Pipeline guide for agents

Updated: 2026-10-13

Pipeline is an AI agent team and shared workspace for B2B outreach and LinkedIn content. Use your external LLM to reason and write, then use Pipeline to save evidence, build tables, prepare campaigns, and inspect results. Pipeline campaign workflows execute native LinkedIn delivery through connected accounts.

This guide covers the entire published tool catalog. It does not mean every app screen has an agent tool, every provider is connected, or every delivery scenario has been verified. Discover current tools and schemas before acting.

Connect and discover

Hosted MCP: https://app.pipeline.help/api/mcp-server.

Configure Authorization: Bearer YOUR_PIPELINE_KEY securely. For personal credentials, select the workspace with X-Pipeline-Workspace-Id: WORKSPACE_ID_OR_SLUG when needed. Never put real secrets in this file, prompts, logs, or source control.

npm install -g pipeline-gtm@latest
pipeline init
pipeline whoami
pipeline list-workspaces --json
pipeline config set defaultWorkspace WORKSPACE_ID_OR_SLUG
pipeline help --json

Use CLI 1.3.3 or newer for the current external SDR options. Global installs from 1.3.4 check for stable CLI updates on every invocation and install only a newer version. Versions 1.3.2 and 1.3.3 check at most once an hour and will pick up this updater. Older installs need one final npm install -g pipeline-gtm@latest. pipeline update refreshes only the tool catalog, not CLI code. PIPELINE_AUTO_UPDATE=0 disables automatic updates; project-local and npx installs remain npm-managed.

If using the npm MCP proxy, update pipeline-mcp and reconnect. Refresh hosted MCP tool discovery after a release. Workspace roles, subscriptions, provider permissions, and account eligibility still apply.

Use MCP tools/list for exact schemas, resources/list to discover skills and recipes, and resources/read to read them. Some clients expose a selected toolset; check its configuration before declaring a missing tool unsupported. CLI agents can use:

pipeline run TOOL_NAME --args '{"workspaceId":"WORKSPACE_ID"}' --json

Replace the arguments with the selected tool's schema. Resolve internal IDs and technical choices yourself instead of asking the user to write JSON or choose MCP versus CLI. Read back mutations rather than repeating them through another surface.

• API reference
• MCP reference
• CLI reference
• SDK reference, verify published package support before relying on a generated method
• OpenAPI specification
• Detailed campaign operator guide

Operating rules

1. Keep all operations in the authorized workspace. Verify identity and access before writes.
2. Identify the user's target table, campaign, list, workflow, post, or saved source. Reuse confirmed targets. Otherwise present candidates and ask for confirmation; never silently pick the first or newest saved object.
3. Match the requested scope. A CSV import does not require strategy work. A connection-only request does not authorize scoring, follow-ups, withdrawal, or InMail. Preserve supplied copy and audience constraints.
4. Read schemas and relevant skills. Resolve providers by capability instead of guessing endpoints, IDs, or settings.
5. Use your external LLM for reasoning by default. Pipeline-hosted AI is a separate execution mode requiring explicit consent and applicable workspace configuration. Do not silently switch to it.
6. Connected providers use workspace credentials. Do not assume platform environment keys are available for prospect research. Inspect availability and limits before spending or scaling. Pipeline has no platform credit system; connected providers may have their own balances and quotas.
7. Save source evidence and results in tables or the relevant draft object. Preserve provenance, row IDs, versions, and run IDs. Never invent contacts, company facts, scores, emails, or outcomes.
8. Pilot before scaling. Respect task-specific spend, scale, schedule, and launch gates. Obtain authorization for sending, publishing, destructive changes, CRM mutations, and outbound pushes. A draft is not approval.
9. Retain async job and run IDs and inspect their status. After a timeout, check persisted state before retrying a write.
10. Report saved, skipped, failed, scheduled, and sent work accurately. A successful create, trigger, or start response does not establish downstream completion or recipient delivery.

Task skills and workspace knowledge

pipeline skills list --json
pipeline skills install --targets claude-code,codex --project .

