Tool Reference

The DataGrail MCP server exposes a set of tools that your AI client can invoke on your behalf. Each tool maps to a specific privacy operations capability within DataGrail, and all tool calls are scoped to your organization and user permissions.

Below is a comprehensive reference for every tool available through the MCP server, grouped by product area: Request Manager, Opt-Out Management, Integrations, Risk & Compliance, Consent Management, Data Broker Compliance, Support, Privacy Outcomes, Documentation, and Feedback. Each tool is classified as either Read-only (retrieves data without side effects) or Write (creates or modifies data).

Tool Authorization

During the OAuth authorization flow, you choose which tools to grant access to. You do not need to authorize all tools at once — you can always re-authorize later to add more.

Write Tool Access

Write Tools require your organization's administrator to enable write tools in Settings > MCP Tool Access, and to explicitly grant you access to each write tool. See Controlling Tool Access for details.

Request Manager

Tools for searching and inspecting privacy request tickets (DSARs, access, deletion, and opt-out requests).

search_tickets

Search privacy request tickets with flexible filters and aggregation modes.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`ticket_uuid`	string	No	Get full details for a specific ticket by UUID. When provided, all other filters are ignored.
`start_date`	string (date)	No	Start of search window (ISO date, e.g. "2024-01-01"). Defaults to 90 days ago.
`end_date`	string (date)	No	End of search window (ISO date). Defaults to today. Max window is 365 days.
`email`	string	No	Filter by requester email address (case-insensitive partial match).
`notes`	string	No	Search within ticket notes/comments (case-insensitive partial match).
`status`	string	No	Filter by workflow status. Values include: "Active", "Closed", "Pending Action", "Complete", and others.
`kind`	string	No	Filter by request type: "Access", "Deletion", "Opt Out", "Rectification", "Data Portability", "Object to Processing", and others.
`deadline_status`	string	No	Filter by deadline urgency: "past_due", "due_soon", or "on_time".
`assignee`	string	No	Filter by assignment: "assigned_to_me" or "unassigned".
`policy_type`	string	No	Filter by privacy regulation (e.g. "GDPR", "CPRA", "LGPD").
`has_duplicates`	boolean	No	Filter to tickets with duplicate email addresses.
`integration_state`	string	No	Filter by integration state: "processing", "completed", or "failed".
`via`	string	No	Filter by submission channel: "Phone", "Email", "Intake Request Form", "API", "Request Manager", "Internal Form".
`entered_status`	string	No	Find tickets that transitioned into a specific status historically. Requires `entered_status_start_date`.
`entered_status_start_date`	string (date)	No	Start of date range for `entered_status` filter.
`entered_status_end_date`	string (date)	No	End of date range for `entered_status` filter. Defaults to today.
`aggregation_mode`	string	No	Get aggregate counts instead of ticket list: "count", "group_by_status", "group_by_kind", "group_by_policy", "group_by_deadline", "group_by_via", "group_by_submitted_by", "group_by_country", "group_by_region", "group_by_day", "group_by_week", "group_by_month".
`limit`	integer	No	Maximum results to return (default: 25, max: 100).

Example response:

{
  "results": [
    {
      "uuid": "ticket-uuid-123",
      "email": "jane@example.com",
      "kind": "deletion",
      "workflow_state": "pending_legal",
      "due_date": "2025-04-15",
      "created_at": "2025-03-01T12:00:00Z",
      "via": "Intake Request Form"
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

get_ticket_activity_log

Retrieve the chronological activity log for a specific privacy request ticket, including state changes, emails sent, and manual actions.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`ticket_uuid`	string	Yes	The UUID of the ticket to get the activity log for.
`limit`	integer	No	Maximum number of activity log entries to return (default: 50, max: 200).

Example response:

{
  "ticket_uuid": "ticket-uuid-123",
  "activity_log": [
    {
      "timestamp": "2025-03-01T14:30:00Z",
      "actor": "admin@acme.com",
      "event": "workflow_state_change",
      "details": { "from": "pending_confirmation", "to": "pending_legal" }
    }
  ],
  "count": 1
}

get_request_policies

Retrieve the list of privacy request policies configured for your organization, including legal frameworks, verification methods, and supported privacy rights.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`include_archived`	boolean	No	Include archived/inactive policies in results (default: false).

Example response:

{
  "policies": [
    {
      "id": 1,
      "internal_name": "CPRA",
      "external_name": "CPRA",
      "status": "active",
      "default_policy": true,
      "verification_method": "email",
      "request_duration_days": 45,
      "privacy_rights": ["Access", "Deletion", "Opt Out"],
      "locations": [{ "code": "US-CA", "name": "California" }]
    }
  ],
  "count": 1,
  "disclaimer": "This information is provided for informational purposes only..."
}

get_privacy_request_center

Retrieve your organization's Privacy Request Center configuration, including its domain, multibrand setup, and optionally its published intake form revisions and questions.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`include_revisions`	boolean	No	Include published intake form revisions (default: true).
`include_form_questions`	boolean	No	Include the questions on each revision's intake form (default: false).

