list_research_notes
Reads what Heimdall's research sweep found about a project's domain, with the latest run's standing.
Read a project's research by project_id: run, the latest sweep with its status (queued, running, ready or failed) and counts, or null when none was started; and notes, the notes of the latest finished sweep, each with a topic, a summary and its sources. Read them before drafting requirements or rules so the record carries what the industry expects, and tell a person whether a sweep is still running. A staff token with import:view-any on the project is needed.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same actions as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
project_id*stringUUID of the project.
What it returns
{ "data": { "run": { "id": "c5d6e7f8-a9b0-4c1d-8e2f-3a4b5c6d7e8f", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "status": "ready", "note_count": 6, "suggestion_count": 9, "provider": "anthropic", "model": "claude-sonnet-5-5", "usage_id": "d6e7f8a9-b0c1-4d2e-8f3a-4b5c6d7e8f9a", "failure_reason": null, "created_by": "5b6c7d8e-9f0a-4b1c-8d2e-3f4a5b6c7d8e", "creator_name": "Bea Analyst", "started_at": "2026-10-28T11:50:04+00:00", "finished_at": "2026-10-28T11:53:30+00:00", "created_at": "2026-10-28T11:50:00+00:00" }, "notes": [ { "id": "e7f8a9b0-c1d2-4e3f-8a4b-5c6d7e8f9a0b", "run_id": "c5d6e7f8-a9b0-4c1d-8e2f-3a4b5c6d7e8f", "position": 1, "topic": "Compliance", "summary": "Card payments taken on the site fall under PCI DSS; a hosted payment page keeps the site out of scope for most of it.", "sources": [ { "title": "PCI Security Standards Council", "url": "https://www.pcisecuritystandards.org/" } ], "created_at": "2026-10-28T11:53:30+00:00" } ] }}How it fails
RESOURCE_NOT_FOUNDunknown project_id, or a project outside the token's scope or the person's visibility.
FORBIDDENthe token is a client guest's, or the holder's role on the project does not carry import:view-any.
TOKEN_MISSING_ABILITYtoken lacks import:view-any.
How is this guide?
Last updated on