Fast.io

Auth & sessions: signin, signup, signout, 2FA, PKCE, API keys, OAuth sessions. Call action='describe' for the full action/param reference. Destructive: api-key-delete, oauth-revoke, oauth-revoke-all.

File upload: stream-upload (one-shot — auto-finalizes, no filesize needed), chunked (create-session → chunk → finalize, for exact-known-size or files split across blobs), web URL import, and batch (many small files). Call action='describe' for the full action/param reference. Side effects: finalize/stream/stream-upload/web-import/batch create files and consume storage credits. Same-name uploads to a folder OVERWRITE the existing node in place (preserved as a recoverable version). BYTES → SERVER: the **DEFAULT for every file/binary is the `POST /blob` sidecar** — a plain HTTP POST outside the MCP pipe (the create-session/blob-info response hands you a ready-to-run curl command) that returns a `blob_id` you pass to stream-upload/chunk/batch: no base64, no MCP size limit, up to 100 MB. Use `content_base64` (inline base64, capped a few MB by the MCP transport) ONLY when your client cannot make the POST /blob call. `content` is small text only (verbatim UTF-8). UPLOAD STRATEGY (read top-to-bottom, pick the FIRST that matches): (1) Have a URL? → `web-import` (single call). (2) DEFAULT for a file/binary → `POST /blob`, then `stream-upload` with `blob_id` (single call, auto-finalizes, NO filesize required). Unknown/generated size and no way to reach /blob → `stream-upload` with `content_base64`. (3) Known exact byte count, or a large file split across blobs → `create-session` + `chunk`(`blob_id`) + `finalize`. **filesize must match the bytes you actually upload — mismatch causes finalize to fail with code 10522 and you must cancel the session.** (4) Multiple small files (≤4 MB each, ≤200 total) into one folder? → `batch`. Prefer `blob_id` (POST /blob) for every file/binary upload; fall back to `content_base64` only when you cannot reach /blob. Do NOT guess `filesize` for generated content — use `stream-upload`. max_size is a hard ceiling that aborts mid-transfer — always overestimate or omit (server uses plan limit).

User profile, contacts, invitations, and assets. Call action='describe' for the full action/param reference. Destructive: close.

Organization management: CRUD, billing, members, invitations, ownership transfer, assets, discovery. Call action='describe' for the full action/param reference. Destructive: close (permanently deletes org and all data).

Workspace management: list/details/update/delete, archive, members, notes, quickshares, share import, import toggle. NOTE: metadata actions MOVED — templates + AI extraction → `metadata` tool; node-level metadata → `storage` tool. The `metadata-*` actions here are deprecated one-release execute-and-warn shims, removed next release. Call action='describe' for the full action/param reference. Destructive: delete (workspace + all files). ⚠️ intelligence COSTS CREDITS (10/page) — only enable on explicit user request; toggle is rate-limited. Verbosity (detail param): list/available/members/list-shares default to terse (compact rows). details defaults to full (drill-down). Pass an explicit detail='standard'|'full' to override.

Share management: create/update/delete, archive, password auth, members, autotitle. NOTE: quickshare-create is DEPRECATED (returns error 10756) — use the `fileshare` tool's `create` action for durable single-file shares. Call action='describe' for the full action/param reference. Destructive: delete (permanent). Side effects: autotitle AI-generates + applies a title/description (consumes credits, mutates share metadata). ⚠️ intelligence on create COSTS CREDITS (10/page) — default false unless user explicitly requests RAG. Verbosity (detail param): list/available/members default to terse (compact rows). public-details defaults to standard. details defaults to full (drill-down). Pass an explicit detail='terse'|'standard'|'full' to override.

File Shares: durable single-file share links. create/list/details/update/delete, per-user grants (grant-list/grant-add/grant-revoke incl. grant-by-email with pending invites), and direct read/preview/version URLs. Call action='describe' for the full action/param reference. Bound to ONE workspace file (immutable binding); deletion NEVER touches the bound file. Recipient 404 is UNIFORM — not-found / revoked / expired are indistinguishable by design (do not speculate). Passwords are supplied via the x-ve-password header (the `password` input) — never placed in URLs. Destructive: delete (removes the share, not the file). Reversible access change: grant-revoke (re-grantable). download-url / preview-url / version-download-url return a DIRECT API URL — gated shares require Authorization and/or x-ve-password HEADERS on the GET (the password is never embedded in the URL).

Coordination Rooms — a private, workspace-scoped space for agentic teams (agents + humans) to join, post messages, track each other's status/presence, and hand off files. Create is idempotent per (workspace, topic_slug). Presence is refreshed by ANY room call; liveness ≠ progress. Hand files off via the `upload` tool into the room's storage. Call action='describe' for the full protocol + action/param reference.

