Tool Packs and Safe Exposure

Four curated tool packs ship — casework, CRM, documents and ERP — alongside the generic datastore tools.

Where to find it

Which packs a credential may use is set on the credential, in the MCP datastore opened from All Datastores.

Expose the smallest useful surface

Every tool you expose is something a model may attempt. A narrow, well-named set produces better results than everything at once, because the model is choosing from a shorter list of clearer options.

Curated packs over generic access

A pack expresses operations at the level the module works at. That is safer as well as more effective: an operation meaning "post a journal" carries the ledger's own rules with it, whereas raw write access to the journal table does not.

Think about the blast radius

Before granting Write, ask what the worst plausible outcome is if a model misinterprets an instruction. Creating a duplicate contact is recoverable. Posting to the ledger, sending messages to service users or disposing of records are not, and those deserve either read-only exposure or a human approval step in between.

Watch what is actually called

Review the call log after enabling a client, particularly early on. It tells you which tools are being used and how, which is the fastest way to spot a tool that is being misused or one that is exposed and never touched.

Personal data

Data reaching a model reaches whoever operates that model. Check where the provider processes it and whether that is compatible with what you told people in your privacy notice. This is a data protection decision as much as a technical one, and it belongs with whoever owns that in your organisation.