Vendor tools

The tools a vendor MCP server exposes, and the scope each requires.

Where a tool has a GraphQL equivalent, both are gated by the same scope — an add_product tool call and a createProduct mutation both need vendors:products:write.

The tool list your server advertises is wider than what your vertical's GraphQL schema exposes. See before you decide what to grant.

Discovering tools

The authoritative list for your endpoint comes from the server:

curl -X POST https://vendors.apis.kesk.app/v1/food/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "mcp-session-id: $SESSION_ID" \
  -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list"}'

Each tool returns its own JSON Schema for arguments. Prefer this over any hand-written list — including this page.

Tools

Tool	Purpose	Scope
`get_vendor_profile`	Profile: name, description, contact, status	`vendors:profile:read`
`get_vendor_settings`	Vendor settings	`vendors:settings:read`
`list_vendor_locations`	List branches	`vendors:locations:read`
`get_vendor_location`	One branch	`vendors:locations:read`
`create_vendor_location`	Add a branch	`vendors:locations:write`
`update_vendor_location`	Modify a branch	`vendors:locations:write`
`delete_vendor_location`	Remove a branch	`vendors:locations:write`
`get_vendor_orders`	List orders	`vendors:orders:read`
`get_order_details`	One order	`vendors:orders:read`
`accept_order`	Accept a pending order	`vendors:orders:write`
`update_order_status`	Progress an order	`vendors:orders:write`
`get_menu`	The product catalogue	`vendors:products:read`
`add_product`	Add a product	`vendors:products:write`
`update_product_price`	Change a price	`vendors:products:write`
`update_product_availability`	Toggle availability	`vendors:products:write`
`get_inventory_status`	Stock levels	`vendors:inventory:read`
`get_sales_analytics`	Sales analytics	`vendors:analytics:read`
`get_performance_metrics`	Performance metrics	`vendors:analytics:read`
`get_customer_reviews`	Customer reviews	`vendors:reviews:read`
`list_vendor_webhooks`	List webhooks	`vendors:webhooks:read`
`get_vendor_webhook`	One webhook	`vendors:webhooks:read`
`create_vendor_webhook`	Register a webhook	`vendors:webhooks:write`
`update_vendor_webhook`	Modify a webhook	`vendors:webhooks:write`
`delete_vendor_webhook`	Remove a webhook	`vendors:webhooks:write`
`list_vendor_bots`	List bots	`vendors:bots:read`
`get_vendor_bot`	One bot	`vendors:bots:read`

Your vertical may add tools beyond these — services and bookings on Services, fleets on Taxis, reservations on Dining, facilities on Sports.

Coverage differs from GraphQL

The tool list does not narrow to your vendor type. Your server advertises the table above whether or not the matching operations exist in your vertical's GraphQL schema — so on Accommodations, Fleet operators, Parcels, Rentals, Services, Sports and Taxis you will see product and stock tools with no GraphQL counterpart, and on Accommodations, Fleet operators and Sports order tools as well.

Do not treat the tool list as a description of what a vertical supports. A tool that has no GraphQL equivalent on your vertical may fail, or may act on an inventory the vertical does not otherwise expose — neither is a documented contract, and both may change.

Grant scopes to an assistant on the basis of what you intend it to do, not what the tool list implies is available. vendors:products:write is included in the coarse vendors grant, so request granular scopes if you want a narrower connection.

As of 2026-08-10; tracked in backend#657.

The stock, sales, performance and review tools have GraphQL equivalents under the same scopes — vendors:inventory:read, vendors:analytics:read and vendors:reviews:read — and both surfaces compute their answers with the same code, so the figures agree. Sales, performance and reviews are in every vendor GraphQL API; stock levels only on Food, Groceries, Pharmacies, Shops and Dining. See Vendor APIs.

tools/list on a live session remains the authority on what a given token can actually reach.

Scope failures

A tool call without the required permission fails on authorisation rather than returning empty data. If an assistant reports a tool as unavailable, the usual cause is that the connection was approved without it — autonomous unit access in particular is never included in a normal approval and has to be granted explicitly.

Reconnect the server from your client and review what you approve. See Add Kesk to your AI client.

Add Kesk to your AI client

Built with