Reimplement MCP

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -6,11 +6,15 @@ package mcp_v1
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"time"
 
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/mail"
 	"go.probo.inc/probo/pkg/page"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/authn"
@@ -1892,16 +1896,6 @@ func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.Call
 	}, nil
 }
 
-func (r *Resolver) ListProfilesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListProfilesInput) (*mcp.CallToolResult, types.ListProfilesOutput, error) {
-	return nil, types.ListProfilesOutput{}, fmt.Errorf("listProfiles not implemented")
-}
-func (r *Resolver) GetProfileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetProfileInput) (*mcp.CallToolResult, types.GetProfileOutput, error) {
-	return nil, types.GetProfileOutput{}, fmt.Errorf("getProfile not implemented")
-}
-func (r *Resolver) UpdateProfileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateProfileInput) (*mcp.CallToolResult, types.UpdateProfileOutput, error) {
-	return nil, types.UpdateProfileOutput{}, fmt.Errorf("updateProfile not implemented")
-}
-
 func (r *Resolver) ListMeetingsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeetingsInput) (*mcp.CallToolResult, types.ListMeetingsOutput, error) {
 	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionMeetingList)
 
@@ -2055,3 +2049,178 @@ func (r *Resolver) DeleteMeasureTool(ctx context.Context, req *mcp.CallToolReque
 		DeletedMeasureID: input.ID,
 	}, nil
 }
+
+func (r *Resolver) ListUsersTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListUsersInput) (*mcp.CallToolResult, types.ListUsersOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, iam.ActionMembershipProfileList)
+
+	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
+		Field:     coredata.MembershipProfileOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if input.OrderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.MembershipProfileOrderField]{
+			Field:     input.OrderBy.Field,
+			Direction: input.OrderBy.Direction,
+		}
+	}
+	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
+
+	filter := coredata.NewMembershipProfileFilter(nil)
+	if input.Filter != nil {
+		filter = coredata.NewMembershipProfileFilter(input.Filter.ExcludeContractEnded)
+	}
+
+	pageResult, err := r.iamSvc.OrganizationService.ListProfiles(ctx, input.OrganizationID, cursor, filter)
+	if err != nil {
+		return nil, types.ListUsersOutput{}, fmt.Errorf("list users: %w", err)
+	}
+
+	users := make([]*types.Profile, 0, len(pageResult.Data))
+	for _, p := range pageResult.Data {
+		users = append(users, types.NewProfile(p))
+	}
+	var nextCursor *page.CursorKey
+	if len(pageResult.Data) > 0 && pageResult.Cursor != nil {
+		cursorKey := pageResult.Data[len(pageResult.Data)-1].CursorKey(pageResult.Cursor.OrderBy.Field)
+		nextCursor = &cursorKey
+	}
+	return nil, types.ListUsersOutput{
+		Users:      users,
+		NextCursor: nextCursor,
+	}, nil
+}
+
+func (r *Resolver) GetUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetUserInput) (*mcp.CallToolResult, types.GetUserOutput, error) {
+	profile, err := r.iamSvc.OrganizationService.GetProfile(ctx, input.ID)
+	if err != nil {
+		var errNotFound *iam.ErrProfileNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, types.GetUserOutput{}, fmt.Errorf("user not found: %w", err)
+		}
+		return nil, types.GetUserOutput{}, fmt.Errorf("get user: %w", err)
+	}
+	r.MustAuthorize(ctx, profile.OrganizationID, iam.ActionMembershipProfileGet)
+	return nil, types.GetUserOutput{User: types.NewProfile(profile)}, nil
+}
+
+func (r *Resolver) CreateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateUserInput) (*mcp.CallToolResult, types.CreateUserOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate)
+
+	var contractStart, contractEnd **time.Time
+	if input.ContractStartDate != nil {
+		contractStart = &input.ContractStartDate
+	}
+	if input.ContractEndDate != nil {
+		contractEnd = &input.ContractEndDate
+	}
+	profile, err := r.iamSvc.OrganizationService.CreateUser(ctx, &iam.CreateUserRequest{
+		OrganizationID:           input.OrganizationID,
+		EmailAddress:             input.EmailAddress,
+		Role:                     input.Role,
+		FullName:                 input.FullName,
+		AdditionalEmailAddresses: input.AdditionalEmailAddresses,
+		Kind:                     input.Kind,
+		Position:                 input.Position,
+		ContractStartDate:        contractStart,
+		ContractEndDate:          contractEnd,
+	})
+	if err != nil {
+		var errAlreadyExists *iam.ErrUserAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, types.CreateUserOutput{}, fmt.Errorf("user with email already exists: %w", err)
+		}
+		return nil, types.CreateUserOutput{}, fmt.Errorf("create user: %w", err)
+	}
+	return nil, types.CreateUserOutput{User: types.NewProfile(profile)}, nil
+}
+
+func (r *Resolver) InviteUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.InviteUserInput) (*mcp.CallToolResult, types.InviteUserOutput, error) {
+	r.MustAuthorize(ctx, input.ProfileID, iam.ActionInvitationCreate)
+
+	invitation, err := r.iamSvc.OrganizationService.InviteUser(ctx, &iam.CreateInvitationRequest{
+		OrganizationID: input.OrganizationID,
+		ProfileID:      input.ProfileID,
+	})
+	if err != nil {
+		var errOrgNotFound *iam.ErrOrganizationNotFound
+		var errUserExists *iam.ErrUserAlreadyExists
+		if errors.As(err, &errOrgNotFound) {
+			return nil, types.InviteUserOutput{}, fmt.Errorf("organization not found: %w", err)
+		}
+		if errors.As(err, &errUserExists) {
+			return nil, types.InviteUserOutput{}, fmt.Errorf("user already in organization: %w", err)
+		}
+		return nil, types.InviteUserOutput{}, fmt.Errorf("invite user: %w", err)
+	}
+	return nil, types.InviteUserOutput{InvitationID: invitation.ID}, nil
+}
+
+func (r *Resolver) UpdateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateUserInput) (*mcp.CallToolResult, types.UpdateUserOutput, error) {
+	r.MustAuthorize(ctx, input.ID, iam.ActionMembershipProfileUpdate)
+
+	var additionalEmails []mail.Addr
+	if input.AdditionalEmailAddresses != nil {
+		additionalEmails = *input.AdditionalEmailAddresses
+	}
+	var position *string
+	if p := UnwrapOmittable(input.Position); p != nil {
+		position = *p
+	}
+	var contractStart, contractEnd **time.Time
+	if p := UnwrapOmittable(input.ContractStartDate); p != nil {
+		contractStart = p
+	}
+	if p := UnwrapOmittable(input.ContractEndDate); p != nil {
+		contractEnd = p
+	}
+	profile, err := r.iamSvc.OrganizationService.UpdateUser(ctx, &iam.UpdateUserRequest{
+		ID:                       input.ID,
+		FullName:                 input.FullName,
+		AdditionalEmailAddresses: additionalEmails,
+		Kind:                     input.Kind,
+		Position:                 position,
+		ContractStartDate:        contractStart,
+		ContractEndDate:          contractEnd,
+	})
+	if err != nil {
+		return nil, types.UpdateUserOutput{}, fmt.Errorf("update user: %w", err)
+	}
+	return nil, types.UpdateUserOutput{User: types.NewProfile(profile)}, nil
+}
+
+func (r *Resolver) UpdateMembershipTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMembershipInput) (*mcp.CallToolResult, types.UpdateMembershipOutput, error) {
+	r.MustAuthorize(ctx, input.MembershipID, iam.ActionMembershipUpdate)
+	if input.Role == coredata.MembershipRoleOwner {
+		r.MustAuthorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner)
+	}
+
+	membership, err := r.iamSvc.OrganizationService.UpdateMempership(ctx, input.OrganizationID, input.MembershipID, input.Role)
+	if err != nil {
+		return nil, types.UpdateMembershipOutput{}, fmt.Errorf("update membership: %w", err)
+	}
+	return nil, types.UpdateMembershipOutput{
+		Membership: &types.Membership{
+			ID:        membership.ID,
+			Role:      membership.Role,
+			CreatedAt: membership.CreatedAt,
+		},
+	}, nil
+}
+
+func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RemoveUserInput) (*mcp.CallToolResult, types.RemoveUserOutput, error) {
+	r.MustAuthorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete)
+
+	err := r.iamSvc.OrganizationService.RemoveUser(ctx, input.OrganizationID, input.ProfileID)
+	if err != nil {
+		var errManagedBySCIM *iam.ErrUserManagedBySCIM
+		var errLastOwner *iam.ErrLastActiveOwner
+		if errors.As(err, &errManagedBySCIM) {
+			return nil, types.RemoveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be removed: %w", err)
+		}
+		if errors.As(err, &errLastOwner) {
+			return nil, types.RemoveUserOutput{}, fmt.Errorf("cannot remove last active owner: %w", err)
+		}
+		return nil, types.RemoveUserOutput{}, fmt.Errorf("remove user: %w", err)
+	}
+	return nil, types.RemoveUserOutput{DeletedUserID: input.ProfileID}, nil
+}

