MCP servers as agent tools

2501 agents can use MCP servers as tools: instead of composing command lines, the agent calls functions the server describes in plain language. A plugin can be a public MCP server or one you built in-house, and each is given only to the agents that need it.

An agent working through a complicated command-line tool makes the mistakes a person makes with one: the wrong argument, an option that does not exist. A well-described tool removes most of that.

What 2501 does

Plugins are set up with 2501 for each customer so they work reliably with the agents. Each one is assigned to the agents that need it and no others, scoped to one organisation or to the whole tenant, and can be switched off at once if a function misbehaves. With VMware, for example, agents struggled with the command-line client and managed machines, snapshots and datastores without friction through an MCP-based plugin. Add an MCP server where agents consistently struggle with a tool, not for tools they already handle well: every plugin adds to the agent's context, and a crowded context makes a less reliable agent.

You stay in control

• You choose the level, per specialty: investigate only, act after a person confirms, or act on its own within your rules.
• The MCP server's permissions are the hard limit: access control can live inside the server, including read-only versions of its tools for investigation.
• The server's credentials stay away from the agent: a credential you keep from agents cannot be used during tasks.
• One integration, one token: never reuse a production token for a read-only agent's plugin.

Frequently asked

Can we connect our own MCP server? Yes. In-house MCP servers work as well as public ones.

Does every agent get every plugin? No. Plugins are assigned per agent.

Should we wrap every tool in an MCP server? No. Add one where agents struggle with a tool; otherwise it only adds context and cost.

Related

• VMware Datastore Operator
• Azure OpenAI and Azure API Management
• Guardrails: what an agent may never touch
• Read-only AI investigation