Workday's MCP server gives outside agents 275 read tools and 54 write or delete tools
Workday made its MCP server, SQL access to live data and a shared agent runtime generally available on Tuesday. Agents built in Claude Code or Cursor run under the signed-in user's permissions, the company says.
The Engineer · Build desk
Key figures: about 16 percent of the MCP server's tools can write or delete data; 54 of its tools can write or delete data; the server offers 329 tools in total.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Share of MCP server tools that can write or delete, about | 16% | 18 | |
| Tools that write or delete | 54 tools | 10 | |
| MCP tools in total | 329 tools | 17 |
What happened
- The MCP server is named Agent-Ready Tools and ships as part of Workday Extend AI.
- Workday CTO Gabe Monroy put the server's current count at 275 read tools and 54 that can write or delete data.
- Live Data Query, a feature of Workday Data Cloud, gives BI tools and agents direct SQL access to Workday data. Monroy described it as JDBC access to Workday's object graph.
- Agent Harness is the shared runtime for Workday's own agents and those built by customers and partners, and it passes each agent the user's identity, org position and access rights.
Why it matters
- Who has to decide decision Teams that feed agents from a data-lake copy or a service account can run the same questions through Live Data Query as a restricted user and compare what comes back.
- Who's exposed exposure About one tool in six on the server can write or delete. An agent signed in as a user with write rights can call them, so the approval step Workday points to is the control to test first.
- What it limits constraint Grounded Reasoning, the pre-action policy check, and Agent Context Service, the data preload, are early access in early 2027. Until then the pre-action check is not available.
- What doesn't add up contradiction Workday says copies and service accounts bypass access controls. The New Stack notes that SAP, Microsoft and others would say they have access control in place too, so the comparison is Workday's framing.
Next story · Build · yesterday
Anthropic and OpenAI fund separate firms to station engineers inside customersConfirmed2 publishers
The design choice is identity pass-through. Each user authenticates with their own Workday login, and according to Workday, an agent working on that user's behalf is limited to what the user's account can access [4]. Live Data Query applies the same rule to SQL: Workday says each query returns only what the requesting user is cleared to see [5]. Workday's complaint about the usual alternatives is that data-lake copies and service accounts bypass those controls [19].
Its evidence is a demo Workday ran. Monroy connected an agent to a custom MCP server, a setup he said Workday commonly sees among customers. The agent returned job requisitions its user had no business seeing and moved the wrong employee between teams with no approval [12]. Pointed at a Snowflake copy of Workday data, the same agent produced the CTO's salary when asked [13]. Routed through Workday's MCP server and Data Cloud with the user signed in, the same queries returned only the requisitions that user was allowed to see [14]. The New Stack noted that it wouldn't have been much of a demo otherwise [14].
For the result to transfer, your own custom MCP server and your own data copy would have to be as permissive as the ones in the demo. The source does not describe how either was configured.
Pass-through cuts both ways. In our view, an agent can reach whatever its user can, so a role with broad rights produces an agent with broad rights. Monroy's answer for writes is the approval layer. No matter who builds the agent, he said, "it runs under Workday permissions, approvals and audit trail" [3].
There are two ways in. Developers can build agents in Claude Code, Cursor and other tools, provided those agents follow the same rules as the people using them [9]. Teams that build with LangChain or Google's ADK can instead deploy onto Agent Harness [8]. Harness picks the model for each task by cost and performance [7], and customers can run agents on models from Anthropic, Google, Meta, Mistral, Nvidia and OpenAI [2].
Workday's product chief is candid about scope. Gerrit Kazmaier, Workday's president of product and technology, was asked whether headless matters as much to Workday as it does to Salesforce. He said, "I'd always prefer if they use our user interface, but headless will be equally good" [15]. He added that building agents directly on Workday's tools and APIs is "only possible for a small set of use cases where you don't need to have HR or finance domain logic" [16].
What to watch
- Whether Agent Context Service and Grounded Reasoning reach early access in early 2027 as Workday's roadmap says.
- Whether Google ADK support on Agent Harness extends beyond design partners.
- Whether customers publish results from running one agent against a data copy and against Live Data Query outside Workday's own demo.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption25
- Hype gap+25
- Incentives75
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On Tuesday, at its Workday Rising conference in Las Vegas, Workday made its Trusted Agent Platform headless; its MCP server, SQL access to live Workday data and a shared runtime for agents are generally available.
- [2]
Customers can run their own agents on models from Anthropic, Google, Meta, Mistral, Nvidia and OpenAI.
- [3]
Workday CTO Gabe Monroy said in a press briefing that no matter who builds the agent, "it runs under Workday permissions, approvals and audit trail".
- [4]
Agent-Ready Tools is Workday's MCP server and ships as part of Workday Extend AI. Users sign in with their own Workday credentials, and Workday says an agent acting for them can't reach anything their own account can't.
- [5]
Live Data Query, part of Workday Data Cloud, lets BI tools and agents run SQL queries directly against Workday's data; Monroy described it as JDBC access to Workday's object graph, and the company says each query returns only what the requesting user is cleared to see.
- [6]
Agent Harness is the shared runtime that Workday's own agents and those built by customers and partners run on. It passes each agent the user's identity, org position and access rights, and limits what the agent can do.
- [7]
Agent Harness picks which model handles each task based on cost and performance.
- [8]
Custom Agents lets teams deploy agents they built with LangChain or Google's Agent Development Kit (ADK) onto Agent Harness, though ADK support is limited to design partners for now.
- [9]
Workday is allowing developers to build their own HR and finance agents in Claude Code, Cursor and other tools, as long as those agents follow the same rules as the people using them.
- [10]
Monroy said the MCP server currently offers 275 read tools and 54 tools that write or delete data.
- [11]
Agent Context Service and Grounded Reasoning are on the roadmap for early access in early 2027. Agent Context Service will preload only the Workday data a task calls for; Grounded Reasoning will check a planned action against the customer's policies, process rules and Workday records before the agent carries it out.
- [12]
In a briefing demo, an agent connected to a custom MCP server, a setup Monroy said Workday commonly sees among its customers, returned job requisitions its user had no business seeing and moved the wrong employee between teams with no approval.
- [13]
When pointed at a copy of Workday data in Snowflake, the same agent produced the CTO's salary when asked.
- [14]
When the agent went through Workday's own MCP server and Data Cloud with the user signed in, the same queries returned only the requisitions that user was allowed to see; The New Stack noted it wouldn't have been much of a demo of those access controls otherwise.
- [15]
Asked whether headless matters as much to Workday as it does to Salesforce, Gerrit Kazmaier, Workday's president of product and technology, said: "I'd always prefer if they use our user interface, but headless will be equally good."
- [16]
Kazmaier said building agents directly on Workday's tools and APIs is "only possible for a small set of use cases where you don't need to have HR or finance domain logic."
- [17]
The MCP server offers 329 tools in total.
- [18]
About 16 percent of the MCP server's tools, roughly one in six, can write or delete data.
- [19]
Workday notes that many companies connect their agents to HR and finance data through copies in a data lake or through service accounts, and argues those approaches bypass its access controls.
- [20]
The New Stack notes that companies like SAP, Microsoft and others would surely argue that they, too, have access control in place.
Sources
2 independent publishers whose own reporting we read for this story.