Best Practices & AI Examples

Treat an AI assistant connected through MCP like an automated operator working inside your ChatbotX workspace. Always establish safety boundaries, verify token capabilities, and require explicit confirmation for state mutations.

Core Operational Rules

AI assistants need valid workspace credentials and structured operational procedures to interact safely with ChatbotX resources. Configure your AI assistants with the following principles:

Discovery First: Start every session by querying workspace context with capabilities_get and verifying permissions with token_get. Do not make assumptions about available tags, flows, channels, or fields.
ID Resolution Over Names: When performing actions on contacts, tags, custom fields, or flows, look up and verify the exact internal ID first (for example using contacts_get, contacts_list, or capabilities_get).
Validate Before Publishing: When creating or editing conversational automation with Flow Builder tools, compile and test flow graphs with flows_validate before calling flows_publish.
Meta-Tool Discovery: For specialized API endpoints outside the 43 default tools (such as discount coupons, bot fields, or billing data), guide the AI to query search_tools and invoke them via call_tool.
Draft and Review: For outbound communications, mass tagging, or bulk updates, have the AI draft the action and display target recipients for human review before execution.

Human-in-the-Loop Safeguards

Human-in-the-loop workflows ensure the AI assistant prepares, validates, and simulates changes, then pauses for your explicit approval before mutating any workspace data.

Standard Safe Protocol

Discovery / Search ──> ID Resolution ──> Draft Action & Target Preview ──> Human Approval ──> Execution & Report

Instruct your AI assistant to follow this sequence whenever working with production workspace data:

Display target contacts, current tags, or matching counts before initiating updates.
Draft message content, template names, and variable payloads before sending.
Verify whether the active token has full or read_only permission with token_get.
Test on a single test contact before rolling out modifications across larger segments.
Provide a summary report with execution status and IDs after completing actions.

Natural Language AI Prompts

Use the following production-ready prompt templates to guide your AI assistant across common automation, support, and marketing workflows.

1. Workspace Discovery & Capability Check

Check my ChatbotX workspace capabilities using capabilities_get and verify my token permissions with token_get.
Summarize:
- Workspace name and ID
- Active connected channels (WhatsApp, Messenger, etc.)
- Available tags and custom fields
- Current token access level (read_only or full)
Do not perform any data modifications.

2. Contact Lookup and Tagging

Find the contact with phone number "+84901234567" using contacts_get (or contacts_list with keyword).
If found:
1. Show their current details, existing tags, and last active timestamp.
2. Check if the tag "VIP Customer" exists in our workspace.
3. Ask for my confirmation before attaching the tag.
4. Once I confirm, call contacts_add_tags_by_name to apply "VIP Customer" and show the updated profile.

3. Safe Flow Validation and Publishing

I want to create a new WhatsApp welcome flow:
Inspect the flow graph schema with schemas_flow_spec.
Draft a simple flow with a greeting text node and a quick reply button.
Validate the flow JSON definition using flows_validate.
If validation passes, display the flow structure and ask for my approval.
Only after I approve, invoke flows_publish to make it live.

4. Extended Resource Lookup via Meta-Tools

We need to check available discount coupons and campaign data:
Use search_tools with query "coupon" or "campaign" to find relevant extended API tools.
Inspect the parameters required by the discovered tool.
Use call_tool to retrieve the active coupon list.
Present the coupon codes, expiration dates, and discount rates in a clear markdown table.

5. Audience Segmentation & Message Draft

Find all contacts tagged "Lead" created within the last 7 days using contacts_list:
Count the total matching contacts and display the top 5 records.
Draft a friendly WhatsApp follow-up message template offering product assistance.
Show me the drafted text and the total recipient count.
Stop and wait for my explicit confirmation. Do NOT call any send or broadcast tool until I approve.

Security Best Practices

Use Read-Only Tokens for Analytics & Reporting

When configuring AI assistants for audit, dashboard reporting, or conversation analytics, issue a workspace token with read_only scope in Settings > Integrations > Workspace token. This guarantees that the assistant cannot accidentally delete contacts, publish flows, or dispatch broadcasts.

Rotate Tokens Periodically

If an AI client configuration file (claude_desktop_config.json, .antigravity/settings.json, or environment files) is committed or shared across team members, revoke the old token immediately in your dashboard and issue a fresh workspace token.

Keep Sensitive Identifiers Isolated

Instruct your AI assistant not to output full personally identifiable information (PII) such as payment tokens, raw email addresses, or unmasked credit data into shared chat transcripts or public logs.

Getting Started

Usage & Reference

Core Operational Rules

Human-in-the-Loop Safeguards

Standard Safe Protocol

Natural Language AI Prompts

1. Workspace Discovery & Capability Check

2. Contact Lookup and Tagging

3. Safe Flow Validation and Publishing

4. Extended Resource Lookup via Meta-Tools

5. Audience Segmentation & Message Draft

Security Best Practices

​Core Operational Rules

​Human-in-the-Loop Safeguards

​Standard Safe Protocol

​Natural Language AI Prompts

​1. Workspace Discovery & Capability Check

​2. Contact Lookup and Tagging

​3. Safe Flow Validation and Publishing

​4. Extended Resource Lookup via Meta-Tools

​5. Audience Segmentation & Message Draft

​Security Best Practices

Core Operational Rules

Human-in-the-Loop Safeguards

Standard Safe Protocol

Natural Language AI Prompts

1. Workspace Discovery & Capability Check

2. Contact Lookup and Tagging

3. Safe Flow Validation and Publishing

4. Extended Resource Lookup via Meta-Tools

5. Audience Segmentation & Message Draft

Security Best Practices