Sharing and invitations
Manage access and invitations for projects, apps and grids.
Manage access and invitations for projects, apps and grids.
These are action names. In default compact mode, call the indicated group tool with {"action":"<action-name>","params":{...}}; the arguments below go inside params. In ?mode=all, call the action name directly with those arguments. browse_github and read_docs are direct tools in both modes. Expand each schema for nested fields, enum values and validation constraints. Successful results are JSON in both text content and structuredContent; failures use isError and structuredContent.error.
Add existing organization members with add_grantees; invite new members with invite_member. Resource-grant values remain viewer and editor: editor means Developer in the portal and is capped by the member’s organization role. Grids accept viewer for use only; developers can deploy and viewers only inspect. The older invitation actions below handle existing invitations only. They do not create new resource invitations.
add_grantees
Add members of the resource's organization to a project, app or grid. No invitation: access starts at once. Each role is at most theirs in the organization (a viewer is added as viewer; grids take viewer only), and someone already added gets the new role. People outside the organization can't be added
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: add_grantees
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.grantees.add
POST /sharing/grantees
See conditions below
Conditional
resourceType is project
projects:admin
Conditional
resourceType is app
apps:admin
Conditional
resourceType is grid
pools:admin
Arguments
resourceType
"project" / "app" / "grid"
Yes
What is shared
resourceId
string
Yes
Project or app id, or grid id
people
array<object>
Yes
Members to add, each with a role
Result
resourceType("project" / "app" / "grid"): What is sharedresourceId(string): See the complete response schema below.resourceName(string): See the complete response schema below.ownerEmail(string or null): The account the resource's organization began as; null for organizations created as suchcallerRole("viewer" / "editor" / "owner"): Legacy permission values: owner means an organization admin; editor means the member who created the resourcegrantees(array<object>): See the complete response schema below.
Operation-specific errors: 400 not_member.
list_grantees
Who a project, app or grid is shared with, and as what
Group: sharing · Behavior: Read
Compact tool: sharing · Action: list_grantees
MCP annotations: readOnlyHint: true · destructiveHint: false · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.grantees.list
GET /sharing/grantees
See conditions below
Conditional
resourceType is project
projects:admin
Conditional
resourceType is app
apps:admin
Conditional
resourceType is grid
pools:admin
Arguments
resourceType
"project" / "app" / "grid"
Yes
What is shared
resourceId
string
Yes
Project or app id, or grid id
Result
resourceType("project" / "app" / "grid"): What is sharedresourceId(string): See the complete response schema below.resourceName(string): See the complete response schema below.ownerEmail(string or null): The account the resource's organization began as; null for organizations created as suchcallerRole("viewer" / "editor" / "owner"): Legacy permission values: owner means an organization admin; editor means the member who created the resourcegrantees(array<object>): See the complete response schema below.
set_grantee_role
Change a grantee's role on a project or app (grids are shared as viewer only). On a grid, taking an old editor grant away also releases the machines and spot groups they added. Not on the caller's own grant.
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: set_grantee_role
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.grantees.update
PATCH /sharing/grantees/{granteeUserId}
See conditions below
Conditional
resourceType is project
projects:admin
Conditional
resourceType is app
apps:admin
Conditional
resourceType is grid
pools:admin
Arguments
resourceType
"project" / "app" / "grid"
Yes
What is shared
resourceId
string
Yes
Project or app id, or grid id
role
"viewer" / "editor"
Yes
Resource grant values: viewer reads; editor means Developer. Grids take viewer for use only; organization developers may deploy and viewers only read
granteeUserId
string
Yes
User id of the grantee, from the grantees list
Result
resourceType("project" / "app" / "grid"): What is sharedresourceId(string): See the complete response schema below.resourceName(string): See the complete response schema below.ownerEmail(string or null): The account the resource's organization began as; null for organizations created as suchcallerRole("viewer" / "editor" / "owner"): Legacy permission values: owner means an organization admin; editor means the member who created the resourcegrantees(array<object>): See the complete response schema below.warning(string or null): Set when a grid could not release the grantee's machines or spot groups; the access change stands
Operation-specific errors: 403 forbidden.
revoke_access
Remove a grantee's access. On a grid, machines and spot groups a former co-manager added leave it too. Not on the caller's own grant (use leave).
