Loading…
Dynamics 365 Finance and Operations X++ knowledge base with Azure DevOps integration.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 26 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The ALMXPPMCP MCP server exposes 90 tools, focused primarily on AI, database, and filesystem capabilities. Its published description reads: "Dynamics 365 Finance and Operations X++ knowledge base with Azure DevOps integration". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates ALMXPPMCP F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check ALMXPPMCP's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add ALMXPPMCP to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.almxpp.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Run an in-house best-practice audit on any AOT object (custom or standard), from the indexed source -- NOT the Microsoft BP checker. Rules are this server's own: SEC (security chain), PERF (firstOnly,
Find all extension objects (AxClassExtension, AxTableExtension, AxFormExtension, AxEnumExtension), CoC classes ([ExtensionOf]), and event handlers for a base object. Also queries Azure DevOps Code Sea
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: ado_analyze_workitem
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
NIQUEMENT. IMPORTANT: never post (never call ado_post_comment) on anyRecommendationRemove model-directed instructions from tool descriptions.
tool: create_aot_object
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
l[:intValue]]" IMPORTANT: start from value 10 or higherRecommendationRemove model-directed instructions from tool descriptions.
tool: list_release_note_inputs
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
vendor model). IMPORTANT: this server holds the ACTUAL indexed code diffRecommendationRemove model-directed instructions from tool descriptions.
tool: validate_best_practices
A tool description tries to alter the model’s use of another tool.
e profiling use detect_performance_issues instead. [!] Auto-fixing Critical violations reRecommendationDescriptions must describe only their own tool.
tool: find_extensions
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
yet in the KB. ALWAYS call before creating a new extension — avoid parallel custoRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: dmf_import_file
A tool description tries to alter the model’s use of another tool.
me from the KB (find_entity_for_table) -- do not invent it.RecommendationDescriptions must describe only their own tool.
tool: search_d365_code
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: search_d365_code
A database tool exposes a query/sql parameter that is a free-form string with no allow-list or parameterisation constraint — a raw-string injection surface. A tool exposing structured filters or an `enum` of named queries does not fire.
unconstrained query parameter "query"RecommendationExpose parameterised operations instead of a raw query string; never build queries from unvalidated model output.
tool: dmf_transform_excel
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
elForDMF. NO FO credentials required (offline transform). Provide the workbRecommendationRemove side-channel parameters; constrain tool inputs.
tool: dmf_transform_excel
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: generate_query
A tool description tries to alter the model’s use of another tool.
ble joins, call find_related_objects (or get_relation_graph if the relation index isRecommendationDescriptions must describe only their own tool.
tool: appinsights_diagnose_slowness
A tool description tries to alter the model’s use of another tool.
gured first via appinsights_set_connection (or server env vars). Triggers: 'déduire et coRecommendationDescriptions must describe only their own tool.
tool: get_object_details
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: ado_query_workitems
A tool description tries to alter the model’s use of another tool.
365 code -> use search_d365_code or get_object_details. Shortcuts: 'bugs' (all aRecommendationDescriptions must describe only their own tool.
tool: dmf_apply_entity_filter
A tool description tries to alter the model’s use of another tool.
of an existing DMF project, so the export only contains the matchiRecommendationDescriptions must describe only their own tool.
tool: find_references
A tool description tries to alter the model’s use of another tool.
ions only — use find_extensions for CoC/event handlers.RecommendationDescriptions must describe only their own tool.
tool: ado_gap_fit_analysis
A tool description tries to alter the model’s use of another tool.
en analysed by `ado_analyze_workitem` in the same turn, pass the requirement text diRecommendationDescriptions must describe only their own tool.
tool: batch_search
A tool description tries to alter the model’s use of another tool.
se INSTEAD of multiple sequential search_d365_code calls -- each line becoRecommendationDescriptions must describe only their own tool.
tool: ado_read_attachment
A tool description tries to alter the model’s use of another tool.
kitem first (or ado_query_workitems) to discover attachment file names if you don'tRecommendationDescriptions must describe only their own tool.
tool: plan_and_execute
A tool description tries to alter the model’s use of another tool.
ble"}},{"tool":"validate_best_practices","args":{"objectName":"SalesTable"}}]` ## WhenRecommendationDescriptions must describe only their own tool.
