MCP tools reference
Relata ships a built-in Model Context Protocol server with 60+ tools that AI agents can invoke. MCP is the canonical agent surface for Relata — agents get scoped ACL principals, governed by the same Cedar-inspired ABAC model as human users.
Endpoint
POST /mcp/initialize
GET /mcp/tools
POST /mcp/tools/call
GET /mcp/sessions
POST /mcp/tools/call takes a flat body: {"name": "<tool>", "arguments": {...}}.
Auth: bearer token.
Generate a client config
relata mcp config --client claude # prints a claude_desktop_config.json snippet
relata mcp config --client cursor # Cursor IDE config
relata mcp config --client cline # Cline / Roo
relata mcp config --client stdio # raw stdio configEach command prints a ready-to-paste JSON snippet pointing at your local Relata server.
Tool catalogue (60+ tools)
Query
| Tool | Purpose | Notes |
|---|---|---|
query | Execute governed SQL (SELECT / PATHS_BETWEEN / LOOKUP_IDENTITY / SIMILAR) | Mandatory purpose; rows capped at 10,000 |
query_knowledge | Execute SQL with automatic purpose injection | Default purpose analytics |
explain_policy | Static ACL/purpose/egress analysis without executing | Returns allowed/denied + reasons |
suggest_extensions | List active extension packs and relevance | No arguments |
search_knowledge | Free-text search over IntelChunk/entities/relationships | type_filter, source_filter, min_confidence |
search_entities | Full-text + identity search across entity types | Typo-tolerant (fuzzy) |
hybrid_search | Combined BM25 + vector + graph, RRF fusion | Per-query weights |
find_in_social_corpus | Unified social-media retrieval (BM25 + vector + identity filter) |
Entity & Identity
| Tool | Purpose | Notes |
|---|---|---|
lookup_identity | Resolve a raw identifier to canonical form + matching entities | Arg raw (phone/email/IP/IMEI/…) |
list_entity_types | List object types with row counts | No arguments |
get_entities | Paginated entity list for a type with filters | entity_type, filters, limit, offset |
get_domain_summary | Per-domain roll-up (financial/telco/cyber/sanctions/…) | Arg domain |
resolve_entity_identity | RESOLVE_IDENTITY canonical cluster for an entity | Arg identity |
Ingest & RAG
| Tool | Purpose | Notes |
|---|---|---|
ingest_document | Store text + entities + relations with bi-temporal provenance | Routes to IntelChunk / canonical types / KnowledgeTriple |
rag_store_answer | Store a RAG answer (RagAnswer + RagSource rows) | Flat and dgrep-rag nested shapes |
rag_store_elements | Store dgrep-rag ExtractorElements | elements, source_filename |
ingest_media | Image/audio/video (base64) or text for embedding + perceptual-hash dedup | Returns a task id |
Knowledge graph
| Tool | Purpose | Notes |
|---|---|---|
get_relationships | KnowledgeTriple records, filtered by subject/predicate/object/source | Returns triples + unique entities |
paths_between | Governed PATHS_BETWEEN walk | Args from, to, max_hops |
list_link_types | Governed edge types in the ontology | No arguments |
Entity intelligence
| Tool | Cost | Notes |
|---|---|---|
get_entity_profile | 5 | 360° profile (identity, relationships, transactions, intel, sanctions) |
get_timeline | 3 | Chronological event timeline |
find_connections | 3 | Hidden network connections (relationship / transaction / shared attribute) |
get_case_summary | 5 | Per-purpose summary: inventory, graph, notes, RAG answers, next steps |
add_case_note | 1 | Analyst note stored as CaseAnnotation |
get_audit_trail | 1 | Tamper-evident audit log scoped to a purpose |
Memory (agent cognitive verbs)
| Tool | HTTP equivalent | Notes |
|---|---|---|
remember | POST /memory/remember | Store a MemoryItem (content, session_id, confidence, memory_class) |
remember_batch | POST /memory/remember/batch | Bulk write; items[] + default purpose |
recall | GET /memory/recall | Hybrid BM25 + vector; query/q, top_k, as_of, class_filter |
recognize | GET /memory/recognize/:id | Fetch one MemoryItem by id |
episodes_in | GET /memory/episodes | List Episodes for a session |
justify | GET /memory/justify/:id | Provenance chain + audit trail |
consolidate | POST /memory/consolidate | Supersede a MemoryItem (id, content, confidence) |
