> For the complete documentation index, see [llms.txt](https://docs.finout.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.finout.io/ai-and-developer-tools/finout-mcp-integration.md). # Finout MCP Integration ### Overview With the Finout MCP ([Model Context Protocol](https://modelcontextprotocol.io/introduction)), you can ask questions about your cloud cost spend, anomalies, waste, budgets, tag coverage, unit economics, and more - directly inside the AI tools you already use. The Finout MCP acts as a bridge to your live Finout data, letting you query and visualize cloud spend through natural language without switching tools or exporting data. The Finout MCP is hosted and managed by Finout. There is nothing to install and no credentials to manage locally - authentication is handled via a standard OAuth flow, the same experience you use to log in to Finout. ### MCP Clients An MCP client is any AI assistant or agent that can communicate using the Model Context Protocol. The Finout MCP is compatible with any client that supports remote MCP with OAuth. Examples include: * [Claude](https://claude.ai/) (web and desktop) * [Cursor](https://www.cursor.com/) IDE * Any other MCP-compatible AI tool You can find a full list of clients in the[ MCP documentation](https://modelcontextprotocol.io/clients). ### What You Can Do Once connected, ask questions like: * "Show me the top 5 AWS services by cost last month" * "Compare our cloud spend this quarter vs last quarter" * "Which dimensions had the biggest cost increase this month?" * "Are there any high-severity cost anomalies this week?" * "What are our biggest waste and rightsizing opportunities?" * "How are we tracking against our Q1 budget?" * "What percentage of our spend is tagged with a team tag?" * "What changed in my K8s allocation tag between last week's version and today's?" * "Run my saved 'K8s cost' data explorer and show me the results" * "Has CPU utilization on this idle instance actually been trending up, or was that a one-time spike?"
### Getting Connected Finout MCP supports several integration patterns, depending on who or what is connecting. Pick the one that matches your situation. Every path here except Machine-to-Machine runs on the credentials of whoever logs in - your queries are scoped to your own Finout permissions, exactly like the Finout app. Machine-to-Machine is the one exception: since no person is involved, its permissions come from a role assigned when the credential is created, not from an individual's access.
What do you want to do?ExampleIntegrationUser login required?Whose permissions apply?
Use Finout from your own AI clientAsk Claude or Cursor, "What caused our AWS costs to increase this month?"Individual AI ClientYesYour own Finout permissions
Make Finout available through a company-managed AI platformLet employees query Finout through ChatGPT, Microsoft Copilot Studio, or an internal appEnterprise AI ConnectorYes, for each userEach user's own Finout permissions
Run a workflow without a person involved (Machine-to-Machine)Send a daily cost summary to Slack, check for anomalies every hourMachine-to-Machine (M2M)NoA fixed Finout role, assigned when the credential is created
Connect a native or CLI client that can't store a secret or self-register (DCR/CIMD)Connect an internal FinOps CLIPublic PKCE ClientYesYour own Finout permissions
Not sure which to choose? If a person is available to log in and the connection should use that person's own Finout permissions, use a user-based integration (Individual, Enterprise, or Public PKCE). If the workflow must run independently, with no person present, use Machine-to-Machine.
