Windsor.ai MCP Write Actions: 123 Published, 131 Live

Windsor.ai MCP write actions come with two published numbers. The documentation page — “How Windsor MCP Write Actions Work” — says 123 write actions across 18 connectors, and growing. The registry that Windsor’s own MCP server hands to Claude, ChatGPT and Copilot returns 131 actions across 19. Eight actions live in the gap between those two sentences, and one entire connector is missing from the inventory an agency would hand to its compliance lead.

That gap matters more than it looks, because documentation is not a description of a product. It is the thing a regulated agency copies into a client-facing AI usage policy. When the list you can read is eight actions behind the list a model can call, your policy has an unenumerated remainder — and nobody signed off on it.

The larger point sits underneath the arithmetic. A count of actions is a statement about what an agent can do. It is not a record of what it did, who approved it, or which client’s money moved. Windsor has now spent eight consecutive Fridays expanding the first number. The second has not appeared at all.

Credit where it is due: the registry is the best idea in this lane

Start with what Windsor actually shipped, because it is more than most competitors in the write-capable agent category have managed.

• A real, enumerable action registry. Since June 26 the changelog has advertised “discoverable /actions API endpoints — LLMs and integrations can now dynamically list all available write actions per connector.” That endpoint is live, it is machine-readable, and it returns a typed parameter schema for every action. Most write-capable vendors in this lane publish nothing comparable.
• Per-action documentation, not a feature page. Each of the documented actions carries its own description, its required parameters and — the part almost nobody does — a reversibility note: “Reversible via pause_campaign,” “Reversible via enable_campaign.”
• Honest per-action warnings where the platform is unforgiving. The registry tells you that deleting a Google Ads Customer Match list “cannot be undone,” that an ad-group update is “a value change with no built-in undo,” and that a Salesforce delete is recoverable in the Salesforce UI “but not through Windsor.”
• One action that genuinely requires a human. Changing a connected Google Business Profile storefront address refuses to run unless acknowledge_reverification_risk is set to true, which the docs describe as requiring “the end user’s explicit approval.” That is a real gate.
• Free to run. The MCP server carrying all of this sits on Windsor’s free tier, which is a distribution decision worth crediting rather than dismissing.

Two numbers, two readers

Same vendor, same week, two answers to the same question. Here is where each number lives.

Neither surface is wrong about anything it says. The documentation page was accurate on 7 September. The trouble is that the page also makes a promise about being current, and the registry is the falsifier.

Where the eight actions are

Eighteen of the nineteen connectors tally exactly between the two surfaces. Three do not, and each one reconciles to a dated changelog entry.

The smallest item is the most interesting one. Five live write actions for OpenAI Ads — pause and resume a campaign, set its spend limit, pause and resume an ad group — are callable right now, and the word OpenAI appears zero times on the documentation page that enumerates the whole surface.

That page is explicit about its own currency. From its FAQ: “Coverage keeps expanding, and the list above always reflects what’s live.”

The list above does not. And the missing connector is the newest advertising surface in the market — the one an agency is most likely to be asked about by a client in the next two quarters, and the one where almost nothing about measurement or governance has settled.

A count is not a record

Suppose Windsor reconciled every number tomorrow and the two surfaces matched perfectly. The gap that matters for a regulated agency would still be open, because the unit is wrong.

Every one of the 131 action descriptions tells you what the action does. Across 51,643 characters of them, here is what the vocabulary looks like:

Approver: zero. Approved by: zero. Actor: zero. Human: zero. Jurisdiction: zero. Retention: zero. Export: zero. Evidence: zero.

The two near-misses are worth reading closely, because they show what governance vocabulary looks like when it is genuinely about governance rather than about capability. The single approval is the Google Business Profile address gate. The single audit is a field audit: “Currently set attributes can be audited via the location_attributes field.” That is a way to inspect a listing, not a way to reconstruct who changed a client’s campaign budget in March.

The word record appears eighteen times across those descriptions. Every one of them means a CRM record in Salesforce or a database row — the thing being written. None of them means a record of the write.

