io.github.corply-dev/corply

Tools

• adopt_existing_company

  Attach an already-existing company without creating a Corply formation. Records name, jurisdiction, entity type, date, and file number as founder assertions—not verified facts—then returns a refreshed get_company_briefing result and requests the charter, bylaws, and cap table/stock ledger when available. Prerequisites: active company-manager access, an explicit companyId when the organization has multiple companies, and a stable idempotencyKey. Safe retries with the same key and exact request return the original result; reusing the key for different inputs is rejected. No extra confirmation is required because this records the user's explicit assertion and does not file, pay, sign, invite, or verify anything. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• amend_frozen_application

  Apply confirmed answer changes to a frozen, pre-submission formation. This supersedes the frozen legal documents and open signature requests, reopens intake, and requires document regeneration and fresh signatures. Use only after the founder explicitly confirms that consequence. Partial data still deep-merges over stored answers. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• await_payment

  Wait for the incorporation payment to land. Returns {status: 'paid'|'pending'|'expired'|'unpaid'}. Call it in a LOOP until it returns 'paid' — do not call request_signature, invite_cofounders, or submit_for_formation before then; they refuse with PAYMENT_REQUIRED. 'expired' → run request_payment again for a fresh link. 'unpaid' → no session yet; run request_payment first. Each call waits at most ~8 seconds by design — long-held requests get killed by the gateway. Call it REPEATEDLY until it returns 'paid'; a 'pending' result includes retryAfterSeconds. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• await_registered_agent_upgrade

  Wait for the $350 lifetime registered-agent upgrade to land. Returns {status:'lifetime'|'pending'|'expired'|'unpaid'}. Call in a LOOP until 'lifetime'. 'expired' → call request_registered_agent_upgrade again for a fresh link. 'unpaid' → no session yet, call request_registered_agent_upgrade first. Each call waits at most ~8 seconds by design, because the gateway kills long-held requests; a 'pending' result includes retryAfterSeconds. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• check_company_names

  Check the formation's saved company name and up to five supplied alternatives through OpenSOSData. Pass the currently saved selectedName exactly and preserve the desired alternative order. Returns every name with available=true, false, or null when only that provider request failed. Previously rejected names return false without another provider call. Results are advisory and never block document generation; Corply operations performs the mandatory Delaware check immediately before filing. No confirmation is required. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• configure_payment_catalog

  Validate and deterministically add the founder-approved fixed-price SaaS subscription catalog to an integrity-hashed Corply Pay manifest. The agent derives technical product/price/entitlement keys, environment-variable names, and the SaaS category matching the already-approved business model; do not ask the founder for implementation identifiers or a tax code. Inputs contain environment-variable NAMES only—never Paddle IDs, API keys, webhook secrets, bank/card data, or customer data. Makes zero provider calls and charges nothing. Refuses drifted manifests, duplicate identifiers, model/category mismatches, or catalog/billing-model contradictions. Next call create_payment_integration_bundle. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• create_payment_integration_bundle

  Generate a reviewable repository patch plan from a valid catalog manifest: the unpublished local @corply/payments alpha package coordinate, exact manifest, environment-variable-name template, structured external Paddle sandbox setup handoff, framework adapter files, and required verification checks. Makes zero provider/network calls, writes no files itself, never overwrites existing files, and never handles credential values. The manifest is verify-exact and must never be merged field-by-field; generated code is create-only and code collisions require deliberate integration. The calling agent must inspect each target path, apply safe files, follow the provider handoff only after founder authentication, run every returned check locally, capture SHA-256 evidence references, call verify_payment_integration with truthful pass/fail/not-run evidence, repair from its report, and repeat. Do not execute the afterPublishCommand until the package is actually published. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• create_payment_project

  Legacy Paddle path only. After prepare_revenue_launch returns sandbox_build_ready, deterministically generate the integrity-hashed sandbox-only manifest that the agent will commit inside an existing legacy integration. This is a pure draft action: it stores no hosted state, makes zero provider calls, creates no Paddle account/catalog, charges nothing, and accepts no secret values. The hash detects drift but is not a provider approval or cryptographic signature. Same company + projectKey + inputs returns the same project and hash. Next call configure_payment_catalog. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• create_payment_route_draft

  Create or exactly replay one local sandbox merchant-route draft for Corply's own payment pipeline. This reversible backend save accepts only company, route key, USD, and an idempotency key; it cannot accept or store credentials, provider IDs, identity documents, terms acceptance, bank/card data, or a production setting. It makes zero provider calls, creates no external account, activates nothing, and moves no money. Afterward call get_payment_pipeline_status; provider onboarding, payout-bank connection, route activation, and live enablement remain separately confirmed actions. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• generate_documents