tool: recommend_extension_strategy
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: find_related_objects
A tool description tries to alter the model’s use of another tool.
d, delegates to get_relation_graph (O(1)) internally — do NOT call both tools forRecommendationDescriptions must describe only their own tool.
tool: ado_review_xpp_pr
A tool description tries to alter the model’s use of another tool.
run on it. Use find_error_patterns for Microsoft rule text. Triggers: 'review thisRecommendationDescriptions must describe only their own tool.
tool: dmf_create_data_project
A tool description tries to alter the model’s use of another tool.
e (or extend) a DMF data project -- EXPORT or IMPORT -- entirely thRecommendationDescriptions must describe only their own tool.
tool: find_entity_for_table
A tool description tries to alter the model’s use of another tool.
ntité expose', 'DMF entity for', 'create data entity', 'expose viaRecommendationDescriptions must describe only their own tool.
tool: summarize_for_stakeholder
A tool description tries to alter the model’s use of another tool.
object_details, validate_best_practices, ado_analyze_workitem, detect_performance_issueRecommendationDescriptions must describe only their own tool.
tool: resync_devops_index
A tool description tries to alter the model’s use of another tool.
ride the server PAT for this resync. The eviction + download runs in theRecommendationDescriptions must describe only their own tool.
tool: dmf
A tool description tries to alter the model’s use of another tool.
tool schema instead of five. The dedicated tools remain available unchangeRecommendationDescriptions must describe only their own tool.
tool: ado_analyze_pr_impact
A tool description tries to alter the model’s use of another tool.
ew'. NEVER call search_d365_code when 'PR' or 'Pull Request' + a number is mentiRecommendationDescriptions must describe only their own tool.
tool: ado_analyze_pr_impact
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
a Pull Request. Reads each changed file's CONTENT straight from the PR's source commit via the ADRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: find_error_patterns
A tool description tries to alter the model’s use of another tool.
ead of developers.RecommendationDescriptions must describe only their own tool.
tool: suggest_edt
A tool description tries to alter the model’s use of another tool.
end instead of using raw primitives (str, int64, real, date). Triggers: 'wRecommendationDescriptions must describe only their own tool.
tool: get_object_context
A tool description tries to alter the model’s use of another tool.
TEAD of those two separate calls to reduce round-trips. Optionally includeRecommendationDescriptions must describe only their own tool.
tool: odata_upsert_rows
A tool description tries to alter the model’s use of another tool.
bulk loads use dmf_import_file. Provide rows as a JSON array of objects; resolRecommendationDescriptions must describe only their own tool.
tool: find_change_impact
A tool description tries to alter the model’s use of another tool.
t. Combine with validate_best_practices / detect_performance_issues to get both impactRecommendationDescriptions must describe only their own tool.
tool: appinsights_set_connection
A tool description tries to alter the model’s use of another tool.
ights_query and appinsights_diagnose_slowness use it automatically until it expires or you caRecommendationDescriptions must describe only their own tool.
tool: dmf_get_job_status
A tool description tries to alter the model’s use of another tool.
the status of a DMF import/export execution by its executionId (e.gRecommendationDescriptions must describe only their own tool.
tool: detect_performance_issues
A tool description tries to alter the model’s use of another tool.
ral quality use validate_best_practices. [!] Auto-fixing requires D365_CUSTOM_MODEL_PATRecommendationDescriptions must describe only their own tool.
tool: get_relation_graph
A tool description tries to alter the model’s use of another tool.
e complete than find_related_objects for known object names. ALWAYS call this beforeRecommendationDescriptions must describe only their own tool.
tool: get_relation_graph
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
n object names. ALWAYS call this before generating code that touches multiple objects oRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: d365fo_clear_connection
A tool description tries to alter the model’s use of another tool.
rent session by d365fo_set_connection.RecommendationDescriptions must describe only their own tool.
tool: generate_xpp_template
A tool description tries to alter the model’s use of another tool.
rn. ALWAYS call get_object_details first to verify the object exists.RecommendationDescriptions must describe only their own tool.
tool: generate_xpp_template
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
/exist pattern. ALWAYS call get_object_details first to verify the object exists. {"type":"object","RecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: generate_fdd
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: generate_fdd
A tool description tries to alter the model’s use of another tool.
al docs -- use `get_object_details` for that. FUNCTIONAL DESIGN DOCUMENT GENERATRecommendationDescriptions must describe only their own tool.
tool: map_business_process
A tool description tries to alter the model’s use of another tool.
ns only -- use `find_related_objects` for that (faster and more precise).RecommendationDescriptions must describe only their own tool.
tool: ado_post_comment
A tool description tries to alter the model’s use of another tool.
