This page covers the capability tools. Two families are documented separately because they
answer different questions: the brain tools cover what the company knows, and the
runtime & governance tools cover the team’s runtime, the belief
queue, and how a refusal is made legible to a model. Between the three pages every declared tool
has exactly one home, and a gate checks it.
Subject resolution
Every multi-tenant tool accepts an optionaluser_id argument — the child project the
call acts on. When omitted, the call resolves to the API key’s default tenant user. The
user_id is validated against the key’s company — a cross-tenant id returns not_found
(never leaked). Tool availability and execution are gated by the resolved user’s
AccountKit.
Every tool that takes user_id also takes an optional project_id. Omit it and the
call resolves to the organization’s default project, which is
where every pre-projects row lives — so an existing user_id-only call is unchanged. Pass
both and the resolver asserts the child project is in that project, returning not_found
if it is not. A key pinned to a project refuses a different project_id with a
forbidden / key_project_mismatch.
Connections (3rd-party apps)
Vault
rotate and delete are REST/SDK-only (PATCH/DELETE /v1/users/{user_id}/vault/{key}, or vault.rotate() / vault.delete() in the SDK). They are intentionally not exposed as MCP tools, so an agent cannot destroy or re-key a stored credential.Logs
AccountKit filtering may reject a connection tool with
forbidden and a reason of
toolkit_not_allowed, tool_not_allowed, or primitive_disabled_by_kit. Surface the
error rather than retrying.Approvals
A sensitive call may answer HTTP 202 with
status: "pending_approval" and an approval_id.
That is a successful deferral, not an error — poll naive_approvals_get until status
becomes executed, denied or failed.There is deliberately no approve or deny tool. Only a human can resolve the queue: the
server refuses an agent-authored resolution, and it refuses a resolver who is also the
requester. An agent that could approve its own action would make the gate decorative.Browser
Cloud browser sessions a user’s agents drive, plus autonomous signup/login backed by the Vault. Every tool takes an optionaluser_id and is gated by the user’s AccountKit (browser primitive).
Credentials never reach the model: signup/login fill the password server-side via variable substitution. There is no agent-facing revoke (destroying a shared saved login is human-only). The live-view URL is never returned to an agent.
Storing a known credential and the user’s profile email are REST/SDK-only (no MCP tool): use
POST /v1/users/{user_id}/browser/credentials (saveCredential) to vault an email/password before a later naive_browser_login, and PATCH /v1/users/{user_id} (profile.setEmail) to point the user’s account email at a provisioned inbox so signup verification mail can be received.Auth & Identity
Registration, linking, and company selection are REST-only operations (not exposed via MCP). Agents connect to MCP after they already have a key.
Orchestration tools (CEO, tasks, objectives, employees, cron, memory) are available via the REST API and CLI only. They are not exposed as MCP tools because orchestration requires stateful conversation flows that don’t map well to single tool calls.
The following are also REST/SDK (and where noted, CLI) only and have no MCP tools: AccountKits, tenant Users CRUD, Approvals (approve/deny), Sessions, Templates and Template Apps, the
profile primitive, and the browser save_credential route. Agents act within a kit/session that an agent profile has already configured; managing those objects is a control-plane concern.Agent Profiles
Provision and govern a per-tenant real-world agent profile (identity, card, comms, runtime). Every regulated action the agent profile’s agent takes still routes through the governance gateway.Domains
The DNS edit tools (
naive_list_dns_records, naive_set_dns_record, naive_delete_dns_record) are gated behind AGENT_DNS_EDIT_ENABLED=true on the API. They enforce a strict allowlist (A/AAAA/CNAME/MX/TXT/CAA), block DMARC/DKIM/inbound records, and rate-limit at 5/min and 20/hr per company. List is allowed for system domains (*.usenaive.ai); set/delete refuse with SYSTEM_DOMAIN. For app HTTP on a system domain use naive apps domains connect / verify-dns — the platform writes the apex A record.naive_set_dns_record
naive_delete_dns_record
Phone
Provision phone numbers and send/receive SMS (Surge-backed). Provisioning is approval-gated; outbound SMS is gated until the carrier (10DLC) campaign is approved. Inbound SMS works immediately.Search
LLM
OpenRouter-backed chat completions across 300+ models. Billed in Naive credits by the model’s token cost.Audio
Speech routing — transcription, and native audio-in/audio-out turns, across a managed catalog of speech models. Billed in Naive credits by audio duration.Text-to-speech has no MCP tool on purpose: it returns raw binary audio, and a
base64 clip in a tool result would consume the model’s context for no benefit.
Call
POST /v1/audio/speech, naive.audio.speech(), or naive audio speak instead.
naive_audio_converse likewise strips the reply audio from its result and returns
only the transcript — the audio stays available via the REST route.Images
Video
Video Clipping
Voice
Synthesis and discovery only. There is deliberately no clone/create/revoke tool — cloning a voice requires out-of-band human action in the dashboard.Clone (Digital Twin)
Generate a lip-synced talking video of a real person from a reference image + saved cloned voice. Feature-flagged (private beta) — the tools only appear in the catalog whenCLONE_GENERATE_ENABLED is on.
