# Agents Finance — NetSuite MCP Standard Tools risk matrix # Source: Oracle NetSuite docs "Available Tools in the MCP Standard Tools SuiteApp" # https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0902023508.html # Verified: 2026-11-06. Risk labels are Agents Finance classifications for finance teams, # not Oracle labels. Do not invent tools: only those listed in the official table. # Companion role tip (community, not Oracle): r/Netsuite thread on REST Web Services (Full) # unlocking create/update when that permission is present on the MCP role. schema_version: 1 source: name: Oracle NetSuite — Available Tools in the MCP Standard Tools SuiteApp url: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0902023508.html verified: "2026-11-06" community_note: name: "r/Netsuite — NetSuite MCP connector gives more access than your role should allow" url: https://www.reddit.com/r/Netsuite/comments/1t1sifq/netsuite_mcp_connector_gives_more_access_than/ gist: "OP update: with REST Web Services (Full) on the role, the user can call ns_getRecord, ns_getRecordTypeMetadata, ns_createRecord and ns_updateRecord. NetSuite pointed to SuiteAnswer 1045687 Companion SuiteApp default roles; the read-only companion role omits REST." profiles: finance-analyst-readonly: description: "Reports, searches and SuiteQL only. No record create/update/transform, no file attach/detach, no record actions." allow_risk: [read] controller-review: description: "Read tools plus File Cabinet attach/detach for audit packs. Still no create/update/transform/execute." allow_risk: [read, attach] close-operator-sandbox: description: "Sandbox only. Allows write and transform for rehearsals; still blocks executeRecordAction until a named approver policy exists." allow_risk: [read, attach, write] blocked_always: - ns_executeRecordAction # treat as highest impact until you map each action to an approval tools: - name: ns_attachFile group: File Cabinet effect: attach risk: attach official_description: Attaches an existing File Cabinet file to a NetSuite record. required_permission: "-" finance_note: Changes the audit trail of a record without deleting the file. - name: ns_detachFile group: File Cabinet effect: detach risk: attach official_description: Removes a file's attachment to a record without deleting the file. required_permission: "-" finance_note: Can break the documentary trail of a bill or journal. - name: ns_getFolderByPath group: File Cabinet effect: read risk: read official_description: Lists the files and folders directly in a specified folder. required_permission: "-" finance_note: Read-only navigation of File Cabinet. - name: ns_getIdFromPath group: File Cabinet effect: read risk: read official_description: Resolves a file or folder path to its internal ID. required_permission: "-" finance_note: Read-only path resolution. - name: ns_getPathFromId group: File Cabinet effect: read risk: read official_description: Resolves a file or folder internal ID to its complete path. required_permission: "-" finance_note: Read-only path resolution. - name: ns_searchFiles group: File Cabinet effect: read risk: read official_description: Searches file names across accessible File Cabinet folders. required_permission: "-" finance_note: Read-only search. - name: ns_createRecord group: Record effect: create risk: write official_description: Creates a new record in NetSuite. required_permission: REST Web Services (Full) finance_note: Can create journals, bills, invoices and other REST-supported records. Needs a dedicated MCP role and sandbox rehearsal. - name: ns_getRecord group: Record effect: read risk: read official_description: Retrieves a record in NetSuite. required_permission: REST Web Services (Full) finance_note: Read of a single record. Still needs REST Full for Standard Tools record family. - name: ns_getRecordTransformMetadata group: Record effect: read risk: read official_description: Lists supported transformations from one NetSuite record type to another. required_permission: REST Web Services (Full) finance_note: Metadata only; does not transform. - name: ns_getRecordTypeMetadata group: Record effect: read risk: read official_description: Retrieves metadata for NetSuite record types, including available fields and data types. required_permission: REST Web Services (Full) finance_note: Metadata only. - name: ns_transformRecord group: Record effect: transform risk: write official_description: Transforms an existing NetSuite record into a new record of a supported target type. required_permission: REST Web Services (Full) finance_note: Creates a new record from another (e.g. sales order to invoice). Treat as write. - name: ns_updateRecord group: Record effect: update risk: write official_description: Updates an existing record in NetSuite. required_permission: REST Web Services (Full) finance_note: Can change amounts, dates, statuses and custom fields on live records. - name: ns_getRecordActionMetadata group: Record Action effect: read risk: read official_description: Returns actions available for a record type or a specific record. required_permission: "-" finance_note: Discovery only. - name: ns_executeRecordAction group: Record Action effect: execute risk: execute official_description: Executes an available action for a specific record. required_permission: "-" finance_note: Highest impact in this SuiteApp. Map each action to a named approver before allowing. - name: ns_getAccountingBooks group: Report effect: read risk: read official_description: Returns accounting books that can filter report results. required_permission: "-" finance_note: Report filter helper. - name: ns_getAccountingContexts group: Report effect: read risk: read official_description: Returns accounting contexts that can filter report results. required_permission: "-" finance_note: Report filter helper. - name: ns_getNexusIds group: Report effect: read risk: read official_description: Returns nexuses that can filter report results. required_permission: "-" finance_note: Report filter helper. - name: ns_getSubsidiaries group: Report effect: read risk: read official_description: Returns subsidiaries that can filter report results. required_permission: "-" finance_note: Report filter helper. - name: ns_listAllReports group: Report effect: read risk: read official_description: Returns a list of all standard and custom reports in your NetSuite account. required_permission: "-" finance_note: Inventory of reports. - name: ns_runReport group: Report effect: read risk: read official_description: Runs a report in your NetSuite account and displays the results. required_permission: "-" finance_note: Read-only report execution; can still expose sensitive figures. - name: ns_getSessionInfo group: Runtime effect: read risk: read official_description: Returns account and role information, enabled features, granted permissions and preference values for the current session. required_permission: "-" finance_note: Useful to verify which role the connector is actually using. - name: ns_listSavedSearches group: Saved Search effect: read risk: read official_description: Returns a list of all saved searches in your NetSuite account. required_permission: Perform Search (View) finance_note: Inventory of searches. - name: ns_runSavedSearch group: Saved Search effect: read risk: read official_description: Runs an existing saved search from your NetSuite account. required_permission: Perform Search (View) finance_note: Read-only search execution. - name: ns_runCustomSuiteQL group: SuiteQL effect: read risk: read official_description: Runs a custom SuiteQL query. Only read-only queries are supported. required_permission: "-" finance_note: Officially read-only. Still can dump large sensitive datasets. - name: ns_getSuiteQLMetadata group: SuiteQL effect: read risk: read official_description: Retrieves metadata for NetSuite records accessible with SuiteQL. required_permission: "-" finance_note: Metadata only.