priiism_container_status | Reports the project’s cloud sandbox status. Use before running/previewing to check whether the sandbox and dev server are live. Returns { status (‘ready' | 'starting' |
priiism_preview_url | Gets the live preview URL for the running dev server. Use when the user wants to view the app in the browser. Returns { previewUrl (branded priiism.ai origin, or null while starting/no sandbox), ready (bool), status (‘ready' | 'starting' |
priiism_project_info | Gets project metadata. Use when you need the project’s name, slug, status, template, hosting subdomain, or timestamps. Returns { project: { id, name, slug, description, status, templateId, cfProjectName, cfPagesSubdomain, lastWebDeployedAt, hasIdentity, createdAt, updatedAt } }; returns 404 if the project does not exist. | None |
priiism_project_state_read | Reads the whole governed state of one project in a single read-only call. Use to answer ‘what is the state of X’ rather than guessing. Pass section for one slice or omit for an aggregate ‘overview’ with counts. Returns { section, …one of: security | compliance |
priiism_govenant_charter_read | Reads the GOVERNED TEAM on this project: every delivery role’s charter (the wall its agent runs inside), its owned levers, its duty roster, whether the team is armed, and the project’s spend against its ceiling — plus the customer’s own CUSTOM DOMAIN ROLES (#2447), listed apart because they are a different org. Read this BEFORE proposing any governance change. Requires the govenant:read scope. Returns { projectId, arming, budget, roles: [ { roleKey, persona, reportsTo, tier, displayName, charter, ownedLevers[], enabled, humanLocked, duties[] } ], domainRoles: [ { roleKey, displayName, charter, enabled, humanLocked, managedBy (‘declaration' | 'api’), duties[] } ] }. |
priiism_govenant_charter_write | Rewrites one role’s CHARTER — the remit that becomes that role’s entire system prompt, and so the boundary of what its agent may do. Say what the role is for AND what it must never do; under 40 characters is refused. A charter a human PINNED is refused with human_locked and never overwritten — that refusal is the lock working, not an error to route around. A lower_snake_case key outside the engineering roster is a CUSTOM DOMAIN ROLE (#2447): the first write CREATES it (charter required, optional displayName), later writes edit it, and deploys never disable API-created ones. DANGEROUS: requires the govenant:configure scope, off by default. Returns { projectId, role }. | roleKey (required), charter, ownedLevers, enabled, displayName |
priiism_govenant_team_arm | Arms or STOPS the governed team on this project. Arming seeds the project’s duty roster and lets due duties act; it is REFUSED (402) when the project or its org is at a budget line, because a team that would refuse every duty is not an armed team. Stopping takes the flags down AND stops every in-flight autonomous run — it is never budget-gated, and it reports any run it could not reach so a partial stop is visible. DANGEROUS: requires the govenant:run scope, which is off by default. Returns { projectId, state, budget, rosterInserted } when arming, or { projectId, state, runsStopped[], runsFailed[] } when stopping. | enabled (required) |
priiism_delivery_trigger | Releases the project’s autonomous delivery loop to run its queued work, and optionally enqueues+prioritizes a GitHub issue first. Use AFTER you have investigated and filed the work, instead of asking a human to press a button. It does NOT merge, deploy, write code, or arm the project (arming is a human-only lever); merges stay human-gated. Returns { armed, budget: { ok, decision, reason, project, org }, enqueued: { issueNumber, priority, deduped } | null, queuedItems, willRun, willRunNextTickWithinMin, note }. |
priiism_prototype_reconcile | Reconciles the frozen clickable prototype, the GitHub issues, and the live deployed app against the same requirements/design. Read-only. Use to answer whether the prototype covers scope, which screen maps to which milestone, or whether the shipped app matches what was approved. Pass target ‘prototype' | 'issues' |