ER: call AFTER `ado_analyze_workitem` when user says 'post the analysis', 'save it tRecommendationDescriptions must describe only their own tool.
tool: get_data_entity_info
A tool description tries to alter the model’s use of another tool.
ding an OData / DMF integration needs a quick rundown of a specificRecommendationDescriptions must describe only their own tool.
tool: list_objects
A tool description tries to alter the model’s use of another tool.
e search -- use search_d365_code.RecommendationDescriptions must describe only their own tool.
tool: explain_workflow
A tool description tries to alter the model’s use of another tool.
details -- use `get_object_details`. WORKFLOW EXPLAINER (Business Language) -- ERecommendationDescriptions must describe only their own tool.
tool: trace_role_license_tree
A tool description tries to alter the model’s use of another tool.
ference -- use `trace_security_chain` for that.RecommendationDescriptions must describe only their own tool.
tool: prepare_release_note_context
A tool description tries to alter the model’s use of another tool.
e server calling its own LLM. Call resolve_client_profile FIRST -- if it fRecommendationDescriptions must describe only their own tool.
tool: ado_analyze_workitem
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
dds latency and token cost.","type":"boolean","default":false},"maxCoRecommendationRemove side-channel parameters; constrain tool inputs.
tool: ado_analyze_workitem
A tool description tries to alter the model’s use of another tool.
search_labels / search_d365_code instead. ## WHAT THIS TOOL RETURNS Raw structRecommendationDescriptions must describe only their own tool.
tool: ado_wiki_create_or_update_page
A tool description tries to alter the model’s use of another tool.
nt. ALWAYS call ado_wiki_get_page first if you intend to edit (not replace) an exRecommendationDescriptions must describe only their own tool.
tool: ado_wiki_create_or_update_page
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
rkdown content. ALWAYS call ado_wiki_get_page first if you intend to edit (not replace) an existingRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: resolve_workspace_roots
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
variables. Use before any tool that accepts a customModelPath/standardModelPatRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: resolve_client_profile
A tool description tries to alter the model’s use of another tool.
tomModelIds for prepare_release_note_context, no further discovery needed. If not found, falRecommendationDescriptions must describe only their own tool.
tool: create_aot_object
A tool description tries to alter the model’s use of another tool.
erride label for this extension AxQueryExtension -------------RecommendationDescriptions must describe only their own tool.
tool: d365fo_set_connection
A tool description tries to alter the model’s use of another tool.
d of resending the secret on every call. In a locked server deployment (D3RecommendationDescriptions must describe only their own tool.
tool: appinsights_clear_connection
A tool description tries to alter the model’s use of another tool.
rent session by appinsights_set_connection.RecommendationDescriptions must describe only their own tool.
tool: generate_data_entity
A tool description tries to alter the model’s use of another tool.
el. ALWAYS call find_entity_for_table first to verify a standard entity doesn't alreaRecommendationDescriptions must describe only their own tool.
tool: generate_data_entity
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
l custom model. ALWAYS call find_entity_for_table first to verify a standard entity doesn't already exiRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: appinsights_query
A tool description tries to alter the model’s use of another tool.
ounters. Prefer appinsights_diagnose_slowness for a ready-made "why is it slow" report -- useRecommendationDescriptions must describe only their own tool.
tool: search_context_docs
A tool description tries to alter the model’s use of another tool.
objects -- use search_d365_code / get_object_details for that. Triggers: 'whatRecommendationDescriptions must describe only their own tool.
tool: trace_security_chain
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: find_relation_path
A tool description tries to alter the model’s use of another tool.
ctor scan. Use `get_relation_graph` for the full neighbourhood of a single object;RecommendationDescriptions must describe only their own tool.
tool: ado_estimate_effort
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
mbined with ADO history (similar past tasks) to produce a structured hoRecommendationRemove side-channel parameters; constrain tool inputs.
tool: ado_estimate_effort
A tool description tries to alter the model’s use of another tool.
