Tool governance
Controlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.
Showing artifacts, examples and content with confirmed Node.js applicability. View All CAP
Overview
No SAP artifact is confirmed here for Node.js.
A Node.js coverage assessment has not been written. View all flavors
A Node.js coverage assessment has not been written. View all flavors
Artifacts
Content
Group by
Piece, what it offers
MCP Servers are the New Z-TablesMCP Servers are the New Z-TablesA single CAP service exposed as three overlapping MCP servers tools, queried by the same prompt nineteen times, returned the same tool every time — evidence, the author argues, that tool selection rests on the resemblance between a prompt and a tool's description rather than on any binding a where-used list could enumerate before retiring it. It contrasts that setup with @cap-js/mcp, which exposes a whole service as three generic tools instead of one per operation, and quotes the adapter's own beta documentation admitting no rate limiting, audit logging, input validation or approval workflow, and no use as a gateway to SAP Application APIs. From there it names four small Tool governance practices it has adopted: an owner recorded in the tool's own metadata, logging every invocation, deprecating inside the description, and exposing fewer tools.published 2026-08-21
Details
Coverage
Designs that place it
AI-native North Star architecture — Platform LayerAI-native North Star architecture — Platform Layersingle governed gateway for agent traffic
For your agent
- Ref
capability:tool-governance- JSON
- /capabilities/tool-governance.json
- MCP
- Connecting an agent