Reference

MCP

The Frazer MCP server at https://mcp.frazer.ai gives AI agents the Frazer API as tools. It is the same API the console and the CLI call, with the same permissions and audit, and it is read-only by default: an agent lists and calls read tools until you grant writes, and every write becomes a plan that waits for a person’s approval. The server speaks the Model Context Protocol (revision 2026-07-28) over Streamable HTTP.

curl -fsSL https://get.frazer.ai | sh
frazer login
frazer mcp install

frazer mcp install adds the Frazer MCP server to your agent’s configuration.

Add a remote MCP server (Streamable HTTP) with this URL:

https://mcp.frazer.ai

The first time the client calls Frazer, it opens Frazer’s sign-in in your browser:

Sign in to Frazer.
Choose the organization. A connection is bound to one organization; to work in another, connect again.
Check what the client asks for. The page shows the client’s name and the host it is published from, where it sends you back, the scopes in words, and how long the connection lasts. Read-only is on. A client that runs only on your computer carries a warning: any app on your computer can use its name.
Choose Allow, or Deny if anything looks wrong.

The client then lists the tools your scopes allow. Frazer asks for consent every time a client authorizes. You find every connection under Account › Connected apps and agents, and you can revoke any of them there.

OAuth 2.1 with authorization code and PKCE (S256). Frazer is the authorization server, https://api.frazer.ai.
Client IDs are https URLs of a Client ID Metadata Document, which Frazer fetches and checks. Clients hold no secrets, and there is no dynamic client registration.
Discovery. A call without a valid token gets 401 with a resource_metadata link to https://mcp.frazer.ai/.well-known/oauth-protected-resource and the scope to ask for.
Audience. MCP tokens are minted for https://mcp.frazer.ai only. An API token is refused here, and an MCP token is refused by the API.
Lifetimes. Access tokens live 15 minutes; a connection refreshes them for up to 30 days. Clients may bind their tokens to a key with DPoP (ES256).
No passthrough. Frazer never forwards your token to another service.

Scopes

Scope	Allows
`<service>:read`	The service’s read and list tools, for example `kubernetes:read`
`<service>:write`	The service’s write tools, except IAM changes and data access
`cloud-platform`	Everything you may do
`offline_access`	Refresh tokens, so the connection outlives one access token

With Read-only on, Frazer grants <service>:read for each <service>:write asked and drops cloud-platform. If nothing would be left, the authorization fails with READ_ONLY_EMPTY.

A connection never does more than you can. Its rights are your current rights, narrowed by its scopes and its organization:

a tool its scopes do not cover answers 403 insufficient_scope with the scope it needs;
a call your roles do not allow is denied as it would be in the API;
a resource in another organization answers ORG_RESTRICTED.

Write tools are not even listed for a connection without a write scope.

Toolsets

Tools are generated from the API, one per method, and grouped into toolsets: a product’s toolset holds its read tools and its write tools. A connection gets every toolset its scopes allow; the iam toolset is for admins only. Narrow a connection with URL parameters:

https://mcp.frazer.ai/?toolsets=monitoring
https://mcp.frazer.ai/?project=acme-production

Hints. Each tool says whether it reads, whether it is destructive and whether it is safe to repeat. Hints help your client; Frazer enforces the rules on the server whatever a hint says.
Typed results. Every tool has an output schema and returns structured content.
Untrusted text. Text that comes from your organization’s data, such as names, descriptions and log lines, is marked as untrusted in tool output. Secret values are never returned.
Tools that change. When an app’s tools are approved, Frazer stores a hash of each tool’s name, description and schema, and compares every tool list the app’s server answers with it. At the first change the server is held: agents keep the approved definitions and the app’s sponsor gets the change to approve or remove.
Hidden methods. An API method can be kept from agents; it then has no tool at all.
Docs for agents. The docs toolset gives agents these docs. Every docs page also has a Markdown version at its URL plus .md, and https://frazer.ai/llms.txt indexes them.