pkg/server/api/mcp/v1/server/server.go

@@ -12,11 +12,15 @@ import (
 type ResolverInterface interface {
 	ListOrganizationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListOrganizationsInput) (*mcp.CallToolResult, types.ListOrganizationsOutput, error)
 	ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorsInput) (*mcp.CallToolResult, types.ListVendorsOutput, error)
-	ListProfilesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListProfilesInput) (*mcp.CallToolResult, types.ListProfilesOutput, error)
+	ListUsersTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListUsersInput) (*mcp.CallToolResult, types.ListUsersOutput, error)
+	GetUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetUserInput) (*mcp.CallToolResult, types.GetUserOutput, error)
+	CreateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateUserInput) (*mcp.CallToolResult, types.CreateUserOutput, error)
+	InviteUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.InviteUserInput) (*mcp.CallToolResult, types.InviteUserOutput, error)
+	UpdateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateUserInput) (*mcp.CallToolResult, types.UpdateUserOutput, error)
+	UpdateMembershipTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMembershipInput) (*mcp.CallToolResult, types.UpdateMembershipOutput, error)
+	RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RemoveUserInput) (*mcp.CallToolResult, types.RemoveUserOutput, error)
 	AddVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorInput) (*mcp.CallToolResult, types.AddVendorOutput, error)
 	UpdateVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorInput) (*mcp.CallToolResult, types.UpdateVendorOutput, error)
-	GetProfileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetProfileInput) (*mcp.CallToolResult, types.GetProfileOutput, error)
-	UpdateProfileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateProfileInput) (*mcp.CallToolResult, types.UpdateProfileOutput, error)
 	ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error)
 	GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error)
 	AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error)
@@ -148,16 +152,80 @@ func registerToolHandlers(server *mcp.Server, resolver ResolverInterface) {
 	mcp.AddTool(
 		server,
 		&mcp.Tool{
-			Name:         "listProfiles",
-			Description:  "List all profiles for the organization",
-			InputSchema:  types.ListProfilesToolInputSchema,
-			OutputSchema: types.ListProfilesToolOutputSchema,
+			Name:         "listUsers",
+			Description:  "List all users for the organization",
+			InputSchema:  types.ListUsersToolInputSchema,
+			OutputSchema: types.ListUsersToolOutputSchema,
 			Annotations: &mcp.ToolAnnotations{
 				ReadOnlyHint:   true,
 				IdempotentHint: true,
 			},
 		},
-		resolver.ListProfilesTool,
+		resolver.ListUsersTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "getUser",
+			Description:  "Get a user by ID (profile ID)",
+			InputSchema:  types.GetUserToolInputSchema,
+			OutputSchema: types.GetUserToolOutputSchema,
+			Annotations: &mcp.ToolAnnotations{
+				ReadOnlyHint:   true,
+				IdempotentHint: true,
+			},
+		},
+		resolver.GetUserTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "createUser",
+			Description:  "Create a new user in the organization",
+			InputSchema:  types.CreateUserToolInputSchema,
+			OutputSchema: types.CreateUserToolOutputSchema,
+		},
+		resolver.CreateUserTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "inviteUser",
+			Description:  "Invite a user (profile) to the organization",
+			InputSchema:  types.InviteUserToolInputSchema,
+			OutputSchema: types.InviteUserToolOutputSchema,
+		},
+		resolver.InviteUserTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "updateUser",
+			Description:  "Update an existing user (profile)",
+			InputSchema:  types.UpdateUserToolInputSchema,
+			OutputSchema: types.UpdateUserToolOutputSchema,
+		},
+		resolver.UpdateUserTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "updateMembership",
+			Description:  "Update a membership role",
+			InputSchema:  types.UpdateMembershipToolInputSchema,
+			OutputSchema: types.UpdateMembershipToolOutputSchema,
+		},
+		resolver.UpdateMembershipTool,
+	)
+	mcp.AddTool(
+		server,
+		&mcp.Tool{
+			Name:         "removeUser",
+			Description:  "Remove a user from the organization",
+			InputSchema:  types.RemoveUserToolInputSchema,
+			OutputSchema: types.RemoveUserToolOutputSchema,
+		},
+		resolver.RemoveUserTool,
 	)
 	mcp.AddTool(
 		server,
@@ -179,30 +247,6 @@ func registerToolHandlers(server *mcp.Server, resolver ResolverInterface) {
 		},
 		resolver.UpdateVendorTool,
 	)
-	mcp.AddTool(
-		server,
-		&mcp.Tool{
-			Name:         "getProfile",
-			Description:  "Get a profile by ID",
-			InputSchema:  types.GetProfileToolInputSchema,
-			OutputSchema: types.GetProfileToolOutputSchema,
-			Annotations: &mcp.ToolAnnotations{
-				ReadOnlyHint:   true,
-				IdempotentHint: true,
-			},
-		},
-		resolver.GetProfileTool,
-	)
-	mcp.AddTool(
-		server,
-		&mcp.Tool{
-			Name:         "updateProfile",
-			Description:  "Update an existing profile",
-			InputSchema:  types.UpdateProfileToolInputSchema,
-			OutputSchema: types.UpdateProfileToolOutputSchema,
-		},
-		resolver.UpdateProfileTool,
-	)
 	mcp.AddTool(
 		server,
 		&mcp.Tool{

