# NetSuite MCP Standard Tools — finance policy checker

Agents Finance template based on Oracle NetSuite’s official list of tools in the
**MCP Standard Tools SuiteApp**
([docs](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0902023508.html),
verified 2026-11-06). Risk labels (`read` / `attach` / `write` / `execute`) are ours
for finance teams, not Oracle’s.

## Files

| File | What it is |
| --- | --- |
| `mcp-standard-tools-matrix.yaml` / `.json` / `.csv` | All 25 official tools with effect, risk, permission and a finance note |
| `policy.example.json` | Read-only finance analyst policy (start here) |
| `tool-calls-ok.json` | Fictitious read-only call log that must pass |
| `tool-calls-bad-write.json` | Fictitious log with `ns_createRecord` / `ns_updateRecord` that must fail |
| `tool-calls-bad-execute.json` | Fictitious `ns_executeRecordAction` that must fail even on a sandbox write profile |
| `mcp_tool_policy_check.py` | Checker (Python 3, standard library only) |

## Run

```bash
python3 mcp_tool_policy_check.py --self-test
python3 mcp_tool_policy_check.py --policy policy.example.json --calls tool-calls-ok.json
python3 mcp_tool_policy_check.py --policy policy.example.json --calls tool-calls-bad-write.json
```

Exit `0` = allowed, `1` = blocked, `2` = usage / IO error.

## What this is not

- It does **not** connect to NetSuite. Paste or export your own MCP client tool-call
  log into the same JSON shape (`calls: [{ "tool": "ns_…", "args": {} }]`).
- It does **not** replace NetSuite role permissions, OAuth consent or MCP activity logs.
- SuiteAgents / SuiteSkills / Ask Oracle are separate product surfaces; this matrix
  covers only the **MCP Standard Tools SuiteApp** tool names published by Oracle.

Licence: original Agents Finance work, free to use and adapt. Official tool names and
descriptions remain Oracle’s; cite the docs URL above.