> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP workflow prompts

> Safe prompts that combine AIRCTRL tools for complete tasks.

These prompts combine tools without giving the agent unlimited freedom. Each one separates discovery, review and mutation. Replace the sample IDs before use.

## Inspect a project without decrypting secrets

<div className="section-help">
  Use this for inventory and planning. It keeps plaintext outside the agent context.
</div>

```text theme={}
Review project "00000000-0000-4000-8000-000000000010" in account "00000000-0000-4000-8000-000000000001". Summarize its status and the first 50 active records, including names, formats, tags and due dates. Do not decrypt any values or change anything.
```

<div className="technical-reference">
  **MCP tools used:** `get_project`, `list_records`
</div>

## Read the smallest useful secret scope

<div className="section-help">
  Prefer this over `get_all` when one record or a few fields are enough.
</div>

```text theme={}
Find the record named "Payments environment" in project "00000000-0000-4000-8000-000000000010" and show only its safe metadata and ID. Wait for my confirmation. Then read only "API_URL" and "API_TOKEN" from its production environment, use them only for the active task, and never print or summarize their values.
```

<div className="technical-reference">
  **MCP tools used:** `list_records`, `read_record`
</div>

## Create and verify a generated record

```text theme={}
Verify that AIRCTRL can generate passwords, then prepare a 32-character password record named "Payments database password" in project "00000000-0000-4000-8000-000000000010". Show only the non-secret details and wait for my confirmation. After creating it, confirm its name, format and ID without printing the generated value. Do not decrypt it unless I approve that separately.
```

<div className="technical-reference">
  **MCP tools used:** `list_secret_types`, `create_record`, `list_records`
</div>

## Share a record with a Service Account

<div className="section-help">
  Sharing creates record access; it does not broaden the Service Account's RBAC permissions.
</div>

```text theme={}
Give Service Account "00000000-0000-4000-8000-000000000040" access to record "00000000-0000-4000-8000-000000000020" in project "00000000-0000-4000-8000-000000000010" under account "00000000-0000-4000-8000-000000000001". First confirm that the Service Account is active and the record exists. Show both names and IDs and wait for my confirmation. Change only this record grant; do not alter roles, project assignments or credentials.
```

<div className="technical-reference">
  **MCP tools used:** `get_service_account`, `list_records`, `share_record_service_account`
</div>

## Remove one Service Account grant

```text theme={}
Remove Service Account "00000000-0000-4000-8000-000000000040" from record "00000000-0000-4000-8000-000000000020". First confirm both resources and explain that only this record grant will be removed. Wait for my explicit confirmation. Do not pause, revoke or otherwise modify the Service Account.
```

<div className="technical-reference">
  **MCP tools used:** `get_service_account`, `list_records`, `revoke_record_service_account`
</div>

## Create a gateway from an environment-backed provider key

```text theme={}
Set up an OpenAI gateway named "Payments AI" in project "00000000-0000-4000-8000-000000000010". Use the key stored in "AIRCTRL_MCP_KEY_OPENAI_PRODUCTION", model "gpt-5", and name the first gateway token "Local development". Confirm that OpenAI is enabled, explain every resource that may be created, show only the environment variable name, and wait for my approval. Send the one-time token only to the approved storage step, then return the new gateway's compatible base URLs.
```

<div className="technical-reference">
  **MCP tools used:** `list_providers`, `setup_gateway`, `get_connection_config`
</div>

## Replace a gateway token safely

<div className="section-help">
  Never revoke the old token before the replacement has been stored and deployed.
</div>

```text theme={}
Replace the active token named "CI production" on gateway "00000000-0000-4000-8000-000000000030" with a token named "CI production replacement" that expires in 30 days. Show the old token's ID and expiration, then wait for my confirmation. Send the new one-time value only to the approved storage step and stop until I confirm the workload uses it. Only then revoke the old token and report both final states.
```

<div className="technical-reference">
  **MCP tools used:** `list_gateway_tokens`, `create_gateway_token`, `revoke_gateway_token`
</div>

## Diagnose gateway failures without changing configuration

```text theme={}
Diagnose gateway "00000000-0000-4000-8000-000000000030" in project "00000000-0000-4000-8000-000000000010" since "2026-09-01T00:00:00Z". Review daily metrics, up to 25 requests with status 500, and up to 25 denied provider-key access events. Summarize timing, provider, model, status and denial reasons. Do not read bodies or change routing, credentials, limits or tokens.
```

<div className="technical-reference">
  **MCP tools used:** `read_usage_metrics`, `list_usage_logs`, `read_gateway_key_access`
</div>

## Inspect one failed request deeply

```text theme={}
Find log "00000000-0000-4000-8000-000000000080" among the 25 most recent requests for gateway "00000000-0000-4000-8000-000000000030". Show its safe metadata and ask before reading stored bodies. After I approve, diagnose the failure without quoting credentials, authorization headers or sensitive body fields.
```

<div className="technical-reference">
  **MCP tools used:** `read_usage`, `read_gateway_log`
</div>

## Review spend before changing limits

```text theme={}
Review current spend, the effective limit, request rate and error rate for project "00000000-0000-4000-8000-000000000010". Propose a specific spend limit, time window and per-minute request limit for gateway "00000000-0000-4000-8000-000000000030", but do not change anything yet. After my explicit approval, apply only the approved values and confirm the resulting effective limit.
```

<div className="technical-reference">
  **MCP tools used:** `read_usage_spend`, `read_usage_metrics`, `set_gateway_settings`
</div>

## Rotate a provider key with dependency checks

```text theme={}
Replace provider credential "00000000-0000-4000-8000-000000000071" in account "00000000-0000-4000-8000-000000000001". First show its label and provider and verify that it currently returns models. Never request or display the current secret. Use the replacement from the trusted local secret source, wait for my confirmation, never echo the new value, and verify afterward that models remain available.
```

<div className="technical-reference">
  **MCP tools used:** `list_provider_credentials`, `list_provider_models`, `rotate_provider_key`
</div>

## Configure OpenTelemetry and verify safe state

```text theme={}
For gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001", show the current OpenTelemetry state, endpoint and export flags without requesting header values. Prepare to enable metrics and traces to "https://otel.example.com/v1/traces" using headers from "OTEL_EXPORT_HEADERS". Wait for my confirmation, apply the change, and report only the final safe settings.
```

<div className="technical-reference">
  **MCP tools used:** `get_otel_export`, `set_otel_export`
</div>

## Decommission a gateway

```text theme={}
Decommission gateway "00000000-0000-4000-8000-000000000030" in account "00000000-0000-4000-8000-000000000001". First review its connection settings, active tokens and 25 most recent requests. List every token that will stop working and wait for my explicit confirmation. Delete only the gateway; do not revoke provider credentials because other gateways may use them.
```

<div className="technical-reference">
  **MCP tools used:** `get_connection_config`, `list_gateway_tokens`, `read_usage`, `delete_gateway`
</div>

## Stop conditions

Stop the workflow instead of improvising when an ID is ambiguous or a resource belongs to another account. Also stop when a Service Account is inactive, a provider key is unavailable, or the API returns an authorization error. Ask for the missing decision rather than trying broader access.