pkg/server/api/mcp/v1/specification.yaml

@@ -72,6 +72,16 @@ components:
         - SERVICE_ACCOUNT
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.MembershipProfileKind
 
+    MembershipRole:
+      type: string
+      enum:
+        - OWNER
+        - ADMIN
+        - EMPLOYEE
+        - VIEWER
+        - AUDITOR
+      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.MembershipRole
+
     Profile:
       type: object
       required:
@@ -130,7 +140,7 @@ components:
           format: date-time
           description: Update timestamp
 
-    ListProfilesInput:
+    ListUsersInput:
       type: object
       required:
         - organization_id
@@ -140,7 +150,7 @@ components:
           description: Organization ID
         order_by:
           $ref: "#/components/schemas/ProfileOrderBy"
-          description: Profile order by
+          description: User order by
         size:
           type: integer
           description: Page size
@@ -152,17 +162,17 @@ components:
           properties:
             exclude_contract_ended:
               type: boolean
-              description: Exclude profiles with ended contracts
+              description: Exclude users with ended contracts
 
-    ListProfilesOutput:
+    ListUsersOutput:
       type: object
       required:
-        - profiles
+        - users
       properties:
         next_cursor:
           $ref: "#/components/schemas/CursorKey"
           description: Next cursor
-        profiles:
+        users:
           type: array
           items:
             $ref: "#/components/schemas/Profile"
@@ -600,6 +610,205 @@ components:
         vendor:
           $ref: "#/components/schemas/Vendor"
 
+    GetUserInput:
+      type: object
+      required:
+        - id
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: User ID (profile ID)
+
+    GetUserOutput:
+      type: object
+      required:
+        - user
+      properties:
+        user:
+          $ref: "#/components/schemas/Profile"
+
+    CreateUserInput:
+      type: object
+      required:
+        - organization_id
+        - full_name
+        - email_address
+        - role
+        - kind
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        full_name:
+          type: string
+          description: Full name
+        email_address:
+          $ref: "#/components/schemas/EmailAddress"
+          description: Email address
+        role:
+          $ref: "#/components/schemas/MembershipRole"
+          description: Membership role
+        additional_email_addresses:
+          type: array
+          items:
+            $ref: "#/components/schemas/EmailAddress"
+          description: Additional email addresses
+        kind:
+          $ref: "#/components/schemas/ProfileKind"
+          description: User kind
+        position:
+          type: ["string", "null"]
+          description: Position
+        contract_start_date:
+          type: ["string", "null"]
+          format: date-time
+          description: Contract start date
+        contract_end_date:
+          type: ["string", "null"]
+          format: date-time
+          description: Contract end date
+
+    CreateUserOutput:
+      type: object
+      required:
+        - user
+      properties:
+        user:
+          $ref: "#/components/schemas/Profile"
+
+    InviteUserInput:
+      type: object
+      required:
+        - organization_id
+        - profile_id
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        profile_id:
+          $ref: "#/components/schemas/GID"
+          description: User (profile) ID to invite
+
+    InviteUserOutput:
+      type: object
+      required:
+        - invitation_id
+      properties:
+        invitation_id:
+          $ref: "#/components/schemas/GID"
+          description: Created invitation ID
+
+    UpdateUserInput:
+      type: object
+      required:
+        - id
+        - full_name
+        - kind
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: User (profile) ID
+        full_name:
+          type: string
+          description: Full name
+        additional_email_addresses:
+          anyOf:
+            - type: array
+              items:
+                $ref: "#/components/schemas/EmailAddress"
+            - type: "null"
+          description: Additional email addresses
+        kind:
+          $ref: "#/components/schemas/ProfileKind"
+          description: User kind
+        position:
+          type: ["string", "null"]
+          description: Position
+          go.probo.inc/mcpgen/omittable: true
+        contract_start_date:
+          type: ["string", "null"]
+          format: date-time
+          description: Contract start date
+          go.probo.inc/mcpgen/omittable: true
+        contract_end_date:
+          type: ["string", "null"]
+          format: date-time
+          description: Contract end date
+          go.probo.inc/mcpgen/omittable: true
+
+    UpdateUserOutput:
+      type: object
+      required:
+        - user
+      properties:
+        user:
+          $ref: "#/components/schemas/Profile"
+
+    Membership:
+      type: object
+      required:
+        - id
+        - role
+        - created_at
+      properties:
+        id:
+          $ref: "#/components/schemas/GID"
+          description: Membership ID
+        role:
+          $ref: "#/components/schemas/MembershipRole"
+          description: Membership role
+        created_at:
+          type: string
+          format: date-time
+          description: Creation timestamp
+
+    UpdateMembershipInput:
+      type: object
+      required:
+        - organization_id
+        - membership_id
+        - role
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        membership_id:
+          $ref: "#/components/schemas/GID"
+          description: Membership ID
+        role:
+          $ref: "#/components/schemas/MembershipRole"
+          description: New role
+
+    UpdateMembershipOutput:
+      type: object
+      required:
+        - membership
+      properties:
+        membership:
+          $ref: "#/components/schemas/Membership"
+
+    RemoveUserInput:
+      type: object
+      required:
+        - organization_id
+        - profile_id
+      properties:
+        organization_id:
+          $ref: "#/components/schemas/GID"
+          description: Organization ID
+        profile_id:
+          $ref: "#/components/schemas/GID"
+          description: User (profile) ID to remove
+
+    RemoveUserOutput:
+      type: object
+      required:
+        - deleted_user_id
+      properties:
+        deleted_user_id:
+          $ref: "#/components/schemas/GID"
+          description: Deleted user (profile) ID
+
     GetProfileInput:
       type: object
       required:
@@ -4405,15 +4614,64 @@ tools:
       $ref: "#/components/schemas/ListVendorsInput"
     outputSchema:
       $ref: "#/components/schemas/ListVendorsOutput"
-  - name: listProfiles
-    description: List all profiles for the organization
+  - name: listUsers
+    description: List all users for the organization
     hints:
       readonly: true
       idempotent: true
     inputSchema:
-      $ref: "#/components/schemas/ListProfilesInput"
+      $ref: "#/components/schemas/ListUsersInput"
     outputSchema:
-      $ref: "#/components/schemas/ListProfilesOutput"
+      $ref: "#/components/schemas/ListUsersOutput"
+  - name: getUser
+    description: Get a user by ID (profile ID)
+    hints:
+      readonly: true
+      idempotent: true
+    inputSchema:
+      $ref: "#/components/schemas/GetUserInput"
+    outputSchema:
+      $ref: "#/components/schemas/GetUserOutput"
+  - name: createUser
+    description: Create a new user in the organization
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/CreateUserInput"
+    outputSchema:
+      $ref: "#/components/schemas/CreateUserOutput"
+  - name: inviteUser
+    description: Invite a user (profile) to the organization
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/InviteUserInput"
+    outputSchema:
+      $ref: "#/components/schemas/InviteUserOutput"
+  - name: updateUser
+    description: Update an existing user (profile)
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpdateUserInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpdateUserOutput"
+  - name: updateMembership
+    description: Update a membership role
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/UpdateMembershipInput"
+    outputSchema:
+      $ref: "#/components/schemas/UpdateMembershipOutput"
+  - name: removeUser
+    description: Remove a user from the organization
+    hints:
+      readonly: false
+    inputSchema:
+      $ref: "#/components/schemas/RemoveUserInput"
+    outputSchema:
+      $ref: "#/components/schemas/RemoveUserOutput"
   - name: addVendor
     description: Add a new vendor to the organization
     hints:
@@ -4430,23 +4688,6 @@ tools:
       $ref: "#/components/schemas/UpdateVendorInput"
     outputSchema:
       $ref: "#/components/schemas/UpdateVendorOutput"
-  - name: getProfile
-    description: Get a profile by ID
-    hints:
-      readonly: true
-      idempotent: true
-    inputSchema:
-      $ref: "#/components/schemas/GetProfileInput"
-    outputSchema:
-      $ref: "#/components/schemas/GetProfileOutput"
-  - name: updateProfile
-    description: Update an existing profile
-    hints:
-      readonly: false
-    inputSchema:
-      $ref: "#/components/schemas/UpdateProfileInput"
-    outputSchema:
-      $ref: "#/components/schemas/UpdateProfileOutput"
   - name: listRisks
     description: List all risks for the organization
     hints:

