MCP tools reference

Every tool the BioFlow MCP server offers, grouped by the permission tier you grant.

107 tools in 9 permission tiers. A connection sees only the tiers its owner approved; the assistant can ask for more with request_scopes.

Read your data

Tool	What it does	Permission
`affiliate.list`	The workspace's affiliate links with clicks and commission.	`workspace:read`
`analytics.summary`	Workspace analytics for the last 7/30/90 days: profile views, clicks, unique visitors, CTR, top links, top referrers, and tip revenue.	`analytics:read`
`billing_status`	Current plan, subscription state and renewal date, trial eligibility, payout account status and usage against plan limits.	`workspace:read`
`check_workspace_slug`	Whether a public URL slug is free, with alternatives when it is not.	`workspace:read`
`connector.get_sync_config`	What a connected service syncs into the workspace (limits, filters).	`workspace:read`
`connector.list_content`	What a connected service has synced into the workspace, newest first: videos, posts, products, feed items.	`workspace:read`
`contact.count`	How many contacts the workspace has collected.	`contacts:read`
`contact.export_csv`	Every contact as CSV text (email, name, source, date).	`contacts:read`
`contacts.list`	List the workspace's captured contacts and leads (newsletter signups, form submissions, gated downloads), newest first, paginated via take/skip.	`contacts:read`
`copilot.list_history`	The caller's recent in-app copilot conversation, oldest first.	`workspace:read`
`custom_domain.get`	The workspace's custom domain: hostname, verification and certificate status, and what DNS is still missing.	`workspace:read`
`experiment.list`	A/B experiments on a page with their status.	`workspace:read`
`experiment.results`	Views, conversions and the leading variant for an experiment.	`workspace:read`
`file.get_download`	One file's details.	`files:read`
`file.list`	List the workspace's uploaded files (name, MIME type, public path), newest first.	`files:read`
`file.storage_usage`	How much storage the workspace has used and has left on its plan, plus every file.	`files:read`
`file.where_used`	Which pages and blocks use a file, so you know what deleting it would break.	`files:read`
`form.export_csv`	Every form submission as CSV text.	`contacts:read`
`form.list_submissions`	Answers visitors submitted through form blocks, newest first.	`contacts:read`
`get_profile`	Your name, email, avatar and billing currency, plus the workspace this call acts on (name, slug, plan, your role).	`workspace:read`
`list_connected_apps`	The AI apps and assistants connected to this account through OAuth, with the permissions each holds.	`workspace:read`
`list_connections`	Every integration and its status (connected, needs reconnect, never connected) with the last sync time and error.	`workspace:read`
`list_granted_scopes`	The permission tiers this connection holds and the ones it lacks, each with the tools it unlocks.	any
`list_invites`	Pending workspace invitations (email, role, expiry).	`workspace:read`
`list_members`	Everyone in the workspace with their role.	`workspace:read`
`list_plans`	The plans you can move to, with monthly price in USD, what each includes and the free-trial length.	`workspace:read`
`list_sales`	Recent tips and product sales on this workspace (newest first), or the full sales ledger as CSV text.	`analytics:read`
`list_support_tickets`	Support requests sent from this account, newest first (subject, type, date).	`workspace:read`
`page.check_url_threats`	Whether any link on the page was flagged as unsafe.	`pages:read`
`page.get`	Get one bio page's draft AND published state summaries (block counts by kind, theme, route, timestamps).	`pages:read`
`page.get_editor`	Everything the editor shows for a page: draft, live state, versions, schedule and publish checks.	`pages:read`
`page.list`	List every bio page in the connected workspace: title, slug, publish status, block count, public route, theme, and last update time.	`pages:read`
`page.list_versions`	A page's saved versions, newest first.	`pages:read`
`payouts_status`	Stripe payout account status and live balance for this workspace.	`workspace:read`
`request_log.list`	Recent public API requests with status and key, newest first.	`workspace:read`
`request_scopes`	Ask for more permission tiers on this connection.	any
`webhook.deliveries`	Recent deliveries to an endpoint with status and attempts, newest first.	`webhooks:read`
`webhook.event_catalog`	Every event type a webhook endpoint can subscribe to.	`webhooks:read`
`webhook.get`	One webhook endpoint with its subscribed events and status.	`webhooks:read`
`webhook.list`	The workspace's webhook endpoints and their health.	`webhooks:read`
`workspace.list`	List the workspaces this connection can act on: id, name, slug, and your role in each.	any

