Tools Reference

Every tool the Paxper MCP connector exposes, in one place, so this page can be updated as tools change.

Read tools

list_workspaces

Lists the workspaces in the connected organization, with each workspace’s id. Every other tool that takes a workspace expects that UUID, not the workspace’s name — use this first when the assistant doesn’t already know which workspace you mean.

get_workspace

Returns a workspace’s full diagram: its resources and the connections between them.

Key inputs: workspace id (the UUID from list_workspaces — a workspace name isn’t accepted).

find_resources

Searches for resources by name/label and/or type, and returns every match. Use this when you refer to a resource by a partial or ambiguous name (e.g. “the prod security group”) rather than an exact id.

Key inputs: search text, optional resource type filter, workspace id.

get_resource

Returns all fields of a single resource. Secret values (passwords, keys, tokens) are redacted in the output.

Key inputs: resource id.

get_resource_schema

Returns the fields the assistant is allowed to set on a resource type: field names, defaults, validation rules, and where each field’s value comes from (its source):

• static — a fixed set of options,
• cloud — looked up from AWS for the workspace’s region (via list_field_options), e.g. AMIs, instance types, engine versions,
• workspace — a resource that must already exist in the same workspace, e.g. a key pair or IAM instance profile (also via list_field_options),
• subnet-choice — a subnet type or availability zone picked from list_field_options,
• connection — filled in by connecting the resource to another one, never set directly,
• free — free text.

Also returns requiredConnections for the resource type, if any.

Key inputs: resource type.

list_resource_types

Lists the resource types that can currently be added through the assistant, each with its requiredConnections. Some types are excluded (notAddable) because they’re configured through other resources’ fields instead — see Limits & Troubleshooting.

list_field_options

Returns the valid values for a field whose source is cloud, workspace, or subnet-choice — for example AMIs and instance types available in the workspace’s region, database engine versions, key pairs or IAM instance profiles defined in the workspace, or subnet/availability-zone choices for a connected VPC. Use this before setting such a field so the value you pass is one Paxper recognizes. Cloud-sourced values are looked up from AWS for the workspace’s region, not your AWS account — a cold cache answers status: "warming"; wait about a minute and retry.

Key inputs: resource type, field name, workspace id (for region context).

Policy tools

These read the IAM and S3 policy generators, so an IAM policy (aws_iam_policy) or an S3 bucket policy (aws_s3_bucket, with attach_policy on) is built from real AWS actions and validated before it is saved. Write the policy with build_iam_policy or build_s3_policy and send its policyJson as the resource’s policy value; a write whose policy does not validate is refused.

• search_iam_actions / search_s3_actions — find actions (e.g. s3:GetObject) by text, service (IAM) or category (S3), with their access level.
• list_policy_templates — ready-made IAM or S3 policy templates. get_policy_template returns one with its full policy; replace every ${NAME} listed in placeholders with a real value before building.
• list_policy_conditions — condition keys and operators for a statement.
• list_s3_principals — principal types and AWS service principals (e.g. cloudfront.amazonaws.com) for S3 bucket policy statements.
• build_iam_policy / build_s3_policy — build the document from statements and return it with its validation result.

Key inputs: a policy kind (IAM or S3), search text, and for the builders the statements (Effect, Action, Resource, Condition, and Principal for S3).

Write tools

rename_resource

Renames a resource. This sets both the canvas label and the resource’s underlying name in one step.

Key inputs: resource id, new name.

update_resource

Updates a resource’s label and/or its parameters.

Key inputs: resource id, fields to change.

add_resource

Adds a new resource to the workspace. Accepts an optional connectTo list of resource ids so any connections the new resource requires (e.g. a VPC and a security group for an EC2 instance) are made in the same change, instead of leaving the resource half-configured.

Key inputs: resource type, fields, optional connectTo.

apply_changes

Applies several changes atomically as one change, mixing any of six actions:

• add — create a resource
• update — change a resource’s parameters
• rename — set the canvas label and the resource’s name together, same as rename_resource
• remove — delete a resource
• connect — connect two resources
• disconnect — remove a connection between two resources

New resources created in the same call get a temporary ref that connect and disconnect actions in that call can use as their source or target — this is how the assistant adds a resource together with the connections it requires (see How Edits Work).

update, rename, and remove must target resources that already exist in the workspace; set a new resource’s fields in its add instead.

Key inputs: a list of operations (add/update/rename/remove/connect/disconnect); connect and disconnect can reference a ref from an add in the same call.

connect_resources

Connects two existing resources.

Key inputs: source resource id, target resource id.

disconnect_resources

Removes a connection between two resources.

Key inputs: source resource id, target resource id.

remove_resource

Removes a resource from the workspace diagram.

Key inputs: resource id.