External MCP servers

One of the four custom-connector routes is an external MCP server. Point at one and its tools become available to agents in the workspace, which is the shortest path from an in-house system to something an agent can use.

Where the trust boundary sits

A catalogue connector was checked against its provider before being offered. An MCP server you point at was not — it is checked against what it tells Hawi about itself. Every operation it exposes is classified when the server is scanned, and the conservative rule applies: an operation is a read only when it is both declared read-only and uses a method that does not write.

• Scope the server as narrowly as the job needs. It is your API surface, and a tool you expose is a tool an agent can reach.
• Give the first agent read-only access to it until you have read a week of traces.
• Ambiguous operations are classified conservatively as approval-gated writes rather than as reads.

Hawi's own MCP server

Separately, Hawi publishes an MCP server so that an MCP-compatible product can work with a Hawi workspace from the outside. Its read tools cover agents, approvals, calls, service health and analytics. Its small write set previews every change and does nothing until it is called again with an explicit confirmation.