MCP tools reference

Relata ships a built-in Model Context Protocol server with 60+ tools that AI agents can invoke. MCP is the canonical agent surface for Relata — agents get scoped ACL principals, governed by the same Cedar-inspired ABAC model as human users.

Endpoint

POST /mcp/initialize
GET  /mcp/tools
POST /mcp/tools/call
GET  /mcp/sessions

POST /mcp/tools/call takes a flat body: {"name": "<tool>", "arguments": {...}}. Auth: bearer token.

Generate a client config

relata mcp config --client claude    # prints a claude_desktop_config.json snippet
relata mcp config --client cursor    # Cursor IDE config
relata mcp config --client cline     # Cline / Roo
relata mcp config --client stdio     # raw stdio config

Each command prints a ready-to-paste JSON snippet pointing at your local Relata server.

Tool catalogue (60+ tools)

Query

ToolPurposeNotes
queryExecute governed SQL (SELECT / PATHS_BETWEEN / LOOKUP_IDENTITY / SIMILAR)Mandatory purpose; rows capped at 10,000
query_knowledgeExecute SQL with automatic purpose injectionDefault purpose analytics
explain_policyStatic ACL/purpose/egress analysis without executingReturns allowed/denied + reasons
suggest_extensionsList active extension packs and relevanceNo arguments
search_knowledgeFree-text search over IntelChunk/entities/relationshipstype_filter, source_filter, min_confidence
search_entitiesFull-text + identity search across entity typesTypo-tolerant (fuzzy)
hybrid_searchCombined BM25 + vector + graph, RRF fusionPer-query weights
find_in_social_corpusUnified social-media retrieval (BM25 + vector + identity filter)

Entity & Identity

ToolPurposeNotes
lookup_identityResolve a raw identifier to canonical form + matching entitiesArg raw (phone/email/IP/IMEI/…)
list_entity_typesList object types with row countsNo arguments
get_entitiesPaginated entity list for a type with filtersentity_type, filters, limit, offset
get_domain_summaryPer-domain roll-up (financial/telco/cyber/sanctions/…)Arg domain
resolve_entity_identityRESOLVE_IDENTITY canonical cluster for an entityArg identity

Ingest & RAG

ToolPurposeNotes
ingest_documentStore text + entities + relations with bi-temporal provenanceRoutes to IntelChunk / canonical types / KnowledgeTriple
rag_store_answerStore a RAG answer (RagAnswer + RagSource rows)Flat and dgrep-rag nested shapes
rag_store_elementsStore dgrep-rag ExtractorElementselements, source_filename
ingest_mediaImage/audio/video (base64) or text for embedding + perceptual-hash dedupReturns a task id

Knowledge graph

ToolPurposeNotes
get_relationshipsKnowledgeTriple records, filtered by subject/predicate/object/sourceReturns triples + unique entities
paths_betweenGoverned PATHS_BETWEEN walkArgs from, to, max_hops
list_link_typesGoverned edge types in the ontologyNo arguments

Entity intelligence

ToolCostNotes
get_entity_profile5360° profile (identity, relationships, transactions, intel, sanctions)
get_timeline3Chronological event timeline
find_connections3Hidden network connections (relationship / transaction / shared attribute)
get_case_summary5Per-purpose summary: inventory, graph, notes, RAG answers, next steps
add_case_note1Analyst note stored as CaseAnnotation
get_audit_trail1Tamper-evident audit log scoped to a purpose

Memory (agent cognitive verbs)

ToolHTTP equivalentNotes
rememberPOST /memory/rememberStore a MemoryItem (content, session_id, confidence, memory_class)
remember_batchPOST /memory/remember/batchBulk write; items[] + default purpose
recallGET /memory/recallHybrid BM25 + vector; query/q, top_k, as_of, class_filter
recognizeGET /memory/recognize/:idFetch one MemoryItem by id
episodes_inGET /memory/episodesList Episodes for a session
justifyGET /memory/justify/:idProvenance chain + audit trail
consolidatePOST /memory/consolidateSupersede a MemoryItem (id, content, confidence)
forgetDELETE /memory/forget/:idRetention-policy retract (retain_days; -1 = legal hold)
associatePOST /memory/associateLink two items (from_id, to_id, relation)
resolveGET /memory/resolve/:idFollow supersession chain to the canonical MemoryItem
summarisePOST /memory/summariseGoverned summary of a session/topic

