Nebbos

Showing 25 of 37 from the live probe.

• Audit Event List

  List Article-12 audit events for the caller's tenant, optionally filtered. READ TIER — requires the 'audit_events:read' scope. RLS-scoped to the caller's tenant automatically via ``set_tenant_context``. Parameters: event_type — optional exact match (e.g. 'agent.tool_call'). since — optional ISO-8601 timestamp lower bound (occurred_at >= since). until — optional ISO-8601 timestamp upper bound (occurred_at < until). actor_id — optional UUID exact match. limit — max eve

• Audit Event Get

  Fetch one Article-12 audit event by id — metadata + chain hashes. READ TIER — requires the 'audit_events:read' scope. RLS-scoped to the caller's tenant automatically. Parameters: event_id — UUID of the event. Returns: {"event": {id, event_type, actor_type, actor_id, delegated_by, occurred_at, hash, previous_hash} | None, "meta"}. Payload is OMITTED at MVP scope (encrypted at rest, DEK decryption is Wave 2.5).

• Audit Event Hash Chain Verify

  Verify an audit event's chain integrity — structural link + cryptographic rehash. READ TIER — requires the 'audit_events:read' scope. RLS-scoped to the caller's tenant automatically. Wave 2.5: BOTH checks run. 1. STRUCTURAL — does target.previous_hash resolve to an existing tenant row? (Skipped for genesis events where previous_hash == '0'*64.) 2. CRYPTOGRAPHIC — decrypt payload via tenant DEK, recompute sha256(canonical_json(plaintext) + previous_hash), compare to stored hash.

• List Departments

  List all departments in this Nebos workspace with their current status. What it does: returns every active department for the authenticated tenant, including Pearl status (if a Pearl is assigned), signal counts for the last 7 days, and the timestamp of the most recent signal. When to use: always call this first if you don't know the department structure. Do NOT call query_pearl without knowing the correct department name from this list. Returns: array of department objects with id, name, dep

• Describe Pearl

  Describe a specific Pearl agent's capabilities, data sources, and maturity. What it does: looks up the Pearl assigned to the named department and returns its maturity stage, activation date, connected integrations (tool_connections), days in the current stage, and what question types it can answer reliably at each stage. When to use: before calling query_pearl, to verify that the Pearl can answer your question reliably. Pearl answers become more calibrated the longer it has been running: ob

• List Available Tools

  List what this Nebos instance can do and what requires human approval. What it does: returns a static catalogue of every MCP tool with its HITL tier (read / write / critical), required scope, and a short description. When to use: at session start if you are unsure what your token permits, or to understand the approval requirements before performing write operations. Returns: array of tool descriptors with name, tier, hitl_tier, scope_required, and description; plus a hitl_tier_notes block exp

• Gh Pr View

  Fetch one GitHub pull request — title, state, head SHA, draft flag, and URLs. READ TIER — requires the 'github:read' scope. Parameters: pr_number — positive integer PR number. repo — 'owner/name' (e.g. 'Nebos-ai/nebos-backend'). Returns: {"pr_number", "title", "state", "merged_at", "draft", "html_url", "author", "head_sha", "head_ref", "base_ref", "meta"}.

• Gh Pr List

  List pull requests on a repository. READ TIER — requires the 'github:read' scope. Parameters: repo — 'owner/name'. state — 'open' (default) | 'closed' | 'all'. limit — max PRs to return (default 30; GitHub caps at 100 per page). Returns: {"prs": [<pr-slim>], "count", "meta"}.

• Gh Pr Check Runs

  List check-run status for a pull request's head commit — CI pass/fail signal. READ TIER — requires the 'github:read' scope. Two GitHub API calls: PR fetch for the head SHA, then check-runs fetch against that SHA. Parameters: pr_number — positive integer PR number. repo — 'owner/name'. Returns: {"total_count", "check_runs": [{name, status, conclusion, html_url}], "head_sha", "meta"}.

• Gh Pr Files

  List the files changed in a pull request — filename, status, additions, deletions. READ TIER — requires the 'github:read' scope. Parameters: pr_number — positive integer PR number. repo — 'owner/name'. Returns: {"files": [{filename, status, additions, deletions}], "count", "meta"}.

• Gh Workflow Run Logs

  Fetch the signed URL to a workflow run's logs zip — client downloads it directly. READ TIER — requires the 'github:read' scope. GitHub returns a 302 redirect to a short-lived signed URL. This tool uses follow_redirects=False and returns the URL. Downloading the zip in-process would burn tenant memory + token budget; callers that want the logs fetch it themselves. Parameters: run_id — positive integer workflow-run id. repo — 'owner/name'. Returns: {"logs_url", "meta"}.