priiism_comprehension_read | Reads this project’s PRODUCT COMPREHENSION: the approved product brief (what the product IS — one-liner, core jobs-to-be-done, personas, the core screens that must lead, core entities, anti-scope), the current-state model (what exists today), and the delta (present/partial/divergent/missing — the work to reach the target). Read-only. Use FIRST to ground reasoning, planning, review, or code changes in what the humans want built, so you never treat plumbing/admin/billing as the product. Returns { brief, currentState, delta, isApproved } — fields are null when nothing is comprehended yet (never fabricated). | None |
priiism_config_get | Reads and validates the project’s viiibin.config.json (required for deployment). Use before deploy_web to confirm a valid web/static target exists. Returns { exists, valid, config } when present and parseable; { exists:false, error, schema, example } when missing; { exists:true, valid:false, error, raw } when present but invalid JSON/schema. | None |
priiism_config_set | Writes/overwrites the project’s viiibin.config.json in durable storage (required for deploys); the full config object is validated before write and persisted verbatim. Use when creating or changing the project’s deploy targets. Returns { success: true, config } (the parsed/synthesized config); 400 { error: ‘Invalid config’, details } if it fails schema validation, 400 if config is missing/not an object, 500 on write failure. | config (required) |
priiism_file_read | Reads a single project file’s text content from durable storage (archive-aware, no running sandbox needed). Use to inspect a known file by its project-root-relative path. Path traversal and absolute paths are rejected. Returns { path, content }; 400 for an invalid path, 404 { error:‘File not found’, path } if it does not exist, 500 on read error. | path (required) |
priiism_file_write | Creates or overwrites a single project file in durable storage and tracks it in the project. Write action; overwrites silently. Content is capped at 5MB and the path must be project-root-relative (no ’..’/absolute). Use to persist generated or edited files. Returns { path, written:true }; 400 for invalid path or missing/oversized content, 500 on write error. | path (required), content (required) |
priiism_file_list | Lists all project file paths (project-root-relative) from durable storage, optionally filtered to a path prefix. Use to explore project structure without a sandbox. Returns { files: [path, …] }; empty array when the project has no files (or none match the prefix), 500 on error. | prefix |
priiism_file_delete | Deletes a single project file from durable storage by its project-root-relative path. Write/destructive action. Use to remove a file you know exists; path traversal/absolute paths are rejected. Returns { path, deleted:true }; 400 for an invalid path, 404 { error:‘File not found’, path } if it does not exist, 500 on delete error. | path (required) |
priiism_project_list | Lists all non-deleted projects in the authenticated organization (org derived from the token, never passed). Use to enumerate the workspace’s projects. Returns { projects: [{ id, name, slug, description, status, templateId, createdAt, updatedAt }] }; empty array if the org has none, 500 on error. | None |
priiism_project_create | Creates a new project in the authenticated organization (org from the token). Write action. Provide a name (1-100 chars); optionally description, a templateId to scaffold from (‘empty’/omitted = blank), and configValues for that template’s variables. Returns 201 { project, fileCount? }; 400 for an invalid name or invalid template/validation error, 500 { error, message, stage } if template instantiation fails. | name (required), description, templateId, configValues |
priiism_project_update | Updates an existing project’s name and/or description (identified by projectId, which must belong to the authenticated org). Write action. Use to rename or re-describe a project; at least one field is required. Returns { project } with the updated record; 400 if projectId is missing or no updatable field is given, 404 if the project is not in the caller’s org. | projectId (required), name, description |
priiism_template_list | Lists the active project templates available to the authenticated organization. Use to discover a templateId before project_create or template_instantiate. Returns { templates: [{ id, name, description, category, isFeatured }] }; empty array if none are active, 500 on error. | None |