Files & folders on workspaces/shares: list, search, copy, move, delete, rename, trash, transfer, versions, locks, previews, and per-node metadata (get/set/delete/extract/versions). Call action='describe' for the full action/param reference. Destructive: purge (irreversible). delete moves to trash. metadata-delete removes metadata keys. Verbosity (detail param): list/recent/search/trash-list default to terse (compact rows). details defaults to full (drill-down). Pass an explicit detail='standard'|'full' to override.

AI metadata templates & extraction (the unstructured-data automation pipeline): template CRUD/clone, assign/resolve, the AI pipeline (eligible -> preview-match -> suggest-fields -> template-create -> nodes-add/-list -> auto-match -> extract-all), saved views, and lexical metadata search. Call action='describe' for the full action/param reference. Node-level metadata (get/set/delete/extract on a single file) lives on the `storage` tool. Destructive: template-delete, view-delete, nodes-remove. AI/credit side-effects: preview-match, suggest-fields, auto-match, extract-all (each spends AI credits).

Unified search across a workspace or share — ONE query, results GROUPED BY TYPE into buckets (files, metadata [workspace only], comments), each independently paginated and health-reported. Call action='describe' for the full action/param reference. This is the grouped SUPERSET; for a single result type prefer the narrower tools: `storage action=search` (files only), `metadata action=search` (lexical metadata fields only). The code-mode `search` tool searches the API endpoint catalog, not your content.

Download URLs for files (file-url), folder ZIPs (zip-url), and quickshare links (quickshare-details — DEPRECATED, use the `fileshare` tool's `create` action for new shares). Consumes bandwidth credits. Call action='describe' for the full action/param reference.

Ripley — the MCP delegation surface over Fastio's RAG agent. Ripley is read-only for storage CONTENT: it answers natural-language questions about workspace/share files & folders (with citations) and never creates/edits/deletes your files — for content writes, call the primitive MCP tools directly. It DOES create/manage chat threads (chat-create/chat-update/chat-delete/message-send) and can generate shares (share-generate). Prefer Ripley over issuing many primitive reads: ask one NL question and let the server-side agent search + synthesize. Quick start: action='ask' (question + profile) → returns {answer_text, citations, chat_id, message_id, web_url}; action='status' for an engineered workspace-status summary. Lower-level chat/message actions remain for multi-turn control. Call action='describe' for the full action/param reference. Destructive: chat-delete. Side effects: ask/status/chat-create/message-send consume credits; chat-cancel terminates an in-progress message (partial tokens billed; idempotent). Verbosity (detail param): chat-list/message-list default to terse (compact rows). chat-details/message-details default to full (drill-down). Pass an explicit detail='standard'|'full' to override (best-effort: chat/message/activity endpoints may not yet honor detail server-side).

Comments on files: add/list/delete/react, anchor to image regions, A/V timestamps, PDF pages, or text selections. Call action='describe' for the full action/param reference. Destructive: delete, bulk-delete. Verbosity (detail param): list/list-all default to terse (compact rows). details defaults to full (drill-down). Pass an explicit detail='standard'|'full' to override (best-effort — may be a silent no-op until the comments API honors output=; see describe).

Event log and activity monitoring for workspaces and shares. Also surfaces the per-member DASHBOARD — a 'what's on your plate' feed of cards (@mentions, file activity) for one workspace, with view-only dismiss/snooze and a best-effort AI overlay. Call action='describe' for the full action/param reference. Verbosity (detail param): search/activity-list/activity-poll default to terse (compact rows). summarize defaults to standard (envelope around the AI summary). details defaults to full (drill-down). Pass an explicit detail='terse'|'standard'|'full' to override (best-effort on summarize/activity-list/activity-poll — only search/details honor output=; see describe).

Workspace/share member management: list, add, remove, update, transfer ownership, join, leave. Call action='describe' for the full action/param reference. Destructive: remove.

Workspace/share invitations: list, filter by state, update, revoke. Call action='describe' for the full action/param reference. Destructive: delete.

Brand asset management (logos, banners, profile photos) on org/workspace/share/user. Upload, delete, list, read. Call action='describe' for the full action/param reference. Destructive: delete.

Built-in product help — ask a natural-language "how do I…" question about Fastio and get a grounded, product-aware answer (or a short clarifying question) back in one call. EXPLAIN-ONLY / ADVISORY: it returns GUIDANCE TEXT and performs NO platform action (it will not create shares, move files, or change anything) — read the guidance, then act with the other tools. Answers are grounded in Fastio's own how-to knowledge AND phrased in terms of these MCP tools — they name the concrete `<tool> action="…"` calls to make — so prefer this over guessing endpoints or burning exploratory calls. For Q&A over YOUR uploaded files (RAG) use the `ai` tool instead — `how-to` answers questions about Fastio ITSELF. FREE and requires only an authenticated user (no org, no plan gate, no billing). Call action='describe' for the full action/param reference.