Media Assets
Social
Verification
Formation
Apps
Managed Next.js apps with an optional managed database (fullstack). Fully standalone — no orchestration required: the create response includes a starter-template clone command, and local projects deploy via tarball upload (REST/CLI —naive_apps_deploy itself deploys the agent’s container workspace). When a company container exists, a dedicated engineer agent is provisioned on creation. Beyond the curated tools, naive_apps_vercel_api and naive_apps_supabase_api proxy any hosting REST API / backend management API operation, scoped to the app’s own project with credentials injected.
Mobile
Cloud mobile emulators/devices via Mobilerun. Provision hosted devices, run natural-language agent tasks, display the live screen, manage an app library, and reach the entire Mobilerun API via thesearch/call wildcard. Naïve holds the operator key; each tenant only sees its own devices. Every tool takes an optional user_id and is gated by the user’s AccountKit (mobile primitive).
Compute
Run Docker workloads on managed cloud compute (AWS Fargate/ECS). Workloadtype is service (long-running container, optional public URL, scale-to-zero), job (run-to-completion batch), or schedule (a job on a cron/rate expression).
Sandbox
Disposable, isolated micro-VM code sandboxes any agent can hold — run commands, move files, expose ports, checkpoint, fork. Billed for observed usage (CPU/memory/disk actually used + a one-time creation fee) from credits while running; sleeping and parked sandboxes are free, and running out of credits auto-destroys the sandbox. Every tool takes an optionaluser_id and is gated by the user’s AccountKit (sandbox primitive).
Queue
Durable SQS work queues. Typestandard (at-least-once, best-effort order) or fifo (exactly-once, ordered); optional dead-letter queue for failed messages.
Jobs
Status
Tool Schemas
naive_generate_images
naive_stock_search
naive_send_email
naive_web_search
naive_generate_video
Billing Tools
naive_social_connect
naive_social_create_post
naive_start_verification
naive_complete_member_verification
naive_submit_formation
SEO
Supports Keywords Data (Google, Bing, Trends), Backlinks, and SEO Labs (Google, Bing, Amazon).
App Data
Supports Google Play and App Store — app searches, listings, info, and reviews.
Business Data
Supports Google My Business, Hotels, Reviews, Q&A, Trustpilot, TripAdvisor, and social media engagement — reputation and local listings, as opposed to the company itself (see Company Data below).
The two
places tools are a second provider (Google Maps) rather than more DataForSEO endpoints: they return normalized place and review objects instead of the vendor’s task envelope, name the provider that answered, and bill 3× what the provider run actually cost. Neither returns contact people, and reviewer identity is never collected — see Reviews & Listings.
People
OPT-IN: every tool here is refused until an AccountKit enables
people, the same
gate REST callers meet on /v1/people/*. B2B only — work details, never a home
address or personal phone, and never for employment, credit, insurance or housing
decisions. Metered on 3× the provider run’s real spend; a no-match is billed too, because the
run still happened.
Company Data
Distinct from Business Data above: this is the company (headcount, funding,
investors, technology), not its reputation. Search filters on industry and geo
only — the search provider returns no funding or headcount fields, so those
thresholds are refused rather than silently ignored.
Social Data
READ ONLY, and distinct from the Social tools, which publish to accounts you own.
The five scraped platforms bill 3x real provider spend; Bluesky and Hacker News need no
credential and keep a flat 1 credit (2 with comments) per block of 100 posts.
Reddit is absent from
naive_social_data_discover and naive_social_data_collect on
purpose: a Reddit read takes minutes, so it is reachable only through
naive_social_data_batch, in either discover or collect mode.
AEO (AI Optimization)
Supports LLM Responses (ChatGPT, Claude, Gemini, Perplexity), LLM Scraper, AI Keywords, and LLM Mentions.
E-commerce
Supports Google Shopping and Amazon — product searches, info, sellers, and reviews.
Cards
naive_cards_create
naive_cards_create_cardholder
naive_cards_topup
Trading
Link a brokerage account via OAuth and trade stocks, options & crypto. The ordersymbol
decides the market (AAPL, BTC/USD, AAPL241213C00250000).
naive_trading_create_order
Payments
Each agent gets its own crypto wallet (USDC on Base) and pays for x402-paywalled resources with it. x402 is the HTTP 402 protocol: a paywalled resource answers with402 Payment Required and a payment-required header describing what it accepts.
There is no approval workflow for payments, and that is deliberate. A payment is
bounded by the wallet balance, by
perTxMax (enforced at runtime and as a static
policy inside the custody plane at signing time), and optionally by a rolling
dailyBudget. The wallet’s admin verbs (fund, transfer, policy, sweep) are
deliberately not MCP tools — they are the operator REST surface only. See
Payments.naive_payments_quote
accepts[].amount in atomic units — USDC has 6 decimals, so 500000 =
0.50 USDC. A non-paywalled resource returns free: true.
naive_payments_pay
402 it signs a USDC payment and retries once. Returns the
resource body plus a receipt. A non-402 response means no payment was made.