  Phase-aware immutable generation. Company-name search results are advisory and do not gate this action. Before filing, status 'ready' produces only the filing-stage Certificate of Incorporation. After Delaware acceptance, status 'formed' produces Bylaws, Action of Incorporator, Initial Board Consent, one RSPA per founder, and the unsigned SS-4 using the recorded accepted date. After an electing founder's RSPA is fully executed, Corply automatically produces that founder's 83(b) Election from the actual stock-purchase date and executes it under the advance authorization captured in the founder's signing bundle. A canonical next step may call this tool without another founder confirmation solely to retry that automatic 83(b) preparation. Otherwise, confirm before creating immutable legal documents. Before filing, editing a generated application reopens the formation, supersedes its Certificate and collected signatures, and requires re-generation and re-signing. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: follow the canonical nextStep—confirm when checkpoint=true; an automatic 83(b) preparation retry explicitly needs no new approval.

  shallow
• get_bank_onboarding_status

  First tool for opening a company bank account. Returns any durable Mercury prefill handoff, an in-flight or reconciliation state, or the current direct Mercury fallback. It never reads or returns SSNs, identity documents, provider credentials, or submitted KYC payloads. A handoff URL is available only to an active owner, founder, cofounder, or operator membership. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• get_cap_table

  Return the company's live cap table: every holder with their security type, shares, price paid, and computed ownership %, plus total shares issued. Auto-seeded with founder common stock at formation. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• get_company_briefing

  Use for a broad company briefing, company disambiguation, or a founder asking what matters next. It is not a prerequisite for a goal-specific tool because every Corply result now carries server-authored context continuation. Returns the privacy-filtered caller/org/company context, lifecycle origin, formation/payment/filing/document/signature state, standard Delaware C-corp configuration, deterministic operating plan, and execution boundaries. Prerequisite: an authenticated active organization member. No confirmation is required; resolving may materialize the same deterministic canonical plan but creates no external side effect. When multiple companies exist, pass companyId and never guess. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• get_org

  Compatibility read returning the caller's organization and company identities. Prefer get_company_briefing for company-specific work. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• get_payment_pipeline_status

  Canonical read for Corply's own payment pipeline: returns non-secret merchant routes, lifecycle counts, gross settled/refunded/paid-out totals, recent payment state, reconciliation state, and exact blockers for one company. It never returns provider credentials, hosted payment tokens, bank/card data, or customer data; makes zero provider calls and moves no money. Use this instead of the legacy Paddle integration planner when the founder wants Corply-controlled payment portals. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• get_status

  Return the formation status for a company (or its latest formation): founder-facing checklist, the payment block, THIS caller's pendingSignatures + who else is awaitingOthers, postIncorp tasks, webDashboardUrl, and nextStep — trust nextStep over your own inference of what comes next. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• import_cap_table

  Import a cap table from a Carta/Pulley CSV export (one-way — Corply becomes the system of record). Owner/founder only. Call with confirm:false first to PREVIEW the parsed holders; confirming REPLACES the company's entire existing cap table with the imported set. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• invite_cofounders

  Requires the incorporation fee to be PAID first (request_payment → await_payment). Compatibility action that emails each OTHER listed founder's pending review-and-sign link after documents are generated. It never creates or refreshes membership invitations; use invite_member earlier, after explicit founder confirmation. Only run when the lead explicitly asks. Sign links are delivered directly to each cofounder and are shown here only when their email fails. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• invite_member

  Invite a cofounder to this organization by email. Call only after the founder explicitly confirms the invitation. This membership invitation is independent of name checks, documents, payment, and signatures. They join from their own connected Corply session by signing in with that email. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• manage_operating_access_grant

  Owner/operator-only grant or revocation of one person's expiring access to one restricted operating-data class. Use the narrowest subject and class, explain the business purpose, cap access at 90 days, and revoke immediately when the engagement ends. Revocation is retained as an audit tombstone. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• mark_task_done

  Report one of YOUR post-incorporation tasks as done (for example, opening your bank account) with an optional note. Corply's team verifies and completes it — status becomes 'pending review'. Only works for tasks assigned to the founder. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• nudge_signer

  Re-send the signature reminder email to a cofounder who hasn't signed yet. Only when the lead asks. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• prepare_83b_tin_input

