/mcp; the local stdio entry is pnpm run mcp. Reconnect or restart your client to discover changes. Local, hosted and bridge clients can expose different capabilities.
Tool families
This is a task map, not an exhaustive static schema. Discover the complete list and argument descriptions through your client. Suite registry CLI operations are not exposed as general registry MCP tools.
Reporting resources
bugspray://reporting-guide: evidence and submission discipline.bugspray://ingestion-schema: current ingestion shape.report_verified_bug: reporting prompt.
get_reporting_guide before submitting. submit_finding requires stronger verification than ordinary REST metadata storage, including duplicate search, final-state verification, inspected evidence, auth intent and a repro or concrete omission reason. A consumer can use submit_feedback; contributors working on Bugspray itself should follow contribution guidance.
Authorization and capability failures
Interactive hosted clients use Settings-generated OAuth. Unattended clients use dedicated tenant-boundmcp-scoped service tokens. A user must still belong to the chosen tenant; caller-supplied tenant headers do not choose authority. Administrator-only configuration cannot be performed with an ordinary service token.
Sampling tools need a negotiated sampling-capable host. A stateless hosted connection can report sampling_host_unavailable; fallback is not proof a model ran. An execution-disabled deployment cannot validate a submitted repro. Treat these as explicit capability states, not successful verification.
Developer source map
The installed MCP SDK and server registration define actual schemas. Start withapps/server/src/mcp.ts, catalog-mcp.ts, and suite-planning-mcp.ts. Hosted adapter/gateway paths retain their own authentication and capability checks. Extend shared schemas first rather than teaching clients undocumented arguments.