ER: call AFTER `ado_analyze_workitem` when the user asks 'how long?', 'estimate thisRecommendationDescriptions must describe only their own tool.
tool: ado_list_prs
A tool description tries to alter the model’s use of another tool.
h]'. NEVER call search_d365_code for PR listing requests. List Pull Requests inRecommendationDescriptions must describe only their own tool.
tool: generate_diagram
A tool description tries to alter the model’s use of another tool.
try-points use `trace_security_chain` instead). Note: 'flow' (execution flowchart) iRecommendationDescriptions must describe only their own tool.
tool: save_client_profile
A tool description tries to alter the model’s use of another tool.
le was found by resolve_client_profile and the user wants one created (or updated) forRecommendationDescriptions must describe only their own tool.
tool: dmf_export_package
A tool description tries to alter the model’s use of another tool.
create it with dmf_create_data_project if needed. For ad-hoc exports without a projectRecommendationDescriptions must describe only their own tool.
tool: ado_post_pr_comment
A tool description tries to alter the model’s use of another tool.
ER: call AFTER `ado_analyze_pr_impact` when user says 'post the review', 'add commentRecommendationDescriptions must describe only their own tool.
tool: list_release_note_inputs
A tool description tries to alter the model’s use of another tool.
s FIRST, before prepare_release_note_context -- it discovers the exact D365FO version stringRecommendationDescriptions must describe only their own tool.
tool: list_release_note_inputs
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
te_inputs WHEN: ALWAYS call this FIRST, before prepare_release_note_context -- it discovers thRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: search_labels
A tool description tries to alter the model’s use of another tool.
text, then call find_references with the same label ID to find ALL X++ objectsRecommendationDescriptions must describe only their own tool.
tool: odata_export_entity
A tool description tries to alter the model’s use of another tool.
m the KB first (find_entity_for_table / get_data_entity_info) -- do not invent entityRecommendationDescriptions must describe only their own tool.
tool: fix_best_practice_violations
A tool description tries to alter the model’s use of another tool.
WHEN: validate_best_practices returned violations and you want concrete X++ fRecommendationDescriptions must describe only their own tool.
tool: generate_release_note_document
A tool description tries to alter the model’s use of another tool.
already called prepare_release_note_context and analyzed its 'objects' array yourself, prodRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
e_xpp_template, validate_best_practices, list_objects, ... Keywords: label, libellé, @SRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
puts() -- ALWAYS call first: discovers real version strings + custom modelRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: dmf_import_file
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: dmf_transform_excel
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "dmf_transform_excel"RecommendationScope tools to the minimum needed.
tool: ado_wiki_delete_page
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: appinsights_diagnose_slowness
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "appinsights_diagnose_slowness"RecommendationScope tools to the minimum needed.
tool: ado_update_workitem
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "ado_update_workitem"RecommendationScope tools to the minimum needed.
tool: ado_read_attachment
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
e attachment', 'open the excel file on the work item', 'what does the attached docuRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: ado_read_attachment
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "fileName"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: resync_devops_index
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "resync_devops_index"RecommendationScope tools to the minimum needed.
tool: ado_analyze_pr_impact
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
a Pull Request. Reads each changed file's CONTENT straight from the PR's source commitRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: odata_upsert_rows
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: ado_create_task
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "ado_create_task"RecommendationScope tools to the minimum needed.
tool: appinsights_set_connection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "appinsights_set_connection"RecommendationScope tools to the minimum needed.
tool: d365fo_clear_connection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "d365fo_clear_connection"RecommendationScope tools to the minimum needed.
tool: ado_post_comment
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "ado_post_comment"RecommendationScope tools to the minimum needed.
tool: ado_wiki_create_or_update_page
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: resolve_workspace_roots
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
current caller. Reads D365-Custom-Model-Path and D365-Standard-Model-Path from the request hRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: d365fo_set_connection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "d365fo_set_connection"RecommendationScope tools to the minimum needed.
tool: appinsights_clear_connection
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "appinsights_clear_connection"RecommendationScope tools to the minimum needed.
tool: dmf_export_package
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "dmf_export_package"RecommendationScope tools to the minimum needed.
