MCP prompt catalog

These prompts describe what you want in everyday language. Replace the sample IDs with IDs you obtained from . For write operations, the prompt asks the agent to show the final input before execution. The tool names appear below each prompt only as a technical reference.

How to use this catalog

Ask to check its configuration when identity mode is uncertain.
Replace every sample ID with an ID returned by ; do not ask the agent to invent one.
Keep discovery and mutation as separate steps.
Require a preview before a write or destructive tool.
Tell the agent whether plaintext may enter its context.
Stop on 403 instead of asking the agent to search for broader access.

Each heading lets you find the matching MCP capability. You do not need to include that heading or any tool name in your request. MCP workflows combines these prompts into complete tasks with explicit review points.

Status and projects

Check configuration

Use this first when you are unsure which profile MCP loaded.

Check how AIRCTRL is currently configured. Tell me which API environment and identity type are active. Do not reveal tokens, private keys or local file paths.

MCP tool used: airctrl_status

List accessible accounts

This tool requires a human PAT.

Show me every AIRCTRL account I can access, including each name and ID. Do not change anything.

MCP tool used: list_accounts

List projects

Show the active projects in account "00000000-0000-4000-8000-000000000001". Include each project name, ID and current state. Leave archived projects out.

MCP tool used: list_projects

View a project

Show me project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001". Summarize it without changing anything.

MCP tool used: get_project

Create a project

The result includes the new project ID.

Create a project named "Payments" in account "00000000-0000-4000-8000-000000000001" with the description "Credentials used by the payments service". Show me the exact details and wait for my confirmation before creating it.

MCP tool used: create_project

Update a project

Update project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001". Its name should be "Payments production", its description "Production credentials", and it should remain active. Show every resulting value and wait for my confirmation.

MCP tool used: update_project

Archive or restore a project

Use archived: false to restore it.

Archive project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001". Show me its name and ID, then wait for my confirmation.

MCP tool used: set_project_archive

Service Account metadata

List Service Accounts

Show me the Service Accounts in account "00000000-0000-4000-8000-000000000001". Return only their names, IDs, providers and states.

MCP tool used: list_service_accounts

View a Service Account

Both metadata tools require a human PAT.

Show me Service Account "00000000-0000-4000-8000-000000000040" in account "00000000-0000-4000-8000-000000000001". Only return safe metadata; do not change its state or credentials.

MCP tool used: get_service_account

Record reading and local generation

List record metadata

Show the first 25 active records in project "00000000-0000-4000-8000-000000000010". Return only names, formats, tags and IDs. Do not decrypt any values.

MCP tool used: list_records

Read a complete record

Read record "00000000-0000-4000-8000-000000000020" locally. Use its decrypted fields only for this task. Do not print, log or repeat them in your response.

MCP tool used: get_secret

Read selected record fields

From record "00000000-0000-4000-8000-000000000020", read only the "username" and "password" fields for the production environment. Do not request any other field.

MCP tool used: read_record

Load all project records

This can expose many records to the agent. Prefer read_record when one record is enough.

Load every accessible record from project "00000000-0000-4000-8000-000000000010" for this task. Use decrypted values only as environment input and never include them in chat output.

MCP tool used: get_all

View supported record formats

This helper is local and does not call the API.

Show me the record formats AIRCTRL supports, their required fields and which ones AIRCTRL can generate. Do not create anything.

MCP tool used: list_secret_types

Generate a secret locally

This helper generates values locally and stores nothing.

Generate a 32-character password locally. Do not store or print its value. Tell me only whether generation succeeded.

MCP tool used: generate_secret

Create an encrypted record

Create a password record named "Generated database password" in project "00000000-0000-4000-8000-000000000010" and generate a 32-character value locally. Show the non-secret details and wait for my confirmation. Never print the generated value.

MCP tool used: create_record

Replace record fields

When no recordId is used, supply projectId, name and secretFormat to create or update by name.

Replace the "password" field in record "00000000-0000-4000-8000-000000000020" using the value from the trusted local environment. Confirm the record ID and field name, but never display the value.

MCP tool used: set_secret

Record lifecycle

Update record details

Update record "00000000-0000-4000-8000-000000000020" with the tags "payments" and "production", a due date of "2026-12-01T00:00:00Z", and a 90-day rotation interval. Show the changes and wait for my confirmation.

MCP tool used: update_record_metadata

Archive or restore a record

Archive record "00000000-0000-4000-8000-000000000020". Show me its name and ID, then wait for my confirmation.

MCP tool used: set_record_archive

Transfer record ownership

Transfer ownership of record "00000000-0000-4000-8000-000000000020" to user "00000000-0000-4000-8000-000000000050". Show the current and new owner, then wait for my explicit confirmation.

MCP tool used: transfer_record_ownership

View record version history

Show the version history for record "00000000-0000-4000-8000-000000000020", including version IDs, creation times and which version is current. Do not change anything.

MCP tool used: list_record_versions

Restore a previous record version

Restore record "00000000-0000-4000-8000-000000000020" from version "00000000-0000-4000-8000-000000000021". Explain what the rollback creates, then wait for my confirmation.

MCP tool used: rollback_record

Rotate a record

Rotate record "00000000-0000-4000-8000-000000000020". Confirm its name and explain what will change, without exposing its value, then wait for my confirmation.

MCP tool used: rotate_record

Give user "00000000-0000-4000-8000-000000000050" read access to record "00000000-0000-4000-8000-000000000020". Verify that the user is eligible and wait for my confirmation.

MCP tool used: share_record_user

Give Service Account "00000000-0000-4000-8000-000000000040" access to record "00000000-0000-4000-8000-000000000020" in account "00000000-0000-4000-8000-000000000001". Show the target names and IDs, then wait for my confirmation.

MCP tool used: share_record_service_account

Share record "00000000-0000-4000-8000-000000000020" with group "00000000-0000-4000-8000-000000000060". Verify that both belong to the same account and project, then wait for my confirmation.

MCP tool used: share_record_group

Remove a user’s record access

Remove user "00000000-0000-4000-8000-000000000050" from record "00000000-0000-4000-8000-000000000020". Explain that access ends immediately, then wait for my confirmation.

MCP tool used: revoke_record_user

Remove a Service Account’s record access

Remove Service Account "00000000-0000-4000-8000-000000000040" from record "00000000-0000-4000-8000-000000000020". Confirm that grants for other Service Accounts will remain unchanged, then wait for my approval.

MCP tool used: revoke_record_service_account

Remove a group’s record access

Remove group "00000000-0000-4000-8000-000000000060" from record "00000000-0000-4000-8000-000000000020". Show the target names and IDs, then wait for my confirmation.

MCP tool used: revoke_record_group

Record audit

Review one record’s audit history

Show the 25 most recent audit events for record "00000000-0000-4000-8000-000000000020". Summarize actions, actors and timestamps without exposing secret fields.

MCP tool used: read_record_audit

Find unusual record activity

Show unusual record activity in project "00000000-0000-4000-8000-000000000010" under account "00000000-0000-4000-8000-000000000001". Group the results by severity.

MCP tool used: list_record_anomalies

Review daily record activity

Summarize record activity for project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001" on the UTC day "2026-09-10".

MCP tool used: list_record_activity

Review record alerts

Show the first 25 record alerts for project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001". Do not take corrective action.

MCP tool used: list_record_alerts

Review secret access events

Show the first 25 secret-access events for records in project "00000000-0000-4000-8000-000000000010" under account "00000000-0000-4000-8000-000000000001".

MCP tool used: list_record_access

Providers and credentials

List supported AI providers

Show the AI providers AIRCTRL supports, including their names, IDs and available configuration. Do not add any credentials.

MCP tool used: list_providers

List provider credentials

Show the provider credentials in account "00000000-0000-4000-8000-000000000001". Return labels, IDs, providers and validation status, but never request secret values.

MCP tool used: list_provider_credentials

Add a provider credential

Add a provider credential named "Production OpenAI" to account "00000000-0000-4000-8000-000000000001" for provider "00000000-0000-4000-8000-000000000070". Read the key from environment variable "AIRCTRL_MCP_KEY_OPENAI_PRODUCTION". Confirm only the variable name, never its value, then wait for my approval.

MCP tool used: add_provider_key

List models for a credential

Show the model IDs available through provider credential "00000000-0000-4000-8000-000000000071" in account "00000000-0000-4000-8000-000000000001".

MCP tool used: list_provider_models

Replace a provider key

Replace provider credential "00000000-0000-4000-8000-000000000071" in account "00000000-0000-4000-8000-000000000001" using the replacement from the trusted local secret source. Never echo the key. Wait for my confirmation before changing it.

MCP tool used: rotate_provider_key

Rename a provider credential

Rename provider credential "00000000-0000-4000-8000-000000000071" in account "00000000-0000-4000-8000-000000000001" to "Primary OpenAI". Show the current and new labels, then wait for my confirmation.

MCP tool used: rename_provider_credential

Revoke a provider credential

Revoke provider credential "00000000-0000-4000-8000-000000000071" in account "00000000-0000-4000-8000-000000000001". First show every gateway that depends on it, then wait for my explicit confirmation.

MCP tool used: revoke_provider_credential

Gateway setup and routing

List gateways

Show the gateways in project "00000000-0000-4000-8000-000000000010", including each name, ID, provider and active state.

MCP tool used: list_gateways

Create a gateway

Create a bare gateway named "Payments AI" in project "00000000-0000-4000-8000-000000000010" under account "00000000-0000-4000-8000-000000000001". Do not attach a provider key yet. Show the details and wait for my confirmation.

MCP tool used: create_gateway

Set up a complete gateway

This workflow can add a provider credential, create a gateway and create a one-time gateway token.

Set up an OpenAI gateway named "Payments AI" in project "00000000-0000-4000-8000-000000000010". Read the provider key from "AIRCTRL_MCP_KEY_OPENAI_PRODUCTION", use "gpt-5" by default, and name the first gateway token "Local development". Explain every resource that will be created and wait for my confirmation.

MCP tool used: setup_gateway

View gateway connection settings

Show me how to connect to gateway "00000000-0000-4000-8000-000000000030", including compatible base URLs and required header names. Do not create a new token.

MCP tool used: get_connection_config

Change gateway routing

Attach provider credential "00000000-0000-4000-8000-000000000200" to model "gpt-5" on gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001", and make provider "00000000-0000-4000-8000-000000000070" with that model the default route. Show the current and proposed routing, then wait for my confirmation.

MCP tool used: set_routing

Change gateway limits and behavior

For gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001", set a monthly spend limit of 100, a rate limit of 120 requests per minute, metadata logging without bodies, guardrails in flag mode, and a five-minute cache. Show every proposed change and wait for my confirmation.

MCP tool used: set_gateway_settings

Detach a provider credential

Detach provider credential "00000000-0000-4000-8000-000000000071" from gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". Confirm that another route will remain usable, then wait for my approval.

MCP tool used: detach_gateway_credential

Delete a gateway

Delete gateway "00000000-0000-4000-8000-000000000030" from account "00000000-0000-4000-8000-000000000001". Explain which gateway tokens will stop working, then wait for my explicit confirmation.

MCP tool used: delete_gateway

Gateway tokens

List gateway tokens

Show the tokens for gateway "00000000-0000-4000-8000-000000000030", including IDs, labels, status and expiration. Never request their secret values.

MCP tool used: list_gateway_tokens

Create a gateway token

Create a token named "Local development" for gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". It should expire in 30 days. Wait for my confirmation and send the one-time value only to the approved storage step.

MCP tool used: create_gateway_token

Rename a gateway token

Rename token "00000000-0000-4000-8000-000000000031" on gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001" to "CI production". Show the current and new names, then wait for my confirmation.

MCP tool used: rename_gateway_token

Revoke a gateway token

Revoke token "00000000-0000-4000-8000-000000000031" on gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". Explain that authentication will stop immediately, then wait for my confirmation.

MCP tool used: revoke_gateway_token

Delete a gateway token

Permanently delete token "00000000-0000-4000-8000-000000000031" from gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". Confirm that it is already revoked, then wait for my approval.

MCP tool used: delete_gateway_token

Logs, usage and OpenTelemetry

Review gateway requests

Summarize up to 50 requests handled by gateway "00000000-0000-4000-8000-000000000030" since "2026-09-01T00:00:00Z". Do not read request or response bodies.

MCP tool used: read_usage

Inspect one gateway request

Inspect log "00000000-0000-4000-8000-000000000080" from gateway "00000000-0000-4000-8000-000000000030". Read stored bodies only to diagnose this request and do not repeat sensitive content.

MCP tool used: read_gateway_log

Review provider-key access

Show up to 50 denied provider-key access events for gateway "00000000-0000-4000-8000-000000000030" since "2026-09-01T00:00:00Z". Group the denials by reason.

MCP tool used: read_gateway_key_access

Review project usage logs

Show up to 50 usage logs for gateway "00000000-0000-4000-8000-000000000030" in project "00000000-0000-4000-8000-000000000010" since "2026-09-01T00:00:00Z". Return metadata only.

MCP tool used: list_usage_logs

Inspect one project usage log

Inspect usage log "00000000-0000-4000-8000-000000000080" in project "00000000-0000-4000-8000-000000000010". Do not quote request or response bodies in the final answer.

MCP tool used: read_usage_log

Review project spend

Compare current spend in project "00000000-0000-4000-8000-000000000010" with its effective limit. Do not change any settings.

MCP tool used: read_usage_spend

Review project usage metrics

Summarize daily requests, errors, tokens, latency and spend for project "00000000-0000-4000-8000-000000000010" since "2026-09-01T00:00:00Z".

MCP tool used: read_usage_metrics

View OpenTelemetry settings

Show the OpenTelemetry export settings for gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". Return only safe settings and never request stored header values.

MCP tool used: get_otel_export

Change OpenTelemetry settings

Enable OpenTelemetry metrics and traces for gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". Send them to "https://otel.example.com/v1/traces" and read headers from "OTEL_EXPORT_HEADERS". Show the destination and enabled data, then wait for my confirmation.

MCP tool used: set_otel_export

When a prompt fails

If a tool returns validation, permission or not-found errors, stop and explain the exact code. Do not try neighboring IDs or broader scopes. Retry only temporary rate_limited, internal_error or service_unavailable failures, with a short bounded backoff.

​How to use this catalog

​Status and projects

​Check configuration

​List accessible accounts

​List projects

​View a project

​Create a project

​Update a project

​Archive or restore a project

​Service Account metadata

​List Service Accounts

​View a Service Account

​Record reading and local generation

​List record metadata

​Read a complete record

​Read selected record fields

​Load all project records

​View supported record formats

​Generate a secret locally

​Create an encrypted record

​Replace record fields

​Record lifecycle

​Update record details

​Archive or restore a record

​Transfer record ownership

​View record version history

​Restore a previous record version

​Rotate a record

​Record sharing

​Share a record with a user

​Share a record with a Service Account

​Share a record with a group

​Remove a user’s record access

​Remove a Service Account’s record access

​Remove a group’s record access

​Record audit

​Review one record’s audit history

​Find unusual record activity

​Review daily record activity

​Review record alerts

​Review secret access events

​Providers and credentials

​List supported AI providers

​List provider credentials

​Add a provider credential

​List models for a credential

​Replace a provider key

​Rename a provider credential

​Revoke a provider credential

​Gateway setup and routing

​List gateways

​Create a gateway

​Set up a complete gateway

​View gateway connection settings

​Change gateway routing

​Change gateway limits and behavior

​Detach a provider credential

​Delete a gateway

​Gateway tokens

​List gateway tokens

​Create a gateway token

​Rename a gateway token

​Revoke a gateway token

​Delete a gateway token

​Logs, usage and OpenTelemetry

​Review gateway requests

​Inspect one gateway request

​Review provider-key access

​Review project usage logs

​Inspect one project usage log

​Review project spend

​Review project usage metrics

​View OpenTelemetry settings

​Change OpenTelemetry settings

​When a prompt fails