Events

Frazer’s MCP server offers the Events extension. events/list returns every event type with its argument and payload schemas. Poll with events/poll, hold a stream with events/stream (a heartbeat with the cursor every 15 seconds), or register a callback with events/subscribe. A callback subscription lives as long as you ask, 72 hours if you do not say, and never more than 30 days; refresh it before refreshBefore. Each refresh returns the cursor and the delivery status. Access is checked on every delivery: a principal that loses access gets a terminated notice. Payload fields that hold outside text are marked untrusted. An error that needs a person (exit 13 in the CLI) carries a ready subscription for the outcome, so an agent waits without polling.

Writes become plans

Every write through MCP waits for a person. Nothing changes until someone approves.

The agent calls a write tool. Frazer plans the call (validate_only): the same checks as the real call, with quota impact, policy violations and cost, and no change.
A built-in rule holds the call and creates an approval pinned to the plan’s hash and the target’s current version.
The tool answers input_required with a link to the approval in the console, https://console.frazer.ai/approvals/…. Your client shows you the full link.
A person approves in the console or with frazer approvals approve, with a passkey or second factor from the last 10 minutes. Outside production, the person the agent acts for may confirm; in a production project a second person must approve.
The client repeats the call. While the approval is pending it gets input_required again; once Frazer has applied the change, it gets the result. A rejected, expired, invalidated, canceled or failed approval answers a tool error with the reason.

Exactly the plan. Frazer applies the call once, as you, and only if the target has not changed; otherwise the approval fails and the agent plans again.
Clients without URL elicitation get a tool error APPROVAL_REQUIRED with the approval’s name, state, expiry and page; the plan is in _meta["frazer.ai/plan"]. If you dismiss the link in your client, the call answers APPROVAL_PENDING and the approval stays open.
Previews. An agent that asks for validate_only itself gets the plan back as a normal result.
IAM changes through MCP need someone who may set IAM policy on the target, and always a second person.
Following up. approvals_get and approvals_list read approvals; approvals_get returns the applied change. approvals_begin_batch and approvals_submit_batch group up to 100 held calls into one approval.
Agents never approve. No tool votes, cancels an approval or breaks glass.

Pending approvals expire after 24 hours by default. See Identity and access for approval rules.

Agents, audit and the kill switch

Audit. Every call is recorded with the person, the client, the approval and the result, and the console filters actions by agents.
Ceilings. Organization admins see every connection under Organization › IAM › Agents and MCP and can cap what agents may do with a ceiling role.
Kill switch. Suspend all agents on the same page stops every agent token on its next call. You can also suspend one agent.

Agents on Frazer Agents have an MCP endpoint of their own, with tools to send a message, list sessions and get status.

Errors

Every error names the next call to make. A failed call is a tool error (isError) that carries the reason, the domain and the metadata of the API error. Its _meta holds frazer.ai/decisionId, the decision ID you can replay to see why a call was denied, and frazer.ai/error, the full error.

Tools

Each product’s toolsets and named tools, one per row, from its page. Read tools need the service’s read scope; write tools need its write scope and always wait for approval.

Kubernetes

Tool	What it does
`kubernetes_versions_list`	List the Kubernetes versions of each channel with their end-of-support dates.
`kubernetes_clusters_upgrade_plan`	Plan an upgrade with its steps, preflight results, risk to each workload, duration and slot.
`kubernetes_clusters_rehearse_upgrade`	Rehearse an upgrade on a clone of the cluster's state and report what would break.
`maintenance_events_list`	List planned maintenance events.
`maintenance_insights_list`	List insights, such as deprecated API calls that block an upgrade.

Serverless

Tool	What it does
`serverless_detect`	Read a repository and list the data it needs (Postgres, Valkey, a bucket, an LLM gateway route).
`serverless_services_deploy_plan`	Plan a deploy, Kubernetes or serverless, with the detected resources, bindings and cost. Writes become a plan that waits for approval.
`serverless_services_get`	Show a service's state, revisions and traffic.
`serverless_logs_list`	Read a service's logs.
`serverless_traffic_update_plan`	Plan a traffic change or a rollback. Writes become a plan that waits for approval.
`serverless_stacks_create_plan`	Plan a new stack or a change to one. Writes become a plan that waits for approval.

