NetSuite SuiteAgents and MCP write tools: audit Claude and ChatGPT access before Brennan-style SuiteScript

In two sentences

SuiteAgents and SuiteSkills are NetSuite’s 2026 push to put industry knowledge into agents that still obey ERP roles; the AI Connector is how Claude or ChatGPT reach the same system through 25 named MCP tools, three of which write records and one of which executes record actions. Audit those tools with a matrix and a policy checker before you let any model near a live journal, and keep Brennan Industries’ lesson in view: when a task will run every day, build SuiteScript once instead of paying tokens forever.

What changed at SuiteWorld 2026

On 26 October 2026 Oracle NetSuite announced SuiteAgents: industry-specific agents built on the unified data model that identify issues, recommend next steps and support execution inside NetSuite governance. The press release names six industries. Software, Product and Construction are available now in NetSuite Next; Services, Healthcare and Nonprofit are planned for a future release, with the usual forward-looking disclaimer that timing and features can change.

Evan Goldberg’s quote in the release puts the intent plainly: industry expertise, business context and the next step, with people keeping oversight. The same release separates Ask Oracle (conversational access to skills, knowledge and tools) from SuiteAgents (ongoing monitoring and multi-step execution). That split matters for a controller: chat that answers a flux question is not the same surface as an agent that keeps watching revenue retention or job retainage.

diginomica’s Phil Wainewright, reporting from SuiteWorld with Oracle-funded travel (declared on the article), adds the pieces the press release only sketches:

• More than 45 SuiteSkills — agentic building blocks that run under NetSuite business rules, roles and permissions, usable inside NetSuite’s own AI or through external models via the AI Connector.
• A demo of one CFO dashboard rendered in Claude, ChatGPT and NetSuite Next with consistent numbers.
• Craig Sullivan (GVP Product Management) saying more than 13,000 customers already use AI through the AI Connector over MCP with Claude or ChatGPT.
• SuiteAgent Studio, SuiteFlow Agent and a SuiteAgent Management Workspace for building, conversational workflow creation, permissions and traceability (availability follows Oracle’s release notes; treat future items as direction, not a purchase commitment).
• NetSuite Next / Ask Oracle rolling from the US and Canada into the UK now, with Spain, Sweden and the Benelux in early 2027.

None of those adoption figures are audited by us. We cite them as vendor or press statements and move on to what a finance team can actually control: which tools a connected model is allowed to call.

Four surfaces a finance team must not mix up

Surface	What it is for	Where it runs	What to check before enabling
Ask Oracle	Conversational questions and guided skills inside NetSuite Next	NetSuite Next (regional rollout)	Role, skill set, whether MCP client features are on
SuiteAgents	Industry monitoring and multi-step execution	NetSuite Next (Software / Product / Construction now)	Management Workspace permissions, which agent can change which records
SuiteSkills	Reusable business skills (close, cash, inventory, projects, labour…)	NetSuite AI or Claude / ChatGPT via Connector	Same numbers across models; which skill can act vs only analyse
AI Connector + MCP Standard Tools	Named tools an external LLM invokes over MCP	Claude, ChatGPT and other MCP clients	The 25-tool list, REST permission, dedicated role, call log

Oracle’s product page for the AI Connector describes SuiteSkills for accelerating financial close, improving cash flow, investigating inventory, planning projects, supporting sales and reviewing labour cost — always under established roles and permissions. The MCP Standard Tools SuiteApp is the concrete tool catalogue behind many of those external calls. Our differential in this guide is that catalogue, not a re-telling of Icelandic Glacial’s Claude Skills close or the NetSuite controller Skills case already on this site.

The 25 MCP Standard Tools, classified for finance

Oracle’s help article Available Tools in the MCP Standard Tools SuiteApp lists seven families. We copied every tool name and official description into a matrix (YAML, JSON and CSV in the downloads folder) and labelled each with a finance risk that Oracle does not publish: read, attach, write or execute. Counts on 6 November 2026:

Risk	Count	Tools
read	19	File Cabinet navigation/search, get/list metadata, reports, saved searches, SuiteQL (read-only queries), session info, record action metadata
attach	2	ns_attachFile, ns_detachFile
write	3	ns_createRecord, ns_updateRecord, ns_transformRecord
execute	1	ns_executeRecordAction

Write tools. Record tools use REST Web Services. Oracle states they support the same record types and limits as REST, and the table marks ns_createRecord (and the rest of the Record family) with required permission REST Web Services (Full). Creating a journal, updating a vendor bill or transforming a sales order into an invoice is a ledger event. Treat all three as write even when the model phrases the request as “just prepare”.

Execute tool. ns_executeRecordAction runs an available action on a record after ns_getRecordActionMetadata discovers it. Until your team has mapped each action name to a named approver, keep it in blocked_always — our matrix and checker do that by default.

Attach tools. Attaching or detaching a File Cabinet file does not post a journal, but it changes the documentary trail of a bill or close pack. We give them their own risk so a read-only analyst profile denies them while a controller-review profile can allow them for audit packs.

