> ## Documentation Index > Fetch the complete documentation index at: https://docs.coffeechats.me/llms.txt > Use this file to discover all available pages before exploring further. # What an agent can and cannot do > The reach of the Coffee Chats tool catalogue, the parts of the product that have no tool at all, and the rules every tool obeys. A connection gives an agent a fixed list of named actions and nothing else. After reading this page you will know what those actions reach, which parts of Coffee Chats have no tool at all, and the four rules that hold for every tool in the catalogue. ## The shape of the catalogue The connector publishes 85 tools. Each one carries a risk class in its protocol metadata, and the class says how the tool behaves rather than how important it is. | Risk class | How many | What it does | | - | - | - | | `read` | 54 | Returns your own data. It changes nothing and never asks for your approval. | | `safe_write` | 17 | Changes one of your own settings as soon as the agent calls it. | | `consequential` | 13 | Sends email, spends credits or changes what other people see. Nine of these propose a change and write nothing until you approve it, in a browser or, for a contact update in Claude or ChatGPT, in an approval card. Four act as soon as the agent calls them: `mail.drafts.send`, `mail.batch.enqueue`, `documents.resumes.generate` and `documents.jobs.tailor`. | | `browser_handoff` | 1 | Starts work in the Coffee Chats extension with no approval page. Autofill stops before submit for you to press it; Full access, only if you turned it on, also submits. The connector itself submits nothing. | The [tool reference](https://docs.coffeechats.me/mcp/tools/overview.md) is generated from the connector's own catalogue, so it cannot describe a tool the connector does not have. [Safe writes and approvals](https://docs.coffeechats.me/mcp/writes.md) explains why the writes split into two classes. ## What the tools reach Everything in the catalogue is your own student work. The tools read and write your profile, your booking page and its event types, your contacts and their research, your meetings, the stored state of your connected calendars, your campaigns, your internship applications, your outreach settings and queued mail jobs, and your billing record. > [!NOTE] > > In the whole catalogue, three tools send an email and three tools spend credits. `meeting_thank_you_send` sends a thank-you message you already drafted, to the address stored on the contact linked to that meeting, and only after you read the exact message in a browser and approve it. `mail.drafts.send` sends one outreach draft you already wrote. `mail.batch.enqueue` queues a table of drafts you formatted, and only for contacts you already have, after each row is checked. None of them can invent a recipient. `contacts.research.start` starts research on up to 25 of your contacts, which spends credits, and only after you approve the batch, its cost and your balance in a browser. `documents.resumes.generate` writes a resume for 1 credit, and `documents.jobs.tailor` writes a tailored resume and cover letter that use the application's job credit. Both spend as soon as the agent calls them and need `documents:generate`. `campaign_pause_sending` stops a campaign from sending. A tool reads only the account that authorized the connection. There is no tool that names another student, and no permission that widens a tool to a second account. ## What no tool reaches Some parts of Coffee Chats have no tool, so an agent cannot start them at all. They stay in the app, where you do them yourself. > **Administrator screens** > > The connector covers your own student work and your own booking page. It has no tools for the administrator screens that universities and companies use, so an agent cannot touch those even if you hold an administrator account. > **Guest links** > > If you give an agent a guest booking or cancellation link, that link still does only what a guest can do with it. It never becomes access to your account. No tool accepts a guest link, so an agent cannot use one. > **Live meetings and media** > > Joining a meeting, admitting somebody who is waiting, controlling a transcript and ending a room are things a person does in the browser. No tool does any of them. > **Payments and card details** > > Coffee Chats never accepts a payment credential through an agent. The billing tools only read. Entering or changing payment details stays in the app. > **Resuming a paused campaign** > > An agent can pause a campaign's sending. There is no tool that starts it again, so you resume a campaign yourself in the app. The same rule covers anything that only changes what you see in the app and has no effect on your account. The [tool reference](https://docs.coffeechats.me/mcp/tools/overview.md) also names, one by one, the endpoints that exist in the product and are deliberately not published as tools. ## The four rules every tool obeys Every tool in the catalogue follows all four, whatever it reads or writes. 1. A tool reads only the account that authorized the connection. It cannot reach another student's data. 2. A tool returns a bounded amount of text. Where a stored value can be too large to fit, the tool returns a measured fragment and a cursor, and the agent asks for the next fragment until there is none left. A tool's own reference page says whether it can do this at all. 3. A read tool that fails returns a short message with no code. It says only that the call failed, except in two cases. A lookup that finds no record of yours names the kind of record it did not find, and a meeting whose transcript Coffee Chats does not hold says that instead. [Failures that carry no code](https://docs.coffeechats.me/mcp/errors.md) gives all three texts. 4. A tool that changes something changes one of your own settings straight away, or proposes the change and waits for you to approve it in a browser, or queues it for the Coffee Chats extension, which fills it in your own browser and either leaves the submit to you (Autofill) or submits it (Full access, only if you chose it). ## Next steps > **[Permissions](https://docs.coffeechats.me/mcp/permissions.md)** > > How the Authorize access page decides which tools a connection can call. > **[Safe writes and approvals](https://docs.coffeechats.me/mcp/writes.md)** > > The two ways a change can happen, and the flow of an approval. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.