launchtandem.com

Search Telnyx inventory for buyable US/CA numbers.

Buy a number (E.164 from search_phone_numbers) for the org — lazily creating the org's Telnyx messaging profile.

List the org's phone numbers, each with its unified setupStatus (needs_setup / pending_review / action_required / approved / rejected) and service attachments.

Release a number: detaches it from every service (removing the SMS_* env vars) and gives it up at the carrier.

Register the org's 10DLC brand (its A2P legal identity; one per org).

Finish a SOLE_PROPRIETOR brand registration by submitting the mobile OTP PIN (expires 24 h).

Submit a 10DLC campaign under an approved brand.

Assign one of the org's numbers to a 10DLC campaign so it can carry production traffic.

Submit a toll-free verification (the fastest, free A2P path; ~5 business days).

THE status tool — call this FIRST for any number.

Send an SMS or MMS from an owned number (by numberId or from E.164) to a destination.

List the org's SMS/MMS messages (bodies decrypted for the owner view), newest first.

Attach a number to a service by injecting the SMS_* runtime env vars (SMS_API_URL, SMS_API_KEY, SMS_PHONE_NUMBER, SMS_WEBHOOK_SECRET).

Detach a number from a service, removing the SMS_* env vars the attach injected.

Set (or replace) a number's inbound webhook: inbound messages + delivery events are POSTed to your HTTPS url, signed X-Tandem-Signature: sha256=HMAC(secret, rawBody).

Remove a number's inbound webhook.

Return the caller's own identity and, for every organization it belongs to, that org's live entitlements — so you can plan before acting instead of discovering limits by hitting errors.

Map of the Tandem suite's five pillars — launch (this server: hosting), work (shared human+agent workspace), speak (email/webmail, phone + CRM later), grow (marketing), profit (financial OS) — each with product name, status (live|beta|coming_soon), base URL, MCP endpoint URL (null until that pillar's server is up; a plannedMcpUrl marks where it will live), and how to authenticate (one Tandem ID identity: agents present the SAME tdm_ bearer token to every pillar's MCP endpoint).

List projects visible to the caller (filtered by token scope or user org memberships).

List services.

Read a service's configuration: type, paths, healthcheck, domains, and env var keys (values are NOT returned).

Queue a new deployment for a service.

Queue a preview deployment for a service from a branch/ref.

List recent deployments for a service, newest first.

Read a single deployment by id, including two log-tail fields and errorMessage.

Fetch recent container logs for the service's current healthy deployment.

Restart the current healthy deployment's container.

Roll back a service to a previous healthy deployment.

Bring a suspended service back online.

List GitHub App installations visible to the caller.

List repositories granted to a specific GitHub App installation.

List repositories already connected to the caller's organization(s) — the platform's own `repositories` rows, not GitHub's installation list.

Connect a repository from an installation into a platform organization.

Set an EXISTING project's deploy source.

Fetch and parse the platform.yml file from a connected repository.

Replace the inline platform.yml of a repo-less project (an image app installed via install_app, whose config lives on the project, not a git repo).

Create a new project inside an organization.

Rename a project.

Cascade-delete a project: every service in it (with all its deployments, env vars, attached domains), every storage bucket (dropped at the provider), every database (dropped at the engine), and finally the project row itself.

Scoped cascade-delete of a SINGLE service — the fine-grained sibling of delete_project.

Bulk-create services in a project from a list of service definitions (typically the output of read_platform_yml).

List installable open-source apps in the platform catalog (e.g.

One-call install of a catalog OSS app from its published image (e.g.

Trigger a deployment for every service in a project at the same gitRef.

List tenant databases the token can see — the discovery entry point for every other database tool, which all take a databaseId UUID.

Fetch one tenant database by its UUID — non-secret metadata (id, kind, dbName, dbUser, host, port, projectId, createdAt, service attachments).

Provision a tenant database for a service.

Return the full credential bundle for a database — host, port, db name, user, password, and the tenant-side connection URL.

Return database credentials with the public hostname tenants use to reach the DB from outside the platform (TANDEM_PUBLIC_DB_HOST).

Run SQL against a tenant database — the agent-facing equivalent of the portal's SQL runner.

Export a tenant database — the agent-facing equivalent of the portal's database Export button.

Import a SQL dump into a tenant database — the agent-facing equivalent of the portal's database Import button.

List the IP allowlist entries for a database.

Grant a CIDR public-internet access to a database.