SuiteQL. ns_runCustomSuiteQL is officially read-only. It can still dump large sensitive tables. Prefer saved searches with known result shapes for routine close work; reserve SuiteQL for investigations with a logged query text.

Oracle’s companion article on risks is unusually direct for vendor docs: prompt injection, hallucination, tool poisoning, rug pulls, compromised external agents and weak client-side policy enforcement. Mitigations that matter for finance: MCP off by default; never Administrator; separate roles per tool family; prefer read-only while evaluating; require clients that show the full tool name and schema before consent; review MCP logs with the agent’s own logs.

The community warning about REST Full

A r/Netsuite thread (community experience, not Oracle documentation) reports that enabling REST Web Services (Full) so the Standard Tools can read records also surfaces ns_createRecord and ns_updateRecord for that role. The original poster later updated that NetSuite pointed them to SuiteAnswer 1045687 on the Companion SuiteApp: its read-only default role omits REST, so reports, saved searches and SuiteQL remain available while single-record get/create/update through REST tools do not.

We cannot open SuiteAnswer from this environment. The operational takeaway does not need the PDF: do not reuse a broad controller role for MCP. Start from the Companion read-only role or an equivalent you build, add REST only when you intentionally want record tools, and test create/update attempts in sandbox with that exact role before any production consent.

Brennan Industries: build with Claude and Codex, run as SuiteScript

The SuiteAgents wave is one path. Brennan Industries, a hydraulic parts maker on NetSuite, shows another that diginomica reported on 2 November 2026 (same author disclosure: Oracle-funded SuiteWorld travel).

CIO Ryan King tells diginomica he uses Anthropic Claude Code, OpenAI Codex and more recently NetSuite Next to build apps for colleagues. He states he completes up to five projects a day where each previously took a week or more. The important design choice for cost and control: he has the agent generate SuiteScript so the deployed app runs inside NetSuite, instead of leaving everyday work in the chat where every call spends tokens. His line, as quoted: if you do it continually, build a program in NetSuite that does it automatically — “Then you don’t roast all those tokens.”

A typical flow he describes: sit with a colleague, build a mockup in about 45 minutes, revise, then generate SuiteScript and go live. One production example is a single call-logging screen wired to CRM so sales staff capture call context while looking up price and delivery, without switching NetSuite screens. He says he built that screen in an afternoon; previously call history was effectively missing across hundreds of calls. He also warns it is not magic: someone must know the NetSuite steps, processes and data the agent should follow.

ERP LEADERS’ 3 November summary of the same interview underlines the review risk at five apps a day: the slow step becomes who reviews generated SuiteScript, who tests it, and who keeps it working after the next upgrade. That is the finance control question in another costume — the same question SuiteAgent Management Workspace is meant to answer for vendor agents.

How this sits next to SuiteAgents. SuiteAgents encode NetSuite’s industry playbooks. Brennan encodes Brennan’s UX as SuiteScript. SuiteSkills try to keep numbers consistent whichever model you ask. The AI Connector lets Claude or ChatGPT call MCP tools under your role. A sane finance programme picks per task: vendor agent with Management Workspace logging; external model with a read-only MCP policy; or a SuiteScript app that no longer needs a model at runtime.

Step-by-step audit before any live connector

1. Inventory the surfaces you actually have. NetSuite Next region, Ask Oracle on/off, which SuiteAgents appear for your industry, whether MCP Standard Tools and the Companion SuiteApp are installed.
2. Create a dedicated MCP role from the Companion read-only template (or equivalent). Do not clone the day-to-day controller role. Confirm Administrator cannot use MCP (Oracle control).
3. Connect only in sandbox. Oracle’s connector docs show Claude adding the NetSuite connector with your account-scoped MCP URL for com.netsuite.mcpstandardtools (or /all for every custom tool — avoid /all until you know what else is installed).
4. Call ns_getSessionInfo first. Save account, role, features and permissions next to the close checklist.
5. Load our matrix and start with profile finance-analyst-readonly: allow only read risk tools.
6. Run the checker on a real or exported call log shaped like our fixtures. Any write or execute call must fail closed.
7. Promote one task at a time after two closes of clean logs: attach for audit packs, then sandbox write for a single rehearsed journal type, still blocking ns_executeRecordAction until actions are mapped.
8. Decide the long-term home of the task. If it will run daily, Brennan’s SuiteScript path usually beats leaving it in Claude or ChatGPT. If it is investigative, SuiteSkills or Ask Oracle may be enough. If it is industry monitoring NetSuite already ships, evaluate the matching SuiteAgent under the Management Workspace.

Copy and adapt

Agents Finance template based on Oracle’s published MCP Standard Tools list (verified 6 November 2026). Tool names and official descriptions remain Oracle’s; risk labels, profiles and the checker are ours.

