# Access reviews MCP tools

This page documents **21 tools** in the access reviews group. Return to the [complete MCP tool reference](/docs/developers/api/mcp/tools) to browse another group.

Select a tool to inspect its schemas and behavior. Schema links open the exact definition in GitHub.

### `listAccessReviewCampaigns` — List Access Review Campaigns

List access review campaigns for an organization.

- **Input:** [`ListAccessReviewCampaignsInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9679-L9695)
- **Output:** [`ListAccessReviewCampaignsOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9697-L9708)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17683–L17694 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17683-L17694)

### `listAccessEntries` — List Access Entries

List access entries for a campaign with optional filters (decision, flag, is_admin, active, auth_method, account_type).

- **Input:** [`ListAccessEntriesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9710-L9748)
- **Output:** [`ListAccessEntriesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9750-L9761)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17695–L17706 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17695-L17706)

### `getAccessReviewStatistics` — Get Access Review Statistics

Get statistics for an access review campaign including counts by decision and flag.

- **Input:** [`GetAccessReviewStatisticsInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9763-L9770)
- **Output:** [`GetAccessReviewStatisticsOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9772-L9778)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17707–L17718 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17707-L17718)

### `recordAccessReviewEntryDecision` — Record Access Review Entry Decision

Record a decision on an access entry (APPROVED, REVOKE, DEFER, or ESCALATE). Non-APPROVED decisions require a decision_note.

- **Input:** [`RecordAccessReviewEntryDecisionMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9780-L9794)
- **Output:** [`RecordAccessReviewEntryDecisionMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9796-L9802)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17719–L17730 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17719-L17730)

### `recordAccessReviewEntryDecisions` — Record Access Review Entry Decisions

Record decisions on multiple access entries in a single batch. Non-APPROVED decisions require a decision_note.

- **Input:** [`RecordAccessReviewEntryDecisionsMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9804-L9825)
- **Output:** [`RecordAccessReviewEntryDecisionsMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9827-L9835)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17731–L17742 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17731-L17742)

### `flagAccessReviewEntry` — Flag Access Review Entry

Flag an access entry with one or more flags during review (ORPHANED, INACTIVE, EXCESSIVE, ROLE_MISMATCH, NEW, etc.). Optionally provide reasons.

- **Input:** [`FlagAccessReviewEntryMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9837-L9855)
- **Output:** [`FlagAccessReviewEntryMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9857-L9863)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17743–L17754 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17743-L17754)

### `closeAccessReviewCampaign` — Close Access Review Campaign

Close an access review campaign. All entries must have been decided (no PENDING entries).

- **Input:** [`CloseAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9865-L9872)
- **Output:** [`CloseAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9874-L9880)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17755–L17766 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17755-L17766)

### `listAccessReviewSources` — List Access Review Sources

List access sources for an organization.

- **Input:** [`ListAccessReviewSourcesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9938-L9954)
- **Output:** [`ListAccessReviewSourcesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9956-L9967)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17767–L17778 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17767-L17778)

### `createAccessReviewSource` — Create Access Review Source

Create a new access source for an organization.

- **Input:** [`CreateAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9969-L9986)
- **Output:** [`CreateAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9988-L10001)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17779–L17790 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17779-L17790)

### `updateAccessReviewSource` — Update Access Review Source

Update an existing access source.

- **Input:** [`UpdateAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10003-L10025)
- **Output:** [`UpdateAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10027-L10033)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17791–L17802 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17791-L17802)

### `deleteAccessReviewSource` — Delete Access Review Source

Delete an access source.

- **Input:** [`DeleteAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10035-L10042)
- **Output:** [`DeleteAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10044-L10051)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17803–L17814 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17803-L17814)

### `awsConnectorSetup` — AWS Connector Setup

Return issuer, subject, audience and deploy artifacts for connecting an AWS account.

- **Input:** [`AWSConnectorSetupMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10123-L10130)
- **Output:** [`AWSConnectorSetupMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10132-L10138)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17815–L17826 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17815-L17826)

### `gcpConnectorSetup` — GCP Connector Setup

Return issuer, subject, audience template and deploy artifacts for connecting a GCP project.

- **Input:** [`GCPConnectorSetupMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10165-L10172)
- **Output:** [`GCPConnectorSetupMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10174-L10180)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17827–L17838 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17827-L17838)

### `createWorkloadIdentityConnector` — Create Workload Identity Connector

Create a workload-identity connector (AWS or GCP) and report whether the audit identity can be assumed.

- **Input:** [`CreateWorkloadIdentityConnectorMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10190-L10228)
- **Output:** [`CreateWorkloadIdentityConnectorMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10230-L10236)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Open world
- **Source:** [specification.yaml · L17839–L17850 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17839-L17850)

### `createAccessReviewCampaign` — Create Access Review Campaign

Create a new access review campaign for an organization.

- **Input:** [`CreateAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10238-L10257)
- **Output:** [`CreateAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10259-L10265)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17851–L17862 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17851-L17862)

### `updateAccessReviewCampaign` — Update Access Review Campaign

Update an existing access review campaign.

- **Input:** [`UpdateAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10267-L10280)
- **Output:** [`UpdateAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10281-L10287)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17863–L17874 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17863-L17874)

### `deleteAccessReviewCampaign` — Delete Access Review Campaign

Delete an access review campaign.

- **Input:** [`DeleteAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10289-L10296)
- **Output:** [`DeleteAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10298-L10305)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17875–L17886 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17875-L17886)

### `startAccessReviewCampaign` — Start Access Review Campaign

Start an access review campaign. Triggers data fetching from all configured scope sources.

- **Input:** [`StartAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10307-L10314)
- **Output:** [`StartAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10316-L10322)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17887–L17898 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17887-L17898)

### `cancelAccessReviewCampaign` — Cancel Access Review Campaign

Cancel an in-progress access review campaign.

- **Input:** [`CancelAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10324-L10331)
- **Output:** [`CancelAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10333-L10339)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17899–L17910 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17899-L17910)

### `addAccessReviewCampaignSource` — Add Access Review Campaign Source

Add an access source to an access review campaign's scope.

- **Input:** [`AddAccessReviewCampaignSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10341-L10352)
- **Output:** [`AddAccessReviewCampaignSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10354-L10360)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17911–L17922 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17911-L17922)

### `removeAccessReviewCampaignSource` — Remove Access Review Campaign Source

Remove an access source from an access review campaign's scope.

- **Input:** [`RemoveAccessReviewCampaignSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10362-L10373)
- **Output:** [`RemoveAccessReviewCampaignSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10375-L10381)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17923–L17934 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17923-L17934)