Capabilities (MCP tools)
Beyond account connections, your agent can use tools — capabilities added through the Model Context Protocol (MCP). Connect them at Dashboard → Capabilities. Every tool runs under the same security model as first-party capabilities: credentials in the vault, calls through the egress proxy, and a risk tier on every tool.
Seeds & setup
Paste a playbook URL or X/Twitter status into Ask (or Slack/Telegram /mission).
The agent fetches it (Firecrawl scrape → browser → web fetch), proposes a
SetupPlan of connections and watches, then parks until you connect. See
Jobs → Seeds.
Firecrawl scrape/search is platform-managed — never a setup step. Social
accounts still link under Connections. Proven arbitrary MCP
servers can be promoted into the runtime catalog overlay after human review
(docs/catalog-promotion.md).
The curated catalog
Catalog entries are pre-audited: known tool sets, known risk maps, declared network destinations, one-click connect.
| Tool | Category | What the agent uses it for |
|---|---|---|
| Wavetable | CRM | Query your ledger, create records, send email/SMS via sender identities |
| Apollo | Research | Find and enrich B2B contacts — emails, titles, socials |
| ListKit | Research | B2B people search and enrichment (Apollo-shaped) |
| Eventbrite | Research | List organization events and attendees for post-event follow-up |
| Hunter | Research | Find and verify email addresses |
| Instantly | High-volume cold email with warmed inboxes | |
| Mailchimp | List-based broadcast campaigns (OAuth) | |
| Site watch | Research | Watch a public blog listing or RSS/Atom feed; wakes the agent when new items appear |
| Dropbox Sign | Documents | Send quotes, proposals, and engagement letters for e-signature; chase until signed |
| Google Business Profile | Local | Read and respond to reviews, update hours, publish posts (OAuth) |
| QuickBooks Online | Money | AR aging, invoices, expense categorization drafts (OAuth) |
| Jobber | Field service | Clients, quotes, jobs, and scheduling for home-services businesses (OAuth) |
Included by Waveguide (no connect step): web scrape/search via Firecrawl is platform-managed — usage is metered on Billing like AI model spend. Social posting is also platform-backed; you link X / Instagram / LinkedIn under Connections → Social.
API-key tools ask for the key at connect time (it goes straight into the vault); OAuth tools use the provider’s own consent screen.
Wake triggers
A connected tool isn’t just something the agent can call — it’s something that can wake the agent. Catalog connectors declare their events: vendors that push webhooks (a signed document, a paid invoice) wake the agent the moment they fire, and push-less signals (new Google reviews, a site-watch listing) are polled on a schedule, waking the agent only when something actually changed. Event content is treated as untrusted and quarantined before it can influence any action.
You can also ask the agent to set this up in chat: watch_register / watch_list / watch_remove on a
site-watch connection, and schedule_wake / schedule_list / schedule_cancel for one-shot or recurring
time-based wakes. Same agent loop as a human message — the platform just starts the session without you typing.
Connecting your own MCP server
Any MCP server works — point the agent at its URL and pick the auth type (OAuth discovery per RFC 9728, API key, bearer, or none). On connect, Waveguide:
- Discovers the tools the server exposes (
tools/list). - Classifies each tool into a risk tier T0–T3 using a conservative heuristic — read/search verbs are T0, writes T1, send/post/publish T2, and anything touching money or deletion T3. Unknown verbs fail safe to T2. On Capabilities, click a tool chip to override its tier.
- Scans every tool description for prompt-injection / tool-poisoning patterns (instruction overrides, hidden preconditions, exfiltration directives, credential references). A flagged tool is deactivated until you review it (same tool chip → Clear flag).
- Records a manifest hash so a server that quietly changes what its tools do is detected on the next sync — drift re-triggers review instead of silently granting new behavior.
Network manifests
Each tool connection declares the hosts it’s allowed to reach. The egress proxy enforces this default-deny: a tool that claims to be a CRM can’t suddenly call an unrelated host, because the proxy refuses the connection.
How tools appear to the agent
Connected tools mount as capabilities in the agent’s sandbox. You do not wire each ability to a provider by hand. When you ask for work, name the system if you care (“put them in HubSpot”, “from Instantly”) — or say both. If it’s unclear and you have more than one CRM (or similar substitutes), the agent asks which to use, then continues.
HubSpot honesty: Waveguide does not ship a first-party HubSpot MCP connector. Saying “HubSpot” only works if you connected a custom HubSpot MCP (or use Wavetable / another CRM as the CRM capability). Instantly, Apollo, ListKit, and Ayrshare are first-party shims in the catalog.
Tier gating happens at call time in the proxy, same as everything else: a T0 search runs freely, a T2 send_email
needs your approval or a standing policy, and a T3 tool call always needs a human. Every call is in the
audit trail.
Outreach routing
Tools that send (email campaigns, social DMs, SMS) declare lane semantics — which channel they represent and how replies come back. That’s how a tool like Instantly plugs into missions with correct reply routing and suppression handling.