Tools

A tool is one callable operation on an MCP server: a name, an input and output JSON Schema, and a side_effect_type of read, write, delete, or admin. Discovery sets that side-effect type automatically by scanning the tool's name and description for keywords — "delete", "remove", "drop" mark it delete; "create", "write", "update", "push", "merge", and similar mark it write; everything else defaults to read. It is a heuristic, not a static analysis of what the tool's code actually does, so it can be wrong for a tool whose name doesn't match its behavior — the catalog lets an operator see and correct it.

Every tool belongs to exactly one MCP server (mcp_server_id) and that ownership is what the catalog's server filter and per-server grouping are built on. A tool optionally carries a target_extractor — a small JSON spec, authored from the tool's detail card, that tells the gateway how to derive a resource URI from the tool's invocation arguments at call time. One mode reads a URI template populated from named arguments ({owner}/{repo} from an owner/repo pair); the other parses table names out of a SQL string argument. Without an extractor, a call is only governed at the tool level; with one, the gateway can also evaluate resource- and column-level policy against whatever the extractor resolves. The tool detail card includes a test runner that lets an operator try an extractor against sample arguments before saving it.

Risk tags and compliance tags are free-form labels attached to a tool at creation or discovery time and are what the catalog's search and filtering keys off alongside side-effect type. Policy coverage on a tool's card is not a catalog fact stored on the row — it's computed by looking up which published policies are attached to that specific tool ID, and whether any of them carry a deny effect.

A tool's lifecycle_state (draft, active, deprecated, archived) and version_hash track its evolution independent of governance state — a tool can be actively enforced against while still in draft, and a deprecated tool keeps whatever policies were bound to it until someone removes them.