Principle: tools come from definitions

MCP publishing sits at the end of the Text-to-SQL engine. Declared metrics are compiled, the query to run is inspected, and an administrator freezes the approved definition; excluded definitions keep a reason. A published tool binds its declared arguments, passes execution control and submits a read-only query. On this path the model never regenerates SQL per call.

Tools come from definitions — the path not opened and the path openedNot openedClient → the model writes new SQL on every call → databaseOpened — definition side (administrator)Declared metricsCompiled and inspectedAdministrator freezesexcluded definitionskeep a reasonPublished tooldeclared arguments boundOpened — call side (Claude · ChatGPT)Client calltool list only onauthenticated connectionsExecution controlargument, permissionand output limitsRead-only querySQL is never regeneratedResult with its scopeapplied conditionscome back with itthe frozen definition serves every call
Top: the path not opened. Below: only administrator-frozen definitions become tools, and every call reuses that definition under execution control.

Results that carry their scope

Per-tenant tool lists are served only to authenticated connections. Output limits and masking apply to results, and empty results are distinguished from requests outside the retained period — 'zero rows' and 'no data for that period' are different answers.

A result comes back with its scopeResponse (call recorded 2026-11-08)stateokappliedcancelled documents excludedsigned-in company scopeorder dates 2026-01-01 up to 2026-02-01rowsvalues · output limits and masking appliedjob / auditcomparable against the tenant audit logPer-tenant tool lists are served only to authenticated connectionsZero rowsno rows matched the conditions— the period is inside retentionOutside the retained periodnot an empty result —a different answer: cannot be answered
A response carries state, applied conditions and values; 'zero rows' and 'outside the retained period' are different answers.

One real call

On November 8, 2026 we recorded Claude.ai on the web connected to querymind.co.kr/mcp (QueryMind Connect release 20261108e) on a public demonstration tenant: synthetic ERP data, one approved order-amount query. The response JSON is visible on screen — state ok, the applied conditions (cancelled documents excluded, signed-in company scope, order dates from 2026-01-01 up to 2026-02-01) and the values: January 37,767,000, February 34,638,400, a difference of −3,128,600 (−8.3%). Applying the same tool to April–June returns 71,862,000. The comparison against the tenant audit log is in the recording notes.

Claude.ai showing the QueryMind MCP tool request and response JSON
Request and response — a still from the 2026-11-08 Claude.ai recording. Query, tool call and answer are preserved; synthetic ERP data.

Why the edits and limits are written down

The tab-share recording was normalized to 1904×824 and only the greeting and waiting intervals were cut; no text was overpainted, no result changed. Some things were not captured: the connector setup flow, and a ChatGPT video (the November 7 review cases confirm it works). Because the tool declaration lacks a read-only hint, Claude's permission screen lists the query as a write tool; the next release fixes that. A demonstration is proof of boundaries, not a performance claim.

Same pattern, other engines

The document-reasoning engine's Jupgo MCP connector (2026-10-22) and the controlled-generation engine's Taste Edition MCP stage one (2026-10-23, six read tools) follow the same principle: member OAuth is required, and the tools deliver what the engine already decided rather than letting the client's model decide in its place.