Example response:

{
  "privacy_domain": "privacy.acme.com",
  "alternate_privacy_domains": [],
  "multibrand": {
    "enabled": false
  },
  "revisions": [
    { "id": "rev-1", "published_at": "2026-01-01T00:00:00Z" }
  ],
  "count": 1
}

Opt-Out Management

Tools for managing Do Not Sell / Do Not Share opt-out requests.

search_opt_outs

Search opt-out requests with flexible filters and aggregation modes.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`opt_out_uuid`	string	No	Get full details for a specific opt-out by UUID. When provided, all other filters are ignored.
`start_date`	string (date)	No	Start of search window (ISO date). Defaults to 90 days ago.
`end_date`	string (date)	No	End of search window (ISO date). Defaults to today. Max window is 365 days.
`email`	string	No	Filter by requester email (case-insensitive partial match).
`name`	string	No	Filter by requester name (case-insensitive partial match).
`additional_info`	string	No	Search within opt-out notes (case-insensitive partial match).
`status`	string	No	Filter by status: "Active", "Not Started", "In Progress", "Complete", "Canceled".
`deadline_status`	string	No	Filter by deadline urgency: "past_due", "due_soon", "on_time".
`policy_type`	string	No	Filter by privacy regulation (e.g. "CCPA", "CPRA").
`verification_state`	string	No	Filter by verification status: "verified" or "unverified".
`request_source`	string	No	Filter by submission source: "application", "intake_form", "api".
`has_duplicates`	boolean	No	Filter to opt-outs with duplicate emails.
`integration_state`	string	No	Filter by integration state: "processing", "completed", "failed".
`location`	string	No	Filter by location using ISO codes (e.g. "US-CA" for California, "US" for all US).
`has_been_extended`	boolean	No	Filter by whether the deadline has been extended.
`submitted_by_agent`	boolean	No	Filter by whether submitted by an authorized agent.
`aggregation_mode`	string	No	Aggregate mode: "count", "group_by_status", "group_by_policy", "group_by_deadline", "group_by_verification", "group_by_source", "group_by_day", "group_by_week", "group_by_month".
`limit`	integer	No	Maximum results to return (default: 25, max: 100).

Example response:

{
  "results": [
    {
      "uuid": "optout-uuid-456",
      "email": "user@example.com",
      "status": "in_progress",
      "due_date": "2025-04-01",
      "location": "US-CA",
      "request_source": "Intake Form",
      "policy": "CPRA"
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

Integrations

Tools for exploring available integrations, checking connection health, and reviewing configured connections.

fetch_available_integrations

Browse the catalog of all available DataGrail integrations, search by name, or find integrations that have been discovered but not yet connected.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`search_query`	string	No	Search for a specific integration by name (e.g. "salesforce", "google apps"). Returns all if omitted.
`only_discovered`	boolean	No	Return only integrations discovered but not yet connected (default: false). Useful for "What should I connect next?" queries.

Example response:

{
  "integrations": [
    {
      "id": 42,
      "display_name": "Salesforce",
      "service_name": "salesforce",
      "integration_method": "api",
      "capabilities": ["Access", "Deletion"]
    }
  ],
  "count": 1,
  "filters_applied": {
    "search_query": "salesforce",
    "only_discovered": false
  }
}

fetch_integration_errors

Retrieve integration errors grouped by integration and error type, with sample error details for troubleshooting.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`days`	integer	No	Number of days to look back for errors (default: 30, max: 90).

Example response:

{
  "error_groups": [
    {
      "integration": {
        "name": "salesforce-prod",
        "display_name": "Salesforce"
      },
      "error_type": "Authentication Error",
      "count": 5,
      "first_seen": "2025-02-15T10:00:00Z",
      "last_seen": "2025-03-01T08:30:00Z",
      "sample_errors": [
        {
          "timestamp": "2025-03-01T08:30:00Z",
          "status_code": 401,
          "error_message": "Invalid credentials",
          "ticket_uuid": "ticket-uuid-789"
        }
      ]
    }
  ]
}

fetch_my_integrations

Retrieve your organization's configured (connected) integrations with connection status, capabilities, and integration type details.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`search_query`	string	No	Search by integration name or display name (partial match).
`connection_status`	string	No	Filter by status: "connected", "disconnected", "pending".
`integration_type`	string	No	Filter by method: "api", "direct_contact", "none".
`capability`	string	No	Filter by enabled capability (e.g. "Access", "Deletion", "Data Discovery").
`connected_since`	string (date)	No	Only return integrations connected on or after this date (ISO date).
`sort_by`	string	No	Sort results by "name", "created_at", or "last_good" (default: "name").
`aggregation_mode`	string	No	Aggregate mode: "none", "count", "group_by_status", "group_by_kind", "group_by_integration_type", "group_by_capability" (default: "none").

Example response:

{
  "integrations": [
    {
      "uuid": "auth-uuid-001",
      "url": "https://acme.datagrail.io/integrations/salesforce/auth-uuid-001",
      "name": "Salesforce Prod",
      "integration_name": "Salesforce",
      "service_name": "salesforce",
      "integration_type": "api",
      "is_connected": true,
      "connection_state": "connected",
      "last_good": "2026-08-01T10:00:00Z",
      "enabled_capabilities": ["Access", "Deletion"],
      "available_capabilities": ["Access", "Deletion", "Data Discovery"],
      "available_to_enable": ["Data Discovery"],
      "created_at": "2025-01-10T00:00:00Z",
      "updated_at": "2026-08-01T10:00:00Z"
    }
  ],
  "count": 1,
  "filters_applied": { "connection_status": "connected" }
}

fetch_privacy_request_integration_stats

Retrieve privacy request outcome counts and trends for one or more integrations, with optional direct-contact response metrics.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`service_name`	string	No	Filter to a specific integration by service name (e.g. "salesforce").
`authentication_uuid`	string	No	Filter to a specific configured integration connection by UUID.
`phase`	string	No	Filter by request phase: "access", "deletion", "readiness_check", "identifier", "any" (default: "any").
`outcome_filter`	string	No	Filter by outcome: "succeeded", "failed", "cancelled", "ignored", "processing", "any" (default: "any").
`start_date`	string (date)	No	Start of the reporting window (ISO date). Defaults to 30 days ago.
`end_date`	string (date)	No	End of the reporting window (ISO date). Defaults to today. Max window is 365 days.
`aggregation_mode`	string	No	How to group results: "group_by_outcome", "group_by_service", "group_by_phase", "group_by_service_and_outcome", "group_by_service_and_phase", "group_by_day", "group_by_week", "group_by_month", "count" (default: "group_by_outcome").
`include_direct_contact_metrics`	boolean	No	Include direct-contact response metrics like emails sent and response rate (default: false; automatically enabled when the scope resolves to a single direct-contact integration).

