MCP server

pando_accept_proposal

Accept what Pando worked out and pin it as the app's setup, optionally setting environment variables and secrets in the same step. This does not deploy — call pando_deploy after. On an app that is already configured it is refused unless confirm is true: accepting again replaces how the app is built and what it runs with what detection found, and carries over variables, how each dependency is filled, and storage. pando_get_detection_diff shows what would change. To change only a variable on a configured app, write a spec revision with pando_create_spec instead.

pando_add_app_to_section

Move an app you can open into one of your launcher sections, out of any other.

pando_add_webhook_route

Let a verified delivery with no Pando credential reach one method and exact path of an app, which otherwise stays private. With kind hmac_sha256, header holds the hex HMAC-SHA256 of the body after any prefix, and a signature already accepted is not forwarded again unless allow_repeats is set. With kind header, header holds the secret itself. Without secret, one is generated and returned this once. Saved as a new configuration that takes effect at the app's next deploy.

pando_ai_ask_reference

Ask how to do something with Pando. Answered from Pando's API, CLI and MCP reference, citing the endpoints, commands and tools it relies on. Describes; does nothing.

pando_ai_draft_access

Draft a custom role and a group from a description of who should be able to do what. A draft only: nothing is created. Verbs come from Pando's catalog; anything else is listed as refused.

pando_ai_draft_host_rules

Propose changes to the installation's host policy from a description: the document as it would be saved, and each change. Nothing is saved. Settings fixed in the startup configuration are declined, naming where they are set.

pando_ai_search_audit

Ask a question of the audit log, such as "which apps did Ben Meeker create last month?". Returns a short summary and the filters used, which pando_list_audit takes as-is.

pando_answer_detection

Answer one of the questions from pando_get_detection. An answer that changes what is built (a build argument) has Pando build and scan the image again, so the plan shows the score of what will run: detection reads as running until it has, and accepting waits for it.

pando_approve_deploy

Approve a deploy that is waiting for approval. When it is the last approval the deploy needs, the deploy starts. Approval is a person's sign-off, so by default an installation does not let an agent's token approve; the refusal says so.

pando_assign_ai_function

Have an AI adapter handle one AI function, optionally on a model of its own. Refused while another adapter handles the function; unassign it there first.

pando_authorize_source

Start signing a source connection in. By device code (the default) it returns user_code and verification_url: tell the person to open the URL and enter the code, then call pando_poll_source_authorization every interval_seconds until it says authorized. A connection whose capabilities have web_authorization and not device_authorization — a GitHub App, which Pando creates on GitHub and then installs — takes mode web: give the person authorize_url to open in a browser signed in to Pando, and check pando_list_sources afterwards.

pando_check_app_image

For an app deployed from a published image: whether its tag, such as :latest, now names a different build than the one the app runs. Writes nothing. When update_available is true, pando_deploy_newer_image with latest_digest deploys that build.

pando_check_updates

Ask GitHub for Pando's releases now rather than waiting for the six-hourly check, and answer as pando_get_updates does. A second request within a minute answers from the first. Sends nothing while host policy's disable_update_check is set.

Takes no arguments.

pando_clear_app_icon

Remove the image on an app's launcher tile, so the tile shows the map generated for it.

pando_configure_adapter

Add an adapter, or change one by its id. Settings go in config; a secret such as an API key or a registry password goes in credentials, which is stored encrypted and never shown again. A source connection or an image registry is used from the moment it is saved; any other adapter after Pando restarts. enabled: false turns one off.

pando_connect_notify

Connect a notification adapter such as Slack to its provider. mode web takes token, a Slack configuration token (Slack's app settings, Your App Configuration Tokens, Generate Token) used once and never stored; Pando creates its app and returns authorize_url for the person to open in a browser signed in to Pando and choose Allow. Slack returns only to an https address. mode manual without token returns authorize_url, which creates the app in Slack by hand; with token, the bot token it shows once installed, it finishes. Check pando_list_notify_adapters afterwards.

pando_count_unread_notifications

How many of your notifications are unread, without listing them.