priiism_template_instantiate | Creates a new project in the authenticated org from a template. Write action. Provide templateId and projectName (1-100 chars); optionally configValues for the template’s variables. Use to scaffold from a known template. Returns 201 { project, fileCount? }; 400 for missing/invalid templateId or projectName, 422 { error, message, stage } if config/instantiation fails. | templateId (required), projectName (required), configValues |
priiism_actions_list | Lists the project’s AI-action approval-queue entries, defaulting to status ‘pending’. Use to see what agent actions await human approval before action_approve/reject/batch. Returns { actions: [{ id, toolName, description, impact, category, status, batchId, … }] }; empty array if none match, 400 on an invalid status filter, 500 on error. | status (pending |
priiism_action_approve | Approves one pending AI action by id, optionally executing it immediately (execute:true) — execution runs the underlying tool, a real effect. Use to authorize a queued action. Returns { success:true, actionId, decision:‘approve’, executed, result } (result is the execution outcome or null); 400 if the action is not currently pending, 404 if not found or not in this project. | actionId (required), execute |
priiism_action_reject | Rejects one pending AI action by id, with an optional reason; no effect is executed. Use to decline a queued agent action. Returns { success:true, actionId, decision:‘reject’, executed:false, result:null }; 400 if the action is not currently pending, 404 if not found or not in this project, 500 on error. | actionId (required), reason |
priiism_action_batch | Approves or rejects every still-pending action in a batch by batchId (only status=‘pending’ rows are resolved). Bulk write; approval does not auto-execute here. Use to resolve a grouped set of agent actions at once. Returns { success:true, batchId, decision, resolvedCount } (resolvedCount 0 on a retry after already resolved); 404 if batch not found, 403 if it belongs to another project. | batchId (required), decision (required; approve |
priiism_job_estimate | Estimates the credit + dollar cost of delivering one or more GitHub milestones — read-only, queues nothing. Provide milestoneUrl, or repo (‘owner/name’) plus milestones[] (or selectAll for every open milestone). Use before committing budget to a delivery job. Returns { milestones:[{ number, title, issueCount, estimate:{ totalCredits, totalUsd, confidence, perIssue } }], aggregate:{ totalCredits, totalUsd, milestoneCount, issueCount, confidence } }; 400 for bad input or no open issues, 404/401 if GitHub is not connected/expired. | milestoneUrl, repo, milestones, selectAll |
priiism_job_execute | Releases a queued (or paused) delivery job for pickup by the autonomous SEOS cron runner — this STARTS real autonomous work: each work item runs in its own sandbox and ends in a real PR. It does NOT run synchronously; poll job_status. Returns 202 { status:‘queued’, jobId, queuedItems, driver:‘seos-cron’, message }; 400 if the job is not queued/paused or has no queued items, 404 if not found, 503 if the delivery runtime is not configured. | jobId (required) |
priiism_job_status | Reads one delivery job plus its per-issue work items (ordered by execution order). Read-only. Use to poll progress after job_execute. Returns { job, items:[…] } where job is the agent_jobs row and items are its agent_job_items; 404 if the job is not found or not in this project, 400 for missing ids, 500 on error. | jobId (required) |
priiism_job_pause | Pauses a currently-running delivery job so the cron dequeue skips it. Use to halt in-progress autonomous work. Returns { status:‘paused’, jobId }; 400 if the job is not currently running, 404 if not found or not in this project, 500 on error. | jobId (required) |
priiism_job_resume | Resumes a paused delivery job (sets it back to running so the cron picks it up), optionally raising its cost limit (newCostLimit, positive number-as-string) or token limit (newTokensLimit, positive integer). Use to continue paused autonomous work, possibly with more budget. Returns { status:‘running’, jobId, costLimit?, tokensLimit? }; 400 if the job is not paused or a new limit is invalid, 404 if not found. | jobId (required), newCostLimit, newTokensLimit |
priiism_plan_propose | Kicks off a planner run against the project’s latest succeeded knowledge build, handing off to the PLAN_PROPOSAL durable object; creates a pending proposal (does not push to GitHub). Use to generate a phased milestone/issue plan; optionally override the model. Returns 202 { proposalId, status:‘pending’, knowledgeGraphId }; 409 { error, inFlightProposalId, inFlightStatus } if one is already running, 422 if no succeeded knowledge build exists, 500 if the planner/DO is not configured. | model |
