Skip to main content
This page covers the capability tools. Two families are documented separately because they answer different questions: the brain tools cover what the company knows, and the runtime & governance tools cover the team’s runtime, the belief queue, and how a refusal is made legible to a model. Between the three pages every declared tool has exactly one home, and a gate checks it.

Subject resolution

Every multi-tenant tool accepts an optional user_id argument — the child project the call acts on. When omitted, the call resolves to the API key’s default tenant user. The user_id is validated against the key’s company — a cross-tenant id returns not_found (never leaked). Tool availability and execution are gated by the resolved user’s AccountKit. Every tool that takes user_id also takes an optional project_id. Omit it and the call resolves to the organization’s default project, which is where every pre-projects row lives — so an existing user_id-only call is unchanged. Pass both and the resolver asserts the child project is in that project, returning not_found if it is not. A key pinned to a project refuses a different project_id with a forbidden / key_project_mismatch.

Connections (3rd-party apps)

Vault

rotate and delete are REST/SDK-only (PATCH/DELETE /v1/users/{user_id}/vault/{key}, or vault.rotate() / vault.delete() in the SDK). They are intentionally not exposed as MCP tools, so an agent cannot destroy or re-key a stored credential.

Logs

AccountKit filtering may reject a connection tool with forbidden and a reason of toolkit_not_allowed, tool_not_allowed, or primitive_disabled_by_kit. Surface the error rather than retrying.

Approvals

A sensitive call may answer HTTP 202 with status: "pending_approval" and an approval_id. That is a successful deferral, not an error — poll naive_approvals_get until status becomes executed, denied or failed.There is deliberately no approve or deny tool. Only a human can resolve the queue: the server refuses an agent-authored resolution, and it refuses a resolver who is also the requester. An agent that could approve its own action would make the gate decorative.

Browser

Cloud browser sessions a user’s agents drive, plus autonomous signup/login backed by the Vault. Every tool takes an optional user_id and is gated by the user’s AccountKit (browser primitive).
Credentials never reach the model: signup/login fill the password server-side via variable substitution. There is no agent-facing revoke (destroying a shared saved login is human-only). The live-view URL is never returned to an agent.
Storing a known credential and the user’s profile email are REST/SDK-only (no MCP tool): use POST /v1/users/{user_id}/browser/credentials (saveCredential) to vault an email/password before a later naive_browser_login, and PATCH /v1/users/{user_id} (profile.setEmail) to point the user’s account email at a provisioned inbox so signup verification mail can be received.

Auth & Identity

Registration, linking, and company selection are REST-only operations (not exposed via MCP). Agents connect to MCP after they already have a key.
Orchestration tools (CEO, tasks, objectives, employees, cron, memory) are available via the REST API and CLI only. They are not exposed as MCP tools because orchestration requires stateful conversation flows that don’t map well to single tool calls.
The following are also REST/SDK (and where noted, CLI) only and have no MCP tools: AccountKits, tenant Users CRUD, Approvals (approve/deny), Sessions, Templates and Template Apps, the profile primitive, and the browser save_credential route. Agents act within a kit/session that an agent profile has already configured; managing those objects is a control-plane concern.

Agent Profiles

Provision and govern a per-tenant real-world agent profile (identity, card, comms, runtime). Every regulated action the agent profile’s agent takes still routes through the governance gateway.
Revoke is stricter on this transport than on REST, and the tool list does not change. A tool call has no HTTP method, so the dispatcher cannot refuse writes and allow reads the way the Express chain does — and readOnlyHint is declared for only 14 of 271 tools, which is not a partition anything should be keyed on. So a revoked or suspended profile is refused every tool call here. Its session is still offered all 271 tools: the list is a connect-time snapshot, and hiding them would be a second policy in a second place that could disagree with the first.What stops an agent on this transport, ranked by immediacy:Full measurement, including what this looked like before the current release: the governance gateway.

Domains

The DNS edit tools (naive_list_dns_records, naive_set_dns_record, naive_delete_dns_record) are gated behind AGENT_DNS_EDIT_ENABLED=true on the API. They enforce a strict allowlist (A/AAAA/CNAME/MX/TXT/CAA), block DMARC/DKIM/inbound records, and rate-limit at 5/min and 20/hr per company. List is allowed for system domains (*.usenaive.ai); set/delete refuse with SYSTEM_DOMAIN. For app HTTP on a system domain use naive apps domains connect / verify-dns — the platform writes the apex A record.

naive_set_dns_record

naive_delete_dns_record

Email

Phone

Provision phone numbers and send/receive SMS (Surge-backed). Provisioning is approval-gated; outbound SMS is gated until the carrier (10DLC) campaign is approved. Inbound SMS works immediately.

LLM

OpenRouter-backed chat completions across 300+ models. Billed in Naive credits by the model’s token cost.

Audio

Speech routing — transcription, and native audio-in/audio-out turns, across a managed catalog of speech models. Billed in Naive credits by audio duration.
Text-to-speech has no MCP tool on purpose: it returns raw binary audio, and a base64 clip in a tool result would consume the model’s context for no benefit. Call POST /v1/audio/speech, naive.audio.speech(), or naive audio speak instead. naive_audio_converse likewise strips the reply audio from its result and returns only the transcript — the audio stays available via the REST route.