Takes no arguments.

pando_create_app

Create an app from a git repository (source_url), from an image that is already built (image), or from files you will send next (upload: true, then pando_upload_source). Give exactly one. Returns immediately with the app in draft while Pando works out how to run it; call pando_get_detection next, with wait_seconds to wait for it to finish. For an upload, detection starts when pando_upload_source is followed by pando_rerun_detection.

pando_create_join_token

Create a token a new Pando joins this installation with, at its setup. join in the reply is the token and is shown once. A token for the control role needs every install permission.

pando_create_section

Make a section in your own launcher: a named grouping of apps. Only you see it.

pando_create_spec

Write a new spec revision: the way to change a configured app's variables, egress, workloads or anything else in its spec. Send the whole spec — read the pinned one with pando_get_spec, change it, and send it back. Revisions are append-only, and this neither pins nor deploys: call pando_pin_spec with the revision it returns, then pando_deploy. With dry_run true nothing is written; the reply says whether the spec is accepted, the egress rules it would run with, and whether deploying it would need approval.

pando_create_subscription

Subscribe to events and send them to a webhook (url) or through a notification adapter such as Slack or email (adapter_id). events is a comma-separated list of event names, prefixes such as deploy.*, or *; pando_list_events lists them. With app_id it is about one app; without, it is install-wide and needs install.events.manage. A webhook's signing key is in the result once; tell the person to keep it.

pando_delete_secret

Remove one of an app's secrets. Needs app.secrets.write.

pando_delete_section

Delete one of your launcher sections. Its apps go back to Your apps; nothing else changes.

pando_delete_subscription

Delete a subscription, its signing key and its delivery log.

pando_deploy

Deploy an app. Returns once the deployment has been accepted, not once it is running. Without spec_revision it ships the pinned revision; an edit, from the console or pando_create_spec, writes a newer one, and the reply's newer_revision names it — deploy again with that revision to ship the edit. When the deploy needs somebody's approval, it comes back with status awaiting_approval and approval_reasons saying why; it runs once a person approves it.

pando_deploy_newer_image

Deploy the newer build pando_check_app_image found: writes a revision pinning digest and deploys it. Refused if the tag has moved since the check; check again then. Answers as pando_deploy does, approval included.

pando_diff_specs

Compare two spec revisions: what changed, and whether deploying it restarts, rebuilds or leaves the app alone.

pando_edit_role

Rename a custom role, replace its permissions, or both. The verbs must be of the role's scope; built-in roles cannot be changed. Changing an installation role needs every installation permission it carries before and after; permissions added to an app role must be yours on every app it is granted on. Needs install.users.manage.

pando_favorite_app

Pin an app to the top of your own launcher. It grants nothing and only you see it; you must be able to open the app.

pando_get_address

Where an app is reached: its routing (adapter, mode, hostname, path or port) and address, next_address when a change is saved and not yet deployed, and the routing adapters it could move to — each with the modes it serves, its default mode, base_domain, and domains: every domain a hostname can be in, such as each of a Cloudflare adapter's zones.

pando_get_app

Get one app: its name, source, state and pinned spec. Once the app has been through detection, detection says where that has got to — status, and stage while it is running — which is why an app in draft is still in draft.

pando_get_app_idle

When Pando stops or deletes an app nobody uses: the app's own stop_days and delete_days (null is the installation's, 0 is never), the installation's, the ones in force, last_activity_at, stops_at and deletes_at if nobody uses it before then, and stopped_for_idle when Pando stopped it.

pando_get_app_limit

How many apps a person may own. With user_id: the limit in force (0 is unlimited), where it comes from (user, group or policy, with the group's name), how many apps they own, and the value on their own account. With group_id: the group's max_apps, null when it sets none. Your own account needs no permission; anything else needs install.users.manage.

pando_get_auto_deploy

Whether an app deploys automatically when its repository changes, and how: settings on the newest configuration and deployed on the running one, with pending when they differ; paused when approval now stops it; last_check, what Pando last found and the last commit it tried (each commit is tried once) and why it went nowhere; and the webhook URL, with whether a webhook secret is set.

pando_get_config

The configuration the Pando server started with: every non-secret setting, its value and where it was set (an environment variable, the config file, or the default), and the host policy fields fixed there, which cannot be changed through the API while they are set.