tool: ado_post_pr_comment
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "ado_post_pr_comment"RecommendationScope tools to the minimum needed.
tool: odata_export_entity
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "odata_export_entity"RecommendationScope tools to the minimum needed.
tool: create_aot_object
An unusually long description is a common injection-padding tactic.
description length 7561 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Bulk-import a CSV file into a D365 F&O entity through the Data Management package REST API. Builds the package (Manifest + header + CSV) in memory, uploads it to Azure blob, then calls ImportFromPacka
WHEN: object name is unknown, partial, or you need to find by concept/keyword. Search the D365 F&O knowledge base for X++ code, tables, classes, forms, views, enums, EDTs, security objects using natur
Transform a multi-sheet Excel (.xlsx) into DMF-ready rows using a data-driven JSON mapping -- equivalent to FO_TransformExcelForDMF. NO FO credentials required (offline transform). Provide the workboo
WHEN: developer needs correct X++ select or T-SQL for D365 tables with proper joins. Triggers: 'X++ select', 'generate a query', 'SQL for', 'join with', 'how to query', 'générer une requête', 'write a
AZURE DEVOPS ONLY -- Delete a wiki page. This also deletes its sub-pages if any exist under it. Requires DEVOPS_ORG_URL + DEVOPS_PAT env vars (PAT needs Wiki: Read & Write scope).
WHEN: user wants to understand/deduce why a D365 F&O environment feels slow, using the real Application Insights telemetry the environment already emits -- no trace file upload needed. Runs a set of c
AZURE DEVOPS ONLY -- List all wikis in a project (the project wiki plus any published code-as-wiki repos). Use this FIRST when the user doesn't know the wiki's exact name/id, or to confirm which wiki
WHEN: you know the EXACT object name. Triggers: user gives an exact name like 'SalesTable', 'CustTable', 'VendInvoiceJour', any PascalCase D365 object name. Get complete details: all fields, methods,
AZURE DEVOPS ONLY -- Query Work Items (Bugs, Tasks, FDDs, User Stories, CRs) in Azure DevOps. [~] PRIORITY TRIGGER: use this tool when the user mentions 'FDD', 'RDD', 'IDD', 'CR', 'Task', 'Workitem',
Apply a single-field value filter to ONE entity row of an existing DMF project, so the export only contains the matching records. The kernel builds the packed query (custom 'GenerateQueryData' action)
Update one or more fields on an existing Azure DevOps Work Item. Can update any standard field (System.Description, System.Title, System.State, System.AssignedTo, ...) or custom field (Custom.Extensio
Full index scan for all usages of an object, method, field, or label ID. Use for impact analysis before changing or deleting an object. EXPENSIVE — O(1M+ chunks). Prefer find_callers when XRef index i
WHEN: user asks whether a D365 requirement is standard, needs config, needs an extension, or is a full gap. Also triggered by gap analysis or fit/gap classification of a Work Item. GAP / FIT CLASSIFIE
WHEN: you need context on multiple D365 objects or concepts simultaneously -- runs all queries in parallel. Use INSTEAD of multiple sequential search_d365_code calls -- each line becomes one parallel
AZURE DEVOPS ONLY -- Reads the ACTUAL CONTENT of a file attached to a work item (Excel spreadsheet, Word document, text/CSV/JSON/XML file, or image). WHEN: a work item (FDD/RDD/CR/Bug/Task/User Story)
WHEN: you need to understand the full data lifecycle of a D365 F&O table field: who writes it, who reads it, which forms display it, which reports use it, and which tables have FK relationships to its
CHAIN-OF-TOOLS PLANNER -- Execute a multi-step JSON plan in ONE call by chaining tools. Pass an EXPLICIT JSON array of steps (NL parsing disabled to prevent ambiguity). Maximum 5 steps per plan. The c
Find D365 objects structurally similar to the one you supply (same kind, similar method set, similar field set). Useful when you need a working reference implementation to copy from.
WHEN: developer about to customise a standard D365 object asks 'should I use AxTableExtension, Chain of Command, EventHandler, or Delegate?'. Triggers: 'how to extend', 'best way to customise', 'exten
Compare two D365 F&O KB snapshots to produce a changelog (added/removed/modified objects). Use action 'save_baseline' once, then 'compare' between two snapshots.
