How-tos

Specify a read-only MCP tool

Define an allowlisted input schema, authenticated caller, authorization rule, minimal output, and explicit error outcomes.