api.wellapp.ai

This tool executes an arbitrary named tool with arbitrary args on any connected external provider's own MCP server (e.g. Attio, Notion, Linear), scoped only by workspace connection status. The description tells the agent to use it 'ONLY for an action the user explicitly asked to take,' but nothing in the schema enforces this — it's a policy note, not a technical restriction. Because Well also ingests untrusted third-party text into the same conversation (invoice descriptions, company names, memo/remittance text, AI-extracted fields), a prompt-injection payload embedded in that data could attempt to direct the agent to invoke a destructive or data-exfiltrating action on a connected provider (e.g. create/delete/export records) under the guise of a legitimate workflow step. Given the wide range of possible provider tools and the fact their schemas are only discovered at runtime, this is a high-leverage capability that deserves extra scrutiny/confirmation before invocation.