A sample of the surface, by domain. Which of these a connection can see depends on its toolsets — and, for API-key connections, its permissions.
- Projects —
list_projects,get_project,list_project_members,whoami - Bugs —
list_bugs,create_bug,update_bug_status,assign_bug,convert_bug_to_story - Stories and sprints —
list_stories,create_story,list_epics,move_story_to_epic,create_sprint - Requirements —
generate_requirements,generate_backlog_from_requirements,review_requirements,list_personas - Docs —
list_wiki_pages,create_wiki_page,create_wiki_folder,list_project_resources - QA —
list_test_plans,create_test_case,generate_test_cases_from_story,run_tests,qa_dashboard - Delivery —
list_worklogs,log_time,add_story_comment - Meetings —
list_meetings,get_meeting_notes,save_meeting_as_wiki,sync_calendar,toggle_event_bot - Integrations —
push_stories_to_jira,pull_stories_from_jira,push_wiki_to_confluence,link_pull_request
tools/list on a live connection is the authoritative answer — it reflects your
toolsets and permissions, and picks up tools added since this page was written.
The escape hatch
The api toolset carries a single tool, studio_api_call, for Studio endpoints
that don’t have a dedicated tool yet. It’s available to OAuth and JWT sessions
and refused for API keys — an arbitrary API path can’t be confined to one
project, so a project-scoped key can’t have it.
How tools reach your data
Every tool calls the Studio REST API over loopback rather than touching services directly, so the same guards, DTO validation and membership checks that protect the web app apply here. MCP never becomes a second, weaker door into your data.
Tools return compact prose rather than raw JSON — a model reads the output on a
token budget, so a bug list comes back as lines like • #42 Fix login [OPEN · P2] instead of a payload dump.