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: revoke_access
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: false · openWorldHint: false
Permissions and REST equivalents
sharing.grantees.revoke
DELETE /sharing/grantees/{granteeUserId}
See conditions below
Conditional
resourceType is project
projects:admin
Conditional
resourceType is app
apps:admin
Conditional
resourceType is grid
pools:admin
Arguments
granteeUserId
string
Yes
User id of the grantee, from the grantees list
resourceType
"project" / "app" / "grid"
Yes
What is shared
resourceId
string
Yes
Project or app id, or grid id
Result
warning(string or null): Set when a grid could not release the grantee's machines or spot groups; the access change stands
Operation-specific errors: 403 forbidden.
leave_shared_resource
Give up the caller's own access to a shared project, app or grid. On a grid, their machines and spot groups leave with them.
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: leave_shared_resource
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: false · openWorldHint: false
Permissions and REST equivalents
sharing.leave
POST /sharing/leave
account:write
Arguments
resourceType
"project" / "app" / "grid"
Yes
What is shared
resourceId
string
Yes
Project or app id, or grid id
Result
warning(string or null): Set when a grid could not release the grantee's machines or spot groups; the access change stands
Operation-specific errors: 400 invalid_request.
list_invitations
Invitations on a resource the caller manages, or those the caller sent. Pending and accepted ones: by resourceType and resourceId, or the sent ones within the credential's admin scopes and project restrictions
Group: sharing · Behavior: Read
Compact tool: sharing · Action: list_invitations
MCP annotations: readOnlyHint: true · destructiveHint: false · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.invitations.list
GET /sharing/invitations
See conditions below
Conditional
resourceType is project
projects:admin
Conditional
resourceType is app
apps:admin
Conditional
resourceType is grid
pools:admin
Arguments
resourceType
"project" / "app" / "grid"
No
What is shared
resourceId
string
No
With resourceType: the resource whose invitations to list
Result
invitations(array<object>): See the complete response schema below.
cancel_invitation
Cancel an invitation the caller manages. Cancelling an accepted invitation revokes the access it granted. Needs the admin scope of the invitation's resource type.
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: cancel_invitation
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: false · openWorldHint: false
Permissions and REST equivalents
sharing.invitations.cancel
DELETE /sharing/invitations/{invitationId}
Admin scope of the invitation’s resource: projects:admin, apps:admin or pools:admin
Arguments
invitationId
string
Yes
Invitation id
Result
warning(string or null): Set when a grid could not release the grantee's machines or spot groups; the access change stands
Operation-specific errors: 403 forbidden.
list_received_invitations
Pending invitations addressed to the caller
Group: sharing · Behavior: Read
Compact tool: sharing · Action: list_received_invitations
MCP annotations: readOnlyHint: true · destructiveHint: false · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.invitations.received
GET /sharing/invitations/received
account:read
Arguments
No arguments. Send an empty object.
Result
invitations(array<object>): See the complete response schema below.
accept_invitation
Accept an existing resource invitation addressed to the caller. For new team access, use organization invitations and add members to the resource
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: accept_invitation
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.invitations.accept
POST /sharing/invitations/{invitationId}/accept
account:write
Arguments
invitationId
string
Yes
Invitation id
Result
resourceType("project" / "app" / "grid"): What is sharedresourceId(string): See the complete response schema below.resourceName(string): See the complete response schema below.
Operation-specific errors: 409 no_org.
decline_invitation
Decline an invitation addressed to the caller
Group: sharing · Behavior: Write
Compact tool: sharing_write · Action: decline_invitation
MCP annotations: readOnlyHint: false · destructiveHint: true · idempotentHint: true · openWorldHint: false
Permissions and REST equivalents
sharing.invitations.decline
POST /sharing/invitations/{invitationId}/decline
account:write
Arguments
invitationId
string
Yes
Invitation id
Result
declined(true): See the complete response schema below.
Was this helpful?
