Hub MCP tools

nextup-mcp is a stdio MCP (Model Context Protocol) server, spawned by the agent host through the workspace’s .mcp.json. The Claude CLI picks that file up and connects on its own; other vendors’ CLIs wire MCP up differently and need their own setup. Every call — including denied ones — is written to the ledger. One master switch (“Allow agents to reach the hub”) decides whether agents reach the hub at all — off, even the read tier is refused; everything below assumes it is on.

Read-only (no per-tool grant)

workspace_status · list_tasks · get_task · workflow_status · search_workspace · build_index · workspace_doctor · post_mortem_candidates · list_deliveries (teams module; brief clamps each cover note to its first line) · get_delivery (teams module) · team_overview (prime module; the teams this workspace coordinates, with a summary per member) · team_member_status (prime module) · team_list_deliveries (prime module) · list_specs (specs module) · get_spec (specs module) · validate_task_specs (specs module)

Write (authorised by you)

Authorised on the Tools page by capability group. Expanding a group gives per-tool control. The grouping is presentation only: authorisation is stored, and enforced, per tool.

New workspaces pre-authorise the everyday tools. Some stay off until you open them, because they are the checks themselves — set_task_verification, set_milestone_verified, advance_phase, publish_delivery, upgrade_workspace_assets — and every team-coordination tool is off as well, since each one reaches outside the workspace it was granted in. They are marked (off by default) below; everything unmarked is granted on day one.

• Task editing — create_task · update_task_status · set_task_verification (off by default)
• Collaboration (collaboration module) — claim_task (compare-and-set, cannot be stolen, requires an identity via --agent or NEXTUP_AGENT) · assign_task (dispatch may override)
• Team delivery (teams module) — publish_delivery (off by default; packages a note plus attachments into the outbox — agents have no routing surface at all: a delivery leaves the outbox either because a human pressed send or because a human switched on auto-send for that edge in advance. Attachments are workspace-relative paths and keep that layout inside the envelope, so two capabilities can both deliver a specs/<name>/spec.md; supersedes marks an earlier, still-unsent envelope as replaced rather than deleting it)
• Knowledge records — record_decision · record_note · record_progress · record_rejected · record_lesson · record_lesson_fired · archive_stale_lessons
• Phases & milestones — advance_phase (off by default; no force) · add_milestone · set_milestone_done · set_milestone_verified (off by default)
• Team coordination (prime module) — all off by default: team_set_edge · team_set_edge_auto_route · team_route (sends a published envelope on; a member’s follows the flow graph and a destination not downstream of it is refused, while the coordinator’s own reaches any member — it has no node in the graph to draw an edge from. Both ledgers record that the coordinator did it rather than a person) · team_add_member · team_create_member (creates a new project folder and joins it; never adopts an existing directory) · team_remove_member (takes a project out of the team; its files are untouched) · team_member_tasks · team_member_ledger · team_member_specs (read inside one member — each read is written into that member’s own ledger) · team_archive_task (the sign-off: archives a member’s finished task, which folds its spec deltas into that project’s specification)
• Handoff & maintenance — generate_handoff · upgrade_workspace_assets (off by default; engine curriculum sync — the operating guide and skills the engine shipped into the workspace; dryRun to preview)

Module-bound tools are only exposed where the module is on

In a workspace without the module enabled, these tools do not appear in the agent’s tool list at all, nor in the Tools page authorisation directory.

The tool list is fixed when the agent connects, so switching a module on mid-session changes nothing until that agent reconnects.

What agents can never do

There is no tool surface for forcing a gate or satisfying a manual confirmation. Those are structural, not permission settings you could turn on.

A team’s coordinator is the one agent that reaches past its own workspace, and the shape of what it reaches is the point: it edits the team’s graph, moves envelopes between members, and reads inside them — task text, ledger, specs — with every such read written into that member’s own ledger, so being read is never invisible. It is not itself a member of that team, so the roster it reads never includes it. What it cannot do is the work: no creating tasks, no advancing phases, no marking someone’s work verified. Archiving a member’s finished task — the sign-off that folds its spec deltas — is the one write it has inside a member, and a separate grant from reading. Its authority is granted per team by a human — naming it as coordinator switches the module on but grants nothing; every tool above waits for a separate authorisation — and it has no tool for granting itself more.