Look up employees by e-mail over MCP

employee_lookup (pii:read)

Plans: every plan. Where: the /mcp endpoint, for a token that holds the Owner-granted pii:read scope.

employee_lookup takes up to 50 e-mail addresses and returns the matching employee IDs, so you can join your own list of people to AutoCISO data without exporting the directory. Pair it with the employeeId column of tools such as access_inventory_list.

• Index-based result. { matches: [{ index, employeeId }], unmatchedIndexes, ambiguousIndexes, normalizedCount }. index is the position in the trimmed, lower-cased, de-duplicated list. The response contains no name and no e-mail address.
• Never a guess. An address held by more than one employee is listed under ambiguousIndexes. Matching is exact; terminated and onboarding employees match too.
• Whole-call validation. An empty list, more than 50 distinct addresses or a single malformed address rejects the call with INVALID_ARGUMENTS. To look up more than 50 addresses, call again with the next batch.
• All-or-nothing rate limit. Every distinct address you submit uses one unit of the token’s hourly personal-data allowance, matched or not. If fewer units remain than addresses, the call returns RATE_LIMITED and uses nothing.
• Audited. Every call is written to your audit trail before the result is returned, with counts, matched employee IDs and masked unmatched addresses; raw addresses are never stored.

The tool needs a pii:read token minted after the tool is enabled for your deployment. See MCP Tool Catalog and Employee identity.