Start a supported business workflow. For deal_to_estimate, creates a Sanka estimate draft from the deal, applies existing estimate approval rules, creates pending approval requests when required, and stops there until approval. For deal_to_order, creates or reuses a Sanka Order from a HubSpot Dea...
AI agents invoke start_workflow to trigger actions in Sanka MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
This tool executes complex business workflows with multi-step side effects across integrated systems. While it creates/modifies data (suggesting Write), the fact that it 'starts' workflows means it triggers cascading operations whose exact effects depend on system state and workflow configuration—characteristic of Execute category.
From the tool's definition Tool description states it 'Start[s] a supported business workflow' with multiple outcomes: 'creates a Sanka estimate draft', 'creates or reuses a Sanka Order', 'creates/updates the Subscription', and 'creates the [Invoice]'.
Attacks that exploit this kind of access
Start a supported business workflow. For deal_to_estimate, creates a Sanka estimate draft from the deal, applies existing estimate approval rules, creates pending approval requests when required, and stops there until approval. For deal_to_order, creates or reuses a Sanka Order from a HubSpot Deal or synced CRM revenue record. For deal_to_subscription, creates/reuses the Sanka Order and then creates/updates the Subscription from that Order, including HubSpot batch lists filtered by subscription flags. For estimate_to_invoice, creates/reuses a Sanka Order from a Sanka Estimate, then creates the Invoice from that Order. For order_to_invoice, order_to_subscription, and order_to_purchase_order, starts from Sanka Order records; order_to_purchase_order creates POs only for detected inventory shortages. For subscription_to_invoice, creates invoice drafts from selected Sanka Subscription records. For deal_to_order_handoff, creates a Sanka order draft and optional fulfillment handoff task from an eligible closed-won HubSpot Deal only after explicit start/confirmation; it reruns duplicate/idempotency checks and writes HubSpot order/fulfillment status only after Sanka creation succeeds. For invoice_export, syncs only explicitly scoped Sanka invoice drafts to freee or MoneyForward invoice drafts after duplicate/idempotency checks; do not use it for an ambiguous sync-all request. For freee repeats, never tell the user to delete the freee invoice; freee supports cancellation/restoration instead. Use allow_resync=true for the mapped draft/unregistered invoice, or allow_multiple_freee_drafts=true only after explicit confirmation for a separate draft. list_integration_channels may provide accounting channel_id candidates, but its integration-sync shadow/outbound flags are not invoice_export blockers. Do not use start_workflow for quote_readiness, revenue_control_summary, or sales_incentive_commission; they are read-only preview workflows. Direct CRM deal_to_invoice is disabled. It is categorised as a Execute tool in the Sanka MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the Sanka MCP Server MCP server in PolicyLayer and add a rule for start_workflow: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Sanka MCP Server. Nothing to install.
start_workflow is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the start_workflow rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for start_workflow. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
start_workflow is provided by the Sanka MCP Server MCP server (sankahq/sanka-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →