MCP Tool Catalog

APEX capabilities are available to AI agents through the Model Context Protocol (MCP). Every tool in this catalog is a thin wrapper over a standard REST endpoint — the platform rule is REST-first, and MCP adds no capability the REST APIs lack. The OpenAPI specifications remain the authoritative contract: where a tool's input schema and the REST specification disagree, the REST specification wins. If your integration does not specifically need MCP (for example, you are building a service rather than an agent), integrate over REST instead: start with the integration handbook and the OpenAPI specifications.

MCP access is delivered by the APEX Gateway: a single client-side process that exposes tools for the whole suite over standard input/output (stdio) transport. You run the gateway locally inside your agent or development environment; it forwards each tool call as an HTTP request to the hosted REST APIs using your credentials. There is no hosted or remote MCP endpoint — the gateway always runs on your side.

Every tool takes a tenant_id argument identifying your tenant (for example your-tenant). Unless noted otherwise, the gateway resolves it into the {tenant_id} path segment of the backing endpoint, and the credential you configure must be scoped to that tenant. See Tenancy and onboarding.

Setup

The gateway is a Python package supplied during onboarding (installable with pip). Register it with any MCP client that supports stdio servers. If installed as a package, the apex-gateway console command is equivalent to python -m apex_gateway.server.

Sample client configuration, pointed at the hosted development environment:

{
  "mcpServers": {
    "apex": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "apex_gateway.server"],
      "env": {
        "ZENITH_API_URL": "https://zenith.dev.apex.reisiger.org",
        "VECTOR_API_URL": "https://vector.dev.apex.reisiger.org",
        "ECHO_API_URL": "https://echo.dev.apex.reisiger.org",
        "PRISM_API_URL": "https://prism.dev.apex.reisiger.org",
        "FORGE_API_URL": "https://forge.dev.apex.reisiger.org",
        "PULSE_API_URL": "https://pulse.dev.apex.reisiger.org",
        "QUANTUM_API_URL": "http://localhost:9130",

        "ZENITH_API_TOKEN": "<zenith-credential-from-onboarding>",
        "VECTOR_API_TOKEN": "<vector-credential-from-onboarding>",
        "ECHO_API_TOKEN": "<echo-credential-from-onboarding>",
        "PRISM_API_TOKEN": "<prism-credential-from-onboarding>",
        "FORGE_API_TOKEN": "<forge-credential-from-onboarding>",
        "PULSE_API_TOKEN": "<pulse-credential-from-onboarding>",
        "QUANTUM_API_TOKEN": "<quantum-credential-from-onboarding>"
      }
    }
  }
}

Notes:

• Base URLs. Each product has its own base URL, set through the {PRODUCT}_API_URL environment variables. The values above are the hosted development environment; see Environments and endpoints. Quantum is not hosted — deployments are local or operator-arranged (default http://localhost:9130).
• Authentication. Each product reads its own {PRODUCT}_API_TOKEN environment variable and forwards the value as an Authorization: Bearer header on every backing REST call. Credentials are issued during onboarding and are server-side secrets: keep them in the environment of the machine running the gateway, and never embed them in browser or mobile clients. See Authentication.
• Document Operations is not routed through the gateway; it is consumed directly over REST (see its section below).
• Calls time out after 60 seconds; errors from the backing REST API are returned to the agent as structured error content rather than protocol failures.

Zenith — knowledge engine

Give an agent grounded access to your indexed corpus: semantic search for evidence, retrieval-augmented answers with citations, knowledge-graph exploration, and the ability to trigger ingestion of registered sources. These tools are the natural starting point for any agent that must answer from your documents rather than from general knowledge.

Parameters (* = required):

• zenith_search — query (string — Natural language search query), tenant_id (string — Tenant identifier), limit (integer, 1-50, default 10)
• zenith_query — query (string — Natural-language question (1-2,000 characters)), tenant_id (string), dataset (string — Deprecated alias for query — kept for callers of the legacy structured-query schema. Ignored when query is set)
• zenith_ingest — source (string — Registered source adapter identifier), tenant_id (string), config (object), priority (string: low, normal, high, default normal)
• zenith_datasets — tenant_id* (string)
• zenith_graph_atlas — tenant_id* (string — Tenant identifier), community_id (string — UUID of the community to expand. Omit for overview), entity_name (string — Exact entity name for a dossier. Omit for overview)

Full REST detail: Zenith specification.

