Ducto

Cross-platform workflows

Audits, schedules, and monitors that span every connected platform

The mount that ties the others together: cross-platform audits that produce recommendations, an apply step that runs through the policy engine, and schedules for recurring checks.

10 tools5 read5 writemcp.getducto.com/workflows
Connect Cross-platform workflowsAll platforms
connect the workflows mount

$ claude mcp add --transport http workflows \

https://mcp.getducto.com/workflows

✓ connected — 10 tools

read-only until you set a policy

What your agent does here

Real Cross-platform workflows work, in conversation

Audit across platforms

One audit sweeps every connected platform and returns concrete recommendations with the data behind them.

run_cross_platform_auditlist_connected_platforms

Apply recommendations, governed

Applying a recommendation is a real write — capped, previewed, and approvable like any direct mutation.

apply_recommendation

Schedule the routine

Create and manage recurring audits and monitors, with run history you can inspect.

create_schedulelist_schedule_runsrun_schedule_now

Governed writes

How writes are enforced

apply_recommendation is the whole thesis in one tool: the agent proposes, the policy engine enforces caps and preview, and the flagged classes wait in your approval inbox.

read-only default→caps ← policy row→preview before apply→approval on flagged classes→hash-chained audit

The full request path is on the security architecture page.

Tool reference

Every tool in the workflows mount

Generated from the running gateway's tool registry — this is the complete list, not a highlight reel.

apply_recommendationwriteApply one allowlisted audit recommendation through the target platform's guard. Preview first (apply=false) to get a preview_id; repeat identically with apply=true. Returns the standard MutationDecision shape (preview_id / pending_approval / applied).
create_schedulewriteCreate a recurring report or monitor. Validates the spec/delivery shapes.
delete_schedulewriteDelete a schedule and its run history.
ducto_await_approvalreadWait for a human to decide a change that was parked for approval. Call this after a write returns status=pending_approval: show the human the approval_url, call this with the same preview_id, then repeat the identical apply=true call once it returns approved. Waits at most 15s per call — if the human is still deciding, that's expected: just call this again with the same preview_id.
list_connected_platformsreadConnected platforms in this workspace + each one's policy posture. Also reports what the workspace owner has switched OFF — disabled platforms, disabled tools, and blocked change categories. Tools that are off are hidden from tools/list, so this is the only way to discover that a capability exists but is withheld. When something is off, relay `fix_url` to the human; you cannot enable it yourself.
list_schedule_runsreadList recent runs for one schedule (most recent first).
list_schedulesreadList this workspace's schedules.
run_cross_platform_auditreadRun each connected platform's rule set; returns {findings, recommendations}.
run_schedule_nowwriteExecute a schedule inline (out of band) and return the run summary.
set_schedule_enabledwriteEnable or disable a schedule.
Connect Cross-platform workflows