forget | DELETE /memory/forget/:id | Retention-policy retract (retain_days; -1 = legal hold) |
associate | POST /memory/associate | Link two items (from_id, to_id, relation) |
resolve | GET /memory/resolve/:id | Follow supersession chain to the canonical MemoryItem |
summarise | POST /memory/summarise | Governed summary of a session/topic |
Governance, media & ops
| Tool | Purpose | Notes |
|---|---|---|
erase_subject | GDPR Art. 17 erasure (row + vector + blob) | Returns a signed certified receipt |
similar_multimodal | Governed cross-modal similarity (SIMILAR TO … LIMIT k) | ACL + cell masking apply |
server_health | Readiness snapshot | Mirrors /health/ready |
job_status / list_jobs | Continuous detection jobs | status, interval, last-run, alerts |
schedule_job | Trigger one run of a named job | Returns alert count |
list_workflows / run_workflow / workflow_status | Workflow definitions and executions | |
metrics | Operational counters | Mirrors /metrics.json |
list_rules / create_rule / import_sigma | Detection-rule management | Mirrors /rules |
Investigation, graph analytics & finance
| Tool | Purpose | Notes |
|---|---|---|
trace_crypto | CRYPTO_TRACE hop-by-hop | address, max_hops |
beneficial_ownership | BENEFICIAL_OWNERSHIP_CHAIN | party, max_depth |
reconstruct_wire | WIRE_RECONSTRUCTION | account, tolerance_pct |
trace_hawala | HAWALA_TRACE informal value transfer | seed, max_hops |
geofence | GEOFENCE spatial query | lat, lon, radius_m |
detect_communities | Community detection (Louvain/Leiden) | entity_type, algo |
rank_key_nodes | PageRank / centrality | metric: pagerank/betweenness/closeness/eigenvector |
hub_authority | HITS hub + authority scores | |
predict_links | Link prediction (common_neighbors/jaccard/adamic_adar) | |
find_scc | Strongly connected components | Detects circular structures |
screen_sanctions | SANCTIONS_SCREEN | name, threshold |
aggregate_stats | Governed COUNT/SUM/AVG | entity_type, agg, column |
investigate_entity | Composite investigation profile | entity profile + timeline + connections + risk |
find_threats | Composite threat hunt | communities + top-risk nodes + active rules |
Multimodal
| Tool | Purpose | Notes |
|---|---|---|
search_video_frames | Governed SIMILAR TO over VideoFrame entities | query_id, top_k |
face_match | Biometric face match (GATED — returns 403 until biometric ACL ships) | probe_id, threshold |
Intelligence
| Tool | Purpose | Notes |
|---|---|---|
nl_query | Natural-language → governed SQL → execute | Deterministic fallback when RELATA_LLM_URL is unset; interpret for NL summary |
Tool schema
Every tool exposes a JSON Schema for its input parameters via
GET /mcp/tools. Example (search_knowledge):
{
"name": "search_knowledge",
"description": "Search across ingested knowledge content — documents, entities, and relationships — using free-text query.",
"inputSchema": {
"type": "object",
"required": ["query"],
"properties": {
"query": { "type": "string" },
"purpose": { "type": "string" },
"type_filter": { "type": "string", "description": "Restrict results to a content type: text, person, organization, location, relationship, answer." },
"source_filter": { "type": "string", "description": "Restrict to content from this document/source." },
"limit": { "type": "integer", "default": 20 },
"min_confidence": { "type": "number", "default": 0.0 },
"fuzzy": {
"type": ["boolean", "object"],
"description": "Bounded typo tolerance: true, or an object with edit_distance 1 or 2."
}
}
}
}Agents that respect MCP (Claude, Cursor, Cline, LangChain, LlamaIndex) consume this schema and propose tool calls to the model.
Response shape
{
"content": [
{ "type": "text", "text": "..." },
{ "type": "json", "json": { } }
],
"isError": false,
"meta": {
"processing_time_ms": 42
}
}The meta.processing_time_ms field lets agents measure
their own tool-call overhead.
Agent scoping (security)
Agents authenticate via a bearer token like any other client. The token maps to a principal; the principal's ACL role determines what the agent can do.
Best practice: give each agent a dedicated principal with the minimum required permissions. Don't reuse a human principal for an agent.
