What is a Toolset

Toolsets are reusable packages of tools that extend what Quick Apps and other DIAL applications can do. A Toolset wraps an external service — typically an MCP server or a REST API — and makes its capabilities available to any app that references it.

This page explains what Toolsets are, how they connect to the DIAL platform, and how they are governed.

Toolsets and MCP

MCP (Model Context Protocol) is an open standard for connecting AI models to external data sources and tools. DIAL supports MCP natively: Toolsets are the mechanism through which MCP servers are registered and made available in the platform.

When a Toolset is registered in DIAL Core, any Quick App (or other compatible application) can reference it. At runtime, the language model decides when to invoke tools from the Toolset, sends the invocation through DIAL Core, and receives the result — all within the standard chat completion flow.

Types of tools in DIAL

DIAL supports two categories of tool integrations, both configured through the Toolset mechanism:

MCP server tools

MCP server tools connect to an external MCP-compatible server. The server exposes a set of tools (functions) that the model can invoke. DIAL Core communicates with the server using one of two transport protocols:

Transport	How it works	When to use
HTTP	Standard request-response cycle	Default choice. Works for most use cases.
SSE	Server-Sent Events for streaming	When the tool needs to stream incremental results back to the model.

Examples: a database query server, a code interpreter, a web search service.

Web API tools

Web API tools call external REST endpoints directly. They are defined inline in a Quick App's configuration rather than as standalone Toolset entries. Web API tools support configurable authentication:

Auth type	Description
None	No authentication
API key	Static API key sent in a header or query parameter
Basic	HTTP Basic authentication
Bearer	Bearer token in the Authorization header
OAuth 2.0	Full OAuth flow with token refresh

Examples: a weather API, a CRM endpoint, a payment gateway.

The distinction: MCP server tools are registered as platform-level Toolsets in config.json and can be reused across multiple apps. Web API tools are defined within a specific Quick App's configuration.

To turn a REST API's OpenAPI document into MCP tools without writing an MCP server, see Expose a REST API as MCP tools.

note

An MCP server / MCP toolset is not limited to standalone, platform-wide use. A specific Quick App can reference an MCP toolset directly in its own configuration — for example, via the mcp or dial-mcp toolset types — so MCP tools can be scoped to a single app as well as shared across many.

How Toolsets connect to apps

A Quick App references Toolsets through its configuration. When a user sends a message:

1. The model receives the conversation history, system instructions, and a list of available tools (from all connected Toolsets).
2. If the model decides a tool is needed, it generates a tool call with the tool name and parameters.
3. DIAL Core routes the call to the appropriate Toolset endpoint.
4. The MCP server executes the tool and returns the result.
5. The model incorporates the result into its response.

This loop can repeat — the model may call multiple tools, or the same tool multiple times, before producing a final response.

Configuration

Toolsets are registered in DIAL Core's config.json under toolsets.<toolset_name>. A minimal entry requires an endpoint:

{
  "toolsets": {
    "web-search": {
      "endpoint": "http://search-mcp:5000/tools",
      "displayName": "Web Search",
      "description": "Search the web for current information",
      "transport": "HTTP"
    }
  }
}

Optional attributes include authType, userRoles, allowedTools, maxRetryAttempts, and descriptionKeywords. See the toolsets configuration reference for the full list.

Authentication

Toolsets support three authentication types:

Auth type	Description
NONE	No authentication required (default)
API_KEY	Static API key
OAUTH	OAuth 2.0 flow with token management

For OAuth, the security configuration (client ID, client secret, token endpoint) is managed in the static settings.

Sharing and governance

Toolsets are governed resources in DIAL:

• Role-based access — the userRoles attribute restricts which users can access a Toolset.
• Tool allowlisting — the allowedTools attribute restricts which specific tools within an MCP server are exposed.
• Publication workflow — Toolsets can be published to the Catalog through the standard approval process, giving administrators control over which tools are available to which audiences.
• Versioning — administrators manage Toolset versions in DIAL Admin. See Toolsets.

This governance layer ensures that external tool access is controlled, auditable, and consistent with organizational policies.