Revoke a public-access allowlist entry by id.

Permanently delete a tenant database — the same action as the portal's database Delete button.

Create a new S3-compatible object storage bucket for a project.

List object storage buckets in a project, including which services each bucket is attached to.

Attach an existing bucket to a service by injecting the six S3_* runtime env vars on it.

Detach a bucket from a service.

Enable privacy-friendly web analytics (Tandem Analytics, powered by Umami) for a Tandem-hosted service.

Enable Tandem Analytics for a site hosted ANYWHERE — not on Tandem (for Tandem-hosted services use provision_analytics).

Rebind a service's analytics site as a standalone external site — same website id and script host, so the FULL history is preserved with zero data gap.

Upgrade a site's analytics tag to FIRST-PARTY serving: a custom script host on the site's own domain (default analytics.<its domain>), which survives ad-blockers that drop third-party analytics hosts.

Instantly recheck that a site's pending custom analytics host resolves to the platform IP and activate it: the first-party route publishes, the TLS certificate issues automatically, and the install snippet switches to the custom host.

Remove a site's custom analytics host (and the auto-published DNS record, when the zone is hosted here).

Return the <script> tag to install Tandem Analytics on a site's web pages (data-website-id + script URL).

List a project's analytics sites — both service-bound (kind='service') and external (kind='external', tracking a site hosted anywhere) — with each one's website id, script host, domain, and status.

Disable a Tandem Analytics site and delete its website + data.

Headline web-analytics for a site over a time window: pageviews, visitors, visits, bounces (plus bounceRate and avgVisitSeconds), each compared to the previous equal-length window.

Top values for one axis over a window: type=referrer (traffic sources), country/region/city (geo), url (top pages), device/browser/os, or event (custom events).

Pageviews and sessions over time for a site (by serviceId or siteId), bucketed by `unit` (hour/day/month).

Number of visitors currently active on a site (roughly the last 5 minutes).

Timeline of platform changes over a window — a service's deployments and its project's domain/DNS changes — read from the audit log.

Return the full credential bundle for a bucket — endpoint, region, bucket name, access key id, secret access key, force-path-style flag.

Delete a bucket.

Replace the CORS policy on a bucket so a browser app can make direct cross-origin requests to it (e.g.

Return the current CORS policy for a bucket as a list of rules (allowedOrigins, allowedMethods, allowedHeaders, exposeHeaders, maxAgeSeconds).

Onboard a custom domain for email (sending + receiving).

List the email domains onboarded for a project's org, with their SES identity / DKIM / inbound verification status.

Re-check an email domain's verification status against AWS SES (sending identity + DKIM) and DNS (inbound MX), and update it.

Remove an onboarded email domain: deletes its SES identity and the mail DNS records we manage, and soft-deletes the record.

Configure DMARC aggregate-reporting ownership for an email domain (no vendor lock-in).

Email Health for one onboarded domain: DMARC aggregate-report insights over a window (default 30 days).

Set an email domain's published DMARC policy (the p= in its _dmarc record): none -> quarantine -> reject, and back — a managed, reversible action.

Create an API key for the transactional send API so an app can send mail over HTTP (the Resend-style lane) without a mailbox.

List the transactional send API keys for the project's organization — id, name, prefix, allowed domains, last used, and whether revoked.

Revoke a transactional send API key by id.

Provision a real mailbox (IMAP + SMTP + JMAP, on the self-hosted mail server) on an already-onboarded custom domain.

List mailboxes in a project, including their address, DNS status, and which services each is attached to.

Attach an existing mailbox to a service by injecting the EMAIL_* runtime env vars (IMAP + SMTP + JMAP) on it.

Detach a mailbox from a service, removing the EMAIL_* runtime env vars the attach injected.

Return the full connection profile for a mailbox — address plus IMAP and SMTP host/port/secure/username/password and the JMAP url/token.

Rotate a mailbox's password.

Delete a mailbox.

Register an inbound webhook on a mailbox so an app can receive its mail over HTTP instead of IMAP.

Show a mailbox's inbound webhook config (url, enabled, createdAt) if one is set, else {configured:false}.

Remove a mailbox's inbound webhook.

Share a mailbox with a principal (human or agent) by granting capabilities: canView (read it in Tandem Mail webmail), canCategorize (file messages into categories), canManage (admin the mailbox), canSend (send from its address).

Revoke a subject's access grant on a mailbox (by principalId or email).

