Skip to main content

discover_context

discover_context answers the question "what is governed in this workspace?" It lists every governed asset — tables and columns — from the current deployment publication's deployed instruction decisions, with a per-asset instruction count and the canonical scenario keys under which instructions govern it. Like every Metatate MCP tool it is read-only and advisory: it describes published governance state and never changes it. Clients that present hyphenated tool names can call it as discover-context; the alias is accepted 1:1.

When to useDirect link to When to use

Call discover_context first, before any per-asset question:

  • To map the governed surface of a workspace before drilling into a specific table or column.
  • To collect the exact asset references (database, schema, table, column) and canonical scenario_key values that later calls to get_decision_context, inspect_governance_rules, and authorize_use accept.
  • To confirm that a workspace has a current publication at all — if nothing is published, this tool says so with a typed answer state instead of an empty list.

InputDirect link to Input

All parameters are optional. An empty input ({}) lists every governed asset visible to the workspace.

ParameterTypeRequiredDescription
databasestringNoFilter to one database, by exact normalized name (for example acmecloud_demo).
schemastringNoFilter to one schema, by exact normalized name (for example public).
domainstringNoAccepted by the schema, but answers with a not_supported error today (see below).
sensitivitystringNoOne of public, internal, confidential, restricted. Accepted by the schema, but answers not_supported today.
piibooleanNoAccepted by the schema, but answers not_supported today.
compliance_tagstringNoAccepted by the schema, but answers not_supported today.

The input schema is strict: unknown keys are rejected with invalid_parameters.

OutputDirect link to Output

A successful call returns one JSON payload as the tool result's structured content (also serialized into the text content), discriminated by state.

When the state is answered:

FieldDescription
state"answered".
assetsArray of governed-asset summaries (may be empty after filtering).
assets[].refThe asset scope: database, schema, table, and column. column is always present and is null for a table-level entry. Table-level and column-level scopes appear as separate entries.
assets[].instruction_countHow many published instructions govern this exact scope.
assets[].scenario_keysThe canonical scenario keys under which instructions govern the scope — valid values for scenario_key in follow-up calls.
publicationProvenance of the current deployment publication: publication_id and published_at.

Answer statesDirect link to Answer states

discover_context returns two of the three typed answer states — it never returns review_required:

  • answered — a current publication exists and carries instruction state; the governed-asset list is returned.
  • not_enough_published_state — with reason_code no_current_publication (no deployment publication is current) or no_published_instruction_state (a current publication exists but carries zero instruction decisions). The payload carries a fixed message, an unresolved_targets array (always empty for this tool), and next_actions guidance. A missing publication is never reported as an empty "nothing governed" list.

See Typed answer states for the full model.

ExampleDirect link to Example

Request arguments:

{
  "database": "acmecloud_demo",
  "schema": "public"
}

Response (trimmed to three assets; a real answer lists every governed scope):

{
  "state": "answered",
  "assets": [
    {
      "ref": {
        "database": "acmecloud_demo",
        "schema": "public",
        "table": "customers",
        "column": null
      },
      "instruction_count": 17,
      "scenario_keys": [
        "ai.inference",
        "ai.training",
        "purpose.allowed_use",
        "purpose.prohibited_use",
        "residency.cross_border_transfer"
      ]
    },
    {
      "ref": {
        "database": "acmecloud_demo",
        "schema": "public",
        "table": "customers",
        "column": "email"
      },
      "instruction_count": 1,
      "scenario_keys": ["masking.display"]
    },
    {
      "ref": {
        "database": "acmecloud_demo",
        "schema": "public",
        "table": "support_tickets",
        "column": null
      },
      "instruction_count": 14,
      "scenario_keys": ["ai.training", "purpose.prohibited_use", "sharing.internal"]
    }
  ],
  "publication": {
    "publication_id": "accef000-0000-4000-8000-000000000001",
    "published_at": "2026-07-16T00:00:00.000Z"
  }
}

Note that acmecloud_demo.public.legacy_customer_backup — a table in the sample estate with no governing policy — does not appear: discover_context lists governed scopes from published instruction state, not the full catalog.

Limits and notesDirect link to Limits and notes

  • Unsupported filters refuse explicitly. Providing domain, sensitivity, pii, or compliance_tag returns a not_supported error. These filters are part of the input schema but are not backed by published instruction context facts on the current read surface. The refusal is deliberate: a filter is never silently ignored, so you never mistake an unfiltered list for a filtered one.
  • Filters are exact matches. database and schema compare against normalized (lowercase) catalog names; there is no pattern or prefix matching. A filter that matches nothing returns answered with an empty assets array — distinct from not_enough_published_state, which means there is no publication or no instruction state at all.
  • Metering. Every call that passes input validation consumes one MCP call from your plan's metered allowance before any read happens; over quota, the call fails with quota_exceeded. A call rejected with invalid_parameters is not metered. See Plans.
  • Error codes. Failures outside the typed answer states are redacted errors returned with isError: true and a body of the form {"error": {"code", "message"}}: invalid_parameters, not_supported, read_failed, unauthorized, auth_unavailable, rate_limited, quota_exceeded.
  • Current publication only. Draft policies, approved-but-unpublished changes, and pending deployment plans never appear. Publish a deployment to change what this tool reports; see Deployments.