The tools you see are the ones your administrator has enabled for your organization and
your groups. Below is the full set braXos ships, grouped by system. Each tool is
annotated read-only, write, or destructive so your client can gate changes
appropriately.
Read / write / destructive
- Read-only tools only look things up and can run smoothly.
- Write tools create or add data and prompt for your confirmation.
- Destructive tools modify-in-place, clear, or delete data - always gated.
Google Workspace
| Read |
Write |
Destructive |
| Search/Get Gmail messages & attachments; Get Drive file; Search Drive; Get/Search Calendar events; Get Sheet values & spreadsheet info; Get users, groups, members, org units |
Draft Gmail (standalone or threaded reply); Create/Update Drive file; Create/Update/Append Docs (Replace text); Create spreadsheet; Add/Update/Append Sheet values; Add sheet tab; Format range; Create/Update Calendar events |
Delete Drive file; Delete sheet tab; Clear Sheet values; Delete Calendar event |
Jira
| Read |
Write |
Destructive |
| Get issue; Get issues (JQL search); Get projects; Get transitions; Get users; Get components |
Create issue; Update issue; Add comment; Transition issue; Create subtasks; Create component |
Delete issue; Delete component |
Salesforce
| Read |
Write |
Destructive |
| Get accounts, contacts, cases, opportunities, contracts, assets, users; Get TaskRay projects/tasks; Describe object; Query (read-only SOQL) |
Provision account, contact, case, opportunity, contract, asset, attachment; Provision TaskRay project/task |
- |
S2 physical access control
| Read |
Write |
Destructive |
| Get person / person accesses / access history; Search person data; Get access levels & groups; Get portals, portal groups, readers, elevators, floors, partitions; Get card formats, time specs, event types; Sum access; Get last card |
Provision person; Provision credential; Set card status; Set last access; Insert activity; Modify portal group; Add access-level group; Trigger event; Set threat level |
Clear access levels; Delete access-level group |
| Read |
Write |
Destructive |
| Search pages; Get page / pages; Get site info; List categories; Get category members |
Create page; Merge section |
Replace page; Delete page |
OpenPath (cloud access control)
| Read |
Write |
Destructive |
| Get access-activity events, audit report, card formats, credential types & action types, credentials, custom fields, groups, organizations, photo, readers, roles, scheduled events, sites, users, zones |
Assign group; Provision photo; Provision person |
Unassign group (revokes access) |
Genetec (Security Center)
| Read |
Write |
Destructive |
| Get access history, cardholder(s), credential formats, credentials, custom fields, entity data, visitors |
Provision cardholder; Provision group; Provision image; Update credential state |
- |
C-CURE 9000 (Software House)
| Read |
Write |
Destructive |
| Get personnel (search by name, email, card number, ObjectId, or a custom Text field); Get clearances; Get personnel types; Get custom-field definitions; Get CHUID card formats; Get cardholder photo |
Provision person (add/update/delete cardholder, credentials & clearances); Provision photo; Insert journal (audit-log) message |
- |
Brivo (cloud access control)
| Read |
Write |
Destructive |
| List/Get users; List access points, groups, sites; List access events; List audit trail; List credential formats & custom fields; List recently-changed users |
Create user; Provision user (add/update/delete, credentials & groups); Pulse access point (momentarily unlock a door) |
- |
Pulse actuates a real door
Brivo Pulse access point remotely unlocks live door hardware and grants physical entry. It is a write (gated for confirmation); consider restricting it to specific groups via FGAC.
Everbridge (critical-event management)
| Read |
Write |
Destructive |
| Get assets, contacts, contact attributes & paths, groups, incident templates, incidents, notification status, record types |
Provision contact; Send incident; Send notification; Send locations |
- |
Send* tools dispatch for real
Everbridge Send incident / Send notification deliver real alerts to people, and Send locations writes to the live org. They are writes (gated for confirmation); Send notification also has a SilentMode that must be turned off to actually deliver.
Otis & ThyssenKrupp (elevators)
| Read |
Write |
Destructive |
| - |
Otis: Car call; Card swipe; Update DEC status. ThyssenKrupp: Register call; Card swipe; PIN entry; Update kiosks |
- |
These actuate live elevator hardware
Elevator car calls, credential swipes, and DEC/kiosk configuration command physical destination-dispatch hardware. They are writes and always gated; consider restricting them to specific groups via FGAC.
Workday (HCM)
| Read |
Write |
Destructive |
| Get workers, other-IDs, RaaS report data |
Provision other-ID; Put photo; Put time entry |
- |
Zoom
| Read |
Write |
Destructive |
| Get groups, meetings, reservations, users |
Update reservation |
- |
ODBC (SQL database)
| Read |
Write |
Destructive |
| Run a read-only SQL query |
Execute SQL statement; Write rows |
- |
Freeform SQL
ODBC tools run SQL against a configured data source - like Salesforce Query, the read tool is SELECT-oriented while Execute/Write can mutate. Bound by the connection's own database permissions.
These help Claude compose multi-step work across resources without data returning to the
model. They are available when your organization enables them.
| Tool |
Kind |
Purpose |
pipeline_discover |
Read |
Lists the resources, operations, and transforms you can wire into a transient pipeline |
pipeline_execute |
Write |
Runs an ordered pipeline in-process on the on-prem sidecar (each step is an existing, individually-annotated operation, authorized separately) |
get_integration_run / stop_integration_run |
Read / Write |
Poll or cancel a long-running integration by its run handle |