Takes no arguments.

pando_get_delivery

One delivery: every attempt at it, with the status code and error each got, and the payload sent.

pando_get_detection

What Pando worked out about an app, including any questions it needs answered before it can deploy. The questions are written to be answerable by whatever wrote the app. status is running while Pando is still working: call again. While running, stage says what it is doing — fetching (cloning the repository), detecting (working out what the app is), building (building the image the app would run, so the plan can show its security score), trying (a trial run), scanning (a security scan) or screening (an AI adapter checking the plan); running lists every step under way, since the scan runs beside the build and the trial; and elapsed_seconds says how long it has taken so far; a build or a trial run can take several minutes. Pass wait_seconds (up to 60) to have the call return as soon as the stage changes or detection finishes, instead of calling repeatedly. When it has finished, status is ready (call pando_accept_proposal), needs_answers or unknown (answer the questions with pando_answer_detection), blocked or failed (the detection field says why).

pando_get_detection_diff

What accepting the proposal would change about the app's pinned configuration: each change with its class (benign, restart, rebuild or destructive) and a summary. is_first is true when the app is not configured yet, so everything is new.

pando_get_instructions

The instructions every agent building on this installation follows: Pando's guidance for writing apps that run well and safely here, then this organization's own rules and preferences, which win where the two differ. Read them before writing or changing an app if the client did not load them when it connected. text is the whole document.

Takes no arguments.

pando_get_last_upgrade

The most recent in-place upgrade of Pando: from and to which version, whether it succeeded or was rolled back and why, with the new version's last log lines when it was.

Takes no arguments.

pando_get_logs

Read an app's recent logs. An app can be made of several parts — a web service, a worker, a database it brought with it — and each has its own log. Without workload this is the primary part, the one the app's address resolves to; pando_get_status lists the names. Returns the most recent lines: 200 unless tail says otherwise, and never more than 5000.

pando_get_notification_preferences

Which of Pando's own notifications reach you, on each channel that reaches people, such as the console and email.

Takes no arguments.

pando_get_registry_credential

Whether an image app has a registry credential, and of which kind, with its username or access key ID. Never the password or secret key.

pando_get_spec

Read one spec revision in full: how the app is built, what it runs, its variables, egress and routing.

pando_get_status

What an app is doing right now: running, degraded, failed, and why — including each part separately, so a single part that is crash-looping is visible rather than averaged into one word for the app.

pando_get_two_factor

Who you are (GET /me), including, on a local account, two_factor: whether two-factor authentication is on, whether host policy requires it, and how many recovery codes are left. Setting it up or changing it is done in the console's settings or with pando two-factor, never here: each step handles an authenticator key, recovery codes or your password.

Takes no arguments.

pando_get_updates

Whether a newer Pando is released: the version the server runs, the latest on the update channel, and each version in between with its changelog, security fixes and breaking changes marked, plus the command that upgrades the server. The check is host policy (disable_update_check, update_channel).

Takes no arguments.

pando_get_usage

What each part of an app is using right now: CPU (thousandths of a core), memory and disk in bytes, and each mounted volume's size, beside its limits (0 means none). A reading, not a history.

pando_get_user

One account, with every installation role it holds and where each comes from (install_roles), as pando_list_users shows it. Your own needs no permission; anyone else's needs install.view.

pando_ignore_notice

Hide one of an app's notices from yourself until what it says changes. Only you: everyone else still sees it. It hides a reminder and nothing more — a deploy the notice warned about is still refused.

pando_list_adapter_kinds

The kinds of adapter this build of Pando can run, and the settings each takes: which are credentials, which are required, and the default each takes when left out.

Takes no arguments.

pando_list_adapters

The adapters this installation is configured with — runtimes, routing, builders, image registries, secrets, backup, scanners, AI, source connections and the rest — each with its live capabilities, whether it is reachable, which credentials are set (never their values), and whether it waits on a restart. One declared at startup is read-only.

Takes no arguments.

pando_list_ai_functions

Each AI function Pando has, the AI adapter that handles it and on which model, whether it is on, and whether the startup configuration assigns it.