### **Integration 1: Individual AI Assistant** #### Step 1 - Download and Install an MCP Client * Claude - Download[ Claude for Desktop](https://claude.ai/download) or use[ Claude on the web](https://claude.ai/). * Cursor - Download[ Cursor](https://www.cursor.com/) for your operating system. Other tools - Any MCP-compatible AI tool that supports remote connections via OAuth will work. Point it to . #### Step 2 — Configure the Finout MCP Server {% tabs %} {% tab title="Claude" %} 1. Open **Settings → Connectors** 2. Click **Add Custom Connector** 3. Enter the following details and click **Add**: | Field | Value | | ------------ | --------------------------- | | Name | Finout | | URL | `https://mcp.finout.io/mcp` | | {% endtab %} | | {% tab title="Cursor" %} 1. Press **Cmd/Ctrl + Shift + P** to open the command palette 2. Type **MCP** and select **Open MCP Settings** 3. Add the following to your `mcp.json` file: ```json { "mcpServers": { "finout": { "url": "https://mcp.finout.io/mcp" } } } ``` 4. Save the file {% endtab %} {% tab title="Other clients" %} Any MCP-compatible AI tool that supports remote connections via OAuth will work. Point it at `https://mcp.finout.io/mcp`. {% endtab %} {% endtabs %} #### Step 3 - Authorize the Finout MCP Server After configuring the server, your browser will open an authorization screen. 1. Review the authorization details and click Allow Access 2. Log in to Finout with your existing credentials or via SSO 3. Once authorized, close the browser tab and return to your AI client Tip: By default, most clients ask for approval before each tool call. For a smoother experience, set the permission to Always Allow in your connector settings. #### Step 4 - Start Prompting Open a new chat and start asking questions about your cloud costs. For example: "Show me the top 5 AWS services by cost last month" Your AI client will use the appropriate Finout MCP tool and return results from your live Finout data. ### **Integration 2: Connect an Enterprise AI Platform** Use this when your organization wants to make Finout available through a centrally managed AI platform, so multiple employees can query it without each person setting up their own connector. Examples include: * ChatGPT custom connectors * Microsoft Copilot Studio * Enterprise-hosted MCP connectors * Customer-built web applications used by multiple employees Do not use this integration as a substitute for a machine identity. An enterprise connector still acts on behalf of individual users and requires each user to authorize it. If a workflow must run independently without any user, use Integration 3.
#### Step 1 - Check whether your platform can self-register Most enterprise platforms (Claude, ChatGPT, VS Code) support DCR or CIMD and self-register automatically - if yours does, skip to Step 4. You only need Finout to pre-register your client (Steps 2–3) if your platform requires a fixed, custom redirect URI, which has to be approved in advance. #### Step 2 - Contact Finout. Contact your Finout representative or and provide: * Finout account name * Enterprise platform name * Connector name * Exact redirect URI or URIs * Required OAuth scopes, if specified by the platform * Technical owner * Environment (production or staging) #### Step 3 - Receive and store the registration details Finout will provide the registration details required by the platform. #### Step 4 - Configure the connector In your enterprise platform's connector settings, point it at `https://mcp.finout.io/mcp` and enter the Client ID (and Client Secret, if you completed Steps 2–3). #### Step 5 - Each user authorizes The first time someone queries Finout through the platform, they log in with their own Finout credentials - same as Integration 1, just launched from inside the enterprise platform. ### **Integration 3: Automated or Headless Workflow (Machine-to-Machine)** Use this integration when a workflow must run without a person opening a browser or logging in to Finout. Examples include: * Sending a daily cloud-cost summary to Slack * Checking for new anomalies every hour * Running a weekly cost-allocation report * Monitoring budget status from a scheduled job * Retrieving waste recommendations through an internal automation * Running a recurring FinOps investigation using an AI agent * Connecting a server-side application or CI/CD workflow If your automation currently asks someone to log in again, it is using a user-based connection. Move it to a Machine-to-Machine integration. Do not use a shared Machine-to-Machine identity for personal interactive access. An M2M connection does not represent an individual user. Everyone using the same credentials receives the service identity's permissions, and activity is attributed to the same machine identity. If individual users need their own permissions and audit identity, use an individual or enterprise user-based integration. #### Step 1 - Request an Automated MCP Connection Machine-to-Machine connections are currently registered by Finout. Contact