Example response:

{
  "groups": {
    "succeeded": 142,
    "failed": 8,
    "cancelled": 2,
    "ignored": 0,
    "processing": 3
  },
  "total": 155,
  "filters_applied": {
    "time_range_start": "2026-07-22",
    "time_range_end": "2026-08-21",
    "service_name": "salesforce",
    "phase": "any",
    "outcome_filter": "any",
    "aggregation_mode": "group_by_outcome"
  }
}

Risk & Compliance

Tools for searching and managing the risk register, risk assessments, assessment templates, and system inventory.

search_risks

Search the risk register for identified risks and their mitigation status.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`overall_risk`	string	No	Filter by risk level: "very_low", "low", "medium", "high", "very_high".
`mitigation_status`	string	No	Filter by mitigation status: "not_started", "in_progress", "mitigated", "accepted".
`limit`	integer	No	Maximum results to return (default: 50, max: 100).

Example response:

{
  "results": [
    {
      "id": 10,
      "description": "Unencrypted PII stored in legacy system",
      "overall_risk": "high",
      "impact": "high",
      "likelihood": "medium",
      "mitigation_status": "in_progress",
      "owner_email": "privacy@acme.com",
      "due_date": "2025-06-30"
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

search_assessments

Search completed and in-progress risk assessments (PIAs, DPIAs, vendor reviews) with deadline tracking and contributor filtering.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`assessment_id`	string	No	Get full details for a specific assessment by UUID. When provided, all other filters are ignored.
`start_date`	string (date)	No	Start of search window (ISO date). Defaults to 90 days ago.
`end_date`	string (date)	No	End of search window (ISO date). Defaults to today. Max window is 365 days.
`status`	string	No	Filter by assessment status: "not_started", "in_progress", "pending_approval", "approved".
`deadline_status`	string	No	Filter by deadline urgency: "past_due", "due_soon", "on_time".
`assessment_name`	string	No	Filter by assessment name (partial match, case-insensitive).
`template_name`	string	No	Filter by assessment template name (partial match, case-insensitive).
`contributor_email`	string	No	Filter by contributor email (partial match, case-insensitive).
`contribution_status`	string	No	Filter by contribution status: "not_invited", "not_started", "in_progress", "removed", "complete".
`limit`	integer	No	Maximum results to return (default: 10, max: 100).

Example response:

{
  "results": [
    {
      "id": "assessment-uuid-001",
      "name": "Vendor Security Review - Acme Analytics",
      "status": "in_progress",
      "due_date": "2025-05-01",
      "assessment_template": { "name": "Vendor Assessment Template" },
      "assessment_contributors": [
        { "email": "reviewer@acme.com", "status": "in_progress" }
      ]
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

search_assessment_templates

Search risk assessment templates, including both prebuilt (DataGrail-provided) and custom templates.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`template_id`	string	No	Retrieve a single template by ID with full form details.
`template_name`	string	No	Filter by template name (partial match, case-insensitive).
`limit`	integer	No	Maximum results to return (default: 10, max: 100).

Example response:

{
  "results": [
    {
      "id": "template-uuid-001",
      "name": "Data Protection Impact Assessment (DPIA)",
      "product": "rimo",
      "created_at": "2024-06-01T00:00:00Z"
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

search_inventory

Search the system inventory (Live Data Map) for detected systems and data stores, with filters for risk indicators, assessment status, and processing activity associations.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`sensitive_personal_data`	string	No	Filter by SPI risk. Use "SPI" to find systems with sensitive personal information.
`ai_risks`	string	No	Filter by AI risk: "AI Risks" or "AI Detected".
`has_assessment`	string	No	Filter by assessment association: "yes" or "no".
`processing_activity`	string	No	Find inventory items that should belong to a given processing activity name.
`system_name`	string	No	Find suggested processing activities for a system (fuzzy name match).
`days`	integer	No	Filter by number of days since the inventory item was created.
`limit`	integer	No	Maximum results to return (default: 50, max: 100).

Example response:

{
  "results": [
    {
      "id": 101,
      "name": "Salesforce CRM",
      "description": "Customer relationship management platform",
      "via": "detected",
      "risk": { "spi": true, "ai_detected": false },
      "processing_activities": ["Customer Support", "Marketing"],
      "last_edited": "2025-02-28T10:00:00Z"
    }
  ],
  "count": 1,
  "total_matching": 1,
  "truncated": false
}

search_processing_activities

Search processing activities (Record of Processing Activities entries), get one full record by ID, or find activities a given system should be added to.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`processing_activity_id`	string	No	Get full details for a specific processing activity by ID. When provided, all other filters are ignored.
`suggested_for_system`	string	No	Find processing activities suggested for a given system (fuzzy name match).
`name`	string	No	Filter by activity name (partial match).
`legal_basis`	string	No	Filter by legal basis (partial match).
`country`	string	No	Filter by country (partial match).
`system`	string	No	Filter by an associated system's name (partial match).
`owner`	string	No	Filter by owner (partial match).
`stale`	boolean	No	Filter to activities flagged as stale.
`incomplete`	boolean	No	Filter to activities with incomplete details.
`limit`	integer	No	Maximum results to return (default: 25, max: 100).

