Resources and prompts

Besides tools, the server offers three things the client uses on its own: resources (documents the user attaches to the conversation), prompts (ready-made scripts the user picks) and completions (autocomplete for their arguments). On the 2026-07-28 era it also asks for confirmation before running a destructive tool.

None of this opens a new path to your data: everything goes through the same tools, under the same permissions and the same token scope. With a read-only token, resources and completions stay available, but a prompt that writes — like collect_overdue_invoices, which sends reminders — is not listed.

Resources

A resource is a document identified by a URI. The user picks, say, an invoice, and the client reads the document and puts it in context, without the model having to call a tool.

URI	What comes back
kobana://billing/organization	The token's organization (JSON)
kobana://billing/schemas	The API's resource catalogue (JSON)
kobana://billing/schemas/{resource}	One resource's fields: type, enum, meaning, which are sortable (JSON)
kobana://billing/customers/{id}	One customer (JSON)
kobana://billing/subscriptions/{id}	One subscription (JSON)
kobana://billing/invoices/{id}	One invoice (JSON)
kobana://billing/invoices/{id}/pdf	The invoice PDF
kobana://billing/nfes/{id}	One NF-e (JSON)
kobana://billing/nfes/{id}/pdf	The NF-e DANFE
kobana://billing/nfes/{id}/xml	The authorized NF-e XML (text)

resources/list returns the fixed URIs and resources/templates/list the templates with {id}.

• Permissions. Each resource is read by the matching tool (kobana://billing/invoices/{id} is billing_invoices_get). It is only listed, and only read, if you can run that tool.
• Binaries. PDFs come back base64-encoded (blob), up to 10 MB. Unlike the tools, which only describe the file, here the document is the answer: the client asked for it.
• Not found. An unknown URI, or a record that does not exist in this organization, is -32002 on the 2025 era and -32602 on 2026-07-28 — see Errors.
• No change subscriptions. The server is stateless: there is no resources/subscribe and no list-changed notice.

Prompts

A prompt is a ready-made instruction you pick in the client, which becomes the first message of the conversation. It is only listed if you can run all the tools it relies on.

Prompt	Arguments	What it does
collect_overdue_invoices	customer_id (optional)	Lists open invoices past due, shows a table and asks which ones should get a reminder before sending any.
review_pending_nfes	—	Gathers invoices that still have no NF-e and the rejected NF-e, summarises them and suggests the next step, without issuing anything.
customer_overview	customer_id	One customer's picture: their data, subscriptions, what is open and what is overdue.
monthly_billing_summary	month (optional, YYYY-MM)	What was invoiced, collected and left open in the month.

A missing required argument, or a malformed month, is -32602.

Completions

completion/complete suggests values while you type an argument:

• Ids (customer_id, and the {id} of customers, invoices and subscriptions): searches the matching listing, under its permission. If you cannot list, there is no suggestion.
• {resource} in kobana://billing/schemas/{resource}: the catalogue names, by prefix.
• month: the last twelve months.

With no source for suggestions, the answer is an empty list and you keep typing.

Confirming destructive tools

Tools that delete, cancel, void or refund carry destructiveHint, and most clients already ask for confirmation because of it. On the 2026-07-28 era the server asks too:

1. The first tools/call runs nothing. It comes back with resultType: "input_required" and a one-question form: run this action, with these arguments?
2. The client shows the question and re-sends the same call with your answer.
3. Only an explicit yes runs it. Declining or cancelling returns an isError result with USER_DECLINED, and nothing changes.

The confirmation holds only for that call: the same tool, the same arguments, the same person and organization, for 5 minutes. An answer cannot be reused for another invoice or another action; if anything does not match, the server simply asks again.

The server only asks clients that declare support for elicitation forms. On the 2025 era, or with a client without that support, the tool runs right away and confirmation is left to the client itself.