# Devices MCP tools

This page documents **6 tools** in the devices group. Return to the [complete MCP tool reference](/docs/developers/api/mcp/tools) to browse another group.

Select a tool to inspect its schemas and behavior. Schema links open the exact definition in GitHub.

### `listDevices` — List Devices

List ITAM devices for an organization. Use createDevice to issue a PENDING device and a one-shot enrollment token for the agent installer. Device states: PENDING (enrollment token issued, agent has never checked in), ACTIVE (agent heartbeating), REVOKED (enrollment revoked). Use last_seen_at as the staleness signal. latest_postures is empty unless include_postures is true; when loaded it holds the newest result per check_key and is empty for PENDING devices. Page with size and cursor; when next_cursor is present, pass it as cursor on the next call.

- **Input:** [`ListDevicesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3514-L3533)
- **Output:** [`ListDevicesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3535-L3546)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L15949–L15960 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L15949-L15960)

### `getDevice` — Get Device

Get one ITAM device by ID (soft-deleted devices are not returned). Same state machine as listDevices: PENDING (enrollment token issued, agent has never checked in), ACTIVE (agent heartbeating), REVOKED (enrollment revoked). Use last_seen_at as the staleness signal. latest_postures is empty unless include_postures is true; when loaded it holds the newest result per check_key and is empty for PENDING devices.

- **Input:** [`GetDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3548-L3558)
- **Output:** [`GetDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3560-L3566)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L15961–L15972 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L15961-L15972)

### `createDevice` — Create Device

Create a PENDING ITAM device and return a one-shot enrollment token (plus server_url and enrollment_url) for the agent installer. The plaintext token is shown only in this response; only its hash is stored. The token also expires after a deployment-configured lifetime (7 days by default), so hand it to the installer now instead of storing it for a later retry: exchanging an expired token fails with enrollment token expired and leaves the device PENDING, and you must call createDevice again to issue a fresh device and token. Optionally assign an owner with owner_id (MembershipProfile GID in the same organization).

- **Input:** [`CreateDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3568-L3578)
- **Output:** [`CreateDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3580-L3598)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L15973–L15984 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L15973-L15984)

### `revokeDevice` — Revoke Device

Irreversibly revoke a device enrollment. Immediately invalidates the device agent API key so the agent stops authenticating and reporting; there is no un-revoke tool. Safe to call more than once: state stays REVOKED and revoked_at keeps its original value. Call this before deleteDevice.

- **Input:** [`RevokeDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3600-L3607)
- **Output:** [`RevokeDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3609-L3615)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L15985–L15996 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L15985-L15996)

### `deleteDevice` — Delete Device

Soft-delete a device. The device must already be REVOKED — call revokeDevice first, otherwise the call fails with the error device cannot be deleted. After success the device stops appearing in listDevices/getDevice; enrollment tokens for the device are removed. Eligible orphan rows are later hard-deleted by the ITAM garbage collector.

- **Input:** [`DeleteDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3617-L3624)
- **Output:** [`DeleteDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3626-L3633)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L15997–L16008 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L15997-L16008)

### `setDeviceOwner` — Set Device Owner

Set or clear the owner of an ITAM device. owner_id is required: pass a MembershipProfile GID belonging to the same organization as the device to assign, or null to clear. Omitting the field is invalid.

- **Input:** [`SetDeviceOwnerInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3635-L3649)
- **Output:** [`SetDeviceOwnerOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3651-L3657)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L16009–L16020 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L16009-L16020)