Cork MCP

Get tenants for integrations

List customer tenants observed from an integration. Required: integration-uuid. Optional: page (default: 1), page_size (default: 10), tenant_uuid. Returns array of IntegrationTenant.

Update an API-created integration's display name and/or credentials. _note: Only API-created integrations can be updated. When updating credentials, all credential fields must be provided._. Required: integration-uuid, integration-uuid-2. Optional: credential_fields, display_name. Returns the updated UpdateIntegrationResponse.

Get users for integrations

List users observed from an integration. Required: integration-uuid. Optional: page (default: 1), page_size (default: 10), tenant_uuid. Returns array of IntegrationUser.

List billing invoices. Returns invoice UUIDs required by `Get Invoice Line Items`. _note: If API user is a distributor, use partner_uuid to scope results to a specific partner._. Optional: partner_uuid, page (default: 1), page_size (default: 10).

Get line items for invoices

List billed, top-level line items for an invoice (obtained via `Get Invoices`). Only items with a nonzero total billed are returned; discount line items are included and carry a negative total_billed. Sub-items billed as part of a parent line item (e.g. individual licenses within a bundle) are nested under that item's `children` field, and always carry a total_billed of 0 since their amount is rolled into the parent. Required: invoice-uuid. Optional: page (default: 1), page_size (default: 10). Returns array of InvoiceLineItem.

Surface for browsing, filtering, and deleting rows in the search_learnings table that the LLM populates via the 'teach' command.

Lists rows from the learn_candidates table: corrections and playbook shapes the CLI derived from observed usage. Candidates are quarantined until an explicit 'learnings confirm <id>' materializes them; they never alter command behavior or recall's verified results on their own.

Promotes one open candidate into the verified knowledge tables. The full candidate payload is printed before anything is written, so the caller always sees exactly what is being blessed. Materialization is per class: playbook_candidate upserts a playbook row for the candidate's query family (confidence 2, the same floor as a teach) flag_alias appends a timestamped [amend ...] correction note to the query family's playbook notes Usage errors (unknown id, non-open status) exit 2.

Removes rows from the search_learnings table so a bad teach can be undone without dropping the whole DB. Requires at least one of --resource, --action, or --all.

List recorded learnings

Marks a candidate rejected. The rejected row stays as a tombstone on its derivation signature: the identical observation never re-derives a candidate, and recall never resurfaces it. Rejecting a CONFIRMED playbook_candidate tombstones the candidate but leaves the playbook row in place; repair the guidance with 'playbook amend' if needed. A confirmed flag_alias cannot be rejected: its correction note already lives in the family playbook, so repair the guidance with 'playbook amend' instead. Usage errors (unknown id, no-reject-path candidates) exit 2.

Aggregates the local learn_events table into the loop's headline metrics: recall_hit_rate recall hits / (hits + misses) teach_to_reuse fraction of taught learnings later seen in a recall hit (joined by learning row id, with a query-family fallback for older rows) playbook_resolution_rate playbook hits not followed by an amend on the same query family candidates_confirmed/rejected judgment counts on auto-captured candidates Rates are null until their denominator is non-zero. Everything is local-only: events never leave this machine.

Information on the authenticated user. Returns the WhoAmi.

Inspect or amend stored CLI playbooks

Appends a timestamped note to the matching family's playbook notes_text. If no playbook exists for the family yet, creates a notes-only one. Designed for agents to fire when their debug-protocol response identifies a concrete correction worth persisting (a workaround, an undocumented endpoint shape, a stale field name, observed schema drift). Same fire-and-forget posture as teach: silent on success, errors to teach.log, safe to background with &. Disabling: pass --no-learn or set CORK_NO_LEARN=true.

List stored playbooks (query_family, content presence, last observed)

Returns prior learnings matching the supplied query by token-set overlap (Jaccard >= 0.6) plus entity-aware validation. The LLM should call this FIRST when starting work on a new user question; if found=true AND results[0].entity_match == "exact" AND confidence >= 2, the LLM can skip discovery and go straight to live fetch for the returned resource IDs. Empty match returns {"found": false, "results": []} with exit 0 — this is an information query, not a not-found error. Disabling: CORK_NO_LEARN=true returns the empty shape even when learnings exist.

score subcommands: attribute, regressions

Explain why a client's Cork score moved, broken out by claims, compliance, coverage, and vulnerability impact. Cork's score-history endpoint returns those four impact components per timestamp but never differences them, so the platform can show a trend line and never a cause. This command differences each component across the window and ranks them by how much of the move they account for. Use this command to explain WHY one named client's Cork score moved. Do NOT use this command to find which clients moved across the whole book of business; use 'score regressions' instead.

Rank every client by score change over a window, worst movers first. Reads the score points embedded in the locally mirrored client roster, so one local query answers a question the API can only answer with a per-client fan-out. Use this command to find which clients moved backwards across the whole book of business over a time window. Do NOT use this command to explain the cause of one client's movement; use 'score attribute' instead.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

List past software install attempts (most recent first) with their dispatch state, target client/device, package, and any errors. Every `Install Software` call appears here once dispatched. Filter by `client_uuid` or `device_uuid` to scope to a single client or device. `state` is one of queued, running, success, partial, error; 'success' means the RMM accepted the job, not that the on-device install finished. Optional: page (default: 1), page_size (default: 10), client_uuid (plus 2 more). Returns array of InstallerHistoryItem.

Get the one-time setup steps for an RMM vendor that requires manual setup before software installs work. Returns the script to create in the RMM, the exact name to give it, the settings to match, and the variables to declare. Use this when a connected integration shows `installer.requires_manual_setup=true` (and the package manager is missing from `installer.configured_package_managers`), or when `Install Software` returns `setup_required`. Vendors that auto-provision their script (e.g. Intune) report `requires_manual_setup=false` and need no setup. Required: vendor_key, package_manager_key.

List software packages available to install across supported package managers (WinGet, Chocolatey). Filter by `package_manager_key` to scope to a single manager, or `search` to substring-match name/publisher. Returns package_id values to pass to `Install Software`. Optional: page (default: 1), page_size (default: 10), package_manager_key (plus 1 more).

Install a software package on a single mapped device via the device's RMM integration. The install is dispatched asynchronously through the RMM (Intune, NinjaRMM, Datto RMM); check `Get Installer History` for completion state. The device must have `can_install_software=true` in `Get Client Devices`. Required inputs: `mapped_device_uuid`, `package_manager_key`, `package_id`, `interpreter_key` (use `PS` for PowerShell). If this returns `setup_required` or `not_authorized`, the routing RMM integration needs setup; see `Get Installer Setup Instructions`. Required: interpreter_key, mapped_device_uuid, package_id, package_manager_key. Optional: run_as, scope, version.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.