pkg/server/api/mcp/v1/types/types.go

@@ -5,12 +5,13 @@ package types
 import (
 	"encoding/json"
 	"fmt"
+	"time"
+
 	"go.probo.inc/mcpgen/mcp"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/mail"
 	"go.probo.inc/probo/pkg/page"
-	"time"
 )
 
 // Tool input schemas
@@ -49,6 +50,8 @@ var (
 	CancelSignatureRequestToolOutputSchema          = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"deleted_document_version_signature_id":{"type":"string","format":"string"}},"required":["deleted_document_version_signature_id"]}`)
 	CreateDraftDocumentVersionToolInputSchema       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_id":{"type":"string","format":"string"}},"required":["document_id"]}`)
 	CreateDraftDocumentVersionToolOutputSchema      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_version":{"type":"object","properties":{"approver_ids":{"type":"array","items":{"type":"string","format":"string"},"description":"Approver IDs"},"changelog":{"type":"string","description":"Changelog"},"classification":{"type":"string","enum":["PUBLIC","INTERNAL","CONFIDENTIAL","SECRET"]},"content":{"type":"string","description":"Document content"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"document_id":{"type":"string","format":"string"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"published_at":{"description":"Published timestamp","format":"date-time"},"status":{"type":"string","enum":["DRAFT","PUBLISHED"]},"title":{"type":"string","description":"Document version title"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"},"version_number":{"type":"integer","description":"Version number"}},"required":["id","organization_id","document_id","title","approver_ids","version_number","classification","content","changelog","status","created_at","updated_at"]}},"required":["document_version"]}`)
+	CreateUserToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"role":{"type":"string","enum":["OWNER","ADMIN","EMPLOYEE","VIEWER","AUDITOR"]}},"required":["organization_id","full_name","email_address","role","kind"]}`)
+	CreateUserToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"user":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}},"required":["user"]}`)
 	DeleteDocumentToolInputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_id":{"type":"string","format":"string"}},"required":["document_id"]}`)
 	DeleteDocumentToolOutputSchema                  = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"deleted_document_id":{"type":"string","format":"string"}},"required":["deleted_document_id"]}`)
 	DeleteDraftDocumentVersionToolInputSchema       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_version_id":{"type":"string","format":"string"}},"required":["document_version_id"]}`)
@@ -87,14 +90,16 @@ var (
 	GetNonconformityToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"nonconformity":{"type":"object","properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No audit"}]},"corrective_action":{"description":"Corrective action"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","reference_id","root_cause","owner_id","status","created_at","updated_at"]}},"required":["nonconformity"]}`)
 	GetObligationToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
 	GetObligationToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"obligation":{"type":"object","properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"source":{"description":"Source"},"source_id":{"description":"Source ID"},"status":{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","owner_id","status","created_at","updated_at"]}},"required":["obligation"]}`)
-	GetProfileToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
-	GetProfileToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"profile":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}},"required":["profile"]}`)
 	GetRiskToolInputSchema                          = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
 	GetRiskToolOutputSchema                         = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"risk":{"type":"object","properties":{"category":{"type":"string","description":"Risk category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"inherent_risk_score":{"type":"integer","description":"Inherent risk score"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"organization_id":{"type":"string","format":"string"},"owner_id":{"anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No owner"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"residual_risk_score":{"type":"integer","description":"Residual risk score"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","category","treatment","inherent_likelihood","inherent_impact","inherent_risk_score","residual_likelihood","residual_impact","residual_risk_score","note","created_at","updated_at"]}},"required":["risk"]}`)
 	GetSnapshotToolInputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
 	GetSnapshotToolOutputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"snapshot":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}},"required":["id","organization_id","name","type","created_at"]}},"required":["snapshot"]}`)
 	GetTaskToolInputSchema                          = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
 	GetTaskToolOutputSchema                         = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"task":{"type":"object","properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","state","created_at","updated_at"]}},"required":["task"]}`)
+	GetUserToolInputSchema                          = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"id":{"type":"string","format":"string"}},"required":["id"]}`)
+	GetUserToolOutputSchema                         = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"user":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}},"required":["user"]}`)
+	InviteUserToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"organization_id":{"type":"string","format":"string"},"profile_id":{"type":"string","format":"string"}},"required":["organization_id","profile_id"]}`)
+	InviteUserToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"invitation_id":{"type":"string","format":"string"}},"required":["invitation_id"]}`)
 	LinkControlAuditToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"audit_id":{"type":"string","format":"string"},"control_id":{"type":"string","format":"string"}},"required":["control_id","audit_id"]}`)
 	LinkControlAuditToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object"}`)
 	LinkControlDocumentToolInputSchema              = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"control_id":{"type":"string","format":"string"},"document_id":{"type":"string","format":"string"}},"required":["control_id","document_id"]}`)
@@ -133,18 +138,20 @@ var (
 	ListObligationsToolOutputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"type":"string","format":"string"},"obligations":{"type":"array","items":{"type":"object","properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"source":{"description":"Source"},"source_id":{"description":"Source ID"},"status":{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","owner_id","status","created_at","updated_at"]}}},"required":["obligations"]}`)
 	ListOrganizationsToolInputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"organization_id":{"type":"string","format":"string"}}}`)
 	ListOrganizationsToolOutputSchema               = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"organizations":{"type":"array","items":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Organization description"},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Organization name"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","name","description","created_at","updated_at"]}}}}`)
-	ListProfilesToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"exclude_contract_ended":{"type":"boolean","description":"Exclude profiles with ended contracts"}}},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","FULL_NAME","KIND"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
-	ListProfilesToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"type":"string","format":"string"},"profiles":{"type":"array","items":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}}},"required":["profiles"]}`)
 	ListRisksToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"query":{"type":"string","description":"Search query"},"snapshot_id":{"type":"string","format":"string"}}},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","UPDATED_AT","NAME","CATEGORY","TREATMENT","INHERENT_RISK_SCORE","RESIDUAL_RISK_SCORE","OWNER_FULL_NAME"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
 	ListRisksToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"type":"string","format":"string"},"risks":{"type":"array","items":{"type":"object","properties":{"category":{"type":"string","description":"Risk category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"inherent_risk_score":{"type":"integer","description":"Inherent risk score"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"organization_id":{"type":"string","format":"string"},"owner_id":{"anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No owner"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"residual_risk_score":{"type":"integer","description":"Residual risk score"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","category","treatment","inherent_likelihood","inherent_impact","inherent_risk_score","residual_likelihood","residual_impact","residual_risk_score","note","created_at","updated_at"]}}},"required":["risks"]}`)