your Finout representative or and provide: * Finout account name * Automation name * Description of the automation * The Finout role this automation needs. M2M is the one integration type where permissions aren't inherited from a person, so this determines everything the credential can see and do. If you're not sure which role fits, describe what the automation needs to do (for example, "read cost and anomaly data for cost center X") - Finout will map that to the closest existing role, or create one if nothing fits. * Technical owner * Environment, such as production, staging, or development Example request: > Please create a Machine-to-Machine MCP connection for our Finout account. \ > Client name: Company name – Daily Cost Automation – Production\ > Use case: Run a daily automation that retrieves cost changes and high-severity anomalies through Finout MCP.\ > Requested role: e.g. Read-only, Cost Center X\ > Technical owner: \ > Environment: Production #### Step 2 - Receive the Connection Details Finout provides a Client ID and Client Secret, not a permanent MCP access token. Your automation uses these credentials to generate short-lived access tokens. #### Step 3 - Store the Credentials Securely Store the connection details in a secrets manager or secure environment variables: ``` FINOUT_CLIENT_ID FINOUT_CLIENT_SECRET FINOUT_TOKEN_URL=https://mcp.finout.io/token FINOUT_MCP_URL=https://mcp.finout.io/mcp ``` Do not: * Hard-code the Client Secret in source code * Commit it to a Git repository * Include it in application logs * Send it directly to the MCP endpoint * Share one client across unrelated automations or environments We recommend creating a separate client for each automation and environment. #### Step 4 - Request an Access Token Exchange the Client ID and Client Secret for an access token: ``` curl --request POST "https://mcp.finout.io/token" \ --user "${FINOUT_CLIENT_ID}:${FINOUT_CLIENT_SECRET}" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "grant_type=client_credentials" \ --data-urlencode "scope=mcp" \ --data-urlencode "resource=https://mcp.finout.io/mcp" ``` Example response: ``` { "access_token": "eyJ...", "token_type": "Bearer", "expires_in": 86400, "scope": "mcp" } ``` The access token is valid for 24 hours. #### Step 5 - Call Finout MCP Include the access token in the Authorization header of every MCP request: ``` Authorization: Bearer ``` The Client Secret must only be sent to `https://mcp.finout.io/token` - never directly to `https://mcp.finout.io/mcp`. Your automation or MCP SDK is responsible for requesting the token, caching it securely, attaching it to MCP requests, and replacing it before expiration. #### Step 6 - Renew the Access Token Machine-to-Machine connections do not receive a refresh token. Before the 24-hour access token expires, repeat the same `client_credentials` request using the Client ID and Client Secret. We recommend requesting a replacement token several minutes before expiration. #### Step 7 - Rotate Your Client Secret Every 180 Days This is separate from the access token above. The access token expires every 24 hours and your automation renews it automatically. The Client Secret itself - the long-lived credential from Step 2 - expires every 180 days and has to be rotated, or the connection stops working entirely. Track your Client Secret's issue date and plan to rotate it before the 180-day mark, rather than waiting for requests to start failing. Contact Finout to issue a new secret. You do not need to contact Finout every 24 hours. Contact Finout only when you need to: register a new client, change its role or permissions, rotate its Client Secret (required at least every 180 days), revoke the connection, or replace a lost or compromised secret. Result: your automation can connect to Finout MCP without opening a browser or asking a user to log in. The Client ID and Client Secret remain securely stored in your environment, and the automation generates short-lived access tokens whenever needed. ### **Integration 4: Connect a Native or CLI MCP Client** Use this integration when a customer-built native application or CLI: * Acts on behalf of a Finout user * Cannot securely store a Client Secret * Cannot register automatically using DCR or CIMD * Requires Finout to issue a Client ID in advance * Can open a browser for user login PKCE is not required for most third-party or custom clients - only for ones that meet every condition above. If your client can store a secret, register it as a Confidential client instead (see Integration 2), even if it's a third-party or custom build. Examples include an internal FinOps CLI, a native desktop application, a local developer tool, a mobile or installed application, or a custom MCP client that supports PKCE but not DCR or CIMD. This integration uses a pre-registered Public OAuth client. Finout provides a Client ID, but no Client Secret is created. Do not use this integration for an unattended service. Public PKCE still requires a user to open a browser, log