{
  "schema_version": 1,
  "source": {
    "name": "Oracle NetSuite — Available Tools in the MCP Standard Tools SuiteApp",
    "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0902023508.html",
    "verified": "2026-11-06"
  },
  "community_note": {
    "name": "r/Netsuite — NetSuite MCP connector gives more access than your role should allow",
    "url": "https://www.reddit.com/r/Netsuite/comments/1t1sifq/netsuite_mcp_connector_gives_more_access_than/",
    "gist": "OP update: with REST Web Services (Full) on the role, the user can call ns_getRecord, ns_getRecordTypeMetadata, ns_createRecord and ns_updateRecord. NetSuite pointed to SuiteAnswer 1045687 Companion SuiteApp default roles; the read-only companion role omits REST."
  },
  "profiles": {
    "finance-analyst-readonly": {
      "description": "Reports, searches and SuiteQL only. No record create/update/transform, no file attach/detach, no record actions.",
      "allow_risk": [
        "read"
      ]
    },
    "controller-review": {
      "description": "Read tools plus File Cabinet attach/detach for audit packs. Still no create/update/transform/execute.",
      "allow_risk": [
        "read",
        "attach"
      ]
    },
    "close-operator-sandbox": {
      "description": "Sandbox only. Allows write and transform for rehearsals; still blocks executeRecordAction until a named approver policy exists.",
      "allow_risk": [
        "read",
        "attach",
        "write"
      ]
    }
  },
  "blocked_always": [
    "ns_executeRecordAction"
  ],
  "tools": [
    {
      "name": "ns_attachFile",
      "group": "File Cabinet",
      "effect": "attach",
      "risk": "attach",
      "required_permission": "-",
      "official_description": "Attaches an existing File Cabinet file to a NetSuite record.",
      "finance_note": "Changes the audit trail of a record without deleting the file."
    },
    {
      "name": "ns_detachFile",
      "group": "File Cabinet",
      "effect": "detach",
      "risk": "attach",
      "required_permission": "-",
      "official_description": "Removes a file's attachment to a record without deleting the file.",
      "finance_note": "Can break the documentary trail of a bill or journal."
    },
    {
      "name": "ns_getFolderByPath",
      "group": "File Cabinet",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Lists the files and folders directly in a specified folder.",
      "finance_note": "Read-only navigation of File Cabinet."
    },
    {
      "name": "ns_getIdFromPath",
      "group": "File Cabinet",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Resolves a file or folder path to its internal ID.",
      "finance_note": "Read-only path resolution."
    },
    {
      "name": "ns_getPathFromId",
      "group": "File Cabinet",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Resolves a file or folder internal ID to its complete path.",
      "finance_note": "Read-only path resolution."
    },
    {
      "name": "ns_searchFiles",
      "group": "File Cabinet",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Searches file names across accessible File Cabinet folders.",
      "finance_note": "Read-only search."
    },
    {
      "name": "ns_createRecord",
      "group": "Record",
      "effect": "create",
      "risk": "write",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Creates a new record in NetSuite.",
      "finance_note": "Can create journals, bills, invoices and other REST-supported records. Needs a dedicated MCP role and sandbox rehearsal."
    },
    {
      "name": "ns_getRecord",
      "group": "Record",
      "effect": "read",
      "risk": "read",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Retrieves a record in NetSuite.",
      "finance_note": "Read of a single record. Still needs REST Full for Standard Tools record family."
    },
    {
      "name": "ns_getRecordTransformMetadata",
      "group": "Record",
      "effect": "read",
      "risk": "read",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Lists supported transformations from one NetSuite record type to another.",
      "finance_note": "Metadata only; does not transform."
    },
    {
      "name": "ns_getRecordTypeMetadata",
      "group": "Record",
      "effect": "read",
      "risk": "read",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Retrieves metadata for NetSuite record types, including available fields and data types.",
      "finance_note": "Metadata only."
    },
    {
      "name": "ns_transformRecord",
      "group": "Record",
      "effect": "transform",
      "risk": "write",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Transforms an existing NetSuite record into a new record of a supported target type.",
      "finance_note": "Creates a new record from another (e.g. sales order to invoice). Treat as write."
    },
    {
      "name": "ns_updateRecord",
      "group": "Record",
      "effect": "update",
      "risk": "write",
      "required_permission": "REST Web Services (Full)",
      "official_description": "Updates an existing record in NetSuite.",
      "finance_note": "Can change amounts, dates, statuses and custom fields on live records."
    },
    {
      "name": "ns_getRecordActionMetadata",
      "group": "Record Action",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns actions available for a record type or a specific record.",
      "finance_note": "Discovery only."
    },
    {
      "name": "ns_executeRecordAction",
      "group": "Record Action",
      "effect": "execute",
      "risk": "execute",
      "required_permission": "-",
      "official_description": "Executes an available action for a specific record.",
      "finance_note": "Highest impact in this SuiteApp. Map each action to a named approver before allowing."
    },
    {
      "name": "ns_getAccountingBooks",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns accounting books that can filter report results.",
      "finance_note": "Report filter helper."
    },
    {
      "name": "ns_getAccountingContexts",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns accounting contexts that can filter report results.",
      "finance_note": "Report filter helper."
    },
    {
      "name": "ns_getNexusIds",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns nexuses that can filter report results.",
      "finance_note": "Report filter helper."
    },
    {
      "name": "ns_getSubsidiaries",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns subsidiaries that can filter report results.",
      "finance_note": "Report filter helper."
    },
    {
      "name": "ns_listAllReports",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns a list of all standard and custom reports in your NetSuite account.",
      "finance_note": "Inventory of reports."
    },
    {
      "name": "ns_runReport",
      "group": "Report",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Runs a report in your NetSuite account and displays the results.",
      "finance_note": "Read-only report execution; can still expose sensitive figures."
    },
    {
      "name": "ns_getSessionInfo",
      "group": "Runtime",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Returns account and role information, enabled features, granted permissions and preference values for the current session.",
      "finance_note": "Useful to verify which role the connector is actually using."
    },
    {
      "name": "ns_listSavedSearches",
      "group": "Saved Search",
      "effect": "read",
      "risk": "read",
      "required_permission": "Perform Search (View)",
      "official_description": "Returns a list of all saved searches in your NetSuite account.",
      "finance_note": "Inventory of searches."
    },
    {
      "name": "ns_runSavedSearch",
      "group": "Saved Search",
      "effect": "read",
      "risk": "read",
      "required_permission": "Perform Search (View)",
      "official_description": "Runs an existing saved search from your NetSuite account.",
      "finance_note": "Read-only search execution."
    },
    {
      "name": "ns_runCustomSuiteQL",
      "group": "SuiteQL",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Runs a custom SuiteQL query. Only read-only queries are supported.",
      "finance_note": "Officially read-only. Still can dump large sensitive datasets."
    },
    {
      "name": "ns_getSuiteQLMetadata",
      "group": "SuiteQL",
      "effect": "read",
      "risk": "read",
      "required_permission": "-",
      "official_description": "Retrieves metadata for NetSuite records accessible with SuiteQL.",
      "finance_note": "Metadata only."
    }
  ]
}