Skip to main content

Distinct values seen in recent traffic, for builder typeahead​

Enumerates the values this org's own MCP traffic actually carried, so a rule is authored against real tool names instead of remembered ones. A policy keyed on a misremembered tool name compiles, activates, and silently never fires — which is exactly the failure this exists to make impossible to reach by typing.

Tool values are read from the recorded mcp.tools, never the scalar mcp.tool, which is empty for batched payloads by design: a scalar-keyed aggregate would omit precisely the batched calls an operator is hunting for.

NOT paginated, and deliberately so. This is a suggestion list, not a listing: it answers with the limit most frequently observed values matching prefix, ordered by frequency. Walking pages of it would be walking the tail — values seen once or twice — which is not what a typeahead is for, and the underlying store is an aggregate over an analytics table where a keyset cursor would have to be minted against a GROUP BY result rather than an index. Narrowing with prefix is how a caller reaches a value outside the head, and it is what a typeahead does anyway.

Query Parameters
  • field string required

    Possible values: [tool, method, subject, issuer]

  • since date-time

    Only consider requests recorded at or after this instant. Defaults to 7 days ago, and is floored at 30 days ago: limit bounds the values returned, not the history scanned to find them, so an older instant is silently treated as 30 days ago rather than rejected.

  • prefix string

    Possible values: <= 200 characters

    Case-insensitive prefix the value must start with. This is what the operator has typed so far.

  • limit integer

    Possible values: >= 1 and <= 100

    Maximum number of values to return. Default 50.

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

OK

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object[]
  • value string
  • count int64

    How many recorded requests carried this value in the window.

  • last_seen date-time