Forge — platform core

Workflow orchestration tools: run a named workflow or a cross-product recipe, then poll its status. The tool contracts are pinned so you can build agent flows against them, but the backing orchestration routes are not served yet — use Forge's REST surface (tenant configuration, API keys, billing and usage) directly in the meantime (Forge specification).

Planned tools: contract pinned — not yet served.

Parameters (* = required):

• forge_run_workflow — workflow (string — Workflow ID or name), tenant_id (string), inputs (object — Input variables for the workflow), async_mode (boolean, default false — If true, returns run ID immediately)
• forge_run_recipe — recipe (string — Recipe name (resolves to YAML file)), tenant_id (string), inputs (object — Input variables for the recipe)
• forge_workflow_status — run_id (string — Workflow run ID), tenant_id (string)

Vector — verification and trust

The largest tool set in the suite, built for agent-driven due diligence. The company-graph tools form a loop the agent can run end to end: create a graph for a subject, ingest evidence, review coverage gaps, assert and verify relationships, roll up risk, and export the result. The assessment tools run versioned methodology packs against a target environment and return scored gap registers.

Shared vocabularies: entity types are company, person, project, country, sector, regulator, asset, financial_instrument; relationship types are shareholder_of, director_of, officer_of, subsidiary_of, supplier_to, customer_of, regulated_by, party_to, sanctioned_by, related_party, located_in.

Planned tools: contract pinned — not yet served. Claim verification, investigations, and entity risk scoring are available today through Vector's REST API (Vector specification); the gateway wrappers for those three ship next.

Parameters (* = required):

• vector_investigate — entity (string — Entity name to investigate), tenant_id (string), entity_type (string: company, person, organisation, default company), depth (string: quick, standard, deep, default standard — Investigation depth — affects cost and time), modules (string array — Specific investigation modules to run. Defaults to all)
• vector_verify — claim (string — The claim to verify), tenant_id (string), sources (string array — Source document IDs or URLs to check against), threshold (number, default 0.7 — Minimum entailment score to consider verified)
• vector_risk_score — entity (string), tenant_id (string), dimensions (string array — Risk dimensions to score. Defaults to all)
• vector_graph_create — subject_name (string — Name of the subject company/person under investigation), tenant_id (string), subject_type (string: company, person, project, country, sector, regulator, default company), name (string — Optional graph display name)
• vector_graph_get — graph_id (string), tenant_id (string), entity_type (string: company, person, project, country, sector, regulator, asset, financial_instrument), relationship_type (string: shareholder_of, director_of, officer_of, subsidiary_of, supplier_to, customer_of, regulated_by, party_to, sanctioned_by, related_party, located_in), min_confidence (number, 0-1, default 0), max_hops (integer, 1-6 — Only entities within N hops of the subject)
• vector_graph_ingest — graph_id (string), tenant_id (string), source (string: zenith, zenith_kg, spectra, registry, default zenith), query (string — Search/filter term; defaults to the subject entity name), max_chunks (integer, 1-50, default 10 — zenith source: chunks to extract from), limit (integer, 1-1000, default 200 — Bridge sources: max triples to import), adapter (string: opensanctions, default opensanctions — registry source: adapter plugin to run)
• vector_graph_assert — graph_id (string), relationship_type (string: shareholder_of, director_of, officer_of, subsidiary_of, supplier_to, customer_of, regulated_by, party_to, sanctioned_by, related_party, located_in), claim (string — Natural-language claim this edge asserts), tenant_id (string), source_name (string — Source entity name (e.g. the shareholder/director)), source_type (string: company, person, project, country, sector, regulator, asset, financial_instrument, default company), target_name (string — Target entity name (e.g. the subject company)), target_type (string: company, person, project, country, sector, regulator, asset, financial_instrument, default company), source_entity_id (string — Alternative to source_name: existing entity ID), target_entity_id (string — Alternative to target_name: existing entity ID)
• vector_graph_verify — graph_id (string), tenant_id (string), max_confidence (number, 0-1, default 0.7 — Only verify edges below this confidence), limit (integer, 1-25, default 10), include_verified (boolean, default false)
• vector_graph_gaps — graph_id (string), tenant_id (string)
• vector_graph_risk — graph_id (string), tenant_id (string), max_entities (integer, 1-10, default 5), dimensions (string array — Risk dimensions. Defaults to all)
• vector_graph_export — graph_id (string), tenant_id (string)
• vector_assess — pack (string — Pack name, e.g. 'm365-baseline'. List via vector_packs), tenant_id (string), target_name (string — Display name of the assessed environment. Defaults to the tenant name), collector (string, default microsoft_graph — Observation collector to run)
• vector_assessment_get — assessment_id (string), tenant_id (string), include_observations (boolean, default false — Include the raw ObservationSet snapshot)
• vector_assessment_gaps — assessment_id (string), tenant_id (string), gap_class (string: visibility, control, policy_reality), dimension (string), severity (string: critical, high, medium, low, info)
• vector_packs — tenant_id* (string)

Prism — document generation

Rendering for agent outputs: turn structured data into a templated report. The tool contract is pinned but the backing route is not served yet — render today through Prism's REST API (Prism specification).