List who holds access grants on a mailbox and the capabilities each subject has (view/categorize/manage/send), including pending invite-email grants for people who haven't joined yet.

Provision a managed Redis/Valkey instance for a project — a per-tenant, memory-capped, password-protected Valkey container, durable by default (AOF persistence).

List the managed Redis/Valkey instances in a project, including status (provisioning/ready/error), tier, persistence, and which services each is attached to.

Return the connection details for a managed Redis instance — host, port, password, and the full REDIS_URL (redis://:<password>@host.docker.internal:<port>/0).

Attach a managed Redis instance to a service by injecting REDIS_URL as a runtime env var (overwrites if present).

Detach a managed Redis instance from a service, removing the REDIS_URL env var that attach injected.

Delete a managed Redis instance.

List the env vars on a service.

Set (or overwrite) a single env var on a service.

Set many env vars on a service in one atomic call — paste a whole .env file as `content`, or pass an explicit `vars` array.

Delete an env var from a service by key.

Create a new organization with a new human owner, email a claim link, and return the URL.

Create a new organization owned by YOU, the caller — the agent (or, when called as an authenticated human, the human).

Poll the claim status of an organization.

List every domain the organization has — start here for anything domain-related.

Check whether one or more hostnames are available to register and return the registrar's current price.

Purchase a domain via the platform registrar and attach it to a service.

Attach an already-owned or external hostname to a service.

Point a parked or alias hostname at an arbitrary target with a path-preserving 301 redirect — the tool for pointing old-brand.com (or any spare domain) at the live site without standing up a service for it.

Force an immediate DNS recheck for an attached custom hostname instead of waiting for the automatic sweep (which retries every minute at first, backing off with age).

Move an attached hostname to another service in the same organization in one step — the right tool when a domain should point at a different service.

Detach a hostname from its service entirely: unpublishes the platform A record (if the zone is platform-managed) and deletes the domain attachment, so the hostname stops routing to the platform.

Renew a domain the organization registered through Tandem for one more year, charging via the same payment + approval path the portal uses.

Turn automatic renewal on or off for a domain the organization registered through Tandem.

Transfer a domain registered at another registrar into Tandem, charging one year up front via the same payment + approval path the portal uses.

List the DNS records in the zone that owns a hostname.

Create a DNS record in the zone that owns a hostname (same capability as the portal's zone editor).

Update an existing DNS record by id (get the id from list_dns_records).

Delete a DNS record by id (from list_dns_records).

Take over a Tandem-managed DNS record (managedBy='platform') so your organization manages it from then on.

Best-effort copy of an external domain's PUBLICLY-visible DNS records, for a domain you host on Tandem ('Add external domain') but have no zone file for.

Create the records a user confirmed from a scan_public_dns preview.

Bulk-import a BIND zone file (e.g.

Check whether an organization can currently deploy.

Register an Ed25519 public key as a candidate recovery method for an org.

Complete recovery-key registration by submitting an Ed25519 signature over the challenge issued by register_recovery_key.

List recovery keys registered against an organization.

Revoke a previously-verified recovery key.

Read an organization's billing status: funding provider, tier ('preview' = the 14-day free trial, which DOES deploy; 'paid' = subscribed), previewExpiresAt (when the trial ends and services are suspended), billingEnabled (comp kill-switch), billingVerified (the deploy-gate billing half — true during a live trial even with no card), whether a billing customer + a default payment method are on file, the current subscription (plan/status/period), and any remaining deploy blockers.

Read the organization's latest subscription: plan code, status (active|trialing|past_due|incomplete|canceled|…), current period start/end, cancelAtPeriodEnd, provider, and services included.

List the organization's invoices (recurring subscription billing) newest-first, live from the payment provider: number, status (draft|open|paid|void|uncollectible), amount due/paid + currency, billing period, and the hosted view + PDF download links.

Summarize the organization's metered usage: tier ('preview' = the 14-day free trial, 'paid' = subscribed) + previewExpiresAt/previewServiceLimit, live counts of billable resources (services, databases, buckets, registered domains), application egress over the last 30 days (egress30d: bytes + gb, measured from the tenant HTTP proxy; metered=false means egress was not measured for this org rather than that it was zero), 30-day daily averages for the two gauge metrics (services30d.avgDaily = average billable services held per day, distinct from the live resources.services count; dbStorage30d.avgDailyBytes/avgDailyGb = average tenant-database bytes on disk), and the number of usage events recorded in the last 30 days.

