Tool Execution
How agents discover and run approved connector tools through the Wato gateway.
Agents never call connector APIs directly. Every tool call goes through the Wato MCP gateway, which enforces team approval and per-tool access, runs the call with server-side credentials, and records a trace.
Discover tools
| Tool | What it does |
|---|---|
mesh_search_tools | Search the tools visible to your team by name, connector, description, or regex. Pass includeSchema: true for input schemas. |
mesh_get_tool_schemas | Fetch the complete input schemas for specific team-visible tools. |
Discovery only returns tools the caller is actually allowed to use, so an agent sees exactly what its team and role permit.
Run a tool
mesh_execute_tool runs one tool that was found with mesh_search_tools.
Before the call runs, the gateway checks that:
- the connector is installed/approved for the team,
- the caller is a team member, and
- the tool is allowed by the team's tool-access policy for that role/user.
If all pass, Wato resolves the connector's encrypted credentials, executes the call server-side, and returns the result.
Governed by design
The gateway is the only path to a connector. Credentials stay server-side, the team's approval and tool-access rules are enforced on every call, and the call is recorded as a trace.
Timeouts
Tool calls run within the gateway's request budget (up to a few minutes for long-running operations). Individual connectors may apply their own shorter timeouts.
Related
- Install & configure — get a connector's tools synced first.
- Reference — the full MCP tool catalog.