  Create a short-lived, one-time external-browser link for the taxpayer to enter the SSN/ITIN required on their exact signed 83(b) election. Use only after that founder has signed. Never ask for, accept, repeat, or place a TIN in chat. The link is reversible and may be refreshed without additional confirmation. Corply never stores the TIN as a database field; Corply Ops receives only a short-lived encrypted mail-ready PDF to print and mail. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• prepare_revenue_launch

  LEGACY PADDLE SUBSCRIPTION MIGRATION ONLY; for a new Corply-controlled payment portal call get_payment_pipeline_status instead. The calling coding agent must inspect framework, package manager, app/source root, and test/build commands itself before calling—never ask the founder for repository metadata. Reuses the authenticated company's non-secret formation facts, classifies whether the older fixed-price SaaS subscription Paddle merchant-of-record path fits, and returns only the commercial facts that genuinely need founder input. Makes zero provider calls and no writes; never requests credentials, identity documents, bank/card data, or acceptance of terms. If multiple companies exist, pass an exact companyId from get_company_briefing. Trust nextTool and do not bypass an unsupported marketplace, digital-goods, one-time/mixed/usage billing, physical-goods, or services result. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• recall

  Search the organization's context memory + Corply reference KB for relevant facts. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• reconcile_bank_onboarding

  Owner/operator recovery for one uncertain Mercury onboarding attempt. Call only after Mercury directly confirms either the exact onboardingDataId and mercury.com signup link, or that no active application remains and a corrected retry is safe. Never infer or invent provider evidence. This action creates an auditable reconciliation record. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• reconcile_payment_route

  Read the exact active Moov sandbox wallet balance and compare it with Corply's immutable route-scoped platform-cash postings, then record a hash-bound reconciliation run. It makes provider reads only, exposes no provider account, wallet, credential, bank/card, or customer data, and moves no money. The first run may anchor a pre-existing wallet balance only before any payment or journal activity; later variance fails readiness closed. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• record_existing_completion

  Record evidence that the company completed one exact materialized work occurrence outside Corply. The command pins rule/version/subject/occurrence, requires a durable idempotency key and explicit attestation, and routes the immutable claim to automatic, operator, or professional review. This tool never marks the work completed merely because evidence was submitted; use the normal fact and work-transition tools only after the returned review and remaining evidence/outcome gaps are resolved. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• record_operating_event

  Atomically stage or promote one event occurrence's stable ID and mutable anchor fact. Use this for every fact named by an event rule; scalar writes are rejected to prevent mixed IDs/deadlines. If evidence is required, the first call returns candidate fact IDs. Bind evidence to each evidence-gated candidate, then retry with identical source and validity inputs; both facts become canonical in one transaction. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• record_operating_evidence

  Record a company-owned evidence artifact, then freshly resolve the plan. Evidence is not task completion by itself; attach its id when transitioning a work item. For new files, call upload_operating_evidence (or the authenticated multipart upload endpoint) and use its server-returned filePath/fileHash. Founder-uploaded documents remain claims: use submit_operating_fact_evidence to bind and queue them for operator review. Only an operator may directly promote an evidence-confirmed fact. Professional determinations require named reviewer credentials. A guidance link or model assertion is never professional evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• record_operating_fact

  Record a typed, versioned company or subject fact and freshly resolve the plan. High-impact facts become canonical only with the registry's required confirmation/evidence. Never infer immigration status, work authorization, tax/legal conclusions, or other restricted facts; record explicit evidence or a qualified professional determination. A non-promoted candidate is not safe to treat as true. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• redeem_invite

  Join an organization with an invite join code. Ask the user to confirm first ('Join {company} as a cofounder?') — joining switches your active organization and best-effort emails the other active organization members that their cofounder joined. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• refresh_payment_route_onboarding

  Read the exact hosted Moov sandbox onboarding invite, required capability statuses, default wallet, and verified payout-bank method for one Corply route, then converge the server-only route connection. It accepts no provider IDs, credentials, identity documents, bank/card data, or terms acceptance from chat. It makes provider reads only, never changes the provider account, and activates the sandbox route only when all required provider facts are currently ready; it moves no money and cannot enable production. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• remember

  Persist a durable decision/fact into the organization's context memory. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• request_payment

