-operations surfaces such as CRM, company mail, ads, social, payments admin, registrar domain operations, and design stay on /mcp and /mcp/claude; media generation is /mcp only, as are domain purchase and renewal. Library reads, search, text writes, uploads, and URL ingestion stay in /mcp/openai because the text operations' guidance and the brand kit's recovery steps call them; file publishing and deletion are /mcp and /mcp/claude only. Prospect import and its status read are available on all three endpoints; the other CRM tools keep their existing catalog membership. All three endpoints use the same Cofounder account, with their own OAuth resource identities. Plugin eligibility is explicit per tool; future tools on general MCP are not automatically included in plugin catalogs. When the OAuth proxy is enabled, plugin authorization routes live under /mcp/openai/oauth and /mcp/claude/oauth; the upstream Supabase client must allow both additional redirects: <backend-url>/mcp/openai/oauth/callback and <backend-url>/mcp/claude/oauth/callback. Connection listing and revocation cover all profiles. This adds endpoint support; plugin directory availability is separate.

Durable prospect-import tasks

On protocol version 2026-07-28, all three endpoints advertise io.modelcontextprotocol/tasks under server/discover's capabilities.extensions. A supporting host declares that extension on each request in _meta["io.modelcontextprotocol/clientCapabilities"].extensions. When it calls crm_prospects_import, the server returns a durable receipt with resultType: "task" and a taskId. Save that ID and use tasks/get after reconnecting; honor the returned pollIntervalMs.

The task follows the import through CRM writes. Submission alone is not completion. A completed task includes the final tool result in result; an import failure is a completed task with result.isError: true. The first terminal result stays fixed even if the underlying job is later retried. Task retrieval is available for seven days from job creation, and each follow-up checks the caller's current company access. After expiry, use crm_prospects_imports_get for the ordinary job's current status.

Keep the same import idempotency_key after an uncertain response. Older protocol revisions and hosts without the extension receive the ordinary job response and use crm_prospects_imports_get. Nested calls through a tool proxy also receive that ordinary response. No host support is assumed from plugin installation alone.

tasks/cancel acknowledges a cooperative cancellation request, but prospect import continues and CRM writes are not undone. Continue retrieving its outcome. This consumer does not request mid-flight input; tasks/update acknowledges responses for unknown input keys without changing the import.

Events

With hosted OAuth enabled, /mcp and /mcp/openai support webhook delivery from the draft MCP Events extension on protocol version 2026-07-28. server/discover advertises capabilities.events; hosts use events/list, events/subscribe, and events/unsubscribe on the same authenticated endpoint. These are protocol methods for supporting hosts.

Prospect-import outcomes

Subscribe to crm.prospects.import.finished with company_id and the import's job_id. The event reports a terminal succeeded, failed, or cancelled outcome and replays it to a subscriber that connects after completion. Retrieve row outcomes with crm_prospects_imports_get, or use the saved task ID with tasks/get when the host supports Tasks. Delivery retries preserve the event ID; a repeated callback is a reason to retrieve the result, not to start another import.

Playbook status

Subscribe to playbook.run.status_changed with company_id and run_id arguments. The optional statuses filter defaults to completed, failed, and outcome_unknown. A new subscription includes the latest known run transition if it matches the filter, covering runs that finish before the subscription is created. This tracks the overall long-lived playbook run: completed means its goal was marked complete. Individual scheduled routine runs do not emit this event. Read playbooks_runs_get for current status, schedule, and error; use playbooks_runs_routine_runs_list for routine history.

Playbook review requests

Subscribe to playbook.review.requested with company_id to receive new human-review requests assigned to the connected account. The server derives the reviewer from the authenticated identity; there is no reviewer override. Each new review records its event in the same database transaction. Reviews use email unless the reviewer has an active, authorized review subscription for that company when the request is created and notifications are dispatched. Signing in or installing the plugin alone does not change delivery. Expired, unsubscribed, or disconnected subscriptions leave new notifications on email. New subscriptions do not replace email for earlier reviews. Repeated submissions of unchanged evidence reuse the review.

The payload contains company_id, run_id, review_id, and attempt_id. Read playbooks_reviews_get to present the current question and saved evidence. Only ask for a decision when can_decide is true; the review may already be decided or replaced by the time its notification arrives. After the user explicitly approves or rejects, call playbooks_reviews_submit with their decision and optional comment. The existing human-session and run-owner checks apply. A callback never authorizes an automatic decision.

New subscriptions start now. Use playbooks_reviews_list for pending requests from before subscription, or supply a saved cursor to resume a lapsed subscription. Plugin setup offers monitoring once a company is selected; the host owns the dot or Work chat subscription. The dot's decision and comment become the verification result returned to Eve by cofounder playbooks verification show. When dot delivery is enabled without a subscription, the request stays pending in the review inbox; the flag does not automatically fall back to email.