Planned tools: contract pinned — not yet served.

Parameters (* = required):

• prism_render — template (string — Report template name), data (object — Data to render), tenant_id* (string), format (string: html, pdf, markdown, json, default html)

Echo — communications

Messaging tools for agents: send a notification on a single channel, broadcast across channels, schedule delivery, check delivery status, and list configured channels. The Echo tool set is pinned but its backing routes are not served yet — send and track messages today through Echo's REST API (Echo specification).

Tenancy note: echo_notify, echo_broadcast, and echo_schedule carry tenant_id in the request body rather than the path; echo_status is addressed by notification identifier.

Planned tools: contract pinned — not yet served.

Parameters (* = required):

• echo_notify — channel (string: email, sms, whatsapp, slack, teams, push, webhook), recipients (string array, min 1), body (string — Message content (markdown supported)), tenant_id (string), subject (string), template (string), template_data (object), priority (string: low, normal, high, urgent, default normal)
• echo_broadcast — channels (object array, min 1), body (string), tenant_id* (string), subject (string), priority (string: low, normal, high, urgent, default normal), deduplication (boolean, default true)
• echo_schedule — channel (string: email, sms, whatsapp, slack, teams, push, webhook), recipients (string array), body (string), tenant_id (string), subject (string), deliver_at (string), recurring (object)
• echo_status — notification_id (string), tenant_id (string)
• echo_channels — tenant_id* (string), status (string: active, inactive, all, default all)

Document Operations — document toolbox

Document Operations provides conversion, merge, split, extraction, compression, watermarking, redaction, optical character recognition, and twenty-plus further operations through an asynchronous job model. It does not currently expose tools through the APEX Gateway — integrate with it directly over REST (Document Operations specification). Deployment is operator-arranged; local deployments default to http://localhost:9190.

Pulse — intelligence engine

Awareness tools for agents: sentiment analysis, monitoring feeds, and triggered alerts. The tool contracts are pinned but their backing routes are not served yet — Pulse's served surface today (shadow simulations, signals, trends, anomalies, sweeps — itself Preview) is available directly over REST (Pulse specification).

Planned tools: contract pinned — not yet served.

Parameters (* = required):

• pulse_sentiment — tenant_id* (string), entity (string — Named entity to analyze), topic (string — Topic or theme to analyze), text (string — Raw text to analyze directly), timeframe (string: last_hour, last_24_hours, last_7_days, last_30_days, last_90_days, default last_7_days), sources (string array, default ["all"]), granularity (string: summary, daily, hourly, default summary)
• pulse_monitor — tenant_id* (string), status (string: active, paused, all, default active), entity (string — Filter to monitors for a specific entity)
• pulse_alerts — tenant_id* (string), severity (string: critical, warning, informational, all, default all), entity (string), since (string), limit (integer, default 20)
• pulse_create_monitor — name (string), entity (string), tenant_id* (string), keywords (string array), sources (string array), alert_thresholds (object)

Quantum — analytics

Statistical analysis and forecasting over datasets. The tool contracts are pinned but their backing routes are not served yet — Quantum's served surface today (analysis, patterns, prediction; itself Preview, local deployments only) is available directly over REST (Quantum specification).

Planned tools: contract pinned — not yet served.

Parameters (* = required):

• quantum_analyze — dataset (string — Dataset ID from Zenith), analysis_type (string: correlation, regression, clustering, anomaly, forecast, summary — Type of analysis to run), tenant_id* (string), parameters (object — Analysis-specific parameters)
• quantum_forecast — metric (string — Metric to forecast), tenant_id (string), horizon (integer, default 30 — Number of periods to forecast), granularity (string: hourly, daily, weekly, monthly, default daily)

Availability legend

Availability of the backing REST endpoints is tracked operation-by-operation in the OpenAPI specifications as x-apex-availability. When a Planned tool's backing route ships, the badge here moves to Available with no change to the tool contract.