An AI agent is only as useful as the tools it can call. For Workday, those tools are now a product of their own. Agent-Ready Tools became generally available in Workday Extend AI at Workday Rising on October 13, 2026, alongside custom agents and Developer Agent.
This post explains what they are, how they connect to the AI tools people already use, and what to check before you give an agent access to them.
What Agent-Ready Tools are
Agent-Ready Tools are pre-built tools that let an AI agent read Workday data and take actions in Workday. Workday says there are more than 400, with new tools released monthly, and that they are designed for language models: flat input schemas and clear descriptions, so a model can tell which tool to use and what to pass it.
They speak MCP, the Model Context Protocol, natively. MCP is the open standard most AI assistants and coding tools now use to call external tools. In practice, any MCP-capable agent, whether a Workday custom agent, an agent your team builds with another framework, or an assistant such as Claude, can use the same Workday tools.
Workday also announced with Anthropic that Agent-Ready Tools are available through Workday Extend AI, with plugin availability for Claude to follow later in 2026.
How security works
This is the most important part. Workday says:
- Workday security permissions apply to every call. A tool returns only what the person behind the agent is allowed to see, and can only do what that person is allowed to do.
- Every action traces back to the human who started it.
Agent-Ready Tools do not create a side door into Workday. They are a new way to reach the same data through the same security model. That also means they inherit any weakness in that model. If a security group is wider than it should be, an agent will find it faster than a person would. Review security before you connect tools; the guide to securing custom agents covers how.
How they are billed
Workday's Flex Credits page lists Agent-Ready Tools as one of the capabilities covered by Flex Credits. Check the current Rate Card for how tool use is metered for the customer, especially for agents built outside Workday that call the tools directly.
Read tools vs. tools that change data
Coverage of the launch has reported a split between tools that only read data and a smaller set that can create, update or delete it. Workday's own figure is the total, more than 400, and the catalogue grows monthly, so check the live list rather than any published count.
Whatever the numbers, the split is the one that matters when you scope an agent:
- Read tools answer questions. The main risks are showing too much and costing credits.
- Write tools change records. Each one should be justified by the agent's job and, at first, sit behind a human approval.
A useful rule: an agent's first release gets every read tool its job needs and only the write tools it cannot do without.
Agent-Ready Tools vs. a do-it-yourself Workday MCP server
Before Workday shipped its own tools, teams wrapped Workday's REST, SOAP and reporting APIs in their own MCP servers. Those still work, but compare carefully:
| Agent-Ready Tools | Your own MCP server | |
|---|---|---|
| Who maintains it | Workday | Your team |
| Security | Workday permissions per call, traced to the user | Whatever identity your server uses, often an integration system user |
| Coverage | 400+ tools, growing | What you built |
| Cost | Flex Credits | Your hosting plus your time |
The security row is the deciding one for most organisations. A home-built server that runs every call as one integration system user does not limit each person's agent to that person's data.
What tools alone don't do
Tools give an agent hands. They do not tell it how a particular tenant is configured, which custom objects exist, or what a client's business process expects. Developer Agent adds Workday's knowledge for building; the tenant-specific knowledge still comes from inspecting the tenant itself.
Where kiweely fits
kiweely is a desktop co-pilot for Workday consultants that runs Claude or ChatGPT with its own Workday tools. It connects to each client's tenants separately and asks for your consent before any change. It reads the tenant's actual configuration before it proposes anything, and works across the whole delivery job: building and validating Workday Extend apps, deploying to Development and testing in the browser. For a comparison with a Workday MCP server in Claude Code, see Claude Code with a Workday MCP server vs. Claude in kiweely.