  MANDATORY before any signing: prepare (or reuse) the checkout link for the one-time Corply incorporation fee. Two tiers, and the ONLY difference is how long registered agent is covered: registeredAgent='year_one' is $449 (Essential: formation plus the first year of registered agent), registeredAgent='lifetime' is $799 (formation plus registered agent for the life of the company). Ask the founder which they want before calling; default to year_one if they do not care, because they can upgrade later for $350 at any time via request_registered_agent_upgrade with nothing lost. Optionally include Corply Mail in the SAME Stripe checkout: corplyMail='annual' includes 365 days, then renews at $119/year; corplyMail='monthly' includes 365 days, then renews at $15/month; corplyMail='none' creates no recurring mail subscription. Before selecting annual or monthly, disclose the exact renewal price, that Stripe stores the payment method, and that the founder can cancel in Billing. Never infer consent; default to none. Promo codes are accepted on year_one only. Show the returned checkoutUrl to the founder in chat as a markdown link — creating the link needs no confirmation; the founder chooses whether to Pay in the browser. Only the lead founder pays, once per company; cofounders never pay, and editing/regenerating documents never re-charges. Safe to re-call: it reuses the open session, and switching tier retires the old link and issues the right one. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• request_registered_agent_upgrade

  Upgrade a company from first-year registered agent to LIFETIME registered agent for $350, at any time after the incorporation fee is paid. This is the difference between the $449 Essential tier and the $799 Lifetime tier, so a founder who chose Essential loses nothing by upgrading later. Returns {status:'checkout_ready', checkoutUrl, amountDue} — show the link to the founder as a markdown link, then poll await_registered_agent_upgrade. Returns {status:'already_lifetime'} if the company already has lifetime coverage, in which case say so and do NOT offer to charge again. Requires a paid incorporation fee first: there is no registered agent to extend otherwise. Safe to re-call, it reuses the open session. No promo codes on this one. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• request_signature

  Requires the incorporation fee to be PAID first (request_payment → await_payment). Phase-aware and idempotent: before Delaware acceptance it prepares each founder's one filing-stage bundle. The incorporator's bundle includes the Certificate of Incorporation; every founder's bundle includes the narrow Founder Formation Authorization for the enumerated standard post-acceptance records. After acceptance, standard-v1 records are executed from that stored authorization and must never become a second human signature request. Only a legacy formation that predates the authorization can return a post-acceptance signing bundle. Once an authorized founder's RSPA is fully executed and establishes the stock-purchase date, Corply prepares and executes that founder's 83(b) automatically from the same stored authority. This preparatory action needs no confirmation and sends no cofounder email. It returns only the caller's safe server-issued signing bundle and review link; present reviewUrl as a markdown link. Use the separately confirmed invite_cofounders or nudge_signer action for external messages. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• resolve_company_plan

  Deterministically resolve and materialize the company's current operating graph. The lifecycle is always running—never report globally done. Treat unknown facts as unknown and ask only returned questions; never infer immigration/work permission or restricted personal facts. Honor evidence, signature, payment, authority, licensed-professional, and other human boundaries before acting. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• run_sandbox_payment_probe

  After fresh founder confirmation of the exact USD 1.00 Moov sandbox charge, create or replay one server-priced diagnostic order and send its server-configured card-payment source through Corply's durable create-and-authorize pipeline. The tool accepts no provider IDs, card/bank data, customer data, amount, currency, merchant, fee, reserve, or payout destination. It requires an active route, a fresh zero-variance reconciliation, server-held probe configuration, and an exact idempotency key. This is test-mode money movement only; it cannot charge live money, enable production, or prove settlement by itself. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• run_sandbox_payout_probe

  After fresh founder confirmation of the exact USD 0.01 Moov sandbox payout, send one cent from one exact settled diagnostic payment through Corply's durable payout command to the route's server-resolved verified standard-ACH bank. The tool accepts no amount, currency, provider ID, wallet, bank/card data, or payout destination. It requires the exact paymentKey, active sandbox route, fresh zero-variance reconciliation, and verified bank. This is test-mode money movement only; the scheduled worker records the provider's exact after-the-fact payout fee from transfer and wallet evidence before reconciliation can pass. It cannot move live money or enable production. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• save_application

  Deep-merge upsert of the structured formation application for a company: incremental saves merge over what's already stored — a partial payload never wipes untouched sections. This reversible intake save needs no confirmation. Standard restricted founder shares default to an 83(b) election; omit those fields and do not ask the founder for a separate 83(b) decision. The signing bundle later captures the required authorization. It refuses changes to a frozen legal packet; use amend_frozen_application after explicit founder confirmation when documents and signatures must be superseded. Returns { formationId, nextStep }. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• sign_bundle

