MCP tools

The set of tools available for use through Retool's MCP.

Retool's MCP server provides access to the following tools. When you authenticate the MCP, identify the scope(s) that you want the MCP to be authorized for.

You cannot be granted a scope for more permissions than your Retool account permits. For example, only organization administrators can select the mcp:admin scope. In addition, you will only be shown objects (such as apps, resources, or workflows) that you have permission to view.

Some tools also require a specific Retool plan, as shown in the Plan column. If your plan does not include a tool, the tool does not appear when your client lists the available tools.

App building

These tools enable you to build apps.

Tool	Required Scope	Plan	Description
retool_list_apps	mcp:read	All	List apps in the organization.
retool_get_app	mcp:read	All	Get a single app by app ID.
retool_list_writable_app_folders	mcp:read	All	List the app folders the authenticated user can create apps in, including their personal folder when available. Use this to pick a valid folder ID before creating an app.
retool_search_app_share_subjects	mcp:read	All	Search the app sharing directory for users, pending invites, and groups. Returns the subject IDs used by retool_grant_app_access and retool_revoke_app_access.
retool_list_app_access	mcp:read	All	List the users, invited users, and groups that currently have access to an app. Requires admin or owner access to the app.
retool_grant_app_access	mcp:write	All	Grant or update direct access to an app for a user, pending invite, or group. Requires admin or owner access to the app.
retool_revoke_app_access	mcp:write	All	Revoke direct app access for a user, pending invite, or group. Inherited or group-derived access may still grant effective access.
retool_list_react_app_threads	mcp:read	All	List recently active threads for an app and return thread handles that can be used to continue work.
retool_get_react_app_thread_activity_status	mcp:read	All	Check whether an existing thread has active agent work, without starting a workflow or opening a stream.
retool_read_react_app_thread_stream	mcp:read	All	Fetch the most recent persisted chat messages for an existing thread. Reads durable history only.
retool_list_react_app_files	mcp:write	All	List file paths, sizes, and line counts for an app. Returns metadata only, never file contents.
retool_read_react_app_files	mcp:write	All	Read the contents of specific files in an app. Requires an explicit list of paths.
retool_create_or_append_react_app_thread_message	mcp:write	All	Create or update an app from a natural-language prompt. Omit appUuid to create a new app.
retool_tail_react_app_thread_stream	mcp:write	All	Monitor an active thread and forward progress updates until activity completes, needs review, or times out.
retool_list_pending_react_app_thread_reviews	mcp:write	All	List pending live human-in-the-loop review requests for app threads. Inspect active review prompts before calling retool_respond_to_react_app_thread_review.
retool_view_pending_react_app_thread_hitl	mcp:write	All	View pending live human-in-the-loop review requests for app threads. Functionally identical to retool_list_pending_react_app_thread_reviews, for MCP clients that don't support elicitation.
retool_respond_to_react_app_thread_review	mcp:write	All	Wait for a pending review request, present it to the user, and submit the response so activity can continue.
retool_cancel_react_app_thread_activity	mcp:write	All	Cancel activity on an active thread by sending a stop request to the sandbox agent.
retool_sync_react_app_thread	mcp:write	All	Sync an app's thread branch from external source control into Retool's git repository before making further edits.
retool_publish_react_app	mcp:write	All	Publish a thread using the same publish flow as the app builder. Optionally set the public app identifier, publish and release tags, publish behavior, and a target folder.
retool_list_pending_react_app_function_approvals	mcp:write	All	List publish-blocking approvals required for mutating functions on a thread. Use when retool_publish_react_app reports unapproved mutating functions.
retool_start_prepared_import	mcp:write	All	Start a two-step import of a large existing app. Provisions the app and thread, validates the import plan, and returns an import ID plus a time-limited upload URL for the source zip.
retool_finalize_prepared_import	mcp:write	All	Finalize a two-step import after the source zip is uploaded to the URL from retool_start_prepared_import. Confirms the upload and returns the editor URL.
retool_submit_prepared_import	mcp:write	All	Import an existing app in one step. Takes the cleaned source tree and import plan inline, validates them, creates the app, and returns the editor URL.
retool_report_tool_usage_feedback	mcp:write	All	Report feedback about MCP tool usage, including helpful outcomes, unexpected behavior, or missing capabilities.

Organization and user management

These tools manage your organization's users, spaces, audit logs, and settings.

Tool	Required Scope	Plan	Description
retool_list_audit_logs	mcp:admin	Business, Enterprise	List audit log events in the organization. Organization admins in the root space can pass an orgId from retool_list_user_spaces to show events from one space.
retool_list_user_spaces	mcp:admin	All	List the spaces you can see, starting with the root space. Organization admins in the root space also see every child space.
retool_list_workflows	mcp:admin	All	List workflows in the organization.
retool_get_workflow	mcp:admin	All	Get a workflow by workflow ID.
retool_delete_workflow	mcp:admin	All	Delete a workflow by workflow ID.
retool_list_folders	mcp:admin	All	List folders in the organization.
retool_get_folder	mcp:admin	All	Get a folder by folder ID.
retool_list_environments	mcp:admin	All	List environments in the organization.
retool_get_environment	mcp:admin	All	Get an environment by environment ID.
retool_list_users	mcp:admin	All	List users in the organization.
retool_get_user	mcp:admin	All	Get a single user by user ID.
retool_disable_user	mcp:admin	All	Disable a user. This frees the user's seat and ends their sessions. If users sync through SCIM, the next sync can re-enable them, so make permanent changes in the identity provider.
retool_enable_user	mcp:admin	All	Re-enable a disabled user. The user takes a seat again, so this fails if the organization has no seats left.
retool_reset_user_2fa	mcp:admin	All	Reset a user's two-factor authentication so they can set it up again.
retool_update_user	mcp:admin	All	Change whether a user can use desktop and mobile apps or only mobile apps. The seatType option requires an Enterprise plan.
retool_set_user_attribute	mcp:admin	Business, Enterprise	Set a user's value for a user attribute. The attribute must already exist in the organization.
retool_delete_user_attribute	mcp:admin	Business, Enterprise	Remove a user's value for a user attribute.
retool_get_organization	mcp:admin	All	Get organization settings.
retool_list_user_invites	mcp:admin	All	List user invites in the organization.
retool_get_user_invite	mcp:admin	All	Get a single user invite by invite ID.
retool_create_user_invite	mcp:admin	All	Create a user invite. The seatType option requires an Enterprise plan. On other plans, Retool assigns the default seat type.
retool_delete_user_invite	mcp:admin	All	Delete a user invite by invite ID.
retool_set_user_invite_attribute	mcp:admin	All	Create or update a user attribute on a user invite.
retool_delete_user_invite_attribute	mcp:admin	All	Delete a user attribute from a user invite.