Begin attaching a payment method to the organization.

List the subscribable plans for an organization: code, displayName, base price + currency, included allotments, and metered overage items.

Upgrade the organization to a paid plan by starting a subscription.

Move the organization's ACTIVE subscription to a different plan IN PLACE (e.g.

PLATFORM ADMIN ONLY.

List the members (humans and agents) of an organization: principalId, userId, kind, role, email, displayName, whether a human still has setup pending, and when they joined.

Invite a HUMAN to an organization by email, granting a role.

Change an existing member's org role.

Remove a member from an organization.

Read a principal's limits/policy: action mask (the actions it may perform), spend cap + period, and approval threshold.

Set a principal's limits/policy (human OR agent — limits belong to the principal, not to 'being an agent').

Review EVERY permission a principal holds in one organization, in one call: its membership role and resource grants (which ADD access), plus its limits action mask and, for agents, each credential's action mask and project/service fence (which SUBTRACT it).

List everyone holding an active grant on ONE resource — the 'who has access to this' view, the mirror of list_principal_access.

Give an EXISTING principal (human or agent, by principalId or directory email) capabilities on one resource — Drive-style sharing for anything the platform hosts.

Revoke one grant on one resource, by the grantId from list_grants.

Open a support ticket with the platform team when something looks broken on the PLATFORM side (deploys stuck, DNS/TLS not converging, billing errors) or you need help you can't self-serve.

List the organization's support tickets, newest activity first.

Read a support ticket's full conversation thread.

Reply on a support ticket and/or close it: pass body to answer, close:true to close (optionally both for a close-with-comment).

Show the organization's support webhook config (url, enabled, createdAt) if one is set, else {configured:false}.

Register (or with url:null remove) an HTTPS endpoint that receives HMAC-signed support.ticket.updated POSTs whenever platform support replies or resolves one of the org's tickets — push for your own automation instead of polling.

PLATFORM ADMIN: the platform-wide support queue across all organizations.

PLATFORM ADMIN: read a support ticket's full thread INCLUDING internal notes, and mark it read for the platform side.

PLATFORM ADMIN: reply to a requester on a support ticket (they are notified by email + their org webhook + unread flags), or with internal:true leave an internal note other platform staff see but the requester never does.

PLATFORM ADMIN: triage a support ticket — set status (in_progress / waiting_on_requester / resolved / closed; resolved notifies the requester), assign it to a platform-admin principal (assigneePrincipalId, null to unassign), and/or set priority.

Create a private Tandem Git repository in an organization — first-class git hosting with a standard HTTPS clone URL (username 'git', password = your token).

List Tandem Git repositories you can read — across every org you belong to plus repos shared with you, or narrowed by organizationId / projectId.

Read from a Tandem Git repository without cloning: what='tree' lists a directory (recursive optional), 'file' returns one file's content (base64 + isBinary), 'commits' pages history (limit/cursor, optional path filter), 'branches' lists branches with shas.

Apply a batch of file operations (put/delete/move, up to 200) as ONE atomic commit to a Tandem Git repository branch — no clone needed.

Grant (or with revoke:true, remove) a subject's capabilities on a Tandem Git repository — Drive-style sharing with independent canRead/canWrite/canAdmin booleans, additive on top of org-role access.

Migrate a repository INTO Tandem Git (a one-time copy, not continuous sync).

Migrate a Tandem Git repository OUT to GitHub (a one-time copy, not continuous sync).

Check migrate-job progress AND continuous-mirror state: pass jobId to poll one job returned by import_repository/export_repository_to_github (state, progress phase, error), or repo to see a Tandem repository's provider info, most recent migrate job, and — if configure_git_mirror enabled mirroring — the mirror link's mode/status/lag/last error.

Continuous 'Mirror to GitHub' for a Tandem Git repository — strict single-primary (never multi-master).

Schedule a recurring HTTP request to one of your services' OWN endpoints (e.g.

List a service's cron jobs (schedule, path, method, enabled, next/last run, last status, consecutive failures).

Update a cron job by id — change its schedule/path/method/headers/timeout, or toggle it with enabled.

Delete a cron job by id (its run history goes with it).

Fetch a cron job's recent run history (started_at, duration, HTTP status, outcome 'ok'|'http_error'|'timeout'|'no_upstream'|'error', error, and a truncated response snippet), newest first.