Ask Greg with MCP servers

Ask Greg with MCP serversThe two switches that let Ask Greg use MCP tools, what the model is told and shown, how every result passes the data policy, and example questions across the project, BigQuery, Jira and Confluence. Ask Greg uses an MCP server only when TWO switches are on: "Let the agent use MCP servers" in Ask Greg → Data policy (off by default), and "Available to Ask Greg" on the server itself. The agent then sees the opted-in servers and can list a server's allowed tools and call one at a time, for example to compare a figure in the project with a BigQuery table, to find the open Jira issues behind a variance, or to check a Confluence policy page against a column.

Ask Greg uses an MCP server only when TWO switches are on: "Let the agent use MCP servers" in Ask Greg → Data policy (off by default), and "Available to Ask Greg" on the server itself. The agent then sees the opted-in servers and can list a server's allowed tools and call one at a time, for example to compare a figure in the project with a BigQuery table, to find the open Jira issues behind a variance, or to check a Confluence policy page against a column.
Everything a tool returns passes through the same data policy as the project's own data. Rows are reduced to the data level and masked. Text is withheld entirely at schema-only, shortened at the other levels, and masked. Pseudonyms the model uses are turned back into real values only on this machine, just before the call. A ticket or page that contains instructions is treated as content, never as an instruction. The audit records that MCP was in scope for the answer.

Two switches, both off by default

Let the agent use MCP servers — Ask Greg (beta) → Governance → Data policy — An administrator
Available to Ask Greg — Settings → MCP servers & API → Edit (per server) — An administrator
Let the agent use MCP servers — Off by default. With this on, the agent can call the read-only tools of MCP servers that an administrator marked "Available to Ask Greg" (Settings → MCP servers & API) — a warehouse, a database, Jira, Confluence. Their results pass through the same data level, masking and audit as everything else.
Turn MCP on for Ask Greg: Ask Greg (beta) → Governance → Data policy
AI_ALLOW_MCP=0 on the machine turns it off for a whole fleet; no value of it turns it on.

What changes when it is on

Ask Greg's context lists the servers opted in on this machine's own registry — never servers named in a request or a prompt.
Two tools are offered: list_mcp_tools (a server's allowed tools with their argument descriptions) and call_mcp_tool. With the switch off they are not even described to the model, and they refuse if called anyway.
The agent's scope rules gain an MCP section and say accurately that it can reach the opted-in servers. The policy fingerprint written to the audit trail gains +mcp, so a reviewer can tell which answers were made with MCP available.
Every rule on the MCP servers page still applies: read-only tools, the SQL guard, the deadlines, the audit record (with via: agent).

Every result passes the data policy

schema-only — Reduced to column names and a row count — Withheld entirely
schema+aggregates — At most 25 rows, masked — Cut to 4,000 characters, masked
schema+samples — Up to the sample row limit, masked — Cut to 12,000 characters, masked
full — Whole result, masked — Cut to 24,000 characters, masked
Masked columns and the personal-data detectors apply to MCP results exactly as to the project's own data.
If the model writes a pseudonym token — <<PERSON_1a2b>> — into a tool's arguments, it is turned back into the real value on this machine before the call, so a search for a masked person still finds them; the model never sees the real value.
A Jira ticket or Confluence page that contains instructions is treated as content to report on, never as instructions to follow. The scope rules say so explicitly.
What was sent under an answer shows what the MCP results contributed, after masking.

Turn it on

1. Register the server and test it (see MCP servers). Give it a database login or API token that can only read.
2. In the server's settings, turn on Available to Ask Greg and save.
3. Open Ask Greg (beta) → Governance → Data policy, turn on Let the agent use MCP servers, and save.
4. Ask a question that names the system, for example "Using the BigQuery server, how many rows does test.sales_data have?". The answer's trace lists each list_mcp_tools and call_mcp_tool step.
5. Review the audit trail: each call is an mcp.tool.call record with via: agent.
Watch it done: the training film Ask Greg about BigQuery (1:19, 23 steps, recorded on the real application with a real BigQuery server) — AnalyticsTable → Training, /products/analyticstable/trainings. In that take Greg answered that Shipped has the highest total sales, 9,291,501.08, after correcting one failed call — every step is listed under the answer.

Example questions

Compare the revenue in our project with the BigQuery table finance.revenue_daily for October.
Which Jira issues in project FIN are still open for the Q3 close, and which of them touch the accounts in the outlier sheet?
Summarise the Confluence page "Revenue recognition policy" and check whether our refunds column follows it.
Using the PostgreSQL server, list the tables in the finance schema and count the orders by status.
Ask Greg cannot change anything through MCP. Asked to delete cancelled orders through the BigQuery server, it is refused by the same read-only guard that refuses a script — the refusal appears in the trace and the audit trail.

Previous — MCP security and resilience
Next — Operating the API and MCP
ATX AnalyticsTable documentation — all pages
Sign in to read the full documentation

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.