 	ListSnapshotsToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","NAME","TYPE"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
 	ListSnapshotsToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"description":"Next page cursor","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"snapshots":{"type":"array","items":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}},"required":["id","organization_id","name","type","created_at"]},"description":"List of snapshots"}},"required":["snapshots"]}`)
 	ListTasksToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"measure_id":{"type":"string","format":"string"},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
 	ListTasksToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"description":"Next page cursor","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"tasks":{"type":"array","items":{"type":"object","properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","state","created_at","updated_at"]},"description":"List of tasks"}},"required":["tasks"]}`)
+	ListUsersToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"exclude_contract_ended":{"type":"boolean","description":"Exclude users with ended contracts"}}},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","FULL_NAME","KIND"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
+	ListUsersToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"type":"string","format":"string"},"users":{"type":"array","items":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}}},"required":["users"]}`)
 	ListVendorsToolInputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"snapshot_id":{"type":"string","format":"string"}}},"order_by":{"type":"object","properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","UPDATED_AT","NAME"]}},"required":["field","direction"]},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}},"required":["organization_id"]}`)
 	ListVendorsToolOutputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"next_cursor":{"type":"string","format":"string"},"vendors":{"type":"array","items":{"type":"object","properties":{"business_associate_agreement_url":{"description":"Business associate agreement URL"},"business_owner_id":{"description":"Business owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"category":{"type":"string","description":"Vendor category","enum":["ANALYTICS","CLOUD_MONITORING","CLOUD_PROVIDER","COLLABORATION","CUSTOMER_SUPPORT","DATA_STORAGE_AND_PROCESSING","DOCUMENT_MANAGEMENT","EMPLOYEE_MANAGEMENT","ENGINEERING","FINANCE","IDENTITY_PROVIDER","IT","MARKETING","OFFICE_OPERATIONS","OTHER","PASSWORD_MANAGEMENT","PRODUCT_AND_DESIGN","PROFESSIONAL_SERVICES","RECRUITING","SALES","SECURITY","VERSION_CONTROL"]},"certifications":{"type":"array","items":{"type":"string"},"description":"Certifications"},"countries":{"type":"array","items":{"type":"string"},"description":"Countries (ISO 3166-1 alpha-2 country codes)"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"data_processing_agreement_url":{"description":"Data processing agreement URL"},"description":{"description":"Vendor description"},"headquarter_address":{"description":"Headquarter address"},"id":{"type":"string","format":"string"},"legal_name":{"description":"Legal name"},"name":{"type":"string","description":"Vendor name"},"organization_id":{"type":"string","format":"string"},"privacy_policy_url":{"description":"Privacy policy URL"},"security_owner_id":{"description":"Security owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"security_page_url":{"description":"Security page URL"},"service_level_agreement_url":{"description":"Service level agreement URL"},"status_page_url":{"description":"Status page URL"},"subprocessors_list_url":{"description":"Subprocessors list URL"},"terms_of_service_url":{"description":"Terms of service URL"},"trust_page_url":{"description":"Trust page URL"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"},"website_url":{"description":"Website URL"}},"required":["id","name","organization_id","category","created_at","updated_at"]}}},"required":["vendors"]}`)
 	PublishDocumentVersionToolInputSchema           = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"changelog":{"type":"string","description":"Changelog"},"document_id":{"type":"string","format":"string"}},"required":["document_id"]}`)
 	PublishDocumentVersionToolOutputSchema          = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document":{"type":"object","properties":{"approver_ids":{"type":"array","items":{"type":"string","format":"string"},"description":"Approver IDs"},"classification":{"type":"string","enum":["PUBLIC","INTERNAL","CONFIDENTIAL","SECRET"]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"current_published_version":{"description":"Current published version number"},"document_type":{"type":"string","enum":["OTHER","ISMS","POLICY","PROCEDURE"]},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"title":{"type":"string","description":"Document title"},"trust_center_visibility":{"type":"string","enum":["NONE","PRIVATE","PUBLIC"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","approver_ids","title","document_type","classification","trust_center_visibility","created_at","updated_at"]},"document_version":{"type":"object","properties":{"approver_ids":{"type":"array","items":{"type":"string","format":"string"},"description":"Approver IDs"},"changelog":{"type":"string","description":"Changelog"},"classification":{"type":"string","enum":["PUBLIC","INTERNAL","CONFIDENTIAL","SECRET"]},"content":{"type":"string","description":"Document content"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"document_id":{"type":"string","format":"string"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"published_at":{"description":"Published timestamp","format":"date-time"},"status":{"type":"string","enum":["DRAFT","PUBLISHED"]},"title":{"type":"string","description":"Document version title"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"},"version_number":{"type":"integer","description":"Version number"}},"required":["id","organization_id","document_id","title","approver_ids","version_number","classification","content","changelog","status","created_at","updated_at"]}},"required":["document","document_version"]}`)
+	RemoveUserToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"organization_id":{"type":"string","format":"string"},"profile_id":{"type":"string","format":"string"}},"required":["organization_id","profile_id"]}`)
+	RemoveUserToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"deleted_user_id":{"type":"string","format":"string"}},"required":["deleted_user_id"]}`)
 	RequestDocumentVersionSignatureToolInputSchema  = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_version_id":{"type":"string","format":"string"},"signatory_id":{"type":"string","format":"string"}},"required":["document_version_id","signatory_id"]}`)
 	RequestDocumentVersionSignatureToolOutputSchema = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"document_version_signature":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"document_version_id":{"type":"string","format":"string"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"requested_at":{"type":"string","description":"Requested timestamp","format":"date-time"},"signed_at":{"description":"Signed timestamp","format":"date-time"},"signed_by":{"type":"string","format":"string"},"state":{"type":"string","enum":["REQUESTED","SIGNED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","document_version_id","state","signed_by","requested_at","created_at","updated_at"]}},"required":["document_version_signature"]}`)
 	TakeSnapshotToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"description":{"type":"string","description":"Snapshot description"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}},"required":["organization_id","name","type"]}`)
@@ -179,16 +186,18 @@ var (
 	UpdateMeasureToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"measure":{"type":"object","properties":{"category":{"type":"string","description":"Measure category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Measure description"},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Measure name"},"state":{"type":"string","enum":["NOT_STARTED","IN_PROGRESS","NOT_APPLICABLE","IMPLEMENTED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","category","name","state","created_at","updated_at"]}},"required":["measure"]}`)
 	UpdateMeetingToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"attendee_ids":{"type":"array","items":{"type":"string","format":"string"},"description":"List of attendee profile IDs"},"date":{"type":"string","description":"Meeting date","format":"date-time"},"id":{"type":"string","format":"string"},"minutes":{"description":"Meeting minutes"},"name":{"type":"string","description":"Meeting name"}},"required":["id"]}`)
 	UpdateMeetingToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"meeting":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"date":{"type":"string","description":"Meeting date","format":"date-time"},"id":{"type":"string","format":"string"},"minutes":{"description":"Meeting minutes","anyOf":[{"type":"string","description":"Meeting minutes"},{"type":"null","description":"No minutes"}]},"name":{"type":"string","description":"Meeting name"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","name","date","created_at","updated_at"]}},"required":["meeting"]}`)