Returns ALL FK/DeleteAction/DataSource relations (outgoing) AND back-references (incoming). Call BEFORE generating multi-object code to understand the full dependency graph. When the relation index is
WHEN: reviewing a PR that modifies X++ code or AOT objects and you need D365-specific insights. Returns a structured code review for each changed object: blast radius (who calls it), best-practice vio
Create (or extend) a DMF data project -- EXPORT or IMPORT -- entirely through standard public OData entities, with NO X++ customization required. It POSTs the header to DataManagementDefinitionGroups
WHEN: developer needs to integrate via OData and wants to find the entity name for a given table. Also generates a new entity template when none exists and generateIfMissing=true. Triggers: 'which ent
WHEN: you have a large technical tool output (get_object_details, validate_best_practices, ado_analyze_workitem, detect_performance_issues...) and need it reframed for a non-technical audience. Calls
WHEN: developer wants to improve code quality before a PR merge or code review. Triggers: 'refactor', 'clean up', 'simplify', 'too long method', 'nested ifs', 'code smells', 'améliorer le code'. Sugge
WHEN: the user wants to force a full re-download and re-index of their Azure DevOps custom model. Triggers: 'resync', 'reindex', 'force sync', 'rebuild index', 'my model is stale', 'update index', 'mo
AZURE DEVOPS ONLY -- Read the content of a wiki page (and its immediate sub-page paths). path uses wiki page-path syntax, e.g. '/Home' or '/Architecture/Deployment'. Requires DEVOPS_ORG_URL + DEVOPS_P
Consolidated Data Management Framework tool — one entry point for all 5 DMF operations, selected via `action`. Each action forwards to the exact same implementation as its dedicated tool (dmf_import_f
Full cross-reference profile for a class or method: callers, callees, inheritance chain, interface implementations, overrides, attributes. Requires xref_index.json.gz (generated from DYNAMICSXREFDB vi
WHEN: checking server status, loaded D365 version, or custom model path. Triggers: 'status', 'statut', 'is the server ready', 'how many chunks', 'index loaded'. Returns JSON with: status, indexed chun
[~] PRIORITY TRIGGER: Use this tool when the user says 'analyse PR', 'review PR', 'check PR', 'PR #', 'impact du PR', 'analyse la PR', 'what changed in PR', 'D365 impact of PR', 'code review PR', 'vio
WHEN: a user encounters an error message, infolog error, or runtime exception in D365. Also handles business-language error explanation when audienceType='business'. Triggers (developer): 'fix this er
WHEN: adding a new field to a table -- find the best existing D365 EDT to extend instead of using raw primitives (str, int64, real, date). Triggers: 'what EDT for', 'which EDT should I extend', 'quel
WHEN: you need a COMPLETE picture of a D365 object in ONE call. Returns in a single response: full structure (fields, method signatures, relation summary) AND all CoC extensions / event handlers -- eq
Idempotent import of rows into any entity via OData: PATCH when the record exists (matched by keyFields), otherwise POST. Safe to re-run -- duplicates are updated, not re-created. Best for small-to-me
WHEN: about to modify an X++ object or method and need to understand what could break. Returns a blast-radius report: direct callers, transitive dependents (BFS up to 3 hops), custom model extensions,
Generate a security & licensing governance report for the indexed model(s). For each role, lists duties, privileges, entry points and the inferred user-license tier (Activity, Operations, Finance, etc
WHEN: user asks to create a DevOps Task or start development on a Work Item. Triggers: 'create task', 'créer une tâche', 'start development on', 'commencer le dev sur', 'créer un task ADO', 'new devel
Securely register the D365 F&O environment's Application Insights / Log Analytics connection for the CURRENT session. The client secret is encrypted in memory (AES-256-GCM), never written to disk and
Poll the status of a DMF import/export execution by its executionId (e.g. NotRun, Executing, Succeeded, PartiallySucceeded, Failed). For a completed export, also returns the download URL.
Profile an X++ object for N+1 queries, queries in loops, missing field lists, row-by-row inserts/updates, missing firstOnly. Returns compact issue table with line + fix. Only call when performance is
WHEN: you need the COMPLETE bidirectional relation graph for an object in ONE call. Triggers: 'relations of', 'FK of', 'what tables link to', 'quelles tables liées à', 'avant de générer du code', 'bef
Removes the D365 F&O connection cached for the current session by d365fo_set_connection.