  Record one binding ESIGN/UETA consent for the exact server-issued bundle returned by get_status or request_signature. CALLER GATE: only the live signer may call it, after reviewing every listed document and giving one fresh affirmative act. Never reuse prior-session consent or sign for an absent cofounder. The opaque bundleId prevents omitted, added, or stale documents. For an eligible founder who already elected Section 83(b), the pre-filing Founder Formation Authorization also grants narrow advance authority: once the RSPA establishes the transfer date, Corply automatically completes and executes the election without another signature or confirmation. Then show/open the returned external-browser TIN link immediately and never ask for the TIN in chat. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• start_bank_onboarding

  Create one consented Mercury partner prefill and return the founder-only signup link. Call get_bank_onboarding_status first. Never request or include an SSN, identity image, raw formation document, Mercury credential, or legal name/EIN override; Corply loads trusted company facts server-side. Obtain fresh founder confirmation that Corply may send the supplied owner, address, and business data to Mercury before calling. The founder still completes Mercury identity verification, reviews the application, accepts Mercury's terms, and submits it. Reuse the exact idempotencyKey after a timeout and never invent a new key for an uncertain attempt. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• start_payment_route_onboarding

  Create or recover the secure hosted Moov sandbox onboarding link for one existing Corply payment route. This makes an idempotent provider call after a durable local claim, pre-fills only the canonical legal business name, and asks the founder to complete identity, ownership, underwriting, pricing disclosure, capability, and payout-bank setup directly with Moov. It never receives identity documents, bank/card data, provider credentials, or terms acceptance in chat, activates no route, and moves no money. Return the onboardingLink to the founder, then call get_payment_pipeline_status after they complete it. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• submit_for_formation

  Requires the incorporation fee to be PAID first (request_payment → await_payment). Hand the fully-signed formation to the human filing pipeline, then best-effort notify the organization and email the signed incorporation documents to each founder. Does NOT file with Delaware. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• submit_operating_fact_evidence

  Submit one founder-provided document for an evidence-confirmed operating fact. This stages the exact typed assertion, binds the server-verified immutable artifact, and creates a durable operator-review claim. Submission never makes the fact canonical and the resolver will continue to ask for it until an operator approves the exact claim. filePath/fileHash must come from upload_operating_evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• transition_operating_work_item

  Transition one materialized work occurrence by workItemId, then freshly resolve the company plan. Completion is rejected until attached company evidence covers every requirement and required human/professional boundaries. Legal, tax, regulatory, provider, and contractual requirements cannot be waived; change facts only with truthful evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.

  shallow
• upload_operating_evidence

  Store exact caller-supplied evidence bytes in the active company's private canonical evidence prefix and return the server-computed SHA-256 needed by record_operating_evidence. Use only when the client has supplied the actual base64 file bytes; never invent bytes from a description. Browser/desktop clients should use POST /operating/evidence/upload for files larger than the MCP limit. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• upsert_operating_subject

  Create or update one durable company-owned subject, including a person, location, product, offering, customer, vendor, contract, equity award, account, or obligation, then freshly resolve the plan. Use a stable externalKey; store decision facts through record_operating_fact, not opaque attributes. Never fabricate personal, immigration, or credential data. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• validate_application

  Validate the formation application and return missing fields as dotted paths. Promotes the formation to 'ready' when complete and returns the canonical next step. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; trust the returned actual_tool_output and context_engineering instead of adding a state-recovery call. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• verify_payment_integration

  Inventory caller-reported local/sandbox evidence references against every required Corply Pay control: build/type tests, webhook authenticity/idempotency/out-of-order delivery, subscription lifecycle, deny-by-default entitlements, tenant isolation, return-URL validation, secret scan, and sandbox checkout. This tool reports only whether that caller-supplied inventory is complete; it does not execute or independently attest commands, establish sandbox or production readiness, or make provider calls. Passed/failed results require the exact command and a SHA-256 evidence reference. Evidence inventory completeness NEVER completes KYB/KYC, terms, payout-bank, provider approval, refunds, money movement, migrations, deployment, or production go-live; report those as explicit unverified human/external actions and require fresh founder confirmation for any later live action. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow
• whoami

  Return the resolved caller identity (user + org). If pendingInvites is non-empty, tell the user and OFFER to join (confirm before redeem_invite). Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.

  shallow

Embed this server’s score

Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.

[![Vouch score](https://vouch.tools/api/servers/ebc29e6c-5dc0-44ac-9da0-3aac86181f9a/badge.svg)](https://vouch.tools/servers/ebc29e6c-5dc0-44ac-9da0-3aac86181f9a)