Run agent calls through the same business rules as the app

How to do it

A separate agent endpoint that writes to the database directly skips the stock check, the price rule or the audit log sooner or later. Make each tool a thin adapter that maps arguments to an existing service call. Add a rule once, in the service, and every channel gets it. Tests for business rules run against the service, plus one test per channel that proves it calls the service. Validate arguments first, as Design tools like a small public API says.

Examples

JavaScript example

server.registerTool('create_booking', bookingToolSpec, async (args, { auth }) =>
  toToolResult(await bookingService.create({ ...args, actor: actorsOf(auth.claims) })));

Python example

@mcp.tool(name="create_booking")
async def create_booking(slot: str, guests: int, ctx: Context) -> dict:
    return to_tool_result(await booking_service.create(slot=slot, guests=guests, actor=actors_of(ctx.auth.claims)))

How to check

A test runs each business rule case through the HTTP API and through the MCP tool. Both give the same outcome. A search of the tool code finds no SQL and no direct database client.

Sources

• OWASP Top 10 for LLM Applications, LLM06 Excessive Agency

Related rules

• AIF-15 Design tools like a small public API in AI features