A sample of the surface, by domain. Which of these a connection can see depends on its toolsets — and, for API-key connections, its permissions.
- Projects —
list_projects,get_project,get_project_brief,get_project_context,list_project_members,whoami - Catalog —
list_catalog_entries,get_catalog_entry,get_catalog_file,create_catalog_entry,update_catalog_entry - Tickets —
list_tickets,create_ticket,update_ticket_status,assign_ticket,convert_ticket_to_story,list_ticket_tags - Stories and sprints —
list_stories,create_story,list_epics,move_story_to_epic,create_sprint - Docs —
list_wiki_pages,create_wiki_page,create_wiki_folder,update_wiki_folder,list_project_resources,list_resource_folders,move_project_resource - Internal docs —
list_internal_docs,get_internal_doc(read-only, Heizen team accounts only; Heizen’s internal knowledge base of client projects, not tied to a Studio project) - Requirements —
search_requirements,get_requirement,list_requirement_setup,create_requirement,update_requirement,link_requirements - QA —
list_test_plans,create_test_case,run_tests,qa_dashboard - Delivery —
list_worklogs,log_time,add_story_comment - Meetings —
list_meetings,get_meeting_notes,save_meeting_as_wiki,sync_calendar,toggle_event_bot - Integrations —
push_stories_to_jira,pull_stories_from_jira,push_wiki_to_confluence
tools/list on a live connection is the authoritative answer — it reflects your
toolsets and permissions, and picks up tools added since this page was written.
Reusing catalog builds
The Catalog tools let an agent find and reuse builds other
projects have shared. get_catalog_entry returns the write-up, the author’s
reuse notes, links, and the list of attached files, and get_catalog_file reads
a text file’s content. update_catalog_entry only works on entries you wrote or
contribute to, unless you’re an organization Owner or Admin. The tools pick the
organization from the pinned project, or from your only organization; pass
organization when you belong to several.
Requirements
search_requirements takes a key such as FR-12, or any words. Words are
ranked by both keywords and meaning, so a plain-language description finds a
requirement worded differently; set mode to keyword or semantic to use
one only. Tools accept requirement keys, and module, scope and persona names,
as well as ids.
Each change to a requirement’s wording or criteria made through MCP is saved as a new version, shown in the requirement’s History as MCP for the person who connected. MCP can set a requirement to Draft or Ready but cannot approve it, and it cannot delete requirements or links. What a connection may read or change follows the person’s role on the project, exactly as in the web app, and every change appears in the audit log as made through MCP.
The escape hatch
The api toolset carries a single tool, studio_api_call, for Studio endpoints
that don’t have a dedicated tool yet. It’s available to OAuth and JWT sessions
and refused for API keys — an arbitrary API path can’t be confined to one
project, so a project-scoped key can’t have it.
How tools reach your data
Every tool calls the Studio REST API over loopback rather than touching services directly, so the same guards, DTO validation and membership checks that protect the web app apply here. MCP never becomes a second, weaker door into your data.
Tools return compact prose rather than raw JSON — a model reads the output on a
token budget, so a ticket list comes back as lines like • #42 Fix login [OPEN · P2] instead of a payload dump.