GitHub runners

Tool	What it does
`frazer.runners.v1`	Read pools, jobs, phases, tests, insights and a lane's remaining budget; plan pool changes. Writes become a plan that waits for approval.

Cache

Tool	What it does
`frazer.cache.v1`	Read caches, namespaces and policies, test what a writer may do, and plan a purge. Writes become a plan that waits for approval.

Registry

Tool	What it does
`registry`	Read repositories, images, versions, scan results and where each digest runs. Pushing stays with CI.

Templates and previews

Tool	What it does
`previews`	Read previews and preview policies, so agents see the same previews as people.

LLM gateway

Tool	What it does
`llm_usage_get`	Read gateway usage and cost.
`llm_routes_list`	List the project's routes and their steps.
`llm_keys_create`	Propose a key change for a person to apply. Writes become a plan that waits for approval.

Knowledge

Tool	What it does
`knowledge_bases_search`	Search a knowledge base and return the chunks the caller may see.
`knowledge_bases_ask`	Answer a question with citations, or decline with a reason.
`knowledge_documents_get`	Read one document the caller may open.
`knowledge_sources_list`	List the sources of a knowledge base.
`knowledge_feedback_create`	Grade an answer (good, weak, wrong, uncited, wrongful decline or correct decline).
`knowledge_proposals_create`	Propose a document for the knowledge base; a person or a passing check accepts it. Writes become a plan that waits for approval.

Frazer Agents

Tool	What it does
`send_message`	On an agent's own MCP endpoint, send the agent a message.
`list_sessions`	On an agent's own MCP endpoint, list the sessions you may see.
`get_status`	On an agent's own MCP endpoint, read the agent's state.
`improvements_list`	List an agent's improvement steps and their states.
`improvements_get`	Read one improvement step with its tests, its gain and its canary.
`improvement_kinds_list`	List the kinds of change a scope's policy approves and the kinds that wait for a person.
`revisions_explain`	Explain an agent revision. Approving a revision is a person's step; there is no MCP tool for agents to do it.

Frazer Browsers

Tool	What it does
`browser_open`	Open a browser and return its first snapshot.
`browser_snapshot`	Read the page as compact text with refs.
`browser_run`	Run a script of many steps, with a receipt per step.
`browser_check`	Check the UI or the state behind it.
`browser_repro`	Reproduce an issue and return the recording and the exported test.
`browser_handoff`	Ask a person for a sign-in, a challenge or a payment; a sign-in card on an allowed outside origin.
`browser_policy_get`	The project's browser policy.
`desktop_screenshot`	A screenshot of a desktop, for what the accessibility tree misses.

Frazer Skills

Tool	What it does
`skills_list`	List the skills in the registry and the skill sets.
`skills_get`	Read a skill version, its checks and its use.
`skills_search`	Search the registry and the public skill index by task.
`skills_uses`	Read which sessions used a skill and what came of them.
`skills_import`	Open an import as a pull request on the mirror repository. Writes become a plan that waits for approval.
`skills_suggest`	Open a suggestion for a skill, with its evidence. Writes become a plan that waits for approval.

Harnesses

Tool	What it does
`harnesses_list`	List the harness catalog.
`harnesses_explain`	Explain which profile a session ran on and why.
`harnesses_assignments_set`	Assign a profile to a use. Writes become a plan that waits for approval.
`harnesses_simulate`	Start a simulation of your tasks across profiles, with its estimate first. Writes become a plan that waits for approval.
`harnesses_postmortems_list`	The Frazer harness's postmortems, as data.

