Storyblok

Because they are dispatchers, not endpoints. Rather than exposing one tool per Management API operation and overwhelming the model, Storyblok offers generic tools covering the whole API: search finds an operation, describe returns its parameters, and one of three execute tools runs it. Seven tools therefore reach the entire Management API surface.

The execute tool names it. Storyblok splits execution into execute_readonly, execute_mutating and execute_destructive, and the describe result tells you which one an operation requires through its executeWith field. The safety class is therefore part of the call you make, not something you infer from an operation name.

Storyblok recommends the CLI for anything repeatable. It states that because the LLM mediates every MCP call, results are non-deterministic and unsuited to repeatable, high-volume work. Use MCP for one-off changes and prototyping; use the CLI for CI/CD, bulk content updates, space-to-space syncs and migrations, where it offers dry runs and idempotency.

Because it cannot infer it. Storyblok's own instructions tell an agent that if describe shows no space_id parameter, it must ask you for your region — eu, us, cn, ap or ca — and must not guess. Most operations need a numeric space_id too, which the agent is told to request rather than assume.

Yes, in two steps and with a manual fallback. upload_asset returns a signed S3 URL and a ready-to-use curl command; upload_asset_finish finalizes it. Storyblok's instructions say that if the agent has no shell access it should show you the Storyblok asset manager link instead, so the upload can be completed by hand.

Yes. The initialize handshake answers anonymously and returns the server's usage instructions, but both tools/list and prompts/list reply unauthorized and point at RFC 9728 discovery. So the handshake is open and the tool surface is not — you authenticate through OAuth before any tool is visible.