WHEN: writing an extension or customization -- generates ready-to-use X++ code. Triggers: 'génère un CoC', 'crée une extension', 'generate extension', 'write a CoC class', 'event handler pour', 'templ
WHEN: developer/security architect needs to know WHICH ROLES can access a specific form, table, menu item or service operation. Triggers: 'who can access', 'which roles see', 'security coverage for',
Retrieve the NEXT page of a previously PAGINATED tool output. When a tool result is too large for a single response, it is split losslessly into ordered pages — the footer of each page gives you a `to
PR DEPENDENCY MAP -- Scan multiple Pull Requests and build a cross-PR dependency graph based on (a) shared X++/AOT objects and (b) branch chain relationships. For each PR: * Lists X++ / AOT objects ch
WHEN: user asks to write or generate a Functional Design Document, FDD, functional spec, CdC, or cahier des charges. NOT for developer technical docs -- use `get_object_details` for that. FUNCTIONAL D
WHEN: mapping the technical D365 objects behind a business process, or understanding which tables/forms implement a flow. Triggers: 'processus métier', 'Order-to-Cash', 'Procure-to-Pay', 'Record-to-Re
WHEN: user explicitly asks to post, add, or save a comment to an ADO Work Item. [~] PRIORITY TRIGGER: call AFTER `ado_analyze_workitem` when user says 'post the analysis', 'save it to the ticket', 'aj
WHEN: developer building an OData / DMF integration needs a quick rundown of a specific data entity: its public OData name, datasources, key fields, and IsPublic status. Triggers: 'data entity info',
Compare two D365 F&O objects side-by-side (fields, methods, signatures). Handy when investigating differences between standard and a customisation, or between two similar tables.
WHEN: you need ALL objects of a given type or in a given model. Triggers: 'list all tables in ALM', 'show all classes', 'quels objets dans le modèle', 'give me all forms'. Full index scan -- returns E
WHEN: user asks how an approval workflow works, who approves a document, what states it goes through, or what happens on submission/rejection. NOT for technical workflow class details -- use `get_obje
WHEN: security design, licence audit, or 'what licence does this role require?'. Triggers: 'arborescence du rôle', 'licence nécessaire pour', 'what licence for role', 'role tree', 'droits du rôle', 'e
WHEN: building an AI-assisted D365 F&O upgrade release note (regressions + opportunities) for a specific client, and you (the calling assistant) want to do the reasoning yourself instead of the server
AZURE DEVOPS ONLY -- Fetch a Work Item and assemble ALL technical context needed for D365 F&O expert analysis. [~] PRIORITY TRIGGER: 'analyse le workitem', 'analyse la tâche', 'analyse le FDD/RDD/CR/I
AZURE DEVOPS ONLY -- Create a new wiki page, or OVERWRITE an existing one with new markdown content. ALWAYS call ado_wiki_get_page first if you intend to edit (not replace) an existing page's content,
WHEN: you need to know which folder(s) are configured as the workspace/project root for the current caller. Reads D365-Custom-Model-Path and D365-Standard-Model-Path from the request headers or enviro
WHEN: at the START of any release-note / upgrade-impact conversation -- call this BEFORE list_release_note_inputs to check whether a Client Profile already exists for the CURRENT caller's Azure DevOps
WHEN: developer needs to write or scaffold unit tests for a custom D365 object. Triggers: 'generate tests', 'unit test', 'SysTest', 'write test for', 'scénarios de test', 'test this class'. Generate X
Generate a complete, ready-to-deploy D365 F&O AOT XML scaffold for any object type. Returns the XML + the correct file path inside the model -- the calling client (VS Extension, Cursor, Copilot Chat)
Securely register the D365 F&O connection (URL + Entra app-registration credentials) for the CURRENT session. The client secret is encrypted in memory (AES-256-GCM), never written to disk and never ec
Removes the Application Insights connection cached for the current session by appinsights_set_connection.