Eight Fridays, one line about a log

Windsor publishes weekly, and the cadence itself is a credit: every entry below is dated on a Friday, eight in a row, each one shipping more write capability. Read the third column and notice how quickly the one governance claim in the set stops appearing.

On 24 July, Windsor claimed an audit log covering all write actions, “for compliance and traceability.” Since then: no documentation page for the log, no field list, no retention period, no export format, and no second mention — while the changelog accumulated twelve further write-action releases and its own page recorded zero uses of the words governance and approval.

That is not an accusation of dishonesty. It is an observation about addressability, and it applies to every vendor in this category. A claim that lives in a changelog line is a claim. An artifact lives somewhere a stranger can read its schema — the docs, a security page, a contract. A security page that carries twice as much SOC 2 language as it does audit language is telling you where its attention is: vendor security, not client evidence.

The gate appears where the vendor carries the risk

Windsor requires a person to approve moving a shop’s storefront address. It requires nobody to approve changing a client’s Meta campaign budget — and that asymmetry is not hypocrisy, it is a design signal about what the control is for.

The action refuses to run unless acknowledge_reverification_risk is set to true, which requires the end user’s explicit approval.

The reason the gate exists there is that an address change can push the listing into Google’s re-verification flow and unpublish it — a direct operational cost to the vendor. Nothing in 131 actions puts Windsor’s own numbers at risk the way a paused campaign does, and so nothing else is gated the same way. If a control only activates when the platform penalises the tool, it is a liability limiter, not a governance feature.

The same reading applies to reversibility. The documentation headline says “every action is reversible where the platform allows it.” The registry itself says five of the 131 are not: a Customer Match list deletion that “cannot be undone,” an ad-group value change with “no built-in undo,” a permanent Instagram comment deletion, a video upload that cannot be reversed by an action, and a Salesforce delete recoverable only “in the Salesforce UI but not through Windsor.” Neither sentence is false. Only one of them is a specification, and it is the one the marketer never reads.

What the regulator asks instead

The FCA’s Nikhil Rathi, in “Rethinking regulation for the age of AI” (June 24, 2026):

Accountability for regulated activities and outcomes must remain clear.

Try to answer a financial-promotion review with either of Windsor’s numbers. The question is never “how many actions can your agent call?” It is: on 14 March, who approved the budget increase on this client’s brand-search campaign, what did the account look like before and after, which jurisdiction was the campaign running under, and can you show me. A count cannot answer that. A registry cannot answer that. Only a record can, and only if it still exists when the question arrives — nine months after somebody clicked a settings page next to the action-enablement toggle.

The registry test

Five steps. Run them on any write-capable MCP vendor, including the ones we will not name here. None of them require a security team.

What this looks like when the record is the product

Ott’s answer is narrower and less impressive to look at, because it is the second half of the problem rather than the first:

• Activity Logging records every campaign change — pauses, budget edits, creative swaps, bid and review changes — timestamped, attributed to the actor the platform reports, with before-and-after values. Stored independently of the platform that accepted the change, and with no retention tier to reconcile.
• Budget Ledger keeps one prepaid ledger per brand, so a top-up, a correction and a reset are dated entries, not recollections.
• Agency Hierarchy runs Client → Brand → Account, so a record is filed against the engagement it belongs to rather than against whoever owns the ad account.
• Telegram conversion tracking writes joins and FTDs into the same account-level record through CAPI postbacks that survive the chat, so the Telegram side of a finance funnel lands beside the Meta side.
• Client View lets a brand read its own slice without a shared login and without seeing anything beyond its own accounts.
• Flat CHF plans with no per ad account, per data source, or per Telegram join fees.

To be exact about the comparison: Windsor executes campaigns across nineteen platforms from inside a chat, and Ott does not write campaigns into ad platforms at all. Our lane is the record of what happened and who authorised it. If you want an agent to pause a campaign from Claude, Windsor ships that today and documents most of it well.

But the number in your policy is not the number your agent can call, and neither of them is a record. Ask for the registry, count it, and then ask the question the count cannot answer: when this changes a client’s budget on a Tuesday afternoon in March, what survives — and where does it live when the ad account is the thing that got restricted? Read more on the same axis in the six lifetimes one vendor publishes for a single audit log.