+	UpdateMembershipToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"membership_id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"role":{"type":"string","enum":["OWNER","ADMIN","EMPLOYEE","VIEWER","AUDITOR"]}},"required":["organization_id","membership_id","role"]}`)
+	UpdateMembershipToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"membership":{"type":"object","properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"id":{"type":"string","format":"string"},"role":{"type":"string","enum":["OWNER","ADMIN","EMPLOYEE","VIEWER","AUDITOR"]}},"required":["id","role","created_at"]}},"required":["membership"]}`)
 	UpdateNonconformityToolInputSchema              = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"corrective_action":{"description":"Corrective action"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]}},"required":["id"]}`)
 	UpdateNonconformityToolOutputSchema             = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"nonconformity":{"type":"object","properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No audit"}]},"corrective_action":{"description":"Corrective action"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","reference_id","root_cause","owner_id","status","created_at","updated_at"]}},"required":["nonconformity"]}`)
 	UpdateObligationToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"source":{"description":"Source"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},{"type":"null","description":"No status"}]},"type":{"description":"Type","anyOf":[{"type":"string","enum":["LEGAL","CONTRACTUAL"]},{"type":"null","description":"No type"}]}},"required":["id"]}`)
 	UpdateObligationToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"obligation":{"type":"object","properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"source":{"description":"Source"},"source_id":{"description":"Source ID"},"status":{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","owner_id","status","created_at","updated_at"]}},"required":["obligation"]}`)
-	UpdateProfileToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"additional_email_addresses":{"description":"Additional email addresses","anyOf":[{"type":"array","items":{"type":"string","format":"string"}},{"type":"null","description":"No additional email addresses"}]},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"position":{"description":"Position"}},"required":["id"]}`)
-	UpdateProfileToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"profile":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}},"required":["profile"]}`)
 	UpdateRiskToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"category":{"type":"string","description":"Risk category"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]}},"required":["id"]}`)
 	UpdateRiskToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"risk":{"type":"object","properties":{"category":{"type":"string","description":"Risk category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"inherent_risk_score":{"type":"integer","description":"Inherent risk score"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"organization_id":{"type":"string","format":"string"},"owner_id":{"anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No owner"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"residual_risk_score":{"type":"integer","description":"Residual risk score"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","category","treatment","inherent_likelihood","inherent_impact","inherent_risk_score","residual_likelihood","residual_impact","residual_risk_score","note","created_at","updated_at"]}},"required":["risk"]}`)
 	UpdateTaskToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description"},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"state":{"description":"Task state","anyOf":[{"type":"string","enum":["TODO","DONE"]},{"type":"null","description":"No state"}]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]}},"required":["id"]}`)
 	UpdateTaskToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"task":{"type":"object","properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","name","state","created_at","updated_at"]}},"required":["task"]}`)
+	UpdateUserToolInputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"additional_email_addresses":{"description":"Additional email addresses","anyOf":[{"type":"array","items":{"type":"string","format":"string"}},{"type":"null"}]},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"position":{"description":"Position"}},"required":["id","full_name","kind"]}`)
+	UpdateUserToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"user":{"type":"object","properties":{"additional_email_addresses":{"type":"array","items":{"type":"string","format":"string"},"description":"Additional email addresses"},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"email_address":{"type":"string","format":"string"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}},"required":["id","organization_id","full_name","email_address","additional_email_addresses","kind","created_at","updated_at"]}},"required":["user"]}`)
 	UpdateVendorToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"business_associate_agreement_url":{"type":"string","description":"Business associate agreement URL"},"business_owner_id":{"type":"string","format":"string"},"category":{"type":"string","description":"Vendor category","enum":["ANALYTICS","CLOUD_MONITORING","CLOUD_PROVIDER","COLLABORATION","CUSTOMER_SUPPORT","DATA_STORAGE_AND_PROCESSING","DOCUMENT_MANAGEMENT","EMPLOYEE_MANAGEMENT","ENGINEERING","FINANCE","IDENTITY_PROVIDER","IT","MARKETING","OFFICE_OPERATIONS","OTHER","PASSWORD_MANAGEMENT","PRODUCT_AND_DESIGN","PROFESSIONAL_SERVICES","RECRUITING","SALES","SECURITY","VERSION_CONTROL"]},"certifications":{"type":"array","items":{"type":"string"},"description":"Certifications"},"countries":{"type":"array","items":{"type":"string"},"description":"Countries (ISO 3166-1 alpha-2 country codes)"},"data_processing_agreement_url":{"type":"string","description":"Data processing agreement URL"},"description":{"type":"string","description":"Vendor description"},"headquarter_address":{"type":"string","description":"Headquarter address"},"id":{"type":"string","format":"string"},"legal_name":{"type":"string","description":"Legal name"},"name":{"type":"string","description":"Vendor name"},"privacy_policy_url":{"type":"string","description":"Privacy policy URL"},"security_owner_id":{"type":"string","format":"string"},"security_page_url":{"type":"string","description":"Security page URL"},"service_level_agreement_url":{"type":"string","description":"Service level agreement URL"},"status_page_url":{"type":"string","description":"Status page URL"},"subprocessors_list_url":{"type":"string","description":"Subprocessors list URL"},"terms_of_service_url":{"type":"string","description":"Terms of service URL"},"trust_page_url":{"type":"string","description":"Trust page URL"},"website_url":{"type":"string","description":"Website URL"}},"required":["id"]}`)
 	UpdateVendorToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","properties":{"vendor":{"type":"object","properties":{"business_associate_agreement_url":{"description":"Business associate agreement URL"},"business_owner_id":{"description":"Business owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"category":{"type":"string","description":"Vendor category","enum":["ANALYTICS","CLOUD_MONITORING","CLOUD_PROVIDER","COLLABORATION","CUSTOMER_SUPPORT","DATA_STORAGE_AND_PROCESSING","DOCUMENT_MANAGEMENT","EMPLOYEE_MANAGEMENT","ENGINEERING","FINANCE","IDENTITY_PROVIDER","IT","MARKETING","OFFICE_OPERATIONS","OTHER","PASSWORD_MANAGEMENT","PRODUCT_AND_DESIGN","PROFESSIONAL_SERVICES","RECRUITING","SALES","SECURITY","VERSION_CONTROL"]},"certifications":{"type":"array","items":{"type":"string"},"description":"Certifications"},"countries":{"type":"array","items":{"type":"string"},"description":"Countries (ISO 3166-1 alpha-2 country codes)"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"data_processing_agreement_url":{"description":"Data processing agreement URL"},"description":{"description":"Vendor description"},"headquarter_address":{"description":"Headquarter address"},"id":{"type":"string","format":"string"},"legal_name":{"description":"Legal name"},"name":{"type":"string","description":"Vendor name"},"organization_id":{"type":"string","format":"string"},"privacy_policy_url":{"description":"Privacy policy URL"},"security_owner_id":{"description":"Security owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"security_page_url":{"description":"Security page URL"},"service_level_agreement_url":{"description":"Service level agreement URL"},"status_page_url":{"description":"Status page URL"},"subprocessors_list_url":{"description":"Subprocessors list URL"},"terms_of_service_url":{"description":"Terms of service URL"},"trust_page_url":{"description":"Trust page URL"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"},"website_url":{"description":"Website URL"}},"required":["id","name","organization_id","category","created_at","updated_at"]}},"required":["vendor"]}`)
 )
@@ -1006,6 +1015,33 @@ type CreateDraftDocumentVersionOutput struct {
 	DocumentVersion *DocumentVersion `json:"document_version"`
 }
 
