NetSuite
6 reviewed Dtwo policies for NetSuite MCP servers — egress + ingress controls for governing what AI agents can do with NetSuite.
On this page
Reusable DTwo policies for Oracle NetSuite MCP servers — the official NetSuite AI Connector Service + MCP Standard Tools SuiteApp (the endpoint the Claude connector uses directly), the dsvantien/netsuite-mcp-server community proxy that surfaces the same ns_* tools, and adjacent community wrappers. The MCP surface is read tools (ns_getRecord, ns_runCustomSuiteQL arbitrary read-only SQL over the whole ERP, ns_runSavedSearch/ns_runReport, metadata helpers) and two write tools (ns_createRecord, ns_updateRecord) that create or overwrite any REST-exposed record type. Its risk profile is dominated by financial integrity and exfiltration, not deletion: there is no delete tool, but ns_runCustomSuiteQL is a one-query path to employee PII/HR data, full vendor/customer master data (including bank details), and pre-earnings GL results; ns_updateRecord on a vendor is the classic BEC payment-fraud vector; a posted journal in a closed period is a restatement risk; and the /v1/all endpoint can expose arbitrary account-specific SuiteScript tools whose side effects are unknowable in advance.
Available policies
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| default-deny-unknown-tools | ingress | Default-deny any NetSuite tool whose suffix is not in the audited standard ns_* allowlist, so custom SuiteScript tools on /v1/all must be explicitly allow-listed before agents can call them. |
soc2, gdpr-ccpa |
| guard-vendor-banking | ingress | Deny ns_createRecord/ns_updateRecord on vendor records that touch bank/payment fields (account, routing, sort code, IBAN, payment method) unless the caller is in an AP-manager group — anti-BEC. |
sox, soc2 |
| protect-closed-periods | ingress | Deny financial-transaction writes (journalentry, vendorbill, vendorpayment, and peers) unless the caller is in a finance group, protecting posted/closed-period books. | sox, soc2 |
| fence-hr-payroll-suiteql | ingress | Deny ns_runCustomSuiteQL over HR/payroll tables and ns_runSavedSearch identifiers naming payroll/HR unless the caller is in an HR group. |
gdpr-ccpa, soc2 |
| cap-bulk-export | ingress | Clamp the ns_runCustomSuiteQL pageSize argument down to a configurable ceiling (default 100), throttling one-shot mass export of ERP master data (transform-only). |
soc2, gdpr-ccpa |
| redact-financial-pii | egress | Redact SSN/TIN, bank-account, routing/ABA, and IBAN-shaped strings from NetSuite read responses before they reach the agent context (transform-only). | gdpr-ccpa, soc2 |
Tool naming on the DTwo gateway
DTwo prefixes tool names with the MCP server name configured on the gateway. A NetSuite MCP server registered as netsuite will surface tools like netsuite-ns_createRecord, while one registered as ns will surface ns-ns_createRecord. The official server and the dsvantien proxy share the ns_ prefix with camelCase verbs (ns_runCustomSuiteQL), so the policies in this directory match on the suffix (ns_createrecord, ns_runcustomsuiteql, etc., case-insensitively) to stay portable across naming conventions. The independent community wrappers use incompatible conventions (get-* for ChatFin, netsuite_* for glints-dev) with different argument shapes and are not covered by these ns_*-keyed policies. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying — and on /v1/all accounts, pin default-deny-unknown-tools to your audited full gateway tool names rather than relying on suffix matching alone (see that policy's Known limitations).
Identity claims
Several of these policies are single-purpose and require no IdP claims (default-deny-unknown-tools, cap-bulk-export, redact-financial-pii). The identity-gated ones read input.subject.claims.groups with placeholder group names: guard-vendor-banking exempts an AP-manager group, protect-closed-periods gates on a finance group, and fence-hr-payroll-suiteql exempts an hr group. Replace these with your own IdP group names at import time. Missing claims fail closed for grants (no group → not exempt).
Contributing
To add a NetSuite policy:
- Create
apps/netsuite/<policy-slug>/withpolicy.mdand atests.yamltest file. - Add a row to the table above.
- Declare
apps: ["netsuite"]in the policy frontmatter, plus any industry / bundle slugs that apply. - If the policy fits a framework bundle (
soc2,sox,gdpr-ccpa, …), link to it from the matching landing page. - Run
pnpm manifestfrom the repo root.
See CONTRIBUTING.md for the full process.