• Gh Pr Create

  Create a pull request on a GitHub repository. WRITE TIER — requires the 'github:write' scope AND a valid human delegator (HITL gate). If the token does not carry the required scope, this tool returns a pending_approval response rather than executing. Mirrors the projects.create_task + write.acknowledge_signal precedent. Parameters: repo — 'owner/name' (e.g. 'Nebos-ai/nebos-backend'). title — non-empty PR title. head — branch or 'owner:branch' (source of the PR). base — target branch

• Gh Pr Merge

  Merge a pull request on a GitHub repository. WRITE TIER — requires the 'github:write' scope AND a valid human delegator (HITL gate). If the token does not carry the required scope, this tool returns a pending_approval response rather than executing. Parameters: pr_number — positive integer PR number. repo — 'owner/name'. method — 'squash' (default) | 'merge' | 'rebase'. commit_title — optional custom merge-commit title. commit_message — optional custom merge-

• List Workspace Users

  List all users in the tr3i.com Google Workspace. What it does: enumerates users via Domain-Wide Delegation on the nebbos-workspace-sa service account. Fields filtered to non-PII metadata (id, primaryEmail, isAdmin, suspended, archived, orgUnitPath, timestamps). When to use: understanding workspace membership, filtering by org unit or admin status, checking suspended accounts. Args: subject: Impersonation subject (email). Defaults to the workspace default (settings.google_workspace

• List Workspace Groups

  List all groups in the tr3i.com Google Workspace. What it does: enumerates groups via Domain-Wide Delegation. Fields filtered to id, email, name, description, directMembersCount, adminCreated. When to use: understanding group structure, finding distribution lists, counting membership across groups. Args: subject: Impersonation subject (email). Defaults to the workspace default. Returns: {"groups": [...], "count": N, "meta": {...}}.

• List Workspace Org Units

  List all org units (departments) in the tr3i.com Google Workspace. What it does: enumerates the workspace's org-unit tree via Domain-Wide Delegation. Fields filtered to orgUnitId, orgUnitPath, name, description, parentOrgUnitPath. When to use: understanding the departmental structure of the workspace, building filters against org unit path. Args: subject: Impersonation subject (email). Defaults to the workspace default. Returns: {"org_units": [...], "count": N, "meta": {...}}.

• Get Knowledge Graph

  Query the Graphiti temporal knowledge graph for expertise and workflow patterns. What it does: returns knowledge graph entities and relationships for the authenticated tenant, optionally filtered by department or a semantic query. The knowledge graph tracks who knows what, workflow patterns, and causal relationships learned by Pearl agents over time. Parameters: query — semantic search query (e.g. "who knows the Henderson account?") department — optional exact department name to scope

• Search Insights

  Semantic search across resolved signals, post-mortems, and gap resolutions. What it does: performs a full-text search over resolved predictions and resolved pearl_gaps for the authenticated tenant. Results are ordered by relevance (ts_rank on the headline/summary text) then by recency. Parameters: query — what you are looking for (keywords or phrase) date_from — optional ISO date string to search from (e.g. '2026-01-01') date_to — optional ISO date string to search to (e.g. '2026-

• Get Context

  Session-bootstrap context assembly for governance knowledge (ADR-158 AD-1). What it does: embeds the task_description via Voyage-4, runs a pgvector cosine similarity search over the governance knowledge corpus (system tenant), and returns a context blob bounded to ~4,000 tokens. Call this ONCE at session start when working on any Nebos-platform task that may be affected by governance rules, ADRs, or policies. The result surfaces the most relevant governance entries so the agent does not need t

• Query Pearl

  Ask a natural language question to a specific department's Pearl agent. What it does: routes the question to the Pearl LangGraph agent assigned to the named department. Pearl answers using its semantic and episodic memory plus any relevant signals for that department. Parameters: department — exact department name from list_departments question — your question in natural language (treated as untrusted input, never interpolated into system prompts) signal_id — optional signal ID f

• Analyze Gaps

  Get open knowledge gaps — what Pearl is trying to learn by asking employees. What it does: queries the shell_gaps table (renamed from pearl_gaps by migration 112, May 2026) for gaps matching the given department (and optional status filter), ordered by priority_score DESC. Gaps tell you what information Pearl is actively seeking to resolve unexplained operational patterns. Parameters: department — optional exact department name to filter gaps; omit for tenant-wide gaps status — gap

• Search Playbook Catalog

  Search the operational playbook catalog for a department. What it does: runs a semantic search over the playbook catalog scoped to your department and returns the closest-matching playbooks ranked by relevance. When nothing in the catalog clears the relevance bar, it records the search as a demand signal (a "miss") so the gap between what operators ask for and what the catalog covers becomes visible — it does not fabricate an answer. When to use: before assuming a process exists, to find the c

• Get Predictions

  Get upcoming risk predictions from the Orchestrator pattern detection engine. What it does: returns active signals whose pattern detection window extends into the next ``horizon_days`` days — i.e., forward-looking risk indicators derived from operational event patterns. Results are sorted by severity then by predicted occurrence window (soonest first). When to use: for forward-looking planning conversations ("what risks are coming in the next two weeks?"). Use this before leadership stand-up

• List Tasks

  List active tasks from the Nebos Projects tracker (the canonical task queue). READ TIER — requires the 'tasks:read' scope. Parameters: status — optional filter by status ('ready', 'in_progress', 'done', 'blocked', ...). Client-side filter over the returned page. limit — max tasks to return (default 200, upper bound is what the tracker allows). lifecycle_state — 'active' (default), 'archived', or 'deleted'. Returns: {"tasks": [<task-dict>], "met

• Get Task

  Fetch a single task from the Nebos Projects tracker by id. READ TIER — requires the 'tasks:read' scope. Parameters: task_id — UUID of the task to fetch. Returns: {"task": <task-dict-or-null>, "meta": {...}} where task is the raw tracker record, or ``null`` when the id is not found.