Takes no arguments.

pando_list_app_events

An app's recent events, newest first: deploys, state and health changes, scans, shares, backups. Each says what happened in a sentence.

pando_list_approvals

List the deploys waiting for approval on every app you can see. Each says which app, why it needs approval, the approvals it has so far, and can_decide: whether you may approve or reject it. Oldest first, a page at a time: pass next_cursor back as cursor for the next page.

pando_list_apps

List the apps you can manage, with their current state, newest first, a page at a time. Each app has its address, its owner's name (owner_name), and access, who can open it: private (its owner alone), shared (its owner and the people or groups it is shared with), public (anyone on the internet, without signing in) or passcode (anyone on the internet who has the passcode). notice_count is how many of its notices you have not ignored (pando_list_notices lists them), left out when none. total is how many match; pass next_cursor back as cursor for the next page.

pando_list_audit

Read the audit log, newest first. Every filter is optional and they combine: what was done (an action prefix such as app. or grant.delete), who did it, which app, what it was done to, how it ended, text to search for, and when (RFC 3339 times; since inclusive, until exclusive). Each event has a summary in plain words, such as "Deployed crewmate", beside its action.

pando_list_audit_archives

The months of the audit log past retention, archived and removed from the live log: each month's row count, first and last event, time range, size, SHA-256 digest, and where it is kept. Events in these months are not in pando_list_audit; the archive itself is a gzip download from GET /api/v1/audit/archives/{id}, or pando audit archives download.

Takes no arguments.

pando_list_audit_sinks

The audit sinks: destinations, such as a SIEM's syslog or HTTPS collector, that the audit log is pushed to as it is written. Each with what it sends where (transport, endpoint, format, actions, exclude, and disclosure, the sentence saying what leaves the installation), its last delivery, backlog, last_error and failing_since, why Pando turned it off if it did, and gap_from and gap_to for a range of events it missed. Needs install.audit.read.

Takes no arguments.

pando_list_deliveries

A subscription's recent deliveries, newest first: each event, whether it arrived, how many attempts it took, and the last error.

pando_list_events

List the events a subscription can name: each event's name, whether it is about one app or the whole installation, and its data fields.

Takes no arguments.

pando_list_hosts

The hosts that have joined this installation's cluster: each one's name, roles (control, app), address, version and when it was last heard from. Needs install.cluster.manage.

Takes no arguments.

pando_list_join_tokens

Every join token, newest first: its roles, how many of its uses are spent, when it expires and whether it was revoked. Never the token itself. Needs install.cluster.manage.

Takes no arguments.

pando_list_my_apps

The apps you can open — your launcher — with which are favorites, which of your sections each is filed under, and whether you can also manage it (can_manage), and your sections. Favorites first, then filed apps, then the rest, a page at a time: pass next_cursor back as cursor for the next page. A different list from pando_list_apps, which is the apps you can administer.

pando_list_notices

What an app's Overview asks of somebody: a configuration not yet deployed, variables with no value, a backup that was not taken, a security score below this installation's minimum, the spec's warnings. Each has a stable key, a message, a fingerprint and whether you have ignored it as it reads now.

pando_list_notifications

Your notifications inbox, newest first, and how many are unread. unread=true lists only those.

pando_list_notify_adapters

List the notification adapters, each with whether it can send: capabilities.authorized, and problem saying why one cannot. One with web_authorization or manual_authorization that is not authorized, such as Slack, needs pando_connect_notify first.

Takes no arguments.

pando_list_notify_channels

List the channels a subscription to a notification adapter such as Slack can post to: id, name, private. A private Slack channel is listed once Pando is invited to it with /invite @Pando.

pando_list_role_holders

Who holds a role: the groups granted it, then the accounts holding it, each with via — direct, or group for an account holding it only through a group. An app role's holders are those holding it on any app. A page at a time: pass next_cursor back as cursor. Needs install.view.

pando_list_secrets

List which secrets an app has, and where each came from. Never their values.

pando_list_source_branches

The branches of a repository, read through a source connection.

pando_list_source_repositories

The repositories a source connection can read, to pick one for pando_create_app rather than guess its URL. Refused for a connection with no API access, such as an SSH key.

pando_list_sources

The installation's source connections: how Pando reads private repositories on GitHub, GitLab, Azure DevOps, Bitbucket, Gitea or any git host. Each has an id, the host and scope it covers, how it signs in, whether it can list repositories, and whether it is authorized; problem says why one cannot be used. A private repository is read with the connection that covers its URL.

