# Devices MCP tools

This page documents **6 tools** in the devices group. Return to the [complete MCP tool reference](/docs/developers/api/mcp/tools) to browse another group.

Select a tool to inspect its schemas and behavior. Schema links open the exact definition in GitHub.

### `listDevices` — List Devices

List ITAM devices for an organization. Use createDevice to issue a PENDING device and a one-shot enrollment token for the agent installer. Device states: PENDING (enrollment token issued, agent has never checked in), ACTIVE (agent heartbeating), REVOKED (enrollment revoked). Use last_seen_at as the staleness signal. latest_postures is empty unless include_postures is true; when loaded it holds the newest result per check_key and is empty for PENDING devices. Page with size and cursor; when next_cursor is present, pass it as cursor on the next call.

- **Input:** [`ListDevicesInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3127-L3146)
- **Output:** [`ListDevicesOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3148-L3159)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L14564–L14575 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14564-L14575)

### `getDevice` — Get Device

Get one ITAM device by ID (soft-deleted devices are not returned). Same state machine as listDevices: PENDING (enrollment token issued, agent has never checked in), ACTIVE (agent heartbeating), REVOKED (enrollment revoked). Use last_seen_at as the staleness signal. latest_postures is empty unless include_postures is true; when loaded it holds the newest result per check_key and is empty for PENDING devices.

- **Input:** [`GetDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3161-L3171)
- **Output:** [`GetDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3173-L3179)
- **Behavior:** Read only · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L14576–L14587 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14576-L14587)

### `createDevice` — Create Device

Create a PENDING ITAM device and return a one-shot enrollment token (plus server_url and enrollment_url) for the agent installer. The plaintext token is shown only in this response; only its hash is stored. The token also expires after a deployment-configured lifetime (7 days by default), so hand it to the installer now instead of storing it for a later retry: exchanging an expired token fails with enrollment token expired and leaves the device PENDING, and you must call createDevice again to issue a fresh device and token. Optionally assign an owner with owner_id (MembershipProfile GID in the same organization).

- **Input:** [`CreateDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3181-L3191)
- **Output:** [`CreateDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3193-L3211)
- **Behavior:** Writes data · Non-destructive · Non-idempotent · Closed world
- **Source:** [specification.yaml · L14588–L14599 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14588-L14599)

### `revokeDevice` — Revoke Device

Irreversibly revoke a device enrollment. Immediately invalidates the device agent API key so the agent stops authenticating and reporting; there is no un-revoke tool. Safe to call more than once: state stays REVOKED and revoked_at keeps its original value. Call this before deleteDevice.

- **Input:** [`RevokeDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3213-L3220)
- **Output:** [`RevokeDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3222-L3228)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L14600–L14611 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14600-L14611)

### `deleteDevice` — Delete Device

Soft-delete a device. The device must already be REVOKED — call revokeDevice first, otherwise the call fails with the error device cannot be deleted. After success the device stops appearing in listDevices/getDevice; enrollment tokens for the device are removed. Eligible orphan rows are later hard-deleted by the ITAM garbage collector.

- **Input:** [`DeleteDeviceInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3230-L3237)
- **Output:** [`DeleteDeviceOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3239-L3246)
- **Behavior:** Writes data · Destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L14612–L14623 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14612-L14623)

### `setDeviceOwner` — Set Device Owner

Set or clear the owner of an ITAM device. owner_id is required: pass a MembershipProfile GID belonging to the same organization as the device to assign, or null to clear. Omitting the field is invalid.

- **Input:** [`SetDeviceOwnerInput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3248-L3262)
- **Output:** [`SetDeviceOwnerOutput`](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L3264-L3270)
- **Behavior:** Writes data · Non-destructive · Idempotent · Closed world
- **Source:** [specification.yaml · L14624–L14635 ↗](https://github.com/getprobo/probo/blob/main/pkg/server/api/mcp/v1/specification.yaml#L14624-L14635)