Watch findings and stops

Subscribe to watch.event.detected with company_id and watch_id to receive new findings, including a summary and citations. Use watches_list to find an existing watch. Subscribing does not create or run a watch and does not change its billing.

Subscribe separately to watch.stopped with the same arguments to learn when the company could not pay for a recheck. The recorded stop can still be delivered after the watch is removed, provided you retain company access.

New watch subscriptions start at the current event cursor and exclude older findings. Refreshes retain their position; after a subscription lapses, supply a previously received cursor to resume from it. Events arriving during callback verification are included. Unsubscribing stops notifications; use watches_delete to stop the watch itself and its future billing.

Use events_get with company_id and the callback's eventId as event_id to read the complete recorded finding. If a finding exceeds the 256 KiB webhook limit, its callback retains the summary and watch identifiers but omits structured fields and citations; the full event remains in the log.

CRM replies

Subscribe to crm.reply.received with company_id to receive recorded inbound CRM replies. It defaults to human replies; set reply_kind to auto_reply for machine replies. Optional contact_id and account_id arguments narrow the subscription. New subscriptions start at the current company event cursor; after a subscription lapses, provide a prior cursor to resume from it. The callback contains the safe reply summary and activity identifiers, and events_get retrieves the recorded event. Reply capture records events on a best-effort basis, so a CRM activity without a recorded event cannot produce a callback.

Delivery and subscription lifecycle

The host supplies a public HTTPS callback and a Standard Webhooks whsec_ secret. Cofounder signs a verification challenge and requires a successful response that echoes it before activating delivery. Event callbacks include eventId, name, timestamp, data, and a subscription-specific cursor. Verify signatures, deduplicate by eventId, and return a 2xx response to acknowledge receipt. A 410 or 413 response declines that one event and delivery continues with the next. Any other failure is retried with backoff for about an hour, holding later events for that subscription; after that the event is skipped. Redirects are not followed.

Delivery runs on a one-minute schedule and can take longer under backlog or retries. Acknowledgement records receipt; the host decides when to notify the user or continue work. Events do not grant permission for additional actions.

Subscriptions belong to the signed-in account and OAuth connection. Refresh the same event, arguments, and callback before the returned refreshBefore; lifetimes are capped at one hour, with at most 100 active subscriptions per account. A live subscription keeps its own position, so the cursor sent with a refresh has no effect; a subscription that lapsed or was unsubscribed resumes from the cursor supplied when subscribing again. Unsubscribe using the same event, arguments, and callback. Revoking the connection removes its subscriptions at once, and losing company access removes a subscription at its next delivery. A connection that expires without being revoked can no longer refresh, so its subscriptions end with their lifetime, within an hour. Hosts without MCP Events support can continue polling playbook runs.

Resources

Resources are read-only content addressed by URI:

The unscoped company URIs above use the token's company in legacy mode. When the hosted OAuth proxy is enabled, choose a company using user_get and company_memberships_list, then use these resource templates:

Use the chosen org_id for {company_id}. Every read checks current membership and permissions. Proxy mode does not list resources from a default company or accept unscoped company resource URIs; discover the templates and name the company explicitly. Skills remain account-independent.

The readiness resource summarizes existing resource state, with blockers first. Use each returned resources.get next step for the exact recovery instructions. Resource status does not establish that a company goal is ready to run or grant permission to act. The decisions resource is a separate inbox for playbook reviews; it does not include every kind of human approval.

MCP review-list tools return compact summaries with the original review, run, and attempt IDs and a resource_uri. Read that URI for the full question and evidence links. Follow next_uri when a resource returns another page or text chunk. The readiness summary shows at most 50 resources, with a truncated flag and a resources.list next step when more exist. Decisions pages contain at most 50 entries; saved text evidence is returned in chunks of at most 16,000 characters. Ask the assigned human before submitting a decision.

Hosts that support the official MCP Skills extension on protocol 2026-07-28 can discover bundled guides through skills/list and confirm one guide through skills/get. Each entry contains its complete frontmatter and a file manifest with SHA-256 digests and byte sizes. Read files using resources/read. Hosts without Skills support can continue using list_resources, read_resource, and each guide's _manifest resource.

Bundled Skills discovery and file reads advertise a five-minute private cache hint. The guides and manifests describe one deployment snapshot. Company resource reads advertise zero TTL and private scope, so clients refresh the state and any expiring URLs, and keep cached content within its authorization context. Cache hints do not cache tool calls on the server.

The hosted skills include cofounder-setup for troubleshooting, cofounder-repo for CLI repository work, cofounder-repo-mcp for SSH clone and push without the CLI, and cofounder-social for social publishing. Both repository skills and the SSH access tools are available on /mcp, /mcp/openai, and /mcp/claude.

