Capability Surface

Server name: siglata.
Tools: one per operation, each with a title. Reads declare readOnlyHint: true. A write declares destructiveHint: true only when it is irreversible or hard to reverse: purge, member_remove, team_delete, credential_delete, organization_deactivate, message_send, email_send, email_suppression_clear, portal_act, portal_run_write. Other writes create a new edition or can be reversed (destructiveHint: false). Clients can still ask before changes. Web and social reads also declare openWorldHint: true. tools/list shows only tools this grant can call.
Org awareness: One principal_get call returns the user, the organization this grant is bound to (id, name, slug and whether it is active), the member role, the granted scopes, the limits, the organization’s files in bytes (storage) and, in storage.processed, what the spreadsheets the agent queries hold and their limit. Each grant is one organization; a different workspace needs a new OAuth connection authorized with that org active at consent.
Resources: none; file_read returns a file’s content and links.
Prompts: none.
DPoP: optional. A proof is validated and the token bound to its key when a client presents one, and plain bearer tokens keep working.