Example response:

{
  "results": [
    {
      "id": "pa-1",
      "name": "Marketing Analytics",
      "created_at": "2025-11-01T00:00:00Z",
      "document_count": 2,
      "system_count": 3,
      "system_names": ["Salesforce", "Mixpanel", "Snowflake"],
      "data_categories": [{ "text": "Contact Information", "sensitivity": "low" }],
      "legal_basis": ["Consent"],
      "countries": ["United States"],
      "risks": [],
      "stale": false,
      "incomplete": false,
      "last_updated_at": "2026-07-20T00:00:00Z",
      "url": "https://acme.datagrail.io/live-data-map/processing-activities/pa-1"
    }
  ],
  "count": 1,
  "limit": 25,
  "truncated": false,
  "filters_applied": { "legal_basis": "Consent" }
}

get_entity_documents

Retrieve documents attached to a system or a processing activity.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`source_type`	string	Yes	Type of entity to get documents for: "InventoryItem" or "ProcessingActivity".
`source_id`	string	Yes	ID of the system or processing activity.

Example response:

{
  "source_type": "InventoryItem",
  "source_id": 101,
  "source_name": "Salesforce CRM",
  "document_count": 1,
  "documents": [
    { "document_id": 555, "filename": "salesforce_dpa.pdf", "dg_customer_id": 9 }
  ]
}

fetch_data_discovery_agents

Retrieve your organization's Data Discovery agents, including connection state and recent scan activity.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`agent_name`	string	No	Filter by agent name (partial match).
`connection_status`	string	No	Filter by connection status: "connected", "disconnected", "pending".

Example response:

{
  "agents": [
    {
      "uuid": "agent-uuid-1",
      "name": "Primary Discovery Agent",
      "version": "2.4.1",
      "connection_state": "connected",
      "last_good": "2026-08-20T09:00:00Z",
      "integration_count": 5,
      "active_scan_count": 1,
      "last_activity_at": "2026-08-21T02:00:00Z",
      "last_activity_by": "scheduled scan",
      "url": "https://acme.datagrail.io/agents/agent-uuid-1/configuration"
    }
  ],
  "count": 1,
  "filters_applied": { "connection_status": "connected" }
}

create_assessment

Create a new risk assessment from a template. Use search_assessment_templates first to find available templates and their IDs.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`name`	string	Yes	Name for the new assessment (3–100 characters).
`template_id`	string	Yes	UUID of the assessment template to use.
`due_date`	string (date)	No	Due date for the assessment (ISO date, e.g. "2026-06-30").
`systems`	array	No	Systems to associate with the assessment. Each entry needs a `display_name` and optionally a `system_id` or `inventory_item_id`.
`processing_activity_ids`	array	No	UUIDs of processing activities to associate with the assessment.

Example response:

{
  "id": "assess-uuid-002",
  "name": "DPIA - New Analytics Platform",
  "status": "not_started",
  "due_date": "2026-06-30",
  "template": { "name": "Data Protection Impact Assessment" },
  "message": "Assessment created successfully."
}

update_assessment

Update an assessment's name, due date, or status.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`assessment_id`	string	Yes	UUID of the assessment to update.
`name`	string	No	New name for the assessment (3–100 characters).
`due_date`	string (date) or null	No	New due date (ISO date). Pass null to clear the due date.
`status`	string	No	New status: "not_started", "in_progress", or "pending_approval".

Example response:

{
  "id": "assess-uuid-002",
  "name": "DPIA - New Analytics Platform",
  "status": "in_progress",
  "due_date": "2026-07-15",
  "url": "https://acme.datagrail.io/risk-assessments/assess-uuid-002",
  "message": "Assessment updated successfully."
}

answer_assessment_question

Answer a question in an assessment. Use search_assessments with an assessment_id first to see available questions and their types.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`assessment_id`	string	Yes	UUID of the assessment.
`question_key`	string	Yes	Question key in format "section_id.questions.question_id" (e.g., "s1.questions.q1").
`answer`	string or array	Yes	Answer value. For text/date questions: a string. For single-select (radio/dropdown): the option text as a string. For multi-select (checkbox/multi-dropdown): an array of option text strings.

Example response:

{
  "assessment_id": "assess-uuid-002",
  "question_key": "s1.questions.q1",
  "message": "Answer saved successfully."
}

add_system

Add a new system to the Live Data Map inventory.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`name`	string	Yes	Name of the system to add (e.g., "Salesforce", "Snowflake").
`description`	string	No	Description of the system and what data it processes.
`notes`	string	No	Additional notes about the system.

Example response:

{
  "id": 102,
  "name": "Snowflake",
  "system_name": "Snowflake",
  "url": "https://acme.datagrail.io/live-data-map/inventory/102/system-profile",
  "message": "System 'Snowflake' added to inventory."
}

update_system

Update a system's name, description, or notes in the Live Data Map inventory by ID. Supports partial updates — only the fields you provide are changed.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`inventory_item_id`	string	Yes	ID of the system to update.
`name`	string	No	New name for the system.
`description`	string	No	New description of the system and what data it processes. Pass an empty string to clear it.
`notes`	string	No	New notes about the system. Pass an empty string to clear them.

System Type Cannot Be Changed

System type cannot be changed through this tool.

