MCP tools & approvals

Agents call tools through Anthropic's Model Context Protocol (MCP). Aroovo treats every MCP server as a URL: register the server, the platform introspects the tool list, agents see the tools in their prompt, and tool calls dispatch into the configured server. Zapier MCP provides roughly 6,000 SaaS actions through one endpoint; custom MCP servers (Composio, Cloudflare, your own stack) sit alongside.

What lives where

  • Custom tools. Two only: search_knowledge (KB lookup, in-process) and the platform's own tools for managing tenants, agents, and audit. Everything else is MCP.
  • Zapier MCP. One endpoint, hundreds of SaaS integrations. Pro plan (~£20/mo) covers ~9k MCP calls per month; per-tenant cost stays small in practice.
  • Custom MCP servers. Any URL implementing the MCP spec. Registered via POST /api/mcp-servers; per-agent allowlists scope which servers a given persona can talk to.

Tool dispatch lifecycle

  1. Agent loop calls the model with the merged tool catalogue (custom tools + every MCP server introspected for the agent).
  2. Model emits a tool_use block with a namespaced name (zapier:gmail_send, custom:lookup_invoice).
  3. Dispatcher resolves the tool to its registry entry, validates the arguments against the tool's Ajv-compiled schema, and looks up the gating policy.
  4. If gated, the call pauses and an Approval row is written. Operators see the queue at /approvals; the agent gets a synthetic tool_result reply once a human resolves it.
  5. Result is appended to the conversation, the model continues. The tool call + result + approval (if any) all write rows into the HMAC-chained audit log.

Approval gates

Three policies, picked per tool (defaulted at the MCP-server level, overridable per Brand):

  • no_gate. Read-only lookups (search, fetch, list). No approval required.
  • single_approval. A Brand-Owner or Admin clicks approve before the call dispatches. Default for any tool with a side effect.
  • dual_approval. Two distinct operators must sign off. Default for destructive actions (delete record, send invoice, revoke access). Configurable per Brand.

Validation + safety

Every MCP tool ships an Ajv-compiled validator at registration time; invalid arguments become synthetic is_error: true tool results and never hit the upstream server. The MCP bootstrap path enforces SSRF protection (hostname allowlist + private IPv4/IPv6 + loopback name blocks) so a malicious Brand-Owner can't point the runtime at an internal-only service.

References