in, and approve access. If the process must run without a person, use a Machine-to-Machine integration. #### Step 1 - Request a Public PKCE Client Contact your Finout representative or and provide: * Finout account name * Application name * Application type (native or CLI) * Exact redirect URI or URIs * Required OAuth scopes * Technical owner * Environment. #### Step 2 - Receive your Client ID Finout provides: ``` Client ID: Client type: Public PKCE method: S256 ``` #### Step 3 - Configure your application Use the Client ID above and the exact registered redirect URI. Differences in protocol, hostname, port, path, or trailing slash can cause authorization to fail. #### Step 4 - Users log in The first time someone uses the application, it opens a browser for them to log in with their own Finout account and approve access. Result: the native or CLI application can securely authorize Finout users without storing a Client Secret. Each user logs in with their own Finout account, and MCP requests follow that user's permissions. ### **Authentication Troubleshooting** **My Automation Asks Me to Log In.** The automation is using a user-based integration. If it must run without a person, request a Machine-to-Machine connection. **The Token Endpoint Returns invalid\_client.** Check that: the Client ID is correct; the Client Secret is correct and hasn't passed its 180-day expiration; the secret hasn't been revoked; credentials are being sent to `https://mcp.finout.io/token`; the client is using the configured authentication method. If the secret was lost, compromised, or expired, contact Finout to rotate it. **MCP Returns 401 Unauthorized.** A 401 is often part of the normal flow, not a failure: when an access token or session expires, getting a 401 back is exactly what tells a well-behaved client to refresh its token or redirect the user to log in again. Most MCP clients handle this automatically, and you'll just see a fresh login prompt. Treat it as a problem only if it persists after a fresh token or a new login - in that case, request a new token and confirm the request includes resource=. **MCP Returns 403 Forbidden.** The client is authenticated but doesn't have sufficient roles or scopes. Contact Finout and provide the Client ID, MCP operation attempted, request time, and error response. Do not include the Client Secret or access token. **The Authorization Flow Reports a Redirect URI Error.** Confirm the application uses the exact redirect URI registered with Finout. Differences in protocol, hostname, port, path, or trailing slash can cause authorization to fail. ### **Data Access & Permissions** The Finout MCP respects your account's existing data access controls — no exceptions are granted simply because a request originates from an AI client. When you connect the Finout MCP, authentication flows through a standard OAuth screen. The credentials you authorize with are the same credentials your Finout account uses. As a result, every query the MCP runs is scoped to exactly what your user is permitted to see — the same cost centers, filters, and data ranges available to you inside the Finout app. This means: * If your account is restricted to specific cost centers, the MCP cannot query outside them. * If your organization has team-based access policies, those policies apply equally to MCP queries. * There is no elevated or "read-all" mode available through the MCP. #### User-Based Integrations Individual AI assistants, enterprise connectors, and custom user-authorized applications operate with the permissions of the Finout user who authorizes them. Every query is scoped to what that user is permitted to see inside Finout, including applicable cost centers, filters, and data-access policies. This means: if a user is restricted to specific cost centers, MCP cannot query outside them; if the organization has team-based access policies, those policies apply equally to MCP requests; connecting through MCP does not provide elevated access. #### Machine-to-Machine Integrations Automated connections operate as dedicated service identities rather than human users. Their access is determined by the Finout role assigned when the credential was created, the OAuth scopes allowed for the client, the scopes requested when generating the token, and applicable Finout account and data-access policies. The service identity does not automatically inherit the permissions of the person who requested it. The Finout MCP exposes 30 tools across five categories. #### Discovery & Context | Tool | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get\_account\_context | Returns connected cost centers, available data ranges, and account configuration. Good first call when orienting to a new account. | | search\_filters | Finds filter metadata by name - required before calling query\_costs or compare\_costs. | | get\_filter\_values | Returns available values for a specific filter (e.g., "what services do we use?"). | | list\_available\_filters | Lists all available filters