# Reading inputs read-only, and who does the tool-level work

Exports first, read-only MCP tools second. This skill never needs write access. Nothing here asks for an API key, master key or token in chat: keys stay in the user's client or secret store, and the agent works from files the user downloads or from tools already connected with read-only scope.

## Getting each input

- Decision, owners, capacity: ask. Capacity = reviewers x minutes per week / minutes per review (default 8).
- Signal samples, last 30 days or 200 episodes, whichever is larger, with occurred and received timestamps: HubSpot form submissions export; product events from the warehouse or product analytics export; the Clay signal table exported as CSV; the HubSpot buyer intent company list; ZoomInfo or Apollo signal exports.
- CRM schema: HubSpot remote MCP `get_properties` or `search_properties`, or a property export from settings. Salesforce `sobject-reads` describe calls, or the object manager in a browser.
- CRM snapshot: HubSpot `search_crm_objects` or a UI export with Record ID kept as text. Salesforce `sobject-reads` query or a report export with 18-character IDs. Never let a spreadsheet reformat IDs; import CSVs as text.
- Workflow configuration, as exports or screenshots:
  - Clay: the table export; table auto-run state; each paid column's run settings and "Only run if"; the scheduled source's Update existing rows setting; waterfall validation strategy and duplicate-result threshold. If the team uses the Clay CLI, its read commands (for example the workflow graph) show structure without running anything.
  - Apollo: waterfall provider order and validator; CRM sync settings; sequence rulesets; the CSV import options used last.
  - HubSpot: workflow screenshots of owner rotation options and re-enrollment; score property criteria.
  - Salesforce: assignment rules, duplicate and matching rules (browser screenshots).
  - Sequencer: suppression and blocklist setup per client scope, stop on reply and company-level stop, webhook definitions.
- Usage and billing: Clay usage page Time, Column and Run views as CSV; the Apollo waterfall data request log; ZoomInfo Admin Portal usage; invoices or plan allowances.
- Sender facts per sending path: headers of a received test message; read-only DNS lookups; the Postmaster Tools spam rate or "no data"; per-domain daily counts of delivered, hard bounces, opt-outs and replies by the sequencer's category label, never reply text; the schedule per mailbox.
- Outcomes: a CRM report of tasks created, accepted and rejected with reasons, and opportunities created, for completed windows only.

## Per vendor: read tools, blocked tools, approved writes

Checked 2026-11-01 unless marked. Tool lists change monthly; list the tools the connected server actually exposes before relying on these names.

- HubSpot remote MCP (`https://mcp.hubspot.com`):
  - Design use: `get_user_details` first (the connected identity's read and write access per object), `discover_hubspot_schema`, `search_crm_objects`, `get_crm_objects`, `query_crm_data`, `search_properties`, `get_properties`, `search_owners`, and `search_intent_signals` (buyer intent signals, the source of web intent).
  - Block: every tool not listed under Design use, including every `manage_*` tool and `submit_feedback`. Run `get_user_details` again after any scope change. There is no read-only switch; the server acts as the connecting user, so user permissions are the server-side boundary, and a user with View access can still create notes and tasks (checked 2026-11-06).
  - Approved writes: HubSpot's Agent CLI skills (`HubSpot/agent-cli-skills`) with `--dry-run`, digest and confirm; read back after.
- Salesforce hosted MCP servers (names checked in a browser 2026-11-06; endpoints and setup: marketing-mcp-setup):
  - Design use: `sobject-reads` (schema, query, search, relationships; cannot create, update or delete).
  - Block: `sobject-deletes` and `sobject-all`. Connect `sobject-mutations` only for an approved change list. Mutations and deletes also carry read tools, so reading never justifies them.
  - Approved writes: `sobject-mutations` as the signed-in user, with object permissions, field-level security and sharing. Validation rules apply. Salesforce doesn't document whether assignment rules and flows fire on these writes, so test it in a sandbox.
- Clay MCP (`https://api.clay.com/v3/mcp`, OAuth):
  - Design use: prefer table and usage CSV exports. If the MCP server is used, connect an identity with a per-user credit limit (the Sales Rep role has no UI or table access) and only admin-enabled tools and Functions. MCP tools spend workspace credits at the normal rate.
  - Block: paid enrichment and Functions unless a pilot job is approved; a credit limit of 0 hard-blocks further actions.
  - Approved writes: Clay's HubSpot or Salesforce actions under an approved change list, with Ignore blank values on and Duplicate rule override off.
- Clay docs MCP (`https://developers.clay.com/mcp`) and `llms.txt`: unauthenticated docs search for live facts.
- Apollo MCP (`https://mcp.apollo.io/mcp`, per-user OAuth):
  - Design use: people search (no credits, no emails or phone numbers), sequence search, email account list, campaign search, analytics, task search.
  - Block every tool Apollo marks as using credits (checked 2026-11-02): people and company enrichment and their bulk versions, Search for companies, Company job postings, Web and directory research, Validate emails and phone numbers, Google Maps prospecting when saving companies, Run an Assistant task (depends on its actions) and conversation insights that carry AI insights. People search is free; company search is not. Apollo itself recommends Approval required for every credit-consuming action.
  - Also block every other tool not listed under Design use (checked 2026-11-06). Apollo's free write tools cover contacts, accounts, deals, custom objects, lists, tasks, labels, sequences and enrollment, one-off emails, data source imports, website visitor tracking, and buying or browsing sending domains and mailboxes. Avoid the headless route: it needs a master key.
  - Approved writes: update a contact by ID (not `run_dedupe`) under an approved change list.
- ZoomInfo MCP (`https://mcp.zoominfo.com/mcp`):
  - Design use, free: search without redeeming, lookup, find similar, recommended contacts, reading GTM context.
  - Block: enrich tools, search with redeem true, Upsert Audience and Manage Audience Rows loads (data credits), and Account Research, Contact Research, Conversation Intelligence, Audience Analysis and Update GTM Context (AI credits), unless approved. There is no cost preview (checked 2026-11-06).
  - Approved writes: none through MCP; it does not write to the CRM or run bulk exports.
- Instantly MCP (endpoint from the vendor help article; verify at run time): campaign and analytics reads with a key limited to read scopes (for example `all:read`, checked 2026-11-06), held in the client's secret store, header route preferred. Block lead adds, campaign activation, reply sending and sending-account changes.
- Smartlead MCP (verify at run time): campaign, lead and deliverability reads. The documented connection URL embeds the API key, so treat the populated URL as a secret and never paste it in chat. Block lead and campaign writes and unsubscribe operations without approval; verify the client scope.
- HubSpot docs MCP (`https://developers.hubspot.com/docs/mcp`) and `llms.txt`: live developer facts (search, limits, upsert).

