The AI agent does not see a tool, or a call fails with 403 or 412

The MCP adapter of Syncplify Server! (ss-mcp) offers an AI agent exactly the tools its automation token may use, and every change goes through a preview and a confirmation. Nearly every problem with it is therefore one of three things: the token is narrower than you think, the server refused a call, or the object changed between the preview and the confirmation. Start with the check command:

SS_MCP_TOKEN=ssat_... ss-mcp --server https://files.example.com:6443 --plane adm --check

It prints the token's owner and scopes (readOnly, service, the view and edit permission lists), the comparison with the server's specification, and every tool the agent will see.

The agent says it has no tool for what I asked

The adapter offers read tools where the token may view an object, write and delete tools where it may edit one and is not read only, and service tools only with the serviceActions scope. A tool that is missing is one the token may not use.

• Every write is missing: the token is read only, or the adapter runs with --read-only. The check output says which (readOnly: true (adapter flag false) is the token).
• The tools of one object are missing (for example everything about storage): the Admin token lacks that permission (VFS), or its owner lost it: a token never exceeds its owner. Edit the token in the Admin console, or the owner's permissions in the SuperAdmin console.
• Restart, drain, update, start or stop a site, renew a certificate, terminate a session: these need the serviceActions scope on the token, which View and Edit never imply.
• A tool the manual documents is missing on an older server: the check output lists the tools left out because the server does not have them (N tools left out), when the server publishes its specification. Update the server.

After you widen the token, the agent's list follows within five minutes, or at once after the next refused call. Starting a new conversation or restarting the client refreshes it immediately.

A tool answered 403

The server refused the call for lack of rights: webrest.token.readOnly (a read only token called a write), webrest.token.serviceActionsRequired (a service action without the scope), webrest.perm.forbidden (an Admin permission the token or its owner lacks) or webrest.token.routeForbidden (a route no token may ever call, such as anything about operator accounts, passwords, passkeys, backups or tokens). The adapter refreshes the tool list right after a 403, so the tool the agent used disappears, and the agent is told why. Widen the token if the refusal is wrong; nothing can be done about routeForbidden, by design.

A confirmed change answered 412

Someone, or something, changed the object between the agent's preview and your confirmation: the confirmed call carries the ETag of the preview, and the server refuses to overwrite a newer version (webrest.request.preconditionFailed). Nothing was changed. Ask the agent to try again; it previews the current state of the object, and you confirm that.

"The confirmation does not match these arguments or has expired"

The confirmation token is bound to the tool, the exact arguments and the ETag of the preview, and is valid for ten minutes inside one adapter process. The agent changed an argument between the preview and the confirmation, waited too long, or the adapter was restarted (the client was closed and reopened) in between. Ask the agent to start over without confirming; the new preview comes with a new token.

The adapter does not start

The client reports that the server failed, or the Syncplify tools never appear. Run the exact command from a terminal, with the same environment and --check; the adapter prints the reason and exits.

What it prints	What to do
the token is never accepted on the command line	By design. Put it in SS_MCP_TOKEN, or in a file named by --token-file.
--plane (or SS_MCP_PLANE) is required	Add --plane adm for an Admin token or --plane sa for a SuperAdmin token.
--server must be an https URL	The console address is https://host:6443, without a path. Plain http is accepted only for the local machine.
the token was not accepted, automationTokenRejected	Wrong plane for this token (an Admin token on sa or a SuperAdmin token on adm), a wrong server, or a mistyped token.
automationTokenRevoked, automationTokenExpired, automationTokenOwnerDisabled	The token or its owner is no longer valid. Create a new token.
automationTokensDisabled	A SuperAdmin turned tokens off under Global Configuration, Automation.
automationNotLicensed	Automation tokens need a Professional or Ultimate license.
a certificate error	The server uses a private certificate authority: pass it with --ca-cert. Do not turn verification off.
nothing at all, and the client still fails	The path in the client's configuration is wrong (on Windows, every backslash in a JSON string is doubled), the file is not executable, or the environment block lacks the token.

The reference for every refusal code is the manual's Reason codes page; the adapter is described on The MCP adapter.