MCP Tool Catalog and Risk Worksheet for ERP Agents
An MCP server turns ERP functions into tools an AI model can call. Before any of them ship, you need one register that says what each tool touches, how far a mistake can spread and who approves it. This worksheet is that register, with a computed risk score.
| Tool name | ERP object touched | Access type | Impact if wrong (1-5) | Records reachable (1-5) | Hard to undo (1-5) | Risk score | Approval gate | Owner | |
|---|---|---|---|---|---|---|---|---|---|
3 | |||||||||
2 | |||||||||
4 | |||||||||
12 | |||||||||
40 | |||||||||
20 |
Anything scoring above about 40 should sit behind human approval or stay disabled. The scale is a convention for ranking, not a standard. Adjust the gate column after your security review.
Review my MCP tool register
Optionally send your register for a short expert review of scoring and approval gates.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
List one row per tool exactly as it appears in your MCP server's tool list, using the same name the model sees. Name the ERP object it reads or changes, pick the access type, then score impact, reach and reversibility from 1 to 5. The risk column multiplies the three, so a read-only lookup of one record scores low and a delete across many records scores very high. Set the approval gate last, after the score is visible. Export to Excel and attach the file to your change request or security review.
- One row per tool, never per server
- Score the worst realistic mistake, not the expected one
- Review the register whenever a tool is added or its parameters change
How the score works
The score is impact times reach times reversibility, giving a range of 1 to 125. It is a ranking device borrowed from the way FMEA multiplies severity, occurrence and detection. It is not a standard and the thresholds are yours to set. A common starting rule is: below 10 can run with logging, 10 to 40 needs a human to confirm, above 40 stays disabled until a compensating control exists. Reads are not free: a read tool that can page through every customer record has a high reach even though it changes nothing.
Reading the example
In the sample rows, the lookup tools score 2 to 6 and run with light logging. Updating a promise date scores 12 and needs approval because a planner downstream may act on it. Posting a goods receipt scores 40 and deleting a work order scores 20 but is irreversible once downstream transactions exist, so both are marked Disabled until a controlled path exists. The point is that the number forces a conversation about each tool rather than a blanket yes or no on the agent.
Common mistakes
Teams often register the MCP server as a single line and approve it as a whole. Others forget that a generic execute-SQL or run-report tool can reach every table, which makes its reach score a 5 regardless of how it is described. Also remember that ERP roles still apply: the service account behind the tool should carry the least privilege that tool needs, and the register should name that account.
- Avoid generic query or script tools unless the reach score is honest
- Record the ERP service account per tool
- Keep write tools separate from read tools so each can be gated alone
Frequently Asked Questions
How many tools should one MCP server expose?
There is no fixed limit, but fewer, well-described tools generally give better model behavior and smaller prompts. Many teams stay under a few dozen per server and split by domain, such as purchasing, inventory and production, so each agent only sees the tools it needs.
Do read-only tools need approval?
Usually not per call, but they still need logging and a reach limit. A read tool that returns every employee or pricing record can leak data without changing anything. Score reach honestly and cap row counts in the tool itself.
Is the risk score an industry standard?
No. It is a simple multiplication in the style of FMEA scoring, offered so you can rank tools and set your own thresholds. Replace it with your organization's own risk matrix if one exists.
Can I import this into Excel?
You can export the worksheet to Excel or CSV with one click. The risk column is exported as values, so if you want live formulas, multiply the three score columns in your spreadsheet.
Netray builds MCP and agent layers over ERP with read-only defaults and human approval on write-back. If you want a second pair of eyes on your tool register, we can review it.
Related Tools
AI Agent ERP Access Request Form Template
A fill-in form that records which ERP roles, objects and limits an AI agent service account needs, with approval signatures.
Compliance & ContractsAgent Action Audit Log Worksheet
Record agent actions, the tool called, the ERP record affected and the approver, with a computed latency and exception count.
Developer ToolsMCP Server Deployment Runbook Template
A fill-in runbook covering host, secrets, network, health checks, monitoring and rollback for an MCP server in front of an ERP.
AI Agents & AutomationAI Agent Evaluation Test Case Worksheet
Log evaluation questions for an ERP agent with expected answers, the tool it should call and scored results, with a computed pass rate.
More Developer Tools tools
See all- SAP Sales Order ABAP SELECT Generator (VBAK, VBAP, VBFA)
- SAP Sales Order Create BAPI ABAP Generator (BAPI_SALESORDER_CREATEFROMDAT2)
- SAP ABAP Open Items SELECT Generator
- SAP ACDOCA SQL Query Generator
- SAP QM Inspection Lot ABAP SELECT Generator
- SAP Quality Notification Pareto SQL Query Generator
- SAP QM Usage Decision BAPI Skeleton
- ABAP Custom Exception Class Generator
- ABAP Unit Test Class Generator