priiism_plan_dryrun | Reconcile-preview a succeeded plan proposal against the linked GitHub repo WITHOUT writing anything. Use when you want to see what plan_push would do before applying it. Returns { proposalId, cached, dryRun: { strategy, decisions, milestoneJudgements, issueJudgements, counts:{milestonesAttached,milestonesCreated,milestonesSuffixed,milestonesSkipped,issuesCreated,issuesSkippedAsDuplicate}, repoFullName, computedAt }, judgementCostUsd, repoFullName }. Read-only. Errors if proposalId is missing or not succeeded. | proposalId (required) |
priiism_plan_push | WRITE — applies a succeeded plan proposal to the linked GitHub repo, creating/attaching milestones and issues; supports perMilestoneOverrides (create | attach |
priiism_proposals_list | List this project’s plan-proposal history, newest first, paginated. Use to find a proposalId for plan_dryrun/plan_push/autonomy_start, or to review past planner runs. Returns { proposals: [serialized proposal objects], nextCursor }. Read-only; pass limit and an opaque cursor to page. Empty history returns an empty proposals array and no nextCursor. | limit, cursor |
priiism_security_scan | WRITE (compute) — runs a fresh security scan over the project’s current files: static analysis (SAST) plus a dependency-vulnerability audit, persisting a scan record. Use when you need an up-to-date security posture; each call runs a new scan. Returns { scanId, status:‘completed’, score, findingsCount, criticalCount, highCount }. Then call security_findings for details. | None |
priiism_security_findings | List security findings from the most recent scans, newest first. Use after security_scan (or to review existing findings) to inspect specific vulnerabilities. Optionally filter by status (open | resolved |
priiism_domain_bind | WRITE — binds an already-verified custom domain to the project’s live web hosting. Use only after domain_verify reports verified; binding an unverified domain returns 409. Returns the updated domain record { id, projectId, domain, status, verificationType, provider, cfDomainId, sslStatus, apxVhostId, lastError, createdAt, updatedAt, … }. Errors if domainId is missing/not found. | domainId (required) |
priiism_domain_verify | Check whether a custom domain’s ownership DNS (TXT/CNAME) record is in place and, if so, transition it to verified. Use before domain_bind. Returns { verified: boolean, domain: <domain record with status/verificationType/verificationToken/lastError/…> }. Errors if domainId is missing/not found; a still-missing record returns verified:false. | domainId (required) |
priiism_domain_status | Poll the live status of every custom domain on the project, refreshing each from the hosting/DNS provider, and return the current list. Use to check DNS/SSL/binding progress. Returns { domains: [ { id, domain, status, verificationType, provider, sslStatus, apxVhostId, lastError, createdAt, updatedAt } ] }. Read-only; no domains yields domains:[]. | None |
priiism_identity_get | Read the project’s managed identity-provider (Auth0) configuration: provider, provisioning status, callback URLs, allowed logout URLs, and web origins. Use to inspect current auth wiring. Returns { configured, provider, status?, auth0Domain, auth0ClientId, callbackUrls[], allowedLogoutUrls[], webOrigins[], lastError, createdAt, updatedAt }; when unconfigured returns { configured:false, provider:‘none’ }. Never returns the client secret. Read-only. | None |
priiism_identity_configure | WRITE — turns on login/auth for this project by AUTO-PROVISIONING a managed Auth0 application in Priiism’s own tenant and wiring it in. Requires NO input: the user does NOT need an Auth0 account, tenant, credentials, or URLs — call it with no arguments to set up auth. Callback + web-origin URLs for the preview and deployed app are configured automatically, and VITE_AUTH0_* env vars are written for you. NEVER ask the user to bring their own tenant or provide callback/web-origin URLs — just call this tool. Upserts; safe to call repeatedly. Returns configured, provider, status, auth0Domain, auth0ClientId, callbackUrls[], webOrigins[], lastError, timestamps. Never returns the client secret. | provider, callbackUrls, webOrigins, allowedLogoutUrls |
