capsid_admin_run_controls

What it does

The administrator's controls: list them, preview one, perform it with the preview's token. Admin only; perform needs a recent sign-in from a signed-in session.

The administrator's controls, the same ones Capsid Portal's buttons run: overnight, resume_job, fail_job, release_job, close_shipped, supersede_job, park_job, unpark_job, pr_close, approve_pr, revoke_agent, site_add, site_edit, site_remove, reset_breaker, package_add, package_edit, package_remove, canon_approve, canon_reject, canon_approve_all, site_repair, sign_policy_change, sign_policy_from_repo, unit_resume, automerge_resume. Admin only. Two steps, never one.

action "list" returns each control, the params it takes and whether it needs a reason.

action "preview" (control, params) reads the current state, WRITES NOTHING, and returns what will change, the audit rows it will write and a token good for 5 minutes.

action "perform" (token) runs exactly what that preview described, once: the token binds the action, its params and you, and is spent when used, so a second perform of it is refused and you preview again. Performing from here writes a control-<action> audit row naming you and the surface; the Portal writes portal-<action>. Merging a pull request and minting a credential are deliberately not controls: a merge can start a deploy and stays with capsid_close_pr action merge behind can_merge, and a mint stays with capsid_admin_manage_agents. REFUSES: a caller that is not the administrator signed in through Access; an unknown control; a param the control does not take; a switch with no reason; a token that is malformed, expired, issued to someone else or already used.

What a client is told

The MCP hints it carries, so a client can ask before it acts (src/tool-annotations.ts).

• Writes: some action changes state.
• Can overwrite or remove what exists.
• A repeat can change things again.
• Reaches GitHub, Cloudflare or a live site.

Arguments