Takes no arguments.

pando_list_specs

List an app's spec revisions, and which one is pinned. The pinned revision is what runs and what the next deploy ships.

pando_list_subscriptions

List your event subscriptions: what each listens for, where it sends, and whether it is on. app_id narrows to one app. Newest first, a page at a time: pass next_cursor back as cursor for the next page.

pando_list_user_apps

The apps an account has access to: its role for managing each, directly or through a group, whether it can use each, and whether you can change that (can_manage). By app name, a page at a time: pass next_cursor back as cursor for the next page.

pando_list_users

The accounts on this installation, newest first, a page at a time: pass next_cursor back as cursor for the next page. Each carries adapter_name — the identity provider it signs in with — and install_roles — every installation role it holds, and whether it holds it directly or through a group (with the group's name, and the identity provider for a synced group) — and install_role_id, the role granted to the account itself. Needs install.view.

pando_list_webhook_routes

The webhook routes on an app's newest configuration: each one's name, method, path and verification, secret_set, without which it refuses every delivery, and deployed, whether the app runs it as it stands.

pando_mark_host_lost

Say a host is gone and start the standby of each app homed on it. With three or more hosts Pando does this itself when most of them cannot reach the host; with fewer it never does. Refused while the host answers. A failed app is not failed over. Returns the apps started and the ones skipped, with why. Needs install.cluster.manage.

pando_mark_notifications_read

Mark one of your notifications read, by notification_id, or every one when it is omitted.

pando_pin_spec

Pin a spec revision: what the app converges to, and what the next deploy ships. This does not deploy — call pando_deploy after. On an app that has been deployed, pinning changes what it runs, so it needs app.deploy, and a revision whose deploy needs approval is refused: deploy it instead.

pando_plan

Show what a deploy would do, without doing it. Side-effect free, so it is safe to call after any change to check the change is deployable.

pando_plan_upgrade

Whether Pando can upgrade itself in place to a version, and if not, every reason with what to change; which versions in between may break something, with their upgrade notes. Starting an upgrade is not offered here: it takes a backup passphrase, and agents do not hold install.upgrade by default.

pando_poll_source_authorization

Ask once whether the person approved a device authorization started with pando_authorize_source: status pending (slow_down asks for slower polling) or authorized.

pando_read_audit_stream

Read the audit log in commit order, oldest first, one page at a time. Returns events, cursor and caught_up. Pass the cursor back as after to read on from where this page ended; keep it to ask later what has happened since. Without after it starts at the oldest event in the live log; after: "now" starts after the newest. caught_up says there is nothing past the cursor yet. Delivery is at least once: an event can come back again, and its id is the key to drop it by. Needs install.audit.read.

pando_redeliver

Send a delivery again now, with the whole retry schedule ahead of it.

pando_reject_deploy

Reject a deploy that is waiting for approval. One rejection ends the request, and the deploy does not run. Approval is a person's sign-off, so by default an installation does not let an agent's token reject either.

pando_remove_app_from_section

Move an app out of one of your launcher sections, back to Your apps.

pando_remove_host

Remove a host from the cluster. The installation's first host and the host serving the request cannot be removed. For a host that held the control role, the answer's notice and rotate name the keys to replace. Needs install.cluster.manage.

pando_remove_registry_credential

Remove an image app's registry credential, so its image is pulled anonymously.

pando_remove_webhook_route

Remove a webhook route. Its secret goes at once, so deliveries are refused from now on, and the route leaves the configuration at the app's next deploy.

pando_rename_app

Change an app's display name. Its ID and address do not change.

pando_rename_group

Rename a group made in Pando. A group synced from an identity provider is renamed there. Needs install.users.manage.

pando_rename_section

Rename one of your launcher sections.

pando_rerun_detection

Work out again how to run an app, from its source as it is now: after pando_upload_source, after the repository changed, or after setting a registry credential for a private image. Nothing changes until the new proposal is accepted. Then call pando_get_detection with wait_seconds.