+// CreateUserInput represents the schema
+type CreateUserInput struct {
+	// Additional email addresses
+	AdditionalEmailAddresses []mail.Addr `json:"additional_email_addresses,omitempty"`
+	// Contract end date
+	ContractEndDate *time.Time `json:"contract_end_date,omitempty"`
+	// Contract start date
+	ContractStartDate *time.Time `json:"contract_start_date,omitempty"`
+	// Email address
+	EmailAddress mail.Addr `json:"email_address"`
+	// Full name
+	FullName string `json:"full_name"`
+	// User kind
+	Kind coredata.MembershipProfileKind `json:"kind"`
+	// Organization ID
+	OrganizationID gid.GID `json:"organization_id"`
+	// Position
+	Position *string `json:"position,omitempty"`
+	// Membership role
+	Role coredata.MembershipRole `json:"role"`
+}
+
+// CreateUserOutput represents the schema
+type CreateUserOutput struct {
+	User *Profile `json:"user"`
+}
+
 // Datum represents the schema
 type Datum struct {
 	// Creation timestamp
@@ -1417,6 +1453,31 @@ type GetTaskOutput struct {
 	Task *Task `json:"task"`
 }
 
+// GetUserInput represents the schema
+type GetUserInput struct {
+	// User ID (profile ID)
+	ID gid.GID `json:"id"`
+}
+
+// GetUserOutput represents the schema
+type GetUserOutput struct {
+	User *Profile `json:"user"`
+}
+
+// InviteUserInput represents the schema
+type InviteUserInput struct {
+	// Organization ID
+	OrganizationID gid.GID `json:"organization_id"`
+	// User (profile) ID to invite
+	ProfileID gid.GID `json:"profile_id"`
+}
+
+// InviteUserOutput represents the schema
+type InviteUserOutput struct {
+	// Created invitation ID
+	InvitationID gid.GID `json:"invitation_id"`
+}
+
 // LinkControlAuditInput represents the schema
 type LinkControlAuditInput struct {
 	// Audit ID
@@ -1747,26 +1808,6 @@ type ListOrganizationsOutput struct {
 	Organizations []*Organization `json:"organizations,omitempty"`
 }
 