Example response:

{
  "id": 101,
  "name": "Salesforce CRM",
  "description": "Customer relationship platform",
  "notes": null,
  "system_data_assessment_id": "sdr-uuid-1",
  "url": "https://acme.datagrail.io/live-data-map/inventory/101/system-profile",
  "message": "System 'Salesforce CRM' updated successfully."
}

associate_processing_activity

Associate one or more processing activities with an inventory item (system) in the Live Data Map. Use search_inventory to find inventory item IDs and processing activity IDs.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`inventory_item_id`	string	Yes	ID of the inventory item (system) to associate processing activities with.
`processing_activity_ids`	array	Yes	IDs of the processing activities to associate (1–20 IDs).

Example response:

{
  "inventory_item_id": "101",
  "inventory_item_name": "Salesforce CRM",
  "associated_activities": [
    { "id": "pa-1", "name": "Marketing Analytics" },
    { "id": "pa-2", "name": "Customer Support" }
  ],
  "url": "https://acme.datagrail.io/live-data-map/inventory/101/system-profile",
  "message": "Associated 2 processing activities with 'Salesforce CRM'."
}

disassociate_processing_activity

Remove one or more processing activities from a system's associations in the Live Data Map. Use search_inventory to find inventory item IDs and search_processing_activities to find processing activity IDs.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`inventory_item_id`	string	Yes	ID of the inventory item (system) to remove processing activities from.
`processing_activity_ids`	array	Yes	IDs of the processing activities to remove (1–20 IDs).

Example response:

{
  "inventory_item_id": "101",
  "inventory_item_name": "Salesforce CRM",
  "removed_activities": [
    { "id": "pa-2", "name": "Customer Support" }
  ],
  "url": "https://acme.datagrail.io/live-data-map/inventory/101/system-profile",
  "message": "Removed 1 processing activity from 'Salesforce CRM'."
}

Tools for managing consent banners, cookies, tags, and privacy policies related to consent.

Draft Changes Require Publishing

The write tools in this section (categorize_cookie, categorize_tag, create_cookie_rule, update_cookie_rule, delete_cookie_rule, and update_consent_tag) apply to your draft container or project version. Changes take effect for site visitors only after the draft is published.

fetch_cookies

Retrieve cookies in different states: unmanaged cookies awaiting categorization, suggested categorization rules, or existing cookie rules.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`state`	string	Yes	State of cookies to fetch: "unmanaged" (not yet categorized), "suggested" (matching house rules), or "rules" (existing customer rules).

Example response (unmanaged):

{
  "state": "unmanaged",
  "count": 3,
  "cookies": [
    {
      "cookie_name": "_ga",
      "url_domain": "example.com",
      "first_seen_at": "2025-01-15T00:00:00Z",
      "last_seen_at": "2025-03-01T00:00:00Z",
      "seen_count": 450
    }
  ]
}

fetch_tags

Retrieve tags (services) that need consent category assignment.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`state`	string	Yes	State of tags to fetch. Currently supports: "uncategorized" (tags without a consent category).

Example response:

{
  "state": "uncategorized",
  "count": 2,
  "tags": [
    {
      "id": 55,
      "name": "google-analytics",
      "display_name": "Google Analytics",
      "vendor": "Google",
      "status": "active",
      "description": "Web analytics service"
    }
  ]
}

get_banner_status

Get the status of consent banners, containers, and their configuration, including publish state, consent categories, and deployed domains.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`include_categories`	boolean	No	Include consent category details (default: true).
`include_domains`	boolean	No	Include domain information where consent is deployed (default: true).
`container_id`	integer	No	Get status for a specific container ID. Returns all containers if omitted.

Example response:

{
  "containers": [
    {
      "id": 1,
      "name": "Main Website",
      "type": "standalone",
      "managed": true,
      "versions": {
        "has_draft": true,
        "has_published": true,
        "last_published_at": "2025-02-20T16:00:00Z",
        "draft_updated_at": "2025-03-01T10:30:00Z"
      },
      "categories": {
        "total_categories": 4,
        "categories": [
          { "primitive": "essential", "always_on": true },
          { "primitive": "performance", "always_on": false },
          { "primitive": "functional", "always_on": false },
          { "primitive": "marketing", "always_on": false }
        ]
      },
      "domains": [
        { "domain_name": "www.example.com" }
      ]
    }
  ],
  "summary": {
    "total_containers": 1,
    "managed_containers": 1
  }
}

get_consent_updates

Retrieve consent update history and change timeline, including publish events, draft changes, and failed publish attempts.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`container_id`	integer	No	Get updates for a specific container. Returns all if omitted.
`limit`	integer	No	Maximum version updates per container (default: 10).
`include_draft_changes`	boolean	No	Include draft version changes (default: true).
`include_failed_publishes`	boolean	No	Include failed/cancelled publish attempts (default: true).
`days_back`	integer	No	Only show updates from the last N days.

Example response:

{
  "containers": [
    {
      "container_id": 1,
      "container_name": "Main Website",
      "last_published_at": "2025-02-20T16:00:00Z",
      "versions": [
        {
          "version_id": 12,
          "status": "published",
          "published_at": "2025-02-20T16:00:00Z",
          "version_number": 5
        }
      ]
    }
  ],
  "summary": {
    "total_containers": 1,
    "most_recent_publish": "2025-02-20T16:00:00Z"
  }
}

get_consent_privacy_policies

Retrieve consent privacy policies that define how consent banners behave for different privacy frameworks, including consent modes, GPC/DNT settings, and category configurations.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`status`	string	No	Filter by policy status: "draft" or "published" (default: "published").
`include_categories`	boolean	No	Include consent category details (default: false).

