Safety and Approvals

Every Whats91 MCP tool declares a safety class. The class is not decorative: it sets the tool annotations, audit severity, rate-limit class, and the default confirmation, preview, and approval behaviour. A client can read all of it from tools/list before deciding to call anything.

Safety Classes

The Approval and Preview columns below are the defaults a class implies. Individual tools override them in both directions, so treat the class as a guide and the per-tool metadata as the authority.

Never Infer Approval From the Class

A tool can require approval that its class would not imply, and can waive approval that its class would imply. Read whats91/approvalRequired from the tool _meta returned by tools/list, and branch on that value rather than on the safety class.

Prepare and Confirm

High-risk operations are split into two calls. Prepare computes the effect server-side and returns a one-time confirmation token; the second call executes exactly that computed effect. The model never gets to describe an effect in its own words and then have that description executed.

1. Call the prepare tool with an idempotency key. It validates the target, computes a server-side preview, and returns a confirmation token.
2. Show the preview to the person responsible for the action.
3. Call the matching confirm tool with the token to execute the previewed effect.
4. If the underlying draft changed between prepare and confirm, the token no longer matches and confirm is rejected.

{
  "jsonrpc": "2.0",
  "id": 10,
  "method": "tools/call",
  "params": {
    "name": "whats91_campaign_execution_prepare",
    "arguments": {
      "setup_uid": "setup_abc12345",
      "campaign_uid": "cmp_abc123",
      "idempotency_key": "acme-campaign-2026-08-12-001"
    }
  }
}

Most pairs are named _prepare and _confirm. Two flows use a different second step, so match on the prepare tool rather than assuming the suffix.

Idempotency

Every non-read class expects idempotency. Write tools take an idempotency_key: a caller-generated stable key, 8 to 200 characters from letters, digits, dot, underscore, colon, and hyphen. Replaying the same key replays the same result rather than performing the operation twice.

• Derive the key from something stable in your own system, not from a timestamp or random value regenerated on retry.
• SAFE retry policy means the tool can be retried freely.
• IDEMPOTENCY_REQUIRED means retry only with the same idempotency key.
• PROVIDER_AWARE means the outcome depends on an external provider; reconcile before retrying.
• NO_AUTOMATIC_RETRY means never retry automatically. Surface the failure to a human.

Approvals

Approval-required tools are gated by the customer approval path in addition to OAuth scope. Before executing, the platform checks operational readiness and reports whether the approval path is available. When approvals are not configured, an approval-required tool reports that it cannot be attempted instead of silently running.

{
  "operational_capability": {
    "can_attempt": true,
    "approval_required": true
  }
}

Entitlements and Consent

Tools also declare the Whats91 entitlements they need, such as mcp_platform, campaign_builder, or campaign_send, and whether customer consent is required. A scope grant does not bypass a missing subscription, an expired plan, or an inactive add-on.

Rate Limits