For onboarding, call onboarding_get and read the guide at the returned mcp_skill_url. CLI agents can run cofounder onboarding and follow cli_skill_url. These point to the maintained /mcp-onboarding/skill.md and /cli-onboarding/skill.md guides; the plugin's get-started skill uses the same discovery tool.

Clients without resource support don't miss anything: the list_resources and read_resource tools reach the same URIs, and Library files are also callable as library_* tools.

company_get and billing resources return the company's billing status, balance, spending, limits, and payment settings. Billing messages explain any issues and direct the user to the dashboard; payment links are omitted.

Native resource reads and read_resource return the same data. CLI and API responses include payment links and recovery guidance.

Clone and push through MCP

For a provisioned, managed product repository, call code_repository_clone_instructions_get, then read_resource with the returned skill_uri (skill://cofounder-repo-mcp/SKILL.md). This MCP-only guide uses Git and OpenSSH in the agent's execution environment, including a cloud session sandbox. It needs a terminal, writable files, and outbound SSH to GitHub; no user computer access, Cofounder CLI, or GitHub login is required.

Choose the company explicitly and find its repository's resource_id with resources_list. Any company member can register an environment-generated public Ed25519 key using code_repository_access_create. The private key stays outside the checkout in a protected file and must never enter MCP arguments. Cofounder's GitHub App needs repository Administration write permission, and the GitHub organization must allow deploy keys.

The create call returns confirmed valid access and the repository SSH URL. Verify the fingerprint matches the local public key before cloning. After a failed or uncertain response, treat access as invalid and retry the identical request with its original idempotency key. Nothing activates it in the background.

Access persists until code_repository_access_revoke succeeds, confirming GitHub removal with state=invalid and revoked_at populated. Retry failed revocations explicitly; there is no background cleanup. Membership, repository, company, or billing changes can invalidate Cofounder's record without deleting GitHub's key. An invalid state alone does not confirm removal. SSH access covers Git operations only, not GitHub API calls or PR creation.

Prompts

Prompts register as slash commands in clients that support them (/mcp__cofounder__<name>). Each one packages a canned instruction for a common job:

A prompt appears in a profile only while its backing tools belong to that catalog, so generate-image and generate-video do not register on /mcp/openai.

CRM board and domain purchaser

• CRM board: crm_summary_show shows the company's deals, accounts, and contacts as a read-only board. The same data is callable as plain crm_* tools. The board and the CRM tools live on /mcp and /mcp/claude, not /mcp/openai.
• Domain purchaser: domains_discover shows domain suggestions with availability and price for the user to pick from; general /mcp domains_purchase buys the one they choose. Domain search and purchase stay off /mcp/openai; managing domains the company already owns is still in its catalog.

Clients that can't display these views get the same results as plain data.

In proxy mode, the argument-free roadmap sidebar shortcut and Library autocomplete are not advertised because those host actions cannot select a company. Agents can still call roadmap_get with company_id and read the Library through company-scoped tools and resource URIs. Legacy mode retains the host shortcuts.

What MCP adds

The same operations come back a little richer on MCP. media_generate and media_get (cofounder media generate / media get on the CLI) return resource links to the finished files' signed download URLs. Binary library_files_get results also include a resource link with the file name and MIME type. The original URL remains in structured data and the JSON text fallback; client support determines how the link is displayed. To browse company output records in proxy mode, use the company-addressed output URIs above. agent_personalization_get returns text your agent can save to its own persistent instructions, so later sessions know which company they work for.

Structured recovery and next steps

Safe tool errors return the API's error envelope as structured data and JSON text, with isError set. Unexpected failures remain masked. The error envelope is separate from the tool's successful output schema.

Selected responses include next_steps using the existing operation and founder shapes. Each operation names its arguments; a polling operation step also supplies a delay via after_seconds, and a founder step may carry poll, until, and timeout_s to say when the founder finished. These are suggestions, not permission to send, charge, deploy, or launch another job.

• Saved campaign drafts suggest preview. A launched draft or uncertain campaign receipt points to the original request's receipt; an uncertain draft test points to the saved draft state. No campaign review page is implied.
• Pending media points to its original job. Long-lived playbooks suggest inspection of their current state and schedule. Research jobs use their reported polling delay and point to saved results when completed. An uncertain playbook or research job needing attention suggests inspection rather than a new launch.
• Auto-recharge setup and payment recovery return the exact browser URL, followed by a check of the saved status. Recovery belongs to the returned pending transaction, not a new charge.
• Repository imports needing a Vercel repository link return a founder step when the Git settings URL is available, followed by continuation or status readback. Missing URLs do not imply an invented browser destination.

Preserve returned URLs exactly, including query parameters and company scope. Navigation and recovery URLs remain structured fields; fetchable files also receive resource links.

Next steps

The Reference names every operation across all three surfaces and shows how the spellings map.