by cost center. Use only when you need a full overview - prefer search\_filters for targeted lookups. | | debug\_filters | Diagnostic tool for inspecting raw filter metadata. Use when a filter lookup returns unexpected results. | | discover\_context | Finds dashboards, saved views, and data explorers by name. | | list\_data\_explorers | Lists all saved data explorer configurations in the account. | | list\_telemetry\_centers | Lists custom metric sources available for unit economics calculations. | | run\_data\_explorer\_report | Runs a saved data explorer by ID and returns its results (up to the top 500 rows) using the explorer's saved time range, columns, filters, and sort order. Call after `list_data_explorers` to resolve the explorer's ID. |
#### Cost Analysis | Tool | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | query\_costs | Core cost query tool. Returns totals, breakdowns, and trends for any combination of time period, filters, and grouping dimensions. | | compare\_costs | Compares cloud costs between two time periods. | | get\_top\_movers | Identifies dimensions with the biggest cost changes between two periods. | | get\_unit\_economics | Computes cost-per-unit metrics (e.g., cost per active user, cost per API request). | | get\_cost\_statistics | Returns daily cost stats: mean, median, peak, trough, and volatility. | | get\_cost\_patterns | Analyzes temporal patterns - hourly peaks, weekday vs. weekend splits, recurring cycles. | | get\_commitment\_coverage | Analyzes savings plan and reservation coverage, including commitment gaps. | | get\_usage\_unit\_types | Discovers available usage unit types for a cost center. Call before using usage\_configuration in query\_costs. | | query\_telemetry\_values | Queries values from a KPI/telemetry center (S3 CSV, Datadog, CloudWatch, Cost Explorer, or a Finout view ratio) by dimension and timeframe. | #### Anomalies & Waste | Tool | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | get\_anomalies | Retrieves cost anomalies and spikes detected by Finout. Filter by severity: high, medium, low. | | get\_waste\_recommendations | Returns CostGuard waste detection results - idle resources, over-provisioned instances, and commitment gaps. | | get\_resource\_metrics | Returns historical time-series metrics (CPU, memory, network, or usage volume) for a single resource, to confirm the trend behind a waste or rightsizing recommendation. | #### Governance & Allocation | Tool | Description | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | get\_tag\_coverage | Measures what percentage of spend is tagged by a given dimension. | | get\_financial\_plans | Retrieves budgets and forecasts with actuals, run rate, and forecast per dimension. | | analyze\_virtual\_tags | Deep-dives into virtual tag configuration, relationships, and allocation logic. | | list\_vtags (Beta) | Lists all Virtual Tags in your account. Typically called automatically before `compare_vtag_versions` to resolve a tag name to its ID. | | list\_vtag\_versions (Beta) | Returns the version history of a specific Virtual Tag — including who made each change, when, and any change description provided at save time. | | compare\_vtag\_versions (Beta) | Compares two versions of a Virtual Tag and returns a structured diff. Surfaces added, removed, and modified rules — including filter value changes and rule reordering — as well as metadata changes such as the tag name or default value. | | get\_object\_usages | Finds all places a named Finout object is referenced - useful before modifying anything. | | check\_delete\_safety | Checks whether a Finout object is safe to delete without breaking downstream dependencies. | #### Presentation | Tool | Description | | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | render\_chart | Renders a bar, column, line, or pie chart directly in the AI assistant UI. Use after query\_costs or compare\_costs to visualize results in-context. | ### **What the MCP Cannot Do** The Finout MCP is currently read-only. It can retrieve, analyze, and surface your cost data, but it cannot create, edit, or delete anything inside your Finout account. Specifically, the MCP cannot: * Create or modify Virtual Tags, Cost Centers, or Dashboards * Update financial plans or budgets * Change account settings or user permissions * Trigger any action that would alter your Finout configuration If your AI client generates a configuration — for example, a Virtual Tag definition — it will produce that output as text or JSON for you to review and apply manually inside the Finout app or through Finout API. ### Prompting Best Practices * Pair with the Finout Docs MCP: For questions that combine how-to guidance with live account data, connect both the Finout MCP and the [Finout Docs MCP](https://docs.finout.io/ai-and-developer-tools/finout-docs-mcp-integration) at the same time. This lets your AI client retrieve documentation and query your actual cost data in a single conversation. Example: *"What does the documentation say about Reserved Instance coverage, and what does our actual RI coverage look like this month?"