MCP Workflows

Platform MCP works best when the client follows a read, plan, change, verify loop.

These examples show safe autonomous patterns. They use tool names, not a specific client UI, so you can adapt them to Claude, Cursor, OpenCode, or a custom client.

Workflow Guardrails

Before giving an MCP client write access:

1. Give it the smallest preset or exact permissions that fit the job.
2. Keep destructive permissions off by default.
3. Ask the client to produce a plan before write tools run.
4. Require human approval before destructive tools.
5. Verify changes with read tools after every write.
6. Review MCP Connections → Recent Audit Events after the run.

Audit An Agent Before Launch

Best permissions: Agent Builder plus sources:read, retrieval:read, feedback:read, and conversations:read.

Only after the plan is approved should the client use update_agent_prompt, update_agent_model, or update_agent_retrieval_settings.

Add And Sync Knowledge Sources

Best permissions: Content Manager.

1. Use list_sources to avoid duplicates.
2. Use create_source for one URL, sitemap, file, or image source.
3. Use create_bulk_upload for a ZIP upload URL that already exists.
4. Use batch_sources for multiple FILE or IMAGE sources.
5. Use sync_source to queue ingestion or reindex.
6. Use list_ingestion_jobs or get_ingestion_job until the job succeeds or fails.
7. Use search_knowledge_base to verify retrieval.

Do not give sources:delete unless the workflow is allowed to remove sources. Source creation and sync only need sources:write.

Operate Conversations

Best permissions: Operator.

Use this when an internal assistant helps support teams triage active conversations.

1. list_conversations with status or channel filters.
2. get_conversation and list_conversation_messages to understand context.
3. get_end_user and get_end_user_memory to understand the customer.
4. takeover_conversation when a human should respond.
5. send_conversation_message for a human-authored reply in a takeover conversation.
6. assign_conversation or close_conversation when the support flow is complete.

Use set_end_user_memory only for facts the team wants saved for future conversations.

Build Or Update An Agent

Best permissions: Agent Builder.

1. create_agent with a BAREBONES or SUPPORT template.
2. update_agent_identity to set name, slug, or template.
3. update_agent_prompt for system instructions.
4. update_agent_model for model, temperature, output token, context-window, or step defaults.
5. update_agent_builtin_tools and update_agent_channel_settings for runtime behavior.
6. create_skill or install_skill_recipe for reusable instructions.
7. attach_skill_to_agent and reorder_agent_skills.
8. export_agent_configuration before and after changes so the client can show a diff.
9. test_agent or chat_playground to verify behavior.

Use import_agent_configuration only after reviewing the sanitized export payload.

Manage External MCP Servers For An Agent

Best permissions: Agent Builder plus access to the target agent.

1. list_mcp_catalog to inspect supported catalog entries.
2. activate_catalog_mcp_server to attach an API-key catalog server to an agent.
3. create_custom_mcp_server for a private Streamable HTTP or SSE server.
4. test_mcp_server before enabling it for production traffic.
5. update_mcp_server to change enabled tools or mark the config inactive.

The Platform MCP response returns sanitized config metadata only. It does not return stored secrets.

Manage API Keys Safely

Best permissions: Full Admin normal permissions plus exact API-key permissions.

1. list_api_keys and get_api_key to inspect metadata.
2. create_api_key for a new service account. Copy oneTimeRawKey; it will not be returned again.
3. update_api_key to narrow permissions, resource grants, allowed origins, rate limit, or expiry.
4. rotate_api_key when ownership changes or a key may be exposed.
5. revoke_api_key only with api_keys:revoke and explicit human approval.

Prefer rotation over creating duplicate long-lived keys.

Review Usage And Cost

Best permissions: Analytics preset.

Use get_usage, get_analytics, and get_billing_summary to answer questions about usage, cost, credits, and subscription state. These tools are read-only and safe for reporting clients.

Voice Operations

Best permissions: voice:read, and voice:write only for sync or diagnostics cleanup.

1. list_voice_models and list_voices to inspect available ElevenLabs options when configured.
2. get_voice_agent_sync_status to check local voice config for an agent.
3. sync_voice_agent to push voice config to ElevenLabs and store sync metadata.
4. list_voice_sessions, get_voice_transcript, and list_voice_tool_calls for diagnostics.
5. clear_voice_tool_calls to clear transient Redis diagnostics.

Destructive Workflow Pattern

Use this pattern for delete_*, archive_skill, revoke_api_key, and deactivate_user tools.

1. Read the target resource first.
2. Ask the client to summarize impact in plain language.
3. Confirm the resource ID with a human.
4. Run the destructive tool once.
5. Read again to verify the result.
6. Check audit events for mcp.tool.destructive.

Do not grant destructive permissions to broad autonomous clients. Create a separate short-lived key for cleanup runs.

Related Docs

MCP Permissions

Map each workflow to the right preset, exact permissions, and destructive controls.

MCP Client Configs

Connect the MCP client before running these workflows.