pando_reset_user_two_factor

Remove another local account's two-factor authentication — its authenticator and recovery codes — for someone who has lost both, and sign it out everywhere. They then sign in with their password alone, and set it up again if host policy requires it. Needs install.users.manage and every installation permission that account holds.

pando_restart_app

Restart an app's workloads in place. Nothing is rebuilt and nothing is re-read — the same version, started again.

pando_restore_notice

Show one of an app's notices you ignored again.

pando_revise_detection

Tell the install's AI adapter what is wrong with the plan from pando_get_detection, in plain words, e.g. "The app serves on port 8080." It checks the repository, changes what it can show, and replies; the reply, what it changed and what Pando refused are the last entry of detection.conversation. Needs an AI adapter.

pando_revoke_join_token

Revoke a join token, so no host can join with it. Needs install.cluster.manage.

pando_set_address

Change where a configured app is reached. Everything left out keeps what the app has, or takes the adapter's default when moving to another adapter. To put the app in another of the adapter's domains (from pando_get_address), give domain: alone it makes <slug>.<domain>, and with a hostname that is a single name such as docs it makes docs.<domain>. This writes a spec revision and does not deploy; the next deploy moves the app, and the old address stops working then. Without confirm: true it changes nothing and the error says what would move where — tell the person before confirming. A mode the adapter does not default to needs app.routing.override.

pando_set_app_icon

Set the image shown on an app's launcher tile. The image is a PNG, JPEG, WebP or GIF file of at most 256 KB, base64-encoded. SVG is not accepted.

pando_set_app_idle

Set when Pando stops and deletes an app nobody uses. Both are replaced, so pass what pando_get_app_idle returned for the one you are not changing. Each is a number of days, "never", or "default" for the installation's setting. Both count from the last use, so deleting has to come later than stopping. App settings, not spec: nothing is deployed.

pando_set_app_limit

Set how many apps an account, or each person in a group, may own. A number, 0 for unlimited, or "clear" to remove it. An account's own value applies whatever its groups say; otherwise the most generous group's, then host policy's max_apps_per_user. Lowering it removes nothing. Needs install.users.manage, which host policy keeps from agents unless an administrator allows it.

pando_set_auto_deploy

Turn automatic deploys on or off for an app, and choose what deploys: each new commit on a branch (trigger branch_updated, the default; branch empty follows the branch the app was deployed from), or each new release tag (trigger release_tagged; a release is a tag such as v1.2.3, or one matching tag_pattern, such as release-*). Saved as a new configuration that takes effect at the app's next deploy. Refused while the app's deploys need approval.

pando_set_notification_preference

Turn one of Pando's notifications on or off for you on one channel. kind and channel are as pando_get_notification_preferences lists them.

pando_set_registry_credential

Set the credential an image app's private image is pulled with, replacing any it had. It belongs to the app and is never given to it. Pando never shows it again; pando_get_registry_credential says only which kind is set.

pando_set_secret

Set or rotate one of an app's secrets. Needs app.secrets.write. The app gets it only through a secret_ref in its spec: when the reply's read_by_spec is false, add {"key": ..., "secret_ref": ...} to a workload's env with pando_create_spec. Deploying after rotating one the app reads recreates its workload with the new value.

pando_set_webhook_route_secret

Replace a webhook route's secret. The old one stops working at once. Without secret, one is generated and returned this once.

pando_start_app

Start an app that was stopped, bringing back the version that was running.

pando_stop_app

Stop an app without deleting it. Its storage, configuration and address are kept, and it stays stopped until something starts it again.

pando_test_subscription

Send a test event to one subscription, whatever its filter says, to check its endpoint. Returns the delivery; read it with pando_get_delivery.

pando_unassign_ai_function

Turn an AI function off by removing the adapter that handles it.

pando_unfavorite_app

Unpin an app from your launcher.

pando_update_subscription

Change a subscription's events, url, adapter_id, channel or description, or turn it on or off with enabled (true or false).

pando_upload_source

Send an app's files as its source: a gzipped tar of the app's directory, base64-encoded, at most 256 MB compressed. Paths in the archive are relative to the app's root; leave out .git, node_modules and build output. A single index.html is enough for a static site. Replaces any files sent before. Then call pando_rerun_detection so Pando works out how to run them.