## Vendor plugins and skills, and how this skill's rules apply

Official plugins bundle skills that act. When one runs, the gates in this skill still apply.

- Clay (`clay-run/agent-plugins`, with the Clay CLI): tables, workflows, signals and credits. Its inbound routing playbook enriches every lead before scoring; put the step 3 exclusions in front of any paid step and keep owner and opportunity precedence above routing.
- Apollo (`apolloio/apollo-mcp-plugin`: prospect, enrich-lead, sequence-load, analytics, gtm-strategist): gtm-strategist hands execution to sequence-load when it is installed, and sequence-load searches, enriches, creates contacts with `run_dedupe` true and enrolls in one pass. Split it into this skill's gated steps: exclusions, enrichment with the acceptance policy, writeback by ID, enrollment gate. Never let a one-pass load touch contacts already in the CRM. Its enrichment step sets `reveal_personal_emails` true, which buys personal emails (a W05 FAIL without a recorded privacy decision), it passes mobile phones to contact creation when returned, and one confirmation covers enrichment, creation and enrollment (checked 2026-11-02).
- ZoomInfo (`Zoominfo/zoominfo-mcp-plugin`): scoring and research skills that blend fit, source and trigger into one composite. Keep direct requests outside any score and fit apart from engagement before acting on its output.
- HubSpot (`HubSpot/agent-cli-skills`): use the Agent CLI as the execution hand-off for approved bulk writes; it has no field ownership contract of its own, so run `check_writeback.py` on the input first.
- HubSpot (`HubSpot/hubspot-mcp-plugins`, checked 2026-11-02): the HubSpot-Sales import-contacts skill sets `hubspot_owner_id` to the connecting user on every confirmed contact, including existing contacts it updates, and matches companies by name, creating one when the name is not found. Under this skill's contract that is an owner overwrite (W12) and a company create without a domain match (W19). Uncheck existing contacts in its confirmation step (they are checked by default) and leave company creation to the gated create path.

## Identity traps

- Apollo: API-key requests act as the workspace's longest-standing active admin, while OAuth acts as the authorizing user (verify in the authentication reference). The headless MCP route needs a master key. Apollo asks for model training to be off in the connected client.
- ZoomInfo: context agents personalize to the signed-in user, so never share a login between people or agents.
- HubSpot remote MCP: follows the connecting user's permissions; no read-only mode.
- Salesforce hosted servers: act as the signed-in user.
- MCP tool annotations (such as read-only hints) are hints, not enforcement (MCP blog, 2026-03-16). Enforce read-only with the identity's permissions, credit limits and client-side tool blocking.

## Docs access order for live facts

1. The vendor docs MCP server: Clay developers, HubSpot developers.
2. `llms.txt`: Clay developers, Apollo, ZoomInfo, HubSpot developers, Salesforce developers.
3. The Context7 IDs listed in `sources.yaml`.
4. The canonical URL for a person to open in a browser. developer.salesforce.com refuses automated fetches and the Apollo knowledge base often does. help.salesforce.com answers, but some pages return an error shell with no article, so read those in a browser.