# Register a scoped dynamic bearer token via the admin token surface
# (POST /admin/tokens writes to the in-memory + on-disk token registry).
# Give each agent a dedicated principal with the minimum required permissions.Sessions
POST /mcp/initialize is the MCP handshake — it returns server metadata and the
tool catalogue so a client can discover capabilities before calling tools:
curl -X POST http://localhost:9090/mcp/initialize \
-H "Authorization: Bearer $RELATA_TOKEN"
# Response:
# {
# "protocol_version": "2024-11-05",
# "server_info": { "name": "relata", "version": "...", "profile": "...", "node_id": "..." },
# "capabilities": { "tools": { "list_changed": false }, ... },
# "tools": [ { "name": "query", ... }, ... ]
# }GET /mcp/sessions lists AgentSession records with their ToolCall history
(filter by session_id, cap with limit). AgentSessions are created on the
first memory remember for a new session_id — not by /mcp/initialize.
Multi-tenant agents
curl -X POST http://localhost:9090/mcp/tools/call \
-H "Authorization: Bearer $RELATA_TOKEN" \
-H "X-Organization-Id: org-acme" \
-d '{"name": "query", "arguments": {"sql": "SELECT * FROM Person LIMIT 5", "purpose": "analytics"}}'The principal's org scoping applies — agent queries never leak across tenants.
Examples
Claude Desktop
~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"relata": {
"command": "npx",
"args": ["-y", "relata-mcp-bridge"],
"env": {
"RELATA_URL": "http://localhost:9090",
"RELATA_TOKEN": "relata-dev"
}
}
}
}LangChain (Python)
relata_adapters.langchain.RelataMemory is a governed BaseMemory-shaped
adapter backed by Relata's /memory/* surface:
from relata_adapters.langchain import RelataMemory
mem = RelataMemory(base_url="http://localhost:9090", purpose="research")
# chain = ConversationChain(llm=..., memory=mem)
# save_context stores each turn; load_memory_variables recalls the most
# relevant prior memories for the incoming input.Direct curl
curl -X POST http://localhost:9090/mcp/tools/call \
-H "Authorization: Bearer $RELATA_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "search_knowledge",
"arguments": {
"query": "governance policy for cross-border data sharing",
"purpose": "investigation",
"limit": 5,
"fuzzy": true
}
}'Access control
The same rules apply to every tool call:
- Auth: Bearer token required (
Authorization: Bearer <token>). - Purpose: every call requires a registered purpose — absent purpose returns HTTP 400.
- ACL: Cedar-inspired ABAC evaluated on every request; deny-wins.
- Egress filtering: classified types (
SourceTrueIdentity,SigintIntercept,AccessScopedIntercept,LawfulInterceptRecord) are blocked at egress regardless of query success. - Audit: every invocation recorded with principal, timestamp, purpose, cost units, and a tamper-evident hash chain.
- Quota: most query tools cost 1 unit; multi-table / intelligence tools cost 3–5. Default 10,000 units/principal. Quota exhaustion returns HTTP 429.
Purpose enforcement
# Strict (default) — only registered purposes
RELATA_PURPOSE_MODE=strict
RELATA_PURPOSES=analytics,audit,compliance,operations
# Open — any non-empty string (dev/test only)
RELATA_PURPOSE_MODE=openHierarchical scoping with : separator is supported (analytics:external).
Egress filtering
These classified types never appear in tool results:
| Type | What it contains |
|---|---|
SourceTrueIdentity | HUMINT protected true identity |
SigintIntercept | Signal intelligence intercept records |
AccessScopedIntercept | Restricted access-scoped data |
LawfulInterceptRecord | Lawful intercept records |
Errors
{
"content": [{ "type": "text", "text": "error message" }],
"isError": true
}| HTTP | Cause |
|---|---|
| 200 | Tool succeeded |
| 400 | Missing / invalid parameters or missing purpose |
| 401 | Bearer token missing or invalid |
| 403 | ACL denied, purpose denied, egress blocked, or protected-type ingest |
| 404 | Unknown tool |
| 429 | Quota exhausted or ingest queue full |
| 500 | Store unavailable or execution error |
See Error codes reference for the RFC 7807 mapping.
Not exposed over MCP
watch / subscribe are not MCP tools. The SubscriptionManager + /watch/stream SSE endpoint produces a long-lived event stream; the MCP tools/call request-response envelope cannot carry an open stream. Use SSE directly for subscriptions.