Included as both a remote sales-execution MCP provider and an MCP-consuming revenue workspace: external agents can query and mutate Outreach under a licensed user, while Outreach’s own Marketplace connectors currently import read-only tools from vetted or private external servers.
Concrete capability record
A field-by-field summary of what the reviewed first-party references actually support. Publisher update dates and BYO-UI review dates are shown separately below.
Accounts, opportunities, prospects, users, teams, calendar events, emails, Kaia meetings and transcripts, sequences and enrollment state, tasks and configuration lookups, job roles, dynamic filter/input schemas, account or opportunity Q&A history, MCP clients, Marketplace/private connectors, and Amplify credits.
Twenty-seven read/discovery tools cover account, opportunity, prospect, user and team lookup; sequence enrollment state; tasks and lookup values; email, calendar, and Kaia meeting context; current user and organization; and external-ID search. Three schema tools discover filterable and required fields.
Eleven mutation-classified tools create accounts, opportunities, prospects, and tasks; delete accounts, opportunities, and prospects; enroll or remove prospects from sequences; and ask account or opportunity questions that create Q&A history records. Organization admins can allow creates and separately allow deletes.
OAuth 2.1 authorization code with PKCE and Dynamic Client Registration authenticates an active licensed Outreach user. Every call inherits that user’s profile-level RBAC; Amplify with active credits is required. Client-only identities are unsupported, and an autonomous identity must itself be a licensed user.
An organization admin enables the provider and controls create and delete categories, with create on and delete off by default. Calls are attributed to the authenticated user in activity history; IdP disablement revokes access. Inbound external servers are published through a vetted Marketplace or as instance-restricted private connectors.
Amplify, active credits, and an active licensed seat are required. Tool schemas and org-specific fields can change, the provider has no undo and requires agent-layer rate controls, and API throttles apply. The current catalog lists 41 tools and says every tool advertises `openWorldHint: false`. Inbound Outreach connectors currently accept read-only tools.
First-party MCP tool catalog
The 41 exact tool names in Outreach's July 2, 2026 first-party MCP Tool Catalog, organized using the publisher's read and discovery, write and mutation, and schema groups. Reviewed Jul 10, 2026. OAuth 2.1 with PKCE and dynamic client registration inherits the authenticated user's Outreach RBAC. Four delete or sequence-removal tools are explicitly destructive. Older May pages still say 32 tools, and the May annotation page's openWorldHint statement conflicts with the newer July catalog; verify runtime annotations before relying on that hint.
account_get_by_idreadaccount_searchreadaccount_search_by_external_idreadcalendar_events_fetchreadcurrent_orgreadcurrent_userreademails_searchreadjob_role_fetchreadkaia_meeting_fetchreadkaia_meeting_searchreadopportunity_get_by_idreadopportunity_searchreadopportunity_search_by_external_idreadopportunity_stage_fetchreadprospect_get_by_idreadprospect_searchreadprospect_search_by_external_idreadsequence_searchreadsequence_state_searchreadstage_fetchreadtask_priority_fetchreadtask_searchreadtask_theme_searchreadteam_get_by_idreadteam_searchreaduser_get_by_idreaduser_searchreadaccount_answer_questionwriteaccount_createwriteaccount_deleteconsequential writeopportunity_answer_questionwriteopportunity_createwriteopportunity_deleteconsequential writeprospect_createwriteprospect_deleteconsequential writesequence_add_prospectswritesequence_states_destroyconsequential writetask_createwritefilter_fields_fetchreadfilter_schema_fetchreadinput_fields_fetchreadTry a broader name, group, action, or availability term.
Agent access
Support: Official MCP server + 3rd Party MCP services
Read scope: Provider reads span sales records, people and teams, sequence state, tasks, email/calendar/meeting context, configuration lookups, and dynamic schemas under the signed-in user’s RBAC. In the opposite direction, Outreach’s MCP connectors currently consume only read-only external tools.
Write scope: 11 of 41 reviewed named tools have a write, draft, or mixed action label, including account_answer_question, account_create, account_delete, opportunity_answer_question, opportunity_create, and others. Read each catalog boundary before enabling them.
Authentication: OAuth 2.1 with PKCE and Dynamic Client Registration at the remote provider; the browser authenticates a licensed Outreach user through the organization’s SSO or credentials, and each tool call carries that user-bound bearer token.
Approval boundary: Use the organization switches as coarse controls, then confirm each non-idempotent create, every sequence enrollment, and every tool marked destructive before execution. Display actor, Outreach instance, target IDs, batch size, sequence, and changed state; never treat a client’s “Always allow” setting as a replacement for deletion review.
Confirm the current tool catalog, plan, region, scopes, rate limits, terms, and write behavior before implementation.
Editorial assessment
A comparative architecture lens—not a quality score, market ranking, or buying recommendation. Scale: 1–5.
Proposed customer-shaped experiences
The output could be an export, report, graph, artifact, application, agent, workflow, or downstream feed. These proposals are derived from documented access—not claims that Outreach ships them.
Evidence and dates
“Publisher updated” is shown only when the page exposes an update date. “BYO-UI reviewed” records when this research checked the reference. A missing publisher date is reported as missing—not replaced with the review date.
Official Outreach docs confirm external server and inbound client roles. Server enablement is package-gated; write operations should be approval-controlled and not inferred solely from marketing copy.
Targeted first-party MCP/agent-role review; broader API inventory retained
First-party API reference or API overview recorded for this platform.
Inventory source: structurally normalized; content was not individually reopened in this pass.
First-party developer documentation or platform overview.
Inventory source: structurally normalized; content was not individually reopened in this pass.
Documents shell, tab, tile, text-editor, activity-feed, and mailing-link extension surfaces. The page exposes only a relative update label.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
Documents secure Snowflake sharing in ready-to-query form, same-region requirements, overnight sync, and customer-controlled Snowflake permissions. The page exposes only a relative update label.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
Confirms Amplify/licensed-user/admin enablement, active-credit requirements, provider availability, and separately controlled create-on and delete-off defaults.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
First-party product homepage used to confirm product identity and current positioning.
Inventory source: structurally normalized; content was not individually reopened in this pass.
Documents OAuth 2.1 DCR/PKCE, bearer tokens, inherited user RBAC, user-attributed audit history, and IDP revocation. The page exposes only a relative update label.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
First-party webhook, event, SDK, embedded-app, or extension documentation.
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
Named catalog evidence used on this profile.
Targeted first-party catalog review
Named catalog evidence used on this profile.
Targeted first-party catalog review
Tied to cited first-party evidence reviewed for this profile.
Official links recorded for deeper research but not necessarily reopened endpoint by endpoint.
System role, maturity interpretation, and architectural boundary.
Interface patterns and compositions—not vendor product claims.