WHEN: developer needs to CREATE a data entity (AxDataEntityView) AOT XML from a table for OData/DMF/data migration. Triggers: 'create data entity', 'generate entity', 'créer une data entity', 'exposer
Find all event handlers that subscribe to events on a D365 table or class. Searches the knowledge base for [SubscribesTo(classStr(objectName), ...)] / [SubscribesTo(tableStr(objectName), ...)] attribu
Generate a complete, compilable AxForm AOT XML with the CORRECT control serialization (<AxFormControl xmlns="" i:type="...">) for the requested pattern. Patterns: SimpleList, DetailsMaster, DetailsTra
Run a raw KQL (Kusto) query against the D365FO environment's Application Insights / Log Analytics workspace (read-only -- the query language has no mutation operators). Requires the connection to be c
WHEN: the user asks about business/functional context that lives OUTSIDE the D365 code KB -- specs, functional design docs, mapping sheets, contracts, meeting notes, screenshots' captions -- anything
WHEN: security audit -- need the TECHNICAL chain from Role/Duty/Privilege to Entry Points and Table/Form permissions. Also handles BUSINESS-LANGUAGE role explanation when businessLanguage=true. Trigge
WHEN: you need to know HOW two AOT objects are connected -- the chain of relations linking them. Triggers: 'how is X related to Y', 'comment X est lié à Y', 'path between', 'chemin entre', 'lien entre
WHEN: user asks for an effort estimate, chiffrage, or development hours for a D365 Work Item. [~] PRIORITY TRIGGER: call AFTER `ado_analyze_workitem` when the user asks 'how long?', 'estimate this', '
[~] PRIORITY TRIGGER: Use this tool when user mentions 'PR', 'Pull Request', 'list PRs', 'show PRs', 'active PRs', 'mes PR', 'liste des PR', 'pull requests ouverts', 'what PRs are open', 'PRs by [auth
WHEN: developer needs to check that a proposed object name follows D365 + ISV naming conventions, is unique against the indexed KB, and does not collide with a reserved or standard prefix. Triggers: '
WHEN: generating a visual diagram of D365 table relationships or security chains. Triggers: 'generate diagram', 'diagramme', 'visualize', 'schéma', 'ER diagram', 'entity-relationship', 'relation diagr
WHEN: no profile was found by resolve_client_profile and the user wants one created (or updated) for their client, so future release-note requests never need v1/v2/customModelIds again. Creates or upd
Trigger a bulk export through the Data Management package REST API and return the download URL when complete. NOTE: the DMF EXPORT project (definitionGroupId) must already exist in FO with its entitie
WHEN: user explicitly asks to post, add, or save a review comment to an ADO Pull Request. [~] PRIORITY TRIGGER: call AFTER `ado_analyze_pr_impact` when user says 'post the review', 'add comment to PR'
WHEN: ALWAYS call this FIRST, before prepare_release_note_context -- it discovers the exact D365FO version strings and custom model ids actually indexed on THIS server, which you cannot guess. Trigger
Fan-out search across multiple ALM XPP MCP server instances in parallel and merge results using Reciprocal Rank Fusion (RRF). Useful when D365 code is split across multiple organisations or knowledge
Search D365 F&O labels across all indexed languages. Given text (e.g. 'Sales order'), finds the matching label ID (@SYS12345). Given a label ID (e.g. '@SYS12345' or '@SYS:12345'), finds the text in al
Export any D365 F&O data entity via OData (transactional, no DMF project required). Universal: works for ANY public entity. Supports $select, $filter, $orderby and follows server paging automatically.
WHEN: developer wants to see what custom/extension objects exist in their model. Triggers: 'list my custom objects', 'what have we customized', 'show ISV objects', 'list custom model', 'what objects a
WHEN: upgrading D365 F&O to a new version or applying a Microsoft update -- check if your custom code will break. Triggers: 'upgrade D365', 'mise à niveau', 'will this break after upgrade', 'compatibi
WHEN: validate_best_practices returned violations and you want concrete X++ fix suggestions. Returns each BP violation with its built-in fix suggestion AND (when Ollama is available) an AI-generated X
WHEN: you have already called prepare_release_note_context and analyzed its 'objects' array yourself, producing a findings JSON array per the 'instructions' field it returned. This tool renders that f
WHEN: developer needs to resolve a menu item -- find its target object (form / action / output), linked security privilege, label, and parameters. Triggers: 'menu item info', 'what does menu item X op