Pulse and MCP
Pulse is the concept of exposing your topologies as tools over the Model Context Protocol (MCP). Instead of giving an AI agent or a user raw access to your systems, you expose a small set of deterministic processes, and Orchesty governs who can run which one.
Topologies as tools #
A topology becomes a tool when it carries an MCP description and is marked as exposed. The description is what an LLM uses to select the tool; the arguments are validated against a schema before the topology runs. The tool's behavior is fixed by the topology, so the agent decides what to run, never how it runs.
A topology that returns data (it has a response node) is a query; one that is fire-and-forget is a command. This is derived from the topology, not declared.
The authorization model #
Pulse does not introduce a separate permission system. It reuses the platform's groups:
- A caller (an agent user or a signed-in person) belongs to groups.
- A group grants the right to run specific topologies.
- The same per-caller run check builds the tool list and guards each run, so a caller can only ever run what its groups allow.
Execution runs under the system identity, so shared application credentials resolve, while the real caller is carried separately in a protected identity header and recorded in the audit log. This is what lets you grant access to a process without exposing the credentials behind it.