Example response:

{
  "policies": [
    {
      "id": 1,
      "name": "CPRA Consent Policy",
      "status": "published",
      "consent_banner_enabled": true,
      "consent_banner_mode": "opt_out",
      "consent_respect_gpc_enabled": true,
      "privacy_request_policy": {
        "external_name": "CPRA",
        "verification_method": "email",
        "request_duration_days": 45
      }
    }
  ],
  "count": 1,
  "disclaimer": "This information is provided for informational purposes only..."
}

categorize_cookie

Classify an unmanaged cookie by assigning it a consent category, vendor, description, and retention details.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`cookie_name`	string	Yes	Name of the cookie to categorize.
`vendor`	string	Yes	Vendor or service the cookie belongs to.
`description`	string	Yes	Description of what the cookie does.
`category`	string	Yes	Consent category: "Essential", "Performance", "Functional", or "Marketing".
`retention_period`	string	Yes	How long the cookie is retained (e.g. "2 years").
`rights_portal`	string or null	Yes	URL to the vendor's privacy rights portal, if any.
`wildcard_match`	boolean	Yes	Whether this categorization should apply to all cookies matching this name as a wildcard pattern.
`domain`	string	No	Domain the cookie is set on.
`platform`	string	No	Platform the cookie was observed on (e.g. "Web").
`risk_rating`	string	No	Risk rating: "low", "medium", or "high".
`risk_analysis`	string	No	Notes on why the cookie was assigned this risk rating.
`informational_reason`	string	No	Reason the cookie is informational rather than requiring consent, if applicable.

Example response:

{
  "cookie_name": "_ga",
  "vendor": "Google Analytics",
  "description": "Used to distinguish unique users for analytics.",
  "category": "Performance",
  "domain": "acme.com",
  "platform": "Web",
  "retention_period": "2 years",
  "rights_portal": null,
  "wildcard_match": false,
  "risk_rating": "low",
  "risk_analysis": "Standard analytics cookie, low litigation history.",
  "informational_reason": null
}

categorize_tag

Categorize a consent tag (tracker/service) on the draft container version.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`tag_id`	integer	Yes	ID of the tag to categorize.
`category`	string	No	Consent category: "Essential", "Performance", "Functional", or "Marketing".
`vendor`	string	No	Vendor the tag belongs to.
`description`	string	No	Description of what the tag does.
`user_defined_name`	string	No	Custom display name for the tag.
`rights_portal`	string	No	URL to the vendor's privacy rights portal.
`risk_rating`	string	No	Risk rating: "low", "medium", or "high".
`risk_analysis`	string	No	Notes on why the tag was assigned this risk rating.
`container_id`	integer	No	Container the tag belongs to, if not inferable from the tag.
`project_id`	integer	No	Project the tag belongs to, for multi-project accounts.

Example response:

{
  "id": 55,
  "name": "google-analytics",
  "display_name": "Google Analytics",
  "vendor": "Google",
  "description": "Web analytics service",
  "category": "Performance",
  "user_defined_name": null,
  "rights_portal": "https://policies.google.com/privacy",
  "risk_rating": "low",
  "risk_analysis": "Low risk, standard analytics vendor."
}

create_cookie_rule

Create a draft cookie categorization rule, optionally using a wildcard pattern to match multiple cookies.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`cookie_pattern`	string	Yes	Cookie name or wildcard pattern to match (e.g. "_ga*").
`category`	string	Yes	Consent category: "Essential", "Performance", "Functional", or "Marketing".
`description`	string	No	Description of what the matched cookies do.
`vendor`	string	No	Vendor the matched cookies belong to.
`retention`	integer	No	Retention period in days.
`rights_portal`	string	No	URL to the vendor's privacy rights portal.
`project_id`	integer	No	Project the rule belongs to, for multi-project accounts.

Example response:

{
  "id": 301,
  "rule": "_ga*",
  "display_rule": "_ga*",
  "description": "Google Analytics cookies",
  "vendor": "Google",
  "category": "Performance",
  "retention": 730,
  "rights_portal": null,
  "wildcard": true
}

update_cookie_rule

Update an existing draft cookie categorization rule.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`rule_id`	integer	Yes	ID of the cookie rule to update.
`cookie_pattern`	string	No	New cookie name or wildcard pattern.
`category`	string	No	New consent category: "Essential", "Performance", "Functional", or "Marketing".
`description`	string	No	New description.
`vendor`	string	No	New vendor.
`retention`	integer	No	New retention period in days.
`rights_portal`	string	No	New rights portal URL.
`project_id`	integer	No	Project the rule belongs to, for multi-project accounts.

Example response:

{
  "id": 301,
  "rule": "_ga*",
  "display_rule": "_ga*",
  "description": "Google Analytics cookies",
  "vendor": "Google",
  "category": "Performance",
  "retention": 730,
  "rights_portal": null,
  "wildcard": true
}

delete_cookie_rule

Delete a draft cookie categorization rule.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`rule_id`	integer	Yes	ID of the cookie rule to delete.
`project_id`	integer	No	Project the rule belongs to, for multi-project accounts.

Example response:

{
  "deleted": true,
  "rule": "_ga*"
}

update_consent_tag

Update the category, vendor, description, display name, or rights portal for a consent tag on the draft container version.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`tag_id`	integer	Yes	ID of the tag to update.
`category`	string	No	Consent category: "Essential", "Performance", "Functional", or "Marketing".
`vendor`	string	No	Vendor the tag belongs to.
`description`	string	No	Description of what the tag does.
`user_defined_name`	string	No	Custom display name for the tag.
`rights_portal`	string	No	URL to the vendor's privacy rights portal.
`container_id`	integer	No	Container the tag belongs to, if not inferable from the tag.
`project_id`	integer	No	Project the tag belongs to, for multi-project accounts.

