/mcp always exposes three tools. It does not place every Salesforce, Jira, n8n, HQ Rental, Google, or social definition into the AI client’s context.
The effective inner catalog is calculated for every account. Salesforce operations are always namespaced with
salesforce_. Other operations use their provider namespace, such as jira_, confluence_, n8n_, and hqrental_. Disabled operations do not appear in discovery, and a client holding an old cached name cannot bypass the current catalog.
Every Salesforce call checks ApexGenius authorization. New per-user connections apply the connected user’s Salesforce permissions. Some existing projects still use a project-level shared connection, so confirm the connection mode shown for the selected Salesforce project before relying on a user-specific permission boundary.
Salesforce operations
Discovery can return these 21 namespaced Salesforce operations.Project and metadata discovery
Queries, records, and schema
Staging and documentation
The MCP filesystem covers private Salesforce staging and project documentation. Chat-session storage is not available through these operations.Jira and Confluence
Jira and Confluence operations become discoverable only when their provider row is active, the user’s connection is active and healthy, the account has effective access, and the operation is enabled. The current schemas for both providers require an authorized ApexGeniusproject_id on every operation so the gateway can verify project and organization access. Jira is still Beta and can also require project activation during the current transition. The connected Atlassian account remains the Jira and Confluence content boundary.
Jira currently supplies 15 issue, user, field, sprint, and project operations. Confluence supplies six space and page operations. Reads and writes carry distinct risk annotations, and writes pass the same tool-policy and write-audit path as the rest of the gateway.
n8n
A connected n8n provider makes its current 20 operations available to discovery, subject to the connection, account, authorization, and tool-policy checks described above. These operations include workflow inspection, templates, generation, replacement, autofix, test runs, data tables, instance audit, and deletion. The public ApexGenius surface remains three tools.Other connected apps
HQ Rental, Google services, social publishers, remote MCP providers, and approved custom MCP servers use the same public discovery and read/write call tools. An implementation appearing in the catalog does not mean an account is connected. Discovery returns an operation only when the provider and connection pass their live availability checks.Guardrails
- Authorization per call: cached names cannot bypass the current provider, connection, resource, surface, or tool-policy checks.
- Read/write boundary: the read proxy rejects writes. The write proxy is statically labeled destructive and open-world so MCP clients can apply their write confirmation behavior.
- Confirmation and audit: writes are risk-labeled so compatible clients can request confirmation. Supported provider writes are recorded in the write audit. A universal server-enforced Auto, Ask, or Off mode is not yet part of the public contract.
- Health gating: inactive provider rows and unhealthy or inactive connections disappear from discovery and are denied at execution.
- Rate limits: weighted sliding-window limits protect the gateway and connected provider quotas.
- Content-minimized logging: operational records retain bounded tool, actor, project, timing, count, size, outcome, and error-code metadata, not generic copies of tool arguments or results. See How the MCP connection works and the Privacy Policy.
- Restricted data: do not use these tools for payment-card data, PHI, government identifiers, passwords, API keys, MFA codes, or other authentication secrets.