List connector tools (catalog capability)

GET /connector/{slug}/tools

Every tool this connector defines, each flagged `restricted`/`restricted_by` for the caller — the catalog view, with no account behind it. Use it to pick `tool_name` values for toolbox entries. For what one authenticated account can actually run, use `GET /connection/{id}/tools`. Blocked tools are flagged, not omitted; the model-facing `connector.list_tools` operation still omits them, because a tool a model may not call is a wasted turn while a person picking one needs to see why it is unavailable. `q` and `operation` are both applied before paging, and `operation_counts` describes the `q`-filtered set (never narrowed further by `operation` itself), so the console's filter chips stay honest under a search. A restricted connector answers 403. A custom connector the caller cannot see answers 404 (checked before the restriction, so the 403 never confirms it exists). Requires `connector:view`.

Path Parameters

slugstring

required·

Connector slug.

Query Parameters

qstring

Case-insensitive substring match on name, description and resource. LIKE wildcards are matched literally. Max 200 characters.

operationstring

Comma-separated CRUD buckets to keep: read, create, update, delete, other. Unknown values 400. Applied before paging, so the cursor never counts a row the filter would have hidden.

Response Body

operation_countsobject

required·

How many tools of each CRUD bucket the q filter alone leaves — never narrowed further by operation itself, so the count beside an unselected filter chip stays honest. Repeated on every page.

createinteger

deleteinteger

otherinteger

readinteger

updateinteger

next_cursorstring,null

prev_cursorstring,null

resultobject[]

descriptionstring

input_schemaRecord<string, any>

JSON Schema for the tool arguments.

kindstring

remote_mcp for a tool from a remote MCP connector (its resource is the constant mcp, its method the upstream name, and title may be set), catalog for every other tool.

Possible values:

catalogremote_mcp

methodstring

namestring

Exact tool name — what a toolbox entry's tool_name must contain.

operationstring

The CRUD bucket this tool falls into, computed server-side from its resolved HTTP verb (src/connector/toolOperation.ts) — never re-derive it client-side. Filter with ?operation=.

Possible values:

readcreateupdatedeleteother

resourcestring

restrictedboolean

True when the caller's restrictions block THIS tool. Blocked tools are returned flagged, never omitted — a shorter list is no signal, because nobody knows the length it should have been. Presence is not permission: execution still refuses it. The connector-level 403 is a separate question and is unchanged.

restricted_bystring,null

Which precedence layer's rule blocks this tool, null when none does. Same field, union and meaning as on connector and connection rows: adds which to restricted's whether and nothing else — no rule id, author, reason or coverage. restricted === (restricted_by !== null) always.

Possible values:

roleusernull

restricted_scopestring,null

"connector" when the tool is refused because its WHOLE connector is restricted for the caller, "tool" for a rule about the tool itself, null exactly when restricted_by is. Decides which ask can succeed: a tool request on a connector restricted whole is refused (409 tool_request_connector_blocked), so ask for the connector. On this listing it is only ever "tool" when set, since a connector restricted whole 403s the route; toolbox entries carry the same field and can say "connector".

Possible values:

connectortoolnull

tierstring

Always present. What the approval gate and the MCP scope ladder treat this tool as — classifyToolMethod, the one function they share, so a badge can never disagree with the gate. A remote MCP tool's is derived from the server's annotations (unannotated means destructive) and always follows it, up or down, on a refresh. A system-catalog tool whose method documents mcp_annotations takes the tier those give (an HTTP DELETE is always destructive); any other catalog tool, including every custom connector and fork tool, takes it from its method and HTTP verb. Never infer a remote MCP tool from it: read kind.

Possible values:

readwritedestructive

tier_sourcestring

Why a remote MCP tool's tier is what it is: server (the MCP server's own annotations decided it) or default (the server labeled the tool neither way, so the MCP safe default destructive applies). Lets a client say "Not labeled" rather than show a tier nobody chose. Present only on a remote MCP tool.

Possible values:

serverdefault

titlestring

The upstream server's human title for the tool. Present only on a remote MCP tool that has one.

curl -X GET 'https://api.elaichi.ai/connector/<slug>/tools' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json'

const response = await fetch('https://api.elaichi.ai/connector/<slug>/tools', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);

import os
import requests

url = "https://api.elaichi.ai/connector/<slug>/tools"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}

response = requests.get(url, headers=headers)
print(response.json())