priiism_conversations_list | List the project’s chat conversations, newest first. Use to find conversation ids or review recent agent/user sessions. Optionally pass limit (default 20, max 100). Returns { conversations: [ { id, title | null, createdAt |
priiism_org_members_list | List the members of the API key’s organization. Use to see who belongs to the org and their roles. Returns { members: [ { userId, email, name | null, role } ] }. Read-only; the org is derived server-side from the token — you do not pass it. Returns 403 insufficient_scope without org:read. |
priiism_autonomy_start | DANGEROUS WRITE — starts the autonomous multi-step agent loop for the latest succeeded plan proposal (or explicit proposalId); SPENDS credits and opens real pull requests. Requires the opt-in autonomy:run scope (off by default, never in a role bundle). Use only to deliberately kick off autonomous delivery. Returns { runId, status:‘running’, proposalId, stepMode }. Returns 409 with the existing runId if a run is already in progress; 422 if no succeeded proposal or no linked repo. | proposalId, stepMode |
priiism_autonomy_status | Read the status of an autonomous run: the plan_autonomy_runs row plus the most recent node runs for its proposal. Use to monitor a run started by autonomy_start. Returns { run: { id, projectId, proposalId, status, startedAt, finishedAt, totalCostUsd, stepMode, error }, recentNodeRuns: [ { id, nodeId, status, createdAt, output, costUsd, error } ] }. Read-only; requires autonomy:read. Errors if runId is missing. | runId (required) |
priiism_seos_roles_list | List the project’s SEOS engineering-role charters (worker/reviewer/release/lead tiers and their owned governance levers). Use to understand the autonomous org chart and lever ownership. Returns { roles: [ { id, projectId, orgId, roleKey, tier, displayName, charter, ownedLevers[], byline?, enabled, humanLocked, updatedAt } ] }. Read-only; requires autonomy:read. Seeds defaults on first read. | None |
priiism_container_exec | DANGEROUS WRITE — runs an arbitrary shell command in the project’s active cloud sandbox. Requires the opt-in container:exec scope (off by default, never in a role bundle). The command is checked against the platform allowlist BEFORE running; blocked commands (e.g. rm -rf /) never execute. Use only when a real shell is needed. Returns { stdout, stderr, exitCode } with each stream truncated at 10,000 chars. 400 if blocked, 404 if no active sandbox, 502 if exec fails. | command (required), timeout, workdir |
priiism_code_search | RAG semantic search over the whole project’s indexed codebase, returning the most relevant chunks. Requires the opt-in code:search scope (off by default, never in a role bundle). Use to find where something lives across the code by meaning, not exact text. Returns { results: [ { filePath, content, score, startLine, endLine } ], totalTokens }. Read-only; returns 404 if the project has no RAG index. | query (required), topK, minScore |
priiism_supabase_query | Run a READ-ONLY SQL query against the project’s linked Supabase (Postgres) DB and return rows (truncated at 1000). Only read statements allowed — SELECT/WITH/TABLE/VALUES/SHOW/EXPLAIN (no ANALYZE); any INSERT/UPDATE/DELETE/DDL or multiple statements is rejected server-side. Use supabase_schema first to discover tables. Returns { environment, projectRef, rowCount, results[], truncated?, maxRows? }. Returns 409 { hasSupabase:false } when no Supabase connection exists. | sql (required), environment (development |
priiism_supabase_schema | Get the schema (tables + columns with type, nullability, default) of the project’s linked Supabase DB, read from information_schema. Use to discover tables/columns before supabase_query. Optionally narrow by schema (default ‘public’) and/or a single table. Returns { environment, projectRef, schema, tables: [ { name, columns: [ { name, type, nullable, default } ] } ] }. Read-only; returns 409 { hasSupabase:false } when no Supabase connection exists. | schema, table, environment (development |
priiism_supabase_settings | Read the linked Supabase project’s identity and settings: status, region, name, project URL, link status, and Postgres config. Use to confirm the connection and inspect config. Never returns API keys or passwords. Returns { environment, projectRef, projectUrl, linkStatus, readOnly, project:{ id, ref, name, region, status }, postgresConfigAvailable, postgresConfig }. Read-only; returns 409 { hasSupabase:false } when no Supabase connection exists. | environment (development |
