adminBases

Lists the tenant Base instances in the caller's window — a SuperAdmin sees every tenant's, anyone else only their own subtree's.

The scope is enforced TWICE: the upstream is asked for the caller's org, AND every row it returns is re-checked against the resolved scope. An upstream that ignored the filter therefore degrades to empty, never to a cross-tenant leak.

The Base engine is being embedded into cloud; until it lands this proxies BASE_ADMIN_URL and, when that is unset, answers 200 with an empty list and msg saying so — the honest not-yet state, never fabricated instances.

Arguments

This tool declares no arguments. Call it with an empty arguments object.

Call it

A tools/call carries its arguments in one flat object. This tool declares none, so the object is empty.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "adminBases",
         "arguments": {}
       }
     }'

tools/list needs no credential; tools/call does — called without one the door answers HTTP 200 with a JSON-RPC result whose isError is set and whose text says what was missing. How to get a key →

The operation behind it

The same capability over plain HTTP is in the cloud API reference, on https://api.hanzo.ai.

All 834 tools · The door · API reference

Generated from tools/list on https://api.hanzo.ai/v1/mcp — 834 tools captured 2026-08-01 (this build read the vendored copy; the door was unreachable).