* * Add context to your prompts. Mention the provider, time period, service, or tag dimension when relevant. For example: "Break down EC2 costs by environment tag for the last 30 days" * Be specific about the time period. The default is the last 30 days - saying "last quarter" or "March 2026" ensures you get exactly the window you intend. * Ask one thing at a time. Stacking unrelated questions can cause your AI client to conflate results. Ask them separately for cleaner answers. * Specify the output format. If you want a chart, table, or summary, say so. For example: "Show me monthly EC2 spend by region for Q1 as a bar chart" * A saved data explorer runs with its saved time range, columns, and filters. If that explorer was saved with a fixed date range, results may reflect that period rather than the current date - check the explorer's configured time range if the output looks out of date. #### Validating Responses Because the MCP relies on an LLM, responses are not always deterministic. To validate outputs: * Cross-reference results against your existing Finout dashboards or saved data explorers * Expand the tool calls in your AI client to inspect the underlying filters and groupings applied * If a response looks off, note what you asked, what you received, and what you expected - and share it with us via the submit\_feedback tool
### Feedback The Finout MCP includes a built-in submit\_feedback tool. After any interaction, ask your AI client to submit feedback directly: "Please submit feedback: the get\_top\_movers tool returned data for the wrong time period when I asked about last quarter." You can also reach your Finout contact directly or email . The more specific your feedback, the faster we can act on it. ### FAQs **Does the Finout MCP work with enterprise or internally-built AI tools?** Yes, in most cases. Any AI client that implements the MCP standard with OAuth support can connect to the Finout MCP at `https://mcp.finout.io/mcp`. In some cases, custom in-house AI tools that use the MCP protocol but implement OAuth callback registration themselves might face some issues with the initial connections. If your internal tool encounters an authorization error during setup, contact your Finout support for assistance.
**Does `compare_vtag_versions` show changes to reallocation rules?** No. The diff covers tagging rules, filter changes, and rule ordering. Changes to reallocation rules are not included. **Does the Finout MCP work with enterprise or internally-built AI tools?** Yes, in most cases. Any AI client that implements remote MCP with supported OAuth capabilities can connect to . Most enterprise platforms can self-register via DCR or CIMD and connect without contacting Finout - see Integration 2 for when you do need to. Gemini Enterprise is currently an exception: its MCP support is Alpha and not yet recommended for production use. **Which Integration Should I Use for a Scheduled Workflow?** Use an automated Machine-to-Machine integration. It operates as a dedicated service identity and does not require a browser login.
**Do I Need to Rotate My Machine-to-Machine Client Secret?** Yes - every 180 days, separate from the 24-hour access token, which your automation renews on its own without any action from you. **Does an M2M Connection Act as the User Who Requested It?** No. It operates as a dedicated service identity with a role and scopes assigned separately, at creation time. **What Permissions Does a Machine-to-Machine Connection Get?** Whatever Finout role was assigned when the credential was created - not the permissions of whoever requested it. Tell Finout what data or capabilities the automation needs when you request the connection, and Finout will map that to a role. **Does an M2M Connection Receive a Refresh Token?** No. It requests a new access token using the Client ID and Client Secret. **Can I Use One M2M Client for Multiple Automations?** This is not recommended. Use a dedicated client for each automation and environment to simplify auditing, rotation, and revocation.
**What's the Difference Between DCR, CIMD, and PKCE?** DCR and CIMD are both ways for a client to register itself with Finout automatically. PKCE is unrelated to registration - it's the login mechanism a client without a stored secret uses to complete authorization. See "How Finout MCP Clients Register" under Getting Connected.
**Can DCR or CIMD Grant Access to My Finout Account?** No. They register or identify an OAuth client. They do not assign Finout account access or roles.
**Does Finout MCP Provide Broader Access Than the Finout Application?** No. User-based integrations follow the authorizing user's access. Machine-to-Machine integrations follow their assigned service role, scopes, and applicable account policies.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.finout.io/ai-and-developer-tools/finout-mcp-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.