MCP serverorg.brainkb/brainkb

(Admin) Activate a user's account (sets the JWT user active) by email.

(Space manager) Restrict a space action to a subject. action: 'read' | 'write' | 'manage'. subject_type: 'global_role' (e.g. 'Admin','Lab Member') | 'member' (an email) |

Register a named graph and bind it to a space, so ingest/read on that graph are governed by the space's membership and visibility. Owner/editor only. The named_graph_iri is

Add/update a space member. role: 'owner' | 'editor' | 'viewer'. Owner only.

(Admin) Assign a role/group to a user by email (e.g. 'Lab Member', 'External', or a custom group). The user must already have a profile (created on first login/registration

(Admin) List the available roles/groups (Admin, Lab Member, Curator, …).

(Admin) Ban a user by email (reversible; preserves history). This is how accounts are removed — there is NO hard delete. Banning an Admin is SuperAdmin-only; SuperAdmin acc

(Admin only) Show a user's roles, effective capabilities, and delegated grants. Useful to check why someone can/can't create team spaces, ingest, etc.

(Admin) Create a new usermanagement permission, e.g. name='dataset.export', resource='dataset', action='export'. Attach it to roles via the usermanagement role-permissions

(Admin) Create a new role/group — e.g. an 'External' collaborator group — which can then be assigned with brainkb_assign_role.

Create a workspace/space. The caller becomes owner. slug: lowercase/hyphen id, **globally unique** — if it's already taken the call returns 409 (pick another slug; slugs ar

Generate a Personal Access Token (PAT) for browser-free auth. Requires you to be logged in already (brainkb_login or brainkb_globus_login). The token is shown ONCE and neve

(Admin) Deactivate a user's account by email.

The exact triples a job added (its delta), as JSON-LD.

Compare two jobs' deltas: A-only / B-only / shared triple counts + triples.

A named graph's change history: one entry per ingest delta (job, triple count, timestamp), newest first.

Delete one of your staged uploads without ingesting it.

Complete an OAuth login started with brainkb_globus_login by exchanging the one-time code shown in the browser for a session token. The code is single-use and never echoed

Start an OAuth login (Globus / ORCID / GitHub) for THIS session — use this instead of brainkb_login when the user signs in with Globus rather than a password. Returns a URL

(Admin only) Delegate a capability to a user — e.g. 'create_team_space' or 'manage_team_space' so a Curator/Lab Member can create/manage team spaces. Grantable: create_priv

(Admin only) Grant a capability to a whole role/group so EVERY member gets it — e.g. give a custom group 'uk_collaborator' the 'ingest' or 'create_private_space' capability

Ingest local RDF files (ttl/nt/nq/rdf/owl/jsonld/json) into a named graph. Returns a job_id; runs in the background — poll with brainkb_job_status.

Ingest raw RDF text (Turtle / N-Triples / JSON-LD, auto-detected) into a named graph. Returns a job_id; ingestion runs in the background — poll with brainkb_job_status. The

Ingest a file you staged with `POST /upload` into a named graph. This is the route for a large local file: your HTTP client streams the bytes straight to this server over

Detailed status of one ingest job: status, progress %, current file/stage, per-file failures, and (when complete) a summary.

List a space's fine-grained access rules (member/manager of the space).

(Admin only) Catalog of all KG capabilities, which are delegatable ('grantable'), which are admin-only, and a description of each. Use this to see the available permission

List the user's ingest jobs (newest first) with status and progress.

(Admin) List all usermanagement permissions (resource/action pairs used for page-access and role-permission mapping). These are the addable 'permission' options; KG action-

List registered named graphs visible to the caller (private-space graphs the caller can't access are hidden).

List spaces the user can see (their own/member spaces + public ones), each annotated with THIS caller's permission so you know what they may do: - your_role: 'owner' | 'e

List your Personal Access Tokens (metadata only — the secret is never shown): id, name, prefix, created/last-used/expiry, and whether each is active/revoked/expired. Use th

List RDF files YOU have staged with POST /upload but not yet ingested. Shows each upload_id, its size, sha256 and when it expires. Only your own uploads are visible.

(Admin) List users (profiles) — filter by `q` (name/email/orcid) or `role`. Shows profile_id, email, roles, providers, ban status.

Authenticate to BrainKB with the user's credentials and cache the JWT for THIS session only (isolated per caller). The password/token are never echoed. Uses single sign-on

Forget the cached token for this session.

PROV-O ingestion/activity history (JSON-LD) for a named graph.

PROV-O provenance bundle (JSON-LD) for one ingest job.

Find a canned question BrainKB can answer, then run it with brainkb_qa_run. Prefer these over writing SPARQL: they are vetted against BrainKB's actual vocabulary. Discover

Run a canned question from brainkb_qa_list by id. `params` maps parameter names to values; they are validated and escaped, never spliced in raw. Runs through the same SPARQ

Read all RDF (JSON-LD) in a space's graphs. Public spaces are readable by anyone; private spaces require membership.

Attempt to recover a stuck/errored ingest job (marks it recoverable/errored).

(Space manager) Delete a fine-grained access rule by its id (see brainkb_list_access_rules).

(Admin) Remove a role/group from a user by email.

(Admin only) Revoke a previously granted capability from a user.

(Admin only) Revoke a capability from a role/group.

Revoke one of your Personal Access Tokens by id (see brainkb_list_tokens). Takes effect immediately — the next call using that token fails.

(Admin only) List the capabilities granted to a role/group (e.g. 'uk_collaborator', 'Lab Member').

Full-text search over the knowledge graphs, access-filtered by space visibility. Pass `space` to scope to one workspace, omit for a full search. Anonymous/other users never

Set a space 'public' (anyone, even anonymous, can read) or 'private' (members only). Owner only.

Run an arbitrary SPARQL query. Requires an Admin/SuperAdmin role (the sparql_admin capability) — for ordinary questions prefer brainkb_search, brainkb_read_space, or the pr

(Admin) Lift a ban on a user by email.

State of one of your staged/submitted uploads. `state` is `staged` (waiting for brainkb_ingest_upload), `submitting` (the server is streaming it to the ingest API), `submi

Use a Personal Access Token (brainkb_pat_...) for THIS session — an alternative to setting BRAINKB_TOKEN in the config. Validates the token, then caches it so subsequent ca

Report the current caller's auth state (email, authenticated, and when the cached session expires). When signed in it also returns base_url — the backend THIS SERVER talks