Governance, media & ops

ToolPurposeNotes
erase_subjectGDPR Art. 17 erasure (row + vector + blob)Returns a signed certified receipt
similar_multimodalGoverned cross-modal similarity (SIMILAR TO … LIMIT k)ACL + cell masking apply
server_healthReadiness snapshotMirrors /health/ready
job_status / list_jobsContinuous detection jobsstatus, interval, last-run, alerts
schedule_jobTrigger one run of a named jobReturns alert count
list_workflows / run_workflow / workflow_statusWorkflow definitions and executions
metricsOperational countersMirrors /metrics.json
list_rules / create_rule / import_sigmaDetection-rule managementMirrors /rules

Investigation, graph analytics & finance

ToolPurposeNotes
trace_cryptoCRYPTO_TRACE hop-by-hopaddress, max_hops
beneficial_ownershipBENEFICIAL_OWNERSHIP_CHAINparty, max_depth
reconstruct_wireWIRE_RECONSTRUCTIONaccount, tolerance_pct
trace_hawalaHAWALA_TRACE informal value transferseed, max_hops
geofenceGEOFENCE spatial querylat, lon, radius_m
detect_communitiesCommunity detection (Louvain/Leiden)entity_type, algo
rank_key_nodesPageRank / centralitymetric: pagerank/betweenness/closeness/eigenvector
hub_authorityHITS hub + authority scores
predict_linksLink prediction (common_neighbors/jaccard/adamic_adar)
find_sccStrongly connected componentsDetects circular structures
screen_sanctionsSANCTIONS_SCREENname, threshold
aggregate_statsGoverned COUNT/SUM/AVGentity_type, agg, column
investigate_entityComposite investigation profileentity profile + timeline + connections + risk
find_threatsComposite threat huntcommunities + top-risk nodes + active rules

Multimodal

ToolPurposeNotes
search_video_framesGoverned SIMILAR TO over VideoFrame entitiesquery_id, top_k
face_matchBiometric face match (GATED — returns 403 until biometric ACL ships)probe_id, threshold

Intelligence

ToolPurposeNotes
nl_queryNatural-language → governed SQL → executeDeterministic fallback when RELATA_LLM_URL is unset; interpret for NL summary

Tool schema

Every tool exposes a JSON Schema for its input parameters via GET /mcp/tools. Example (search_knowledge):

{
  "name": "search_knowledge",
  "description": "Search across ingested knowledge content — documents, entities, and relationships — using free-text query.",
  "inputSchema": {
    "type": "object",
    "required": ["query"],
    "properties": {
      "query": { "type": "string" },
      "purpose": { "type": "string" },
      "type_filter": { "type": "string", "description": "Restrict results to a content type: text, person, organization, location, relationship, answer." },
      "source_filter": { "type": "string", "description": "Restrict to content from this document/source." },
      "limit": { "type": "integer", "default": 20 },
      "min_confidence": { "type": "number", "default": 0.0 },
      "fuzzy": {
        "type": ["boolean", "object"],
        "description": "Bounded typo tolerance: true, or an object with edit_distance 1 or 2."
      }
    }
  }
}

Agents that respect MCP (Claude, Cursor, Cline, LangChain, LlamaIndex) consume this schema and propose tool calls to the model.

Response shape

{
  "content": [
    { "type": "text", "text": "..." },
    { "type": "json", "json": { } }
  ],
  "isError": false,
  "meta": {
    "processing_time_ms": 42
  }
}

The meta.processing_time_ms field lets agents measure their own tool-call overhead.

Agent scoping (security)

Agents authenticate via a bearer token like any other client. The token maps to a principal; the principal's ACL role determines what the agent can do.

Best practice: give each agent a dedicated principal with the minimum required permissions. Don't reuse a human principal for an agent.

# Register a scoped dynamic bearer token via the admin token surface
# (POST /admin/tokens writes to the in-memory + on-disk token registry).
# Give each agent a dedicated principal with the minimum required permissions.

