# `Lotus.Web.MCP.Access`
[🔗](https://github.com/elixir-lotus/lotus_web/blob/v1.4.0/lib/lotus/web/mcp/access.ex#L2)

Asks the `Lotus.Web.Resolver` about every MCP call, with the action the
dashboard would ask about for the same thing.

| Tool | Action | Resource |
|---|---|---|
| `list_data_sources` | `:discover` or `:query` | each source listed |
| `list_schemas`, `list_tables`, `describe_table` | `:discover` or `:query` | the data source |
| `get_column_values`, `run_sql` | `:query` | the data source |
| `list_queries` | `:query` | each query's data source |
| `get_query`, `run_query`, `show_chart` | `:query` | the query's data source |
| `save_query` | `:create_query`, and `:query` | `nil`, and the data source |
| `update_query`, `save_chart` | `:update_query` | the query |
| `list_dashboards` | `:view_dashboard` | each dashboard listed |
| `get_dashboard`, `run_dashboard` | `:view_dashboard` | the dashboard |
| `create_dashboard` | `:manage_dashboard` | `nil` |
| `add_dashboard_card` | `:manage_dashboard`, and `:query` for a query card | the dashboard, and the query's data source |

A resource needs `:query` (a saved query, on its data source; the chart
app) or `:view_dashboard` (a dashboard).

The tool list shows what the access level allows (and, for actions that
take no resource, what `authorize/3` allows); the call asks
`authorize/3` with the resource. A list tool's result leaves out what
the person may not see. A tool this table does not name is not listed,
so a tool a later Lotus adds stays hidden until Lotus Web maps it.

---

*Consult [api-reference.md](api-reference.md) for complete listing*