Example response:

{
  "id": 55,
  "name": "google-analytics",
  "display_name": "GA4",
  "vendor": "Google",
  "description": "Updated description",
  "category": "Performance",
  "user_defined_name": "GA4",
  "rights_portal": "https://policies.google.com/privacy"
}

Data Broker Compliance

Tools for reviewing DROP (Data Broker Registry) compliance status, records, and audit history for your organization's broker registrations.

Informational, Not Legal Advice

Compliance status and deadlines returned by these tools are provided for informational purposes only and do not constitute legal advice.

list_broker_registrations

List your organization's DROP broker registrations.

Safety classification: Read-only

Parameters:

This tool takes no parameters.

Example response:

{
  "results": [
    {
      "id": "5",
      "broker_id": "CDB-00512",
      "legal_name": "Acme Data Brokers Inc.",
      "integration_kind": "api",
      "registration_state": "active",
      "test_mode": false,
      "created_at": "2025-09-01T00:00:00Z",
      "drop_connection": {
        "credential_state": "valid",
        "last_test_succeeded": true
      }
    }
  ],
  "count": 1
}

get_drop_status

Get the DROP compliance posture for a single broker registration, including deadline, lifecycle counts, and backlog.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`broker_registration_id`	string	Yes	ID of the broker registration to check.

Example response:

{
  "broker_registration_id": "5",
  "has_session": true,
  "status": "in_progress",
  "downloaded_at": "2026-08-01T00:00:00Z",
  "deadline_at": "2026-09-15T00:00:00Z",
  "days_left": 25,
  "record_count": 184500,
  "pre_scan": 2000,
  "deleting": 15000,
  "opting_out": 3000,
  "deleted": 150000,
  "opted_out": 12000,
  "exempt": 1500,
  "not_found": 1000,
  "amendment_backlog": 42
}

search_drop_records

Search or aggregate DROP records for a single broker registration.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`broker_registration_id`	string	Yes	ID of the broker registration to search records for.
`list_type`	string	No	Filter by list type.
`status`	string or array	No	Filter by lifecycle status (single value or array).
`needs_amendment`	boolean	No	Filter to records needing amendment.
`at_risk`	boolean	No	Filter to records at risk of missing their deadline.
`uploaded`	boolean	No	Filter by whether the record has been uploaded to the broker.
`hash`	string	No	Filter by a specific record hash.
`drop_id`	integer	No	Filter by a specific DROP record ID.
`limit`	integer	No	Maximum results to return (default: 25, max: 100).
`after`	string	No	Pagination cursor from a previous response's `page_info.end_cursor`.
`aggregation_mode`	string	No	Aggregate mode: "none", "count", "group_by_lifecycle_status", "group_by_list_type" (default: "none").

Example response:

{
  "broker_registration_id": "5",
  "aggregation_mode": "count",
  "total": 184500
}

get_drop_audit_log

Retrieve the DROP lifecycle audit trail for a single broker registration.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`broker_registration_id`	string	Yes	ID of the broker registration to get the audit log for.
`action_type`	string or array	No	Filter by action type (single value or array).
`status`	string or array	No	Filter by action status: "started", "succeeded", "failed" (single value or array).
`start_date`	string (date)	No	Start of the date range to search (ISO date).
`end_date`	string (date)	No	End of the date range to search (ISO date).
`limit`	integer	No	Maximum results to return (default: 25, max: 100).
`offset`	integer	No	Number of results to skip for pagination (default: 0, max: 9999).

Example response:

{
  "broker_registration_id": "5",
  "results": [
    {
      "id": "9001",
      "action_type": "list_download",
      "status": "succeeded",
      "source": "scheduled",
      "description": "Monthly DROP list downloaded",
      "user_display_name": "System",
      "created_at": "2026-08-01T00:00:00Z"
    }
  ],
  "count": 1,
  "limit": 25,
  "pagination": {
    "offset": 0,
    "limit": 25,
    "total": 1,
    "has_more": false,
    "next_offset": null,
    "max_offset_reached": false
  },
  "truncated": false
}

Support

Tools for viewing and filing your own DataGrail support tickets.

Availability

Support tools are not available on all DataGrail environments. If these tools don't appear in your MCP client, contact support@datagrail.io.

list_support_tickets

List the current user's support tickets.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`state`	string	No	Filter by state: "new", "waiting_on_you", "waiting_on_customer", "on_hold", "closed".
`limit`	integer	No	Maximum results to return (default: 25, max: 50).
`offset`	integer	No	Number of results to skip for pagination (default: 0).

Example response:

{
  "results": [
    {
      "id": "tk_1029",
      "title": "SSO login failing for new admin",
      "state": "waiting_on_you",
      "created_at": "2026-08-15T00:00:00Z",
      "latest_message_time": "2026-08-19T00:00:00Z"
    }
  ],
  "count": 1,
  "pagination": {
    "offset": 0,
    "limit": 25,
    "total": 1,
    "has_more": false,
    "next_offset": null,
    "max_offset_reached": false
  },
  "truncated": false
}

create_support_ticket

File a new support ticket on behalf of the user.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`title`	string	Yes	Short title for the ticket (1–200 characters).
`description`	string	Yes	Description of the issue.
`priority`	string	No	Priority: "urgent", "high", "medium", "low".

Example response:

{
  "issue_id": "tk_1030",
  "title": "Cannot connect Salesforce integration",
  "state": "new",
  "message": "Support ticket submitted successfully."
}

add_support_ticket_comment

Add a reply to a support ticket the user filed.