Sessions

POST /mcp/initialize is the MCP handshake — it returns server metadata and the tool catalogue so a client can discover capabilities before calling tools:

curl -X POST http://localhost:9090/mcp/initialize \
  -H "Authorization: Bearer $RELATA_TOKEN"
 
# Response:
# {
#   "protocol_version": "2024-11-05",
#   "server_info": { "name": "relata", "version": "...", "profile": "...", "node_id": "..." },
#   "capabilities": { "tools": { "list_changed": false }, ... },
#   "tools": [ { "name": "query", ... }, ... ]
# }

GET /mcp/sessions lists AgentSession records with their ToolCall history (filter by session_id, cap with limit). AgentSessions are created on the first memory remember for a new session_id — not by /mcp/initialize.

Multi-tenant agents

curl -X POST http://localhost:9090/mcp/tools/call \
  -H "Authorization: Bearer $RELATA_TOKEN" \
  -H "X-Organization-Id: org-acme" \
  -d '{"name": "query", "arguments": {"sql": "SELECT * FROM Person LIMIT 5", "purpose": "analytics"}}'

The principal's org scoping applies — agent queries never leak across tenants.

Examples

Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "relata": {
      "command": "npx",
      "args": ["-y", "relata-mcp-bridge"],
      "env": {
        "RELATA_URL": "http://localhost:9090",
        "RELATA_TOKEN": "relata-dev"
      }
    }
  }
}

LangChain (Python)

relata_adapters.langchain.RelataMemory is a governed BaseMemory-shaped adapter backed by Relata's /memory/* surface:

from relata_adapters.langchain import RelataMemory
 
mem = RelataMemory(base_url="http://localhost:9090", purpose="research")
# chain = ConversationChain(llm=..., memory=mem)
# save_context stores each turn; load_memory_variables recalls the most
# relevant prior memories for the incoming input.

Direct curl

curl -X POST http://localhost:9090/mcp/tools/call \
  -H "Authorization: Bearer $RELATA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "search_knowledge",
    "arguments": {
      "query": "governance policy for cross-border data sharing",
      "purpose": "investigation",
      "limit": 5,
      "fuzzy": true
    }
  }'

Access control

The same rules apply to every tool call:

  • Auth: Bearer token required (Authorization: Bearer <token>).
  • Purpose: every call requires a registered purpose — absent purpose returns HTTP 400.
  • ACL: Cedar-inspired ABAC evaluated on every request; deny-wins.
  • Egress filtering: classified types (SourceTrueIdentity, SigintIntercept, AccessScopedIntercept, LawfulInterceptRecord) are blocked at egress regardless of query success.
  • Audit: every invocation recorded with principal, timestamp, purpose, cost units, and a tamper-evident hash chain.
  • Quota: most query tools cost 1 unit; multi-table / intelligence tools cost 3–5. Default 10,000 units/principal. Quota exhaustion returns HTTP 429.

Purpose enforcement

# Strict (default) — only registered purposes
RELATA_PURPOSE_MODE=strict
RELATA_PURPOSES=analytics,audit,compliance,operations
 
# Open — any non-empty string (dev/test only)
RELATA_PURPOSE_MODE=open

Hierarchical scoping with : separator is supported (analytics:external).

Egress filtering

These classified types never appear in tool results:

TypeWhat it contains
SourceTrueIdentityHUMINT protected true identity
SigintInterceptSignal intelligence intercept records
AccessScopedInterceptRestricted access-scoped data
LawfulInterceptRecordLawful intercept records

Errors

{
  "content": [{ "type": "text", "text": "error message" }],
  "isError": true
}
HTTPCause
200Tool succeeded
400Missing / invalid parameters or missing purpose
401Bearer token missing or invalid
403ACL denied, purpose denied, egress blocked, or protected-type ingest
404Unknown tool
429Quota exhausted or ingest queue full
500Store unavailable or execution error

See Error codes reference for the RFC 7807 mapping.

Not exposed over MCP

watch / subscribe are not MCP tools. The SubscriptionManager + /watch/stream SSE endpoint produces a long-lived event stream; the MCP tools/call request-response envelope cannot carry an open stream. Use SSE directly for subscriptions.

See also