Create and edit

Tool	What it does	Permission
`affiliate.create`	Create a tracked link to a destination URL with a commission percentage.	`workspace:write`
`affiliate.update`	Pause, resume or change an affiliate link.	`workspace:write`
`experiment.create`	Create an A/B experiment on one block of a page.	`workspace:write`
`experiment.start`	Start splitting visitors between the two variants.	`workspace:write`
`experiment.stop`	Stop an experiment; visitors see the original again.	`workspace:write`
`file.complete_upload`	Record a file whose bytes were uploaded with file.upload_intent.	`files:write`
`file.set_gated`	Require visitors to leave their email before downloading the file (true) or let anyone download it (false).	`files:write`
`file.upload_from_url`	Download a public https file (up to 25 MB) and store it in the workspace.	`files:write`
`file.upload_intent`	Get a presigned upload for a file you can send bytes for: PUT the bytes to uploadUrl with uploadHeaders, then call file.complete_upload with the returned key.	`files:write`
`page.add_block`	Append ONE new block to the page DRAFT, preserving every existing block byte-for-byte (the copilot's add-preservation path — no whole-array re-emission).	`pages:write`
`page.clone`	Copy a page (draft content included) into a new draft page.	`pages:write`
`page.create`	Create a NEW bio page in the connected workspace as an UNPUBLISHED draft — the same path as the dashboard's New page dialog (slug derived from the title, empty draft, default route provisioned).	`pages:write`
`page.remove_block`	Delete one or more blocks from the page DRAFT by id, preserving every other block, theme, and metadata.	`pages:write`
`page.reorder_blocks`	Rearrange the page DRAFT's blocks without editing their content.	`pages:write`
`page.rollback`	Replace the page's draft with an earlier version. Needs a confirmToken.	`pages:write`
`page.update_draft`	Edit the page: title, description, theme preset, and/or merge-patch existing blocks by id — everything you don't mention is preserved.	`pages:write`
`update_workspace_profile`	Change the workspace's display name or avatar image URL.	`workspace:write`
`update_workspace_slug`	Change the workspace's public URL slug. Needs a confirmToken.	`workspace:write`
`webhook.create`	Add an HTTPS endpoint that receives signed event deliveries.	`webhooks:write`
`webhook.reenable_and_replay`	Turn a disabled endpoint back on and redeliver what failed while it was disabled.	`webhooks:write`
`webhook.replay`	Redeliver every failed delivery to an endpoint since a given time.	`webhooks:write`
`webhook.resend`	Redeliver one past delivery to its endpoint.	`webhooks:write`
`webhook.reveal_secret`	Show the endpoint's current signing secret. Needs a confirmToken.	`webhooks:write`
`webhook.rotate_secret`	Issue a new signing secret.	`webhooks:write`
`webhook.test`	Send a signed test event to the endpoint and report the result.	`webhooks:write`
`webhook.update`	Change an endpoint's URL, events, or enable/disable it.	`webhooks:write`

Delete, publish or send

Tool	What it does	Permission
`affiliate.delete`	Permanently delete an affiliate link. Needs a confirmToken.	`data:delete`
`contact.delete`	Permanently delete one contact. Needs a confirmToken.	`data:delete`
`copilot.clear_history`	Hide the caller's copilot conversation for one page. Needs a confirmToken.	`data:delete`
`file.delete`	Permanently delete a file from storage. Needs a confirmToken.	`data:delete`
`page.cancel_scheduled_publish`	Cancel the page's pending scheduled publish (the one page.schedule_publish created), so nothing goes live when it would have fired.	`publish`
`page.delete`	Permanently delete a page with its versions and analytics. Needs a confirmToken.	`data:delete`
`page.publish`	Publish the page's current DRAFT to its live public route — the same code path as the editor's Publish button. Needs a confirmToken.	`publish`
`page.schedule_publish`	Schedule the page to publish at a future time — the same schedule path the copilot's approved SCHEDULE_PUBLISH actions use. Needs a confirmToken.	`publish`
`webhook.delete`	Permanently delete an endpoint and its delivery history. Needs a confirmToken.	`data:delete`