priiism_supabase_migrations_status | Read how many of the project’s repo migrations (supabase/migrations/*.sql) are applied to its bound Supabase DB and which remain pending. Use to check migration drift. Returns { environment, projectRef, total, applied, pending: [ ’_’ ] }. Read-only — does NOT apply migrations. Returns 409 { hasSupabase:false } when no Supabase connection exists. | environment (development |
priiism_supabase_logs | Query the linked Supabase project’s logs (the analytics endpoint the dashboard uses). Use to inspect database/edge activity. Without a log-query SQL only edge_logs are returned; without a time range the last minute is returned (range must be <=24h). Returns { environment, projectRef, result:[log rows] }. Read-only; returns 409 { hasSupabase:false } when no connection, or 502 if the org’s Supabase connection doesn’t allow analytics reads. | sql, start, end, environment (development |
priiism_logs_query | Query and merge log streams across every layer of the project into one source-tagged, time-ordered list: deploy, container (dev-server), supabase, seos, and runtime (edge). Use source=‘all’ to fan out across available sources. Filter with since/until/severity/search/limit (default 100, max 500). Returns { entries:[{source,timestamp,severity,message,meta?}], sources:[{source,available,reason?,count}], limit }. Read-only, one-shot (not a live stream); an unwired source reports available:false, not an error. | source (runtime |
priiism_logs_tail | Return the most recent N log entries from a SINGLE source (deploy, container, supabase, seos, or runtime) — the tail, newest last. Use to peek at one stream’s latest activity. Pass limit (default 50, max 200). Returns { source, available, reason?, entries:[{source,timestamp,severity,message,meta?}] }. Read-only, a one-shot snapshot (NOT a live follow); an unwired source reports available:false with a reason rather than erroring. | source (required; runtime |
priiism_supabase_advisors | Read the linked Supabase project’s advisor findings (same checks as the dashboard Advisors page): security (e.g. missing RLS, exposed tables) or performance (e.g. unindexed FKs). Pass kind=‘security’ (default) or ‘performance’. Returns { environment, projectRef, kind, lints:[findings] }. Read-only; returns 409 { hasSupabase:false } when no connection, or 200 { available:false } if Supabase hasn’t enabled this experimental endpoint. | kind (security |
priiism_analytics_query | Read product-usage analytics from the DEPLOYED app — the event signal of how the live app is actually used. Use to reason about real usage and correlate with runtime errors. Filter by event, environment, and since/until (defaults last 7 days). Returns { range:{since,until}, totals:{events,aggregates}, topEvents:[{event,count,sessions}], topRoutes:[{route,count}], recentEvents:[{event,route,environment,count,hourBucket,lastSeenAt,sampleProperties,releaseCommit}] }. Counts are HOURLY-AGGREGATE rollups, not individual hits. Read-only. | since, until, event, environment (development |
priiism_extract_brand_from_url | Extracts a proposed design brand from a reference URL. Fetches the page HTML and its linked CSS bundle(s) and reads off a palette (shadcn HSL-channel tokens), fonts (display/body/mono), corner radius, a detected motion tier, and a one-line aesthetic direction. Read-only — it never changes the project. Best-effort: an unreachable site or one with no readable theme returns whatever could be derived (possibly little). Use this to bootstrap a brand from a real site the customer points at, THEN call design_brief_update to apply it. Returns { proposal: { design_tokens: { radius, fonts, light, dark }, color_intent, typographic_intent, motion_tier, aesthetic_direction, source_url } }. | url (required) |
priiism_design_brief_update | Deep-merges a proposed brand into the project’s design brief, saves it, and re-synthesizes the frozen design system (contrast-gated). Pass merge — the same shape extract_brand_from_url returns (design_tokens with radius/fonts/light/dark, plus optional color_intent/typographic_intent/motion_tier/aesthetic_direction). WRITE — governed by the design:write scope (only the Design Lead persona holds it). Returns the new design-system version on success, or the contrast-gate failure ({ ok: false, reason: 'contrast_floor', failures }) when the palette fails the accessibility floor — in which case NOTHING is written. | merge (required) |