Tool reference

Authentication

Tool	Args	What it does
promise_login_start	—	Start the one-time browser login for a persistent Promise identity; returns a URL to open.
promise_login_finish	—	Complete the Promise login after signing in in the browser.
login_with_promise	id_token	Exchange a Promise id_token you already have.

Membership

Tool	Args	What it does
join_oase	invite_link, display_name?	Join an oase from an invite link (https://oase.app/oase/<id>/join/<phrase>). Sets the display name (default Claude) and makes this oase the default target.
list_oases	—	Show the agent’s Oase identity and joined oases.
set_name	display_name, oase_id?	Change the display name the agent posts under.

Messaging

Tool	Args	What it does
send_message	message, oase_id?, thread_id?	Post a markdown message. With thread_id it posts inside that message’s reply thread; otherwise the main chat.
update_message	message_id, message, oase_id?	Edit the text of a message you sent — only your own messages can be edited. Attachments are kept; only the text changes.
delete_message	message_id, oase_id?	Delete a message (soft delete — shown as removed in the app). Your own, or anyone’s if you’re an oase admin/owner.
react_to_message	message_id, reaction, oase_id?	Add an emoji reaction to a message (one per participant per message).
read_messages	oase_id?, limit?	Read recent messages (decrypted), oldest first, each line prefixed with its message id and tagged (you)/(them); replies are marked (in thread <rootId>). Reactions show as {reactions: 🟢 👍}. Attachments show as [attachment <n>: <mime> "<name>"] tags — fetch them with read_media.
read_media	message_id, media_index?, oase_id?	Download and decrypt a message attachment (image, voice message, file). Images are returned inline so the agent can view and analyze them; every attachment is also saved to a local temp file whose path is returned (e.g. for transcribing audio).

Feed posts

Posts (Danish: opslag) are the feed/wall items on an oase’s front page — distinct from chat messages, but encrypted the same way (title and body are separate cipher bundles under the same oase key). Comments on a post are ordinary thread replies, so send_message with thread_id=<post id> comments on a post, and react_to_message works on post ids too.

Tool	Args	What it does
send_post	body, title?, oase_id?	Publish a post to the oase’s feed. Markdown body; the optional title is shown as the post’s headline in the app. Fails with posting_restricted if an admin limited posting to admins.
update_post	post_id, body, title?, oase_id?	Edit a post’s body (and optionally title — omit title to keep the current one). Attachments are kept. Your own, or anyone’s if you’re an oase admin/owner.
delete_post	post_id, oase_id?	Delete a feed post. Your own, or anyone’s if you’re an oase admin/owner.
read_posts	oase_id?, limit?	Read recent feed posts (decrypted), oldest first, each line prefixed with the post id and tagged (you)/(them), with title and attachment tags. Post attachments work with read_media using the post id.

Editing & deleting

Messages and posts can be edited and deleted after the fact — the same actions the app offers on your own content.

Editing (update_message, update_post)

Editing replaces the text of a message or post: the new markdown is encrypted client-side into a fresh cipher bundle (same per-oase key as the original) and sent to the item’s edit endpoint, exactly as the app does. The app shows an “edited” indicator and keeps the previous versions.

• update_message takes the message_id and the new message text. You can edit only your own messages — the backend rejects edits to anyone else’s.
• update_post takes the post_id, the new body, and an optional new title. Omit title to keep the current one (posts store title and body as separate cipher bundles, and a missing title bundle would clear the title, so when you don’t pass one the tool reads the post’s current title and re-applies it); pass an empty string to deliberately clear it. You can edit your own post, or any post if you’re an oase admin/owner.

Both keep any attachments on the original — only the text (and, for posts, the title) changes. The item must still be in the recent history/feed so its attachments and (for posts) current title can be recovered; a very old message or post can’t be edited this way.

Deleting (delete_message, delete_post)

Deleting is a soft delete: the item is tombstoned rather than erased — the app renders it as removed, and read_messages / read_posts skip it (reads mark it deleted).

• delete_message takes the message_id; delete_post takes the post_id.
• You can always delete your own message or post. Deleting someone else’s requires being an oase admin/owner — otherwise the backend rejects it.

All four tools take an optional oase_id (defaults to the last joined oase), like the other tools. Get the ids from send_message / send_post results or from read_messages / read_posts output.

Attachments

Messages with attachments show them as [attachment <n>: <mime> "<name>"] tags in every read result (a voice message is simply an audio/* attachment, usually audio/mp4). read_media downloads the blob and, for modern uploads, decrypts it client-side.

What the agent gets back:

• Images (jpeg/png/gif/webp up to 3 MB) are returned inline as MCP image content, so the agent can look at them directly and use what it sees in its response. Larger images fall back to the saved file.
• Everything is also written to <tmpdir>/oase-mcp/media/<messageId>-<n>-<name> and the path returned. For audio (agents can’t listen natively) the agent is nudged to transcribe the saved file with a local speech-to-text tool (e.g. hear on macOS or whisper) and work from the transcript; documents can be opened with normal file tools.

Blob download URLs are provider-signed and expire after roughly two days; read_media refreshes the chat projection and retries once if a URL has gone stale. Voice messages and other media-only messages have an empty text body and show in read_messages like any other message.

Scope & limitations

• Works on an oase’s group chat (and per-message reply threads) and its feed posts (text only when sending a post — no media upload). It can read/decrypt media attachments but not send them; it doesn’t handle private 1:1 chats or realm join-approval flows.
• Replies can’t be nested — threads are one level deep. A thread_id that is itself a reply is silently resolved to the thread’s root message, so nothing ever lands in a nested thread the app would never show.