MCP or CLI is not working

Start outside the AI client so authentication and project failures are visible directly:

anectico whoami
anectico projects list
anectico doctor

For API-key use, confirm ANECTICO_API_KEY is available to the process that launches the CLI or MCP client—not only to your interactive shell.

In the Console, open Agents and keys (/agents) to check the other side. An agent approval shows its status (Active, Pending or Revoked), and an API key shows its expiry and last use. Home (/) shows Connect your agent with the commands that connect a new agent. See The Console.

The MCP client cannot connect

Confirm the remote URL and bearer key match Connect an MCP client. Restart the client after changing its configuration. Reads need mcp:read and the relevant domain read scopes; writes additionally need mcp:write and the action's domain scopes.

A successful connection does not mean the key can read a domain. mcp:read alone is not a useful investigation grant. If no tools appear, check the key's explicit scopes and the URL's profile filter, then refresh discovery for that connection. Also inspect the client's MCP logs for an authentication response and verify it supports remote HTTP MCP. Do not paste the key into chat.

Documentation tools are missing or unauthorized

Documentation reads need both mcp:read and docs:read. All organization roles include docs:read, but a minted API key carries only its explicit scopes. The investigate and incident bundles include it; custom keys and the agent-observability or admin bundles may not. Mint a replacement with --scope docs:read if needed, then reconnect with that key.

Also inspect the MCP URL: ?profile=agent-observability excludes documentation regardless of key scopes. Remove that filter or choose a docs-capable profile. A search source marked unauthorized means a missing scope; out_of_profile means the connection filter excluded it.

search_docs and get_doc are read actions, not standalone entries in the tool list. Discover them with list_read_actions and {"domain":"docs"} to obtain their argument schemas; an unfiltered call only returns an index. Then invoke execute_read_action with the action name and an arguments object matching its schema. Pass a search hit's slug to get_doc, or its ref to fetch; the two identifiers are not interchangeable. Public Markdown documentation needs no credential.

A CLI command returns the wrong project or no rows

anectico projects use my-app
anectico persons search test-user

Check environment and time filters next. Piped CLI output is JSON; interactive output is formatted, so a parser should consume the piped form rather than scraping terminal tables.

A write is missing or refused

Destructive CLI commands require --yes. MCP clients may also require an interactive confirmation. If a tool is absent, check both scopes and the URL profile: ?profile=investigate hides all mutations even for a write-capable key. For a confirmation-required action, Anectico previews the change on the first call; the second call must include the returned confirm_token and the same previewed arguments. That two-call protocol is separate from any human approval your host asks for. See the security model for token expiry, retries, and idempotency. Regenerate a purpose-specific key when scopes are insufficient instead of broadening a shared key.

Use anectico docs --markdown to confirm the installed CLI's exact command and flag surface. Upgrade or pin the CLI if an automation was written for a different early-access version.

• Use the Anectico CLI
• Permissions and safe actions

If a refresh credential is reused, the affected connection is revoked and its tokens stop working. Reconnect and approve access again. Concurrent uses of one refresh credential also trigger this protection; clients should serialize refresh requests. Another approval for the same client may also require reconnection after replay.

Signing out of the Console also clears your sign-in session. Opening a sign-out link manually asks you to confirm; simply navigating to that page does not sign you out.