# Access reviews MCP tools

This page documents **20 tools** in the access reviews group. Return to the [complete MCP tool reference](/docs/developers/api/mcp/tools) to browse another group.

Select a tool to inspect its schemas and behavior. Schema links open the exact definition in GitHub.

### `listAccessReviewCampaigns` — List Access Review Campaigns

List access review campaigns for an organization.

- **Input:** [`ListAccessReviewCampaignsInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9500-L9516)
- **Output:** [`ListAccessReviewCampaignsOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9518-L9529)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17377–L17388 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17377-L17388)

### `listAccessEntries` — List Access Entries

List access entries for a campaign with optional filters (decision, flag, incremental_tag, is_admin, active, auth_method, account_type).

- **Input:** [`ListAccessEntriesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9531-L9572)
- **Output:** [`ListAccessEntriesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9574-L9585)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17389–L17400 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17389-L17400)

### `getAccessReviewStatistics` — Get Access Review Statistics

Get statistics for an access review campaign including counts by decision, flag, and incremental tag.

- **Input:** [`GetAccessReviewStatisticsInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9587-L9594)
- **Output:** [`GetAccessReviewStatisticsOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9596-L9602)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17401–L17412 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17401-L17412)

### `recordAccessReviewEntryDecision` — Record Access Review Entry Decision

Record a decision on an access entry (APPROVED, REVOKE, DEFER, or ESCALATE). Non-APPROVED decisions require a decision_note.

- **Input:** [`RecordAccessReviewEntryDecisionMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9604-L9618)
- **Output:** [`RecordAccessReviewEntryDecisionMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9620-L9626)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17413–L17424 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17413-L17424)

### `recordAccessReviewEntryDecisions` — Record Access Review Entry Decisions

Record decisions on multiple access entries in a single batch. Non-APPROVED decisions require a decision_note.

- **Input:** [`RecordAccessReviewEntryDecisionsMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9628-L9649)
- **Output:** [`RecordAccessReviewEntryDecisionsMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9651-L9659)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17425–L17436 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17425-L17436)

### `flagAccessReviewEntry` — Flag Access Review Entry

Flag an access entry with one or more flags during review (ORPHANED, INACTIVE, EXCESSIVE, ROLE_MISMATCH, NEW, etc.). Optionally provide reasons.

- **Input:** [`FlagAccessReviewEntryMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9661-L9679)
- **Output:** [`FlagAccessReviewEntryMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9681-L9687)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17437–L17448 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17437-L17448)

### `closeAccessReviewCampaign` — Close Access Review Campaign

Close an access review campaign. All entries must have been decided (no PENDING entries).

- **Input:** [`CloseAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9689-L9696)
- **Output:** [`CloseAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9698-L9704)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17449–L17460 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17449-L17460)

### `listAccessReviewSources` — List Access Review Sources

List access sources for an organization.

- **Input:** [`ListAccessReviewSourcesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9762-L9778)
- **Output:** [`ListAccessReviewSourcesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9780-L9791)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17461–L17472 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17461-L17472)

### `createAccessReviewSource` — Create Access Review Source

Create a new access source for an organization.

- **Input:** [`CreateAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9793-L9810)
- **Output:** [`CreateAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9812-L9825)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17473–L17484 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17473-L17484)

### `updateAccessReviewSource` — Update Access Review Source

Update an existing access source.

- **Input:** [`UpdateAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9827-L9849)
- **Output:** [`UpdateAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9851-L9857)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17485–L17496 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17485-L17496)

### `deleteAccessReviewSource` — Delete Access Review Source

Delete an access source.

- **Input:** [`DeleteAccessReviewSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9859-L9866)
- **Output:** [`DeleteAccessReviewSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9868-L9875)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17497–L17508 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17497-L17508)

### `awsConnectorSetup` — AWS Connector Setup

Return issuer, subject, audience and deploy artifacts for connecting an AWS account.

- **Input:** [`AWSConnectorSetupMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9943-L9950)
- **Output:** [`AWSConnectorSetupMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9952-L9958)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17509–L17520 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17509-L17520)

### `createWorkloadIdentityConnector` — Create Workload Identity Connector

Create a workload-identity connector (AWS) and report whether the audit role can be assumed.

- **Input:** [`CreateWorkloadIdentityConnectorMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9967-L9982)
- **Output:** [`CreateWorkloadIdentityConnectorMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9984-L9990)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Open world
- **Source:** [specification.yaml · L17521–L17532 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17521-L17532)

### `createAccessReviewCampaign` — Create Access Review Campaign

Create a new access review campaign for an organization.

- **Input:** [`CreateAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L9992-L10011)
- **Output:** [`CreateAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10013-L10019)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17533–L17544 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17533-L17544)

### `updateAccessReviewCampaign` — Update Access Review Campaign

Update an existing access review campaign.

- **Input:** [`UpdateAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10021-L10034)
- **Output:** [`UpdateAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10035-L10041)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17545–L17556 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17545-L17556)

### `deleteAccessReviewCampaign` — Delete Access Review Campaign

Delete an access review campaign.

- **Input:** [`DeleteAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10043-L10050)
- **Output:** [`DeleteAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10052-L10059)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17557–L17568 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17557-L17568)

### `startAccessReviewCampaign` — Start Access Review Campaign

Start an access review campaign. Triggers data fetching from all configured scope sources.

- **Input:** [`StartAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10061-L10068)
- **Output:** [`StartAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10070-L10076)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17569–L17580 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17569-L17580)

### `cancelAccessReviewCampaign` — Cancel Access Review Campaign

Cancel an in-progress access review campaign.

- **Input:** [`CancelAccessReviewCampaignMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10078-L10085)
- **Output:** [`CancelAccessReviewCampaignMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10087-L10093)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17581–L17592 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17581-L17592)

### `addAccessReviewCampaignSource` — Add Access Review Campaign Source

Add an access source to an access review campaign's scope.

- **Input:** [`AddAccessReviewCampaignSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10095-L10106)
- **Output:** [`AddAccessReviewCampaignSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10108-L10114)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L17593–L17604 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17593-L17604)

### `removeAccessReviewCampaignSource` — Remove Access Review Campaign Source

Remove an access source from an access review campaign's scope.

- **Input:** [`RemoveAccessReviewCampaignSourceMCPInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10116-L10127)
- **Output:** [`RemoveAccessReviewCampaignSourceMCPOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L10129-L10135)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L17605–L17616 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L17605-L17616)