-// ListProfilesInput represents the schema
-type ListProfilesInput struct {
-	// Page cursor
-	Cursor *page.CursorKey          `json:"cursor,omitempty"`
-	Filter *ListProfilesInputFilter `json:"filter,omitempty"`
-	// Profile order by
-	OrderBy *ProfileOrderBy `json:"order_by,omitempty"`
-	// Organization ID
-	OrganizationID gid.GID `json:"organization_id"`
-	// Page size
-	Size *int `json:"size,omitempty"`
-}
-
-// ListProfilesOutput represents the schema
-type ListProfilesOutput struct {
-	// Next cursor
-	NextCursor *page.CursorKey `json:"next_cursor,omitempty"`
-	Profiles   []*Profile      `json:"profiles"`
-}
-
 // ListRisksInput represents the schema
 type ListRisksInput struct {
 	// Page cursor
@@ -1829,6 +1870,26 @@ type ListTasksOutput struct {
 	Tasks []*Task `json:"tasks"`
 }
 
+// ListUsersInput represents the schema
+type ListUsersInput struct {
+	// Page cursor
+	Cursor *page.CursorKey       `json:"cursor,omitempty"`
+	Filter *ListUsersInputFilter `json:"filter,omitempty"`
+	// User order by
+	OrderBy *ProfileOrderBy `json:"order_by,omitempty"`
+	// Organization ID
+	OrganizationID gid.GID `json:"organization_id"`
+	// Page size
+	Size *int `json:"size,omitempty"`
+}
+
+// ListUsersOutput represents the schema
+type ListUsersOutput struct {
+	// Next cursor
+	NextCursor *page.CursorKey `json:"next_cursor,omitempty"`
+	Users      []*Profile      `json:"users"`
+}
+
 // ListVendorsInput represents the schema
 type ListVendorsInput struct {
 	// Page cursor
@@ -1899,6 +1960,16 @@ type MeetingOrderBy struct {
 	Field coredata.MeetingOrderField `json:"field"`
 }
 
+// Membership represents the schema
+type Membership struct {
+	// Creation timestamp
+	CreatedAt time.Time `json:"created_at"`
+	// Membership ID
+	ID gid.GID `json:"id"`
+	// Membership role
+	Role coredata.MembershipRole `json:"role"`
+}
+
 // Nonconformity represents the schema
 type Nonconformity struct {
 	// Audit ID
@@ -2045,6 +2116,20 @@ type PublishDocumentVersionOutput struct {
 	DocumentVersion *DocumentVersion `json:"document_version"`
 }
 
+// RemoveUserInput represents the schema
+type RemoveUserInput struct {
+	// Organization ID
+	OrganizationID gid.GID `json:"organization_id"`
+	// User (profile) ID to remove
+	ProfileID gid.GID `json:"profile_id"`
+}
+
+// RemoveUserOutput represents the schema
+type RemoveUserOutput struct {
+	// Deleted user (profile) ID
+	DeletedUserID gid.GID `json:"deleted_user_id"`
+}
+
 // RequestDocumentVersionSignatureInput represents the schema
 type RequestDocumentVersionSignatureInput struct {
 	// Document version ID
@@ -2429,6 +2514,21 @@ type UpdateMeetingOutput struct {
 	Meeting *Meeting `json:"meeting"`
 }
 
+// UpdateMembershipInput represents the schema
+type UpdateMembershipInput struct {
+	// Membership ID
+	MembershipID gid.GID `json:"membership_id"`
+	// Organization ID
+	OrganizationID gid.GID `json:"organization_id"`
+	// New role
+	Role coredata.MembershipRole `json:"role"`
+}
+
+// UpdateMembershipOutput represents the schema
+type UpdateMembershipOutput struct {
+	Membership *Membership `json:"membership"`
+}
+
 // UpdateNonconformityInput represents the schema
 type UpdateNonconformityInput struct {
 	// Audit ID
@@ -2570,6 +2670,29 @@ type UpdateTaskOutput struct {
 	Task *Task `json:"task"`
 }
 
+// UpdateUserInput represents the schema
+type UpdateUserInput struct {
+	// Additional email addresses
+	AdditionalEmailAddresses *[]mail.Addr `json:"additional_email_addresses,omitempty"`
+	// Contract end date
+	ContractEndDate mcp.Omittable[*time.Time] `json:"contract_end_date,omitempty"`
+	// Contract start date
+	ContractStartDate mcp.Omittable[*time.Time] `json:"contract_start_date,omitempty"`
+	// Full name
+	FullName string `json:"full_name"`
+	// User (profile) ID
+	ID gid.GID `json:"id"`
+	// User kind
+	Kind coredata.MembershipProfileKind `json:"kind"`
+	// Position
+	Position mcp.Omittable[*string] `json:"position,omitempty"`
+}
+
+// UpdateUserOutput represents the schema
+type UpdateUserOutput struct {
+	User *Profile `json:"user"`
+}
+
 // UpdateVendorInput represents the schema
 type UpdateVendorInput struct {
 	// Business associate agreement URL
@@ -2737,12 +2860,6 @@ type ListObligationsInputFilter struct {
 	SnapshotID *gid.GID `json:"snapshot_id,omitempty"`
 }
 
-// ListProfilesInputFilter represents the schema
-type ListProfilesInputFilter struct {
-	// Exclude profiles with ended contracts
-	ExcludeContractEnded *bool `json:"exclude_contract_ended,omitempty"`
-}
-
 // ListRisksInputFilter represents the schema
 type ListRisksInputFilter struct {
 	// Search query
@@ -2751,6 +2868,12 @@ type ListRisksInputFilter struct {
 	SnapshotID *gid.GID `json:"snapshot_id,omitempty"`
 }
 
+// ListUsersInputFilter represents the schema
+type ListUsersInputFilter struct {
+	// Exclude users with ended contracts
+	ExcludeContractEnded *bool `json:"exclude_contract_ended,omitempty"`
+}
+
 // ListVendorsInputFilter represents the schema
 type ListVendorsInputFilter struct {
 	// Snapshot ID