Images

Video

Video Clipping

Voice

Synthesis and discovery only. There is deliberately no clone/create/revoke tool — cloning a voice requires out-of-band human action in the dashboard.

Clone (Digital Twin)

Generate a lip-synced talking video of a real person from a reference image + saved cloned voice. Feature-flagged (private beta) — the tools only appear in the catalog when CLONE_GENERATE_ENABLED is on.

Media Assets

Social

Verification

Formation

Apps

Managed Next.js apps with an optional managed database (fullstack). Fully standalone — no orchestration required: the create response includes a starter-template clone command, and local projects deploy via tarball upload (REST/CLI — naive_apps_deploy itself deploys the agent’s container workspace). When a company container exists, a dedicated engineer agent is provisioned on creation. Beyond the curated tools, naive_apps_vercel_api and naive_apps_supabase_api proxy any hosting REST API / backend management API operation, scoped to the app’s own project with credentials injected.

Mobile

Cloud mobile emulators/devices via Mobilerun. Provision hosted devices, run natural-language agent tasks, display the live screen, manage an app library, and reach the entire Mobilerun API via the search/call wildcard. Naïve holds the operator key; each tenant only sees its own devices. Every tool takes an optional user_id and is gated by the user’s AccountKit (mobile primitive).

Compute

Run Docker workloads on managed cloud compute (AWS Fargate/ECS). Workload type is service (long-running container, optional public URL, scale-to-zero), job (run-to-completion batch), or schedule (a job on a cron/rate expression).

Sandbox

Disposable, isolated micro-VM code sandboxes any agent can hold — run commands, move files, expose ports, checkpoint, fork. Billed for observed usage (CPU/memory/disk actually used + a one-time creation fee) from credits while running; sleeping and parked sandboxes are free, and running out of credits auto-destroys the sandbox. Every tool takes an optional user_id and is gated by the user’s AccountKit (sandbox primitive).

Queue

Durable SQS work queues. Type standard (at-least-once, best-effort order) or fifo (exactly-once, ordered); optional dead-letter queue for failed messages.

Jobs

Status

Tool Schemas

naive_generate_images

naive_send_email

naive_generate_video

Billing Tools

naive_social_connect

naive_social_create_post

naive_start_verification

naive_complete_member_verification

naive_submit_formation

SEO

Supports Keywords Data (Google, Bing, Trends), Backlinks, and SEO Labs (Google, Bing, Amazon).

App Data

Supports Google Play and App Store — app searches, listings, info, and reviews.

Business Data

Supports Google My Business, Hotels, Reviews, Q&A, Trustpilot, TripAdvisor, and social media engagement — reputation and local listings, as opposed to the company itself (see Company Data below). The two places tools are a second provider (Google Maps) rather than more DataForSEO endpoints: they return normalized place and review objects instead of the vendor’s task envelope, name the provider that answered, and bill 3× what the provider run actually cost. Neither returns contact people, and reviewer identity is never collected — see Reviews & Listings.

People

OPT-IN: every tool here is refused until an AccountKit enables people, the same gate REST callers meet on /v1/people/*. B2B only — work details, never a home address or personal phone, and never for employment, credit, insurance or housing decisions. Metered on 3× the provider run’s real spend; a no-match is billed too, because the run still happened.

Company Data

Distinct from Business Data above: this is the company (headcount, funding, investors, technology), not its reputation. Search filters on industry and geo only — the search provider returns no funding or headcount fields, so those thresholds are refused rather than silently ignored.

Social Data

READ ONLY, and distinct from the Social tools, which publish to accounts you own. The five scraped platforms bill 3x real provider spend; Bluesky and Hacker News need no credential and keep a flat 1 credit (2 with comments) per block of 100 posts. Reddit is absent from naive_social_data_discover and naive_social_data_collect on purpose: a Reddit read takes minutes, so it is reachable only through naive_social_data_batch, in either discover or collect mode.

AEO (AI Optimization)

Supports LLM Responses (ChatGPT, Claude, Gemini, Perplexity), LLM Scraper, AI Keywords, and LLM Mentions.

E-commerce

Supports Google Shopping and Amazon — product searches, info, sellers, and reviews.

Cards

naive_cards_create

naive_cards_create_cardholder

naive_cards_topup

Trading

Link a brokerage account via OAuth and trade stocks, options & crypto. The order symbol decides the market (AAPL, BTC/USD, AAPL241213C00250000).

naive_trading_create_order

Payments

Each agent gets its own crypto wallet (USDC on Base) and pays for x402-paywalled resources with it. x402 is the HTTP 402 protocol: a paywalled resource answers with 402 Payment Required and a payment-required header describing what it accepts.
There is no approval workflow for payments, and that is deliberate. A payment is bounded by the wallet balance, by perTxMax (enforced at runtime and as a static policy inside the custody plane at signing time), and optionally by a rolling dailyBudget. The wallet’s admin verbs (fund, transfer, policy, sweep) are deliberately not MCP tools — they are the operator REST surface only. See Payments.

naive_payments_quote

Returns accepts[].amount in atomic units — USDC has 6 decimals, so 500000 = 0.50 USDC. A non-paywalled resource returns free: true.

naive_payments_pay

Fetches the URL; on a 402 it signs a USDC payment and retries once. Returns the resource body plus a receipt. A non-402 response means no payment was made.

naive_payments_receipts

naive_wallet_balance