Download: /downloads/#guide-netsuite-suiteagents-mcp-write-tools-brennan-2026

cd public/downloads/guide-netsuite-suiteagents-mcp-write-tools-brennan-2026   # or your download folder
python3 mcp_tool_policy_check.py --self-test
python3 mcp_tool_policy_check.py --policy policy.example.json --calls tool-calls-ok.json
python3 mcp_tool_policy_check.py --policy policy.example.json --calls tool-calls-bad-write.json

Expected on this machine (6 November 2026): self-test prints 6 checks passed; the ok log exits 0 with five allowed calls; the bad-write log exits 1 and blocks ns_createRecord and ns_updateRecord.

Minimal policy shape:

{
  "profile": "finance-analyst-readonly",
  "deny_tools": [
    "ns_executeRecordAction",
    "ns_createRecord",
    "ns_updateRecord",
    "ns_transformRecord",
    "ns_attachFile",
    "ns_detachFile"
  ],
  "require_session_check": true,
  "environment": "sandbox"
}

Call-log shape your MCP client must be able to export or that you paste by hand:

{
  "label": "Close prep",
  "calls": [
    {"tool": "ns_getSessionInfo", "args": {}},
    {"tool": "ns_runSavedSearch", "args": {"searchId": "YOUR_SEARCH"}}
  ]
}

Concrete example (fictitious log, real tool names)

A controller asks Claude, connected with the read-only policy, to list open periods and pull the balance sheet. The call log matches tool-calls-ok.json: session info, list searches, run one search, a short SuiteQL peek, run report. Checker: allowed.

The same session, after a vague “fix the accrual” prompt, emits ns_createRecord for a journalentry and ns_updateRecord on a vendorbill (tool-calls-bad-write.json). Checker: blocked on both write tools. Nothing reached NetSuite in our test because we never connected; in production the same policy should sit in front of the client or in your review gate before someone clicks Allow on a write tool.

A third log discovers record actions and calls ns_executeRecordAction with action approve. Even on profile close-operator-sandbox (which allows write), our blocked_always list still fails the execute call. That is intentional.

Prices you will actually pay (models only)

NetSuite SuiteAgents / Connector pricing is not on a public list we can quote; treat it as part of your NetSuite contract. For the models Brennan and the Connector use, official pages on 6 November 2026 show (ex-tax, subject to change):

Product	Plan that typically unlocks it	Official price (checked 6 Nov 2026)
Claude / Claude Code	Pro	$20/month monthly; $17/month annual
Claude / Claude Code	Team Standard	$20 per seat/month annual; $25 monthly
ChatGPT / Codex	Plus	$20/month
ChatGPT / Codex	Pro	From $100/month (tiers at $100 / $200 / $500)

Sources: claude.com/pricing, chatgpt.com/pricing. Token burn on top of the subscription is exactly the cost Brennan is trying to avoid for routine screens.

Limits and risks

• Vendor adoption numbers (13,000+ Connector customers; “up to five” Brennan apps a day) are stated by NetSuite or by King via diginomica, not re-measured here.
• diginomica’s SuiteWorld pieces disclose Oracle as premier partner and funded travel — treat colour and emphasis accordingly; we still rely on them for Sullivan’s and King’s quotes.
• SuiteAgents for Services, Healthcare and Nonprofit, Studio, SuiteFlow Agent and parts of Management Workspace may still be future direction — check your account’s release notes.
• Ask Oracle / NetSuite Next are not globally available; Spain is listed for early 2027 in diginomica’s report.
• Our checker does not talk to NetSuite. It only reviews a JSON call log against a policy.
• Official docs say MCP tools never run as Administrator and cannot call elevated SuiteScripts, Suitelets or external HTTP — helpful, not sufficient. Role design and human confirmation on high-impact tools remain yours.
• Prompt injection via PDFs, emails and third-party MCP tools is explicitly listed by Oracle; keep untrusted documents out of write-enabled sessions.

Common errors

1. Enabling the Connector with a full controller role because “it already has the right UI permissions”.
2. Assuming SuiteQL write safety equals “safe for any query” — it is read-only SQL, not a confidentiality control.
3. Confusing SuiteAgents (vendor industry agents) with Brennan-style custom SuiteScript (your UX, your maintenance).
4. Leaving ns_executeRecordAction allowed because “we only approve bills in the UI anyway” — the tool is the UI for the model.
5. Judging success only by tokens saved, without a review queue for generated SuiteScript or agent record changes.
6. Copying Icelandic Glacial’s Claude Skills close pattern without noticing this guide’s angle is Connector tool risk and SuiteAgents, not month-end Skills content.

Conclusions

SuiteWorld 2026 made the NetSuite AI story concrete: industry SuiteAgents where NetSuite has depth, SuiteSkills that travel with the model you choose, and an AI Connector that thousands of customers already use. For a finance team the durable control is still boring: a dedicated role, a written list of allowed tools, logs you actually read, and a bias toward SuiteScript (or SuiteAgents under the Management Workspace) for anything that must run every day without a person staring at the chat. Download the matrix, run the checker on a sandbox log, and only then widen the policy.

Newsletter

The next template in this series will be a close-folder checklist that maps each MCP write tool to a named approver and a NetSuite permission — subscribe so it lands when it ships.