MCP capabilities and limits

Weave MCP lets an Agent work inside an explicitly granted knowledge-base boundary. It does not expose the whole disk.

Current tools

Tool	Purpose	Permission and confirmation
zhixi_list_knowledge_bases	List knowledge bases granted to this client	Read-only pairing
zhixi_search_documents	Search one granted knowledge base, up to 10 results	Read-only pairing
zhixi_read_document_excerpt	Read up to 1,200 characters from a current search citation	Read-only pairing
zhixi_list_project_items	List non-archived project items	Read-only pairing
zhixi_create_project_observation	Create an evidence-backed proposed project observation	project_manage
zhixi_create_ai_derived_record	Create a traceable AI-derived record	derived_write
zhixi_request_operation_confirmation	Submit a note, annotation batch, or file-operation plan	Matching write grant; never executes the plan
zhixi_execute_approved_note_operation	Create or update an approved note	One-time confirmation token
zhixi_execute_approved_annotation_batch	Atomically create 1–100 highlights or notes	One-time token; any invalid item rolls back the batch
zhixi_execute_approved_directory_creation	Create an approved directory	One-time confirmation token
zhixi_execute_approved_file_trash	Move files to Weave’s recoverable private trash	One-time confirmation token
zhixi_execute_approved_file_restore	Restore files from private trash	One-time confirmation token

Agents should obtain exact input schemas dynamically through tools/list. This documentation intentionally does not duplicate schemas that could become stale.

Operations that are not available

• Reading arbitrary local paths;
• Enumerating an ungranted knowledge base;
• Permanently deleting files;
• Directly accepting or overwriting existing project facts;
• Bypassing Desktop approval for a high-impact write;
• Calling tools while Weave is not running.

Rename and move plans can currently be submitted, but no execution tool is exposed. An Agent must not claim those operations were completed.