Billing and subscription

Tool	What it does	Permission
`manage_subscription`	cancel (at period end), resume (opens the billing portal), refund (refunds the last charge inside the refund window and revokes access) or portal (one-click link to the billing portal). Needs a confirmToken.	`billing`
`refund_sale`	Refund one tip or product sale to the buyer through Stripe. Needs a confirmToken.	`billing`
`upgrade_plan`	Start a purchase or a free trial of a paid plan.	`billing`

Profile, preferences, account deletion

Tool	What it does	Permission
`delete_account`	Permanently delete this account. Needs a confirmToken.	`account`
`disconnect_sign_in_method`	Disconnect one sign-in method from this account. Needs a confirmToken.	`account`
`export_data`	Start a full JSON backup of this workspace (pages, contacts, files list, settings).	`account`
`get_referral_summary`	Your Refer & Earn link and its clicks, signups, sales and earnings.	`account`
`list_sign_in_methods`	The ways into this account: Google, Apple and email & password, each connected or not.	`account`
`update_notification_prefs`	Turn the in-app tips and prompts on or off.	`account`
`update_profile`	Change your display name, avatar URL (empty string clears it) and the currency you are quoted and billed in (null = use your location).	`account`

Members and invites

Tool	What it does	Permission
`accept_invite`	Join the workspace an invitation (by token) was sent for.	`team`
`decline_invite`	Decline an invitation you received (by token).	`team`
`get_invite`	Look up an invitation you received by its token (workspace name, role).	`team`
`invite_member`	Email an invitation to join the workspace.	`team`
`remove_member`	Remove a member from the workspace. Needs a confirmToken.	`team`
`resend_invite`	Send a pending invitation email again.	`team`
`revoke_invite`	Cancel a pending invitation.	`team`
`update_member_role`	Change a member's role to ADMIN, EDITOR or VIEWER.	`team`

Connected services

Tool	What it does	Permission
`connect_connector`	Connect an integration that only needs a URL, handle or API key, with no browser step: rss (url), youtube (handle or channel id), calcom (apiKey) or convertkit (apiKey).	`connections`
`connector.update_sync_config`	Change what a connected service syncs.	`connections`
`custom_domain.connect`	Start the guided DNS setup for a hostname.	`connections`
`disconnect`	Disconnect one integration and delete its stored credentials. Needs a confirmToken.	`connections`
`get_connect_links`	One-click links that open the right connect step for each supported integration (Calendly, Cal.com, Kit/ConvertKit, Google Calendar, Instagram, Mailchimp, RSS, Shopify, TikTok, YouTube) and for Stripe payouts.	`connections`
`reverify`	Re-check a connected integration now and queue a fresh sync.	`connections`
`revoke_connected_app`	Disconnect one AI app from the account. Needs a confirmToken.	`connections`

Support tickets

Tool	What it does	Permission
`create_support_ticket`	Send a support request to the BioFlow team from this account (your email and plan travel with it, so Creator and Pro are answered first).	`support`

API keys

Tool	What it does	Permission
`api_key_usage`	This month's public API usage against the plan quota, and which key used how much.	`keys`
`create_api_key`	Create a workspace API key limited to the scopes you pass.	`keys`
`list_api_keys`	API keys on this workspace: name, scopes, prefix, created, last used.	`keys`
`revoke_api_key`	Permanently revoke a key. Needs a confirmToken.	`keys`
`rotate_api_key`	Replace a key's secret.	`keys`

MCP tools reference

On this page