Safety classification: Write

Parameters:

Name	Type	Required	Description
`issue_id`	string	Yes	ID of the support ticket to comment on.
`message`	string	Yes	Comment text to add.

Example response:

{
  "issue_id": "tk_1029",
  "message": "Reply added to support ticket."
}

Privacy Outcomes

Tools for retrieving Privacy Outcomes Reports, which quantify the business value delivered by your privacy program.

get_privacy_outcomes_report

Retrieve the full detail of a Privacy Outcomes Report by ID, including value calculations and operational metrics.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`report_id`	string	Yes	ID of the Privacy Outcomes Report to retrieve.

Example response:

{
  "id": "77",
  "title": "Q2 2026 Privacy Outcomes",
  "status": "finalized",
  "report_start_date": "2026-04-01",
  "report_end_date": "2026-06-30",
  "date_range_display": "Apr 1 – Jun 30, 2026",
  "included_products": ["Request Manager", "Consent"],
  "generated_by": "privacy-lead@acme.com",
  "generated_at": "2026-07-05T00:00:00Z",
  "created_at": "2026-07-01T00:00:00Z",
  "has_saved_assumptions": true,
  "total_value_saved": 184000,
  "litigation_value_saved": 120000,
  "breach_value_saved": 50000,
  "attrition_value_saved": 14000,
  "url": "https://acme.datagrail.io/privacy-outcomes-report/77"
}

Documentation

Tools for searching DataGrail's knowledgebase documentation.

External MCP Only

Tools in this section are available exclusively through external MCP connections (such as Claude, Cursor, or Windsurf). They are not accessible through the Vera chat interface inside DataGrail.

search_knowledgebase_docs

Search DataGrail's knowledgebase documentation using semantic search.

Safety classification: Read-only

Parameters:

Name	Type	Required	Description
`query`	string	Yes	The search query to find relevant documentation.
`limit`	integer	No	Maximum number of results to return (default: 5, max: 10).

Example response:

{
  "results": [
    {
      "text": "To configure SSO, navigate to Settings > Authentication and select Add Identity Provider...",
      "score": 0.91
    },
    {
      "text": "DataGrail supports SAML 2.0 for single sign-on. Contact support@datagrail.io to enable SSO for your organization...",
      "score": 0.84
    }
  ]
}

Feedback

Tools for submitting feedback and feature requests to the DataGrail product team.

submit_product_feedback

Submit product feedback, feature requests, or bug reports on behalf of the user.

Write Tool

This tool sends a feedback message to the DataGrail product team. It does not modify or delete any existing data.

Safety classification: Write (sends a message)

Parameters:

Name	Type	Required	Description
`feedback`	string	Yes	The feedback, feature request, or bug report text.
`product`	string	Yes	The product area: "Request Manager", "Live Data Map", "Risk Assessment", "Consent Management", "Integrations", "Dashboard", or "General".
`additional_context`	string	No	Additional context about the feedback, such as conversation summary.

Example response:

{
  "status": "submitted",
  "message": "Thank you for your feedback!"
}

Need help?

If you have any questions, please reach out to your dedicated Account Manager or contact us at support@datagrail.io.

Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.

Request Manager​

search_tickets​

get_ticket_activity_log​

get_request_policies​

get_privacy_request_center​

Opt-Out Management​

search_opt_outs​

Integrations​

fetch_available_integrations​

fetch_integration_errors​

fetch_my_integrations​

fetch_privacy_request_integration_stats​

Risk & Compliance​

search_risks​

search_assessments​

search_assessment_templates​

search_inventory​

search_processing_activities​

get_entity_documents​

fetch_data_discovery_agents​

create_assessment​

update_assessment​

answer_assessment_question​

add_system​

update_system​

associate_processing_activity​

disassociate_processing_activity​

Consent Management​

fetch_cookies​

fetch_tags​

get_banner_status​

get_consent_updates​

get_consent_privacy_policies​

categorize_cookie​

categorize_tag​

create_cookie_rule​

update_cookie_rule​

delete_cookie_rule​

update_consent_tag​

Data Broker Compliance​

list_broker_registrations​

get_drop_status​

search_drop_records​

get_drop_audit_log​

Support​

list_support_tickets​

create_support_ticket​

add_support_ticket_comment​

Privacy Outcomes​

get_privacy_outcomes_report​

Documentation​

search_knowledgebase_docs​

Feedback​

submit_product_feedback​

Request Manager

search_tickets

get_ticket_activity_log

get_request_policies

get_privacy_request_center

Opt-Out Management

search_opt_outs

Integrations

fetch_available_integrations

fetch_integration_errors

fetch_my_integrations

fetch_privacy_request_integration_stats

Risk & Compliance

search_risks

search_assessments

search_assessment_templates

search_inventory

search_processing_activities

get_entity_documents

fetch_data_discovery_agents

create_assessment

update_assessment

answer_assessment_question

add_system

update_system

associate_processing_activity

disassociate_processing_activity

Consent Management

fetch_cookies

fetch_tags

get_banner_status

get_consent_updates

get_consent_privacy_policies

categorize_cookie

categorize_tag

create_cookie_rule

update_cookie_rule

delete_cookie_rule

update_consent_tag

Data Broker Compliance

list_broker_registrations

get_drop_status

search_drop_records

get_drop_audit_log

Support

list_support_tickets

create_support_ticket

add_support_ticket_comment

Privacy Outcomes

get_privacy_outcomes_report

Documentation

search_knowledgebase_docs

Feedback

submit_product_feedback