What an AI client will be able to do

GET

/mcp/tools

const url = 'https://api.flotera.com/api/v1/mcp/tools';
const options = {
  method: 'GET',
  headers: {cookie: '__Host-erm_session=<__Host-erm_session>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.flotera.com/api/v1/mcp/tools \
  --cookie __Host-erm_session=<__Host-erm_session>

The tool catalog: name, what it does, its risk class and whether it is wired or only declared.

Readable BEFORE any client is connected, and deliberately so. Deciding whether to hand an AI access to a fleet requires seeing the exact list of what it could do — a page that only says “not available yet” gives no basis for that decision.

Write tools are listed with status: stub: they exist in the catalog and change nothing when called. Hiding them would be worse — a model that cannot find a tool starts looking for workarounds.

Authorizations

sessionCookie

Responses

200

Tool catalog.

application/json

object

endpoint

required

Where an MCP client points. Empty when the gateway is not published.

string

<= 300 characters

token_scopes

required

Scopes a personal access token needs for the read-only and the full tool set. Authorization is the token’s scopes intersected with the plan — there is no separate MCP permission model to keep in sync.

object

read

required

Array<string>

<= 20 items

write

required

Array<string>

<= 20 items

tools

required

Array<object>

<= 100 items

object

name

required

string

<= 64 characters

group

required

string

<= 32 characters

summary

required

string

<= 400 characters

risk

required

string

Allowed values: R0 R1 R2 R3

status

required

stub means the tool is declared and does nothing when called.

string

Allowed values: ready stub

entitlement

required

string

Allowed values: mcp.read mcp.write

scopes

required

Domain scopes the tool needs. A grant never exceeds the scopes of the person who issued it.

Array<string>

<= 8 items

needs_approval

required

boolean

forbidden

required

What is not merely unbuilt but will never be exposed: money, identity, secrets, arbitrary execution.

Array<string>

<= 50 items

connect_available

required

Whether an AI client can be connected. False means the gateway address is not configured for this deployment.

boolean

Example

{
  "tools": [
    {
      "risk": "R0",
      "status": "ready",
      "entitlement": "mcp.read"
    }
  ]
}

401

Missing/invalid credentials (code=unauthorized).

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

Allowed values: unauthorized forbidden csrf_rejected not_found conflict idempotency_conflict validation_failed rate_limited payload_too_large unsupported_agent_version temporarily_unavailable offline_queue_full online_queue_full plan_required server_limit_reached feature_not_entitled account_in_grace account_frozen payment_pending payment_expired payment_amount_mismatch change_already_pending change_already_applied change_effective reserve_not_covered direction_changed

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}

503

A dependency the endpoint needs is not configured or is temporarily unavailable (code=unavailable). The rest of the API keeps working — an absent external integration must not take the service down.

application/problem+json

RFC 9457 problem document with a stable machine code.

object

type

required

string format: uri

title

required

string

<= 256 characters

status

required

integer

>= 100 <= 599

code

required

Stable machine-readable error code (03 §2.4).

string

detail

string

<= 2048 characters

instance

string

<= 512 characters

request_id

UUID (v7 for new entities; v4 accepted during migration).

string format: uuid

errors

Array<object>

<= 100 items

object

path

required

JSON Pointer to the offending field.

string

<= 512 characters

code

required

string

<= 64 characters

Example

{
  "type": "https://ermeon.com/problems/validation",
  "code": "unauthorized"
}