Groups

These tools manage permission groups and their members.

note

If your groups sync from SSO or SCIM, the next sync can undo changes you make with these tools. Make permanent changes in the identity provider, or use groups that the sync doesn't manage.

Tool	Required Scope	Plan	Description
retool_list_groups	mcp:admin	Enterprise	List permission groups in the organization, including their members.
retool_get_group	mcp:admin	Enterprise	Get a single permission group by group ID, including its members and access levels.
retool_create_group	mcp:admin	Enterprise	Create a permission group, which starts with no members and no access.
retool_rename_group	mcp:admin	Enterprise	Rename a permission group. Its members and access don't change. You can't rename the Admin, Editor, Viewer, or All Users groups.
retool_delete_group	mcp:admin	Enterprise	Delete a permission group. The first call deletes nothing and reports how many members and pending invites the group has. The group is deleted only after you confirm its name.
retool_add_group_members	mcp:admin	Enterprise	Add users and pending invites to a permission group. Adding anyone to the admin group requires your confirmation.
retool_remove_group_members	mcp:admin	Enterprise	Remove users and pending invites from a permission group. You can't remove yourself from the admin group or from a group you're a group admin of.
retool_set_group_permissions	mcp:admin	Enterprise	Set a group's universal access to all apps, resources, workflows, processes, or agents. If the change would remove the group's access to specific objects, the tool lists them for you to confirm first. Not available when your organization uses object permissions.

Roles and permissions

These tools manage roles and access to specific objects (apps, resources, workflows, and agents).

Tool	Required Scope	Plan	Description
retool_list_permission_scopes	mcp:admin	All	List the permission scopes a role can grant, with each scope's label, section, and the scopes it depends on.
retool_list_roles	mcp:admin	Enterprise	List the organization's roles and the scopes each one grants.
retool_list_role_grants	mcp:admin	Enterprise	List role grants for a role, user, or group. A user's grants include the grants of their groups.
retool_create_role	mcp:admin	Enterprise	Create a custom role from permission scopes. Retool adds any scopes that the selected scopes depend on.
retool_update_role	mcp:admin	Enterprise	Rename a custom role, change its description, or replace its scopes.
retool_delete_role	mcp:admin	Enterprise	Delete a custom role and all of its grants. The first call deletes nothing and reports how many grants the role has. The role is deleted only after you confirm its name.
retool_assign_role	mcp:admin	Enterprise	Assign a role to a user or group. A role that gives access to specific objects is assigned one object at a time, and only to groups.
retool_unassign_role	mcp:admin	Enterprise	Remove a role from a user or group, either completely or for one object. A user keeps any role they have through a group.
retool_get_access_list	mcp:admin	All	Show who can access a given object, and whether each user's or group's access is direct, universal, from a group, or from a parent folder.
retool_list_permitted_objects	mcp:admin	Business, Enterprise	List the objects that a user or group can access. Requires object permissions.
retool_grant_permission	mcp:admin	Business, Enterprise	Give a user or group use, edit, or own access to a workflow, agent, resource, or app folder. For apps, use retool_grant_app_access. Requires object permissions.
retool_revoke_permission	mcp:admin	Business, Enterprise	Remove a user's or group's direct access to a workflow, agent, resource, or app folder. Access from a group, a parent folder, or universal access stays. Requires object permissions.

Resources

These tools manage resources.

Tool	Required Scope	Plan	Description
retool_list_resources	mcp:read	All	List resources available in the organization, including databases, APIs, storage, and AI providers.
retool_get_resource	mcp:read	All	Get metadata for one resource by name. Use this for resource details, not for querying the underlying data.
retool_list_resource_folders	mcp:read	All	List resource folders in the organization. Pass a returned folder ID to retool_create_resource or retool_update_resource to place a resource in that folder.
retool_get_resource_ts_definitions	mcp:read	All	Generate global variable bindings and TypeScript definitions for selected resources. Required before retool_execute_resource_ts.
retool_create_resource	mcp:write	All	Create a new resource. Provide the resource type plus optional connection fields, then finish configuration in the returned URL.
retool_update_resource	mcp:write	All	Update an existing resource by name. Pass only the fields to change and omit secrets to keep their existing values. A resource's type cannot be changed.
retool_execute_resource_ts	mcp:write	All	Execute a TypeScript snippet against selected resources using the bindings from retool_get_resource_ts_definitions.