Squads and campaigns

Tool	What it does
`campaigns_create`	Create a campaign; with validate_only, return its estimate and whether the starter's policy allows it. Writes become a plan that waits for approval.
`campaigns_get`	A campaign's count line, states and exceptions.
`campaigns_explain`	Why a task is waiting or did not run.
`campaigns_simulate`	Simulate a campaign before it starts.
`campaigns_scan`	The recipe scan's data table.
`campaigns_landed`	The landed share and the burndown.
`campaigns_sessions_list`	A campaign's sessions, by state and reason.

Frazer Reviewer

Tool	What it does
`reviews_request`	Request a review of a diff, a directory or a file, of a kind, the estimate first. Writes become a plan that waits for approval.
`reviews_loop`	Start a review loop on a target, with its budget and turns. Writes become a plan that waits for approval.
`findings_list`	List the findings of reviews.
`findings_resolve`	Resolve a finding with a fix, an answer or a contest with evidence. Writes become a plan that waits for approval.
`rules_list`	List the review rules that apply, so a coding agent sees them before it opens a pull request.
`rules_propose`	Propose a rule draft. Writes become a plan that waits for approval.

Lanes, verdicts and outcomes

Tool	What it does
`reviews_verdict`	The verdict for a pull request version, with its lanes, independent evidence and independence.
`lanes_list`	List the lanes in scope.
`lanes_test`	Backtest a lane.
`reviewer_runs_get`	A review run as recorded.
`items_list`	The items of a review run and their results.
`reviewer_outcomes_list`	Outcome links for a change, an incident or a lane.
`misses_get`	A miss analysis with its remedies.
`lanes_validate`	Check a lane file against the lane contract.
`lanes_export`	Export a lane as lane JSON, a skill or SARIF rules.
`lanes_import`	Turn a REVIEW.md, an AGENTS.md or a skill into lane drafts (a dry run returns them).
`reviewer_coverage_get`	What one review run covered.
`headlines_search`	Search finding headlines across the repository's life.
`reviewer_quality_get`	The Reviewer's measured quality, per lane and period.

Databases

Tool	What it does
`database_instances_list`	List database instances.
`database_instances_get`	Describe an instance.
`databases_query`	Run a read-only query.
`databases_explain`	Explain a query's plan.
`databases_insights_top`	List an instance's top queries.
`databases_recommendations_list`	List index and tuning recommendations.
`databases_backups_create`	Take an on-demand backup. Writes become a plan that waits for approval.

In-memory store

Tool	What it does
`keyvalue_instances_list`	List instances.
`keyvalue_instances_get`	Describe an instance.
`keyvalue_instances_get_metrics`	Read an instance's metrics.
`keyvalue_insights_big_keys`	List the biggest keys.
`keyvalue_insights_command_log`	Read the command log of slow and large commands.
`keyvalue_instances_scan`	Scan keys read-only, with value previews capped at 1 KiB.
`keyvalue_instances_create`	Plan a change, failover, flush or delete. Writes become a plan that waits for approval.

VPC and firewall

Tool	What it does
`connectivityTests.run`	Run a connectivity test and return every hop with the rule that allowed or dropped the traffic.

Security Center

Tool	What it does
`list_findings`	List findings with their priority reasons.
`get_finding`	Get one finding with its evidence and fix.
`list_threats`	List runtime, account, agent and network detections.
`list_controls`	List controls with their mode, owner and status.
`explain_path`	Explain the attack path behind an exposure finding.

Identity and access

Tool	What it does
`iam_troubleshoot_access`	Explain a decision by its ID, or a principal's access to a resource.
`approvals_list`	List approvals, such as the ones an agent's writes are waiting on.
`approvals_get`	Get an approval and, once applied, the result of the change.
`approvals_begin_batch`	Start a batch, so up to 100 held writes become one approval.
`approvals_submit_batch`	Submit a batch of held writes for one approval.

Billing and budgets

Tool	What it does
`usage_digest_chain_get`	Get the head of a project's chain of signed usage digests.

API: the methods behind the tools
CLI: frazer mcp install and approvals from the terminal
Identity and access: roles, ceilings, approvals and the kill switch
Frazer Agents: agents that run on Frazer
Errors: reasons and decision IDs