MCP clients can discover and read these workflow skills:

These differ from workspace role skills and SOPs. Read current workspace loadouts, setup, skills, SOP context, and knowledge before reasoning. Use read-provider-docs for the relevant current official docs or live schemas before each new sourcing run and unfamiliar provider operations. Save knowledge or SOP drafts before publishing changes.

Sourcing preflight and refinement

This applies to every supported database and dedicated source tool. The seller's product, service or partnership objective is separate from the target audience. Accountants, 3PLs, logistics firms, manufacturers and other niches need filters for their own business, regardless of what the user sells. SaaS and founder-led are not defaults. Follow published official agent guides, AGENTS.md, llms.txt/llm.txt or API indexes, then compare relevant documented capabilities to the deployed Pipeline tool schema. Record filter semantics, returned data, freshness, pagination/async behavior and cost. If documentation or implementation is missing, disclose the gap and hold unresolved criteria.

Before the first source call, use get-agent-skill-loadout for list building, then read-skill for list-architecture and the selected provider SOP. Read the relevant official provider filter docs. Record account criteria, person criteria, hard exclusions, effective filters, evidence checks and the approved canary ceiling. Review industry, company-description keywords, products/services and team maturity. Do not reduce an account-defined ICP to one broad keyword.

For account-defined audiences, use source-companies, qualify the company description and website, then use source-people with exact account_domains and the required buyer roles. AI Ark account_keywords searches description, SEO and keyword sources; product_and_services searches what the company sells. Check the deployed tool schema before using newly added fields. Company department headcount filters and person title exclusions have different meanings: excluding titles from a founder search does not prove the company has no sales leader or SDR team. Hold unknown evidence.

Use the coding agent's current LLM to diagnose a poor canary and suggest grounded synonyms or product-category terms. Preserve hard criteria, revise optional discovery terms, and run one bounded refinement within the authorized budget. Record before/after filters and fit yield. Identical unsuitable results require an encoding/support check before more paid calls. Quotation marks do not guarantee exact matching; use only documented matching controls. Stop at review before scaling, scheduling or sending.

Exclusion QA

During list QA, group rejected rows by evidence-backed reason and propose the narrowest supported exclusion at account or person scope. Verify provider exclusion and matching semantics and the deployed schema. Never put negatives in include-only keywords. Where native exclusion is unsupported, filter returned evidence downstream before fanout or paid enrichment and preserve removed rows. Review known good rows for false exclusions, change one rule or coherent group within the existing bounded canary budget, record before/after filters and good/bad/held counts, and roll back optional exclusions that damage fit. Keep hard exclusions and workspace suppressions intact; do not over-constrain or change the audience silently.

Research execution mode

External Codex, Claude Code and other coding agents use their current inference and native web search/fetch for public research and extraction by default. Persist evidence to tables using deterministic writes. Do not invoke workspace model, search, crawler or enrichment APIs unless specifically requested or covered by a reviewed run configuration and limits. A request to source from AI Ark authorizes that scoped source call, not Prospeo, Spider.cloud, Firecrawl or another enrichment fallback. Native tools cannot guarantee inaccessible/private data; return unknown or request a concrete provider fallback.

Pipeline-hosted Chief of Staff and GTM Engineer chat uses configured workspace tools and models. It cannot use a local coding-agent subscription automatically. In external-agent chat execution, preserve the external mode through specialist handoffs. Provider-backed table operations remain provider-backed even when started from a coding agent; inspect the operation before running it.

Workspace and integrations

Inspect workspace metadata, subscription, AI settings, integrations, and connected LinkedIn accounts. Use onboarding readiness and context tools to capture the user's company, buyers, offer, and ICP. A provider in the catalog is not a connected integration.

Workspace and credential creation or deletion are explicit configuration actions. Use secure credential inputs and never print stored secrets. Updating AI settings changes defaults; it does not supply consent for hosted execution.

Strategy, ICP, segments, and campaign briefs

Read existing GTM context, ICP, strategy, and assets. Reuse identified material. Distinguish direct offer, front-end offer, and no