> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bugspray.io/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP tools and resources

> Use the deployment’s discovered schemas as the contract.

Connect using the [agent setup guide](https://docs.bugspray.io/guides/ai-agents.md). Streamable HTTP lives at `/mcp`; the local stdio entry is `pnpm run mcp`. Reconnect or restart your client to discover changes. Local, hosted and bridge clients can expose different capabilities.

## Tool families

| Task | Representative tools |
| - | - |
| Report and investigate | `get_reporting_guide`, `search_findings`, `get_finding`, `submit_finding`, `wait_for_findings`, `assign_finding`, `get_ingestion_stats` |
| Product hierarchy | `list_products`, `get_product`, `create_product`, `update_product`, `list_product_areas`, `create_product_area` |
| Workflow expectations | `list_product_workflows`, `get_product_workflow`, `create_product_workflow`, `update_product_workflow` |
| History and bounded retrieval | `list_workflow_definitions`, `get_workflow_definition`, `resolve_current_workflows`, `resolve_workflow_definitions` |
| Workflow lifecycle | `move_product_workflow`, `archive_product_workflow`, `restore_product_workflow` |
| Authentication | `list_auth_profiles`; bridge `authenticate_profile`; hosted authenticated discovery/browser tools when supported |
| Suite planning | `plan_pr_suites`, `plan_and_save_pr_suites` |

This is a task map, not an exhaustive static schema. Discover the complete list and argument descriptions through your client. Suite registry CLI operations are not exposed as general registry MCP tools.

## Reporting resources

* `bugspray://reporting-guide`: evidence and submission discipline.
* `bugspray://ingestion-schema`: current ingestion shape.
* `report_verified_bug`: reporting prompt.

Call `get_reporting_guide` before submitting. `submit_finding` requires stronger verification than ordinary REST metadata storage, including duplicate search, final-state verification, inspected evidence, auth intent and a repro or concrete omission reason. A consumer can use `submit_feedback`; contributors working on Bugspray itself should follow [contribution guidance](https://docs.bugspray.io/contributing.md).

## Authorization and capability failures

Interactive hosted clients use Settings-generated OAuth. Unattended clients use dedicated tenant-bound `mcp`-scoped service tokens. A user must still belong to the chosen tenant; caller-supplied tenant headers do not choose authority. Administrator-only configuration cannot be performed with an ordinary service token.

Sampling tools need a negotiated sampling-capable host. A stateless hosted connection can report `sampling_host_unavailable`; fallback is not proof a model ran. An execution-disabled deployment cannot validate a submitted repro. Treat these as explicit capability states, not successful verification.

## Developer source map

The installed MCP SDK and server registration define actual schemas. Start with [`apps/server/src/mcp.ts`](https://github.com/SynclyUS/bugspray/blob/main/apps/server/src/mcp.ts), [`catalog-mcp.ts`](https://github.com/SynclyUS/bugspray/blob/main/apps/server/src/catalog-mcp.ts), and [`suite-planning-mcp.ts`](https://github.com/SynclyUS/bugspray/blob/main/apps/server/src/suite-planning-mcp.ts). Hosted adapter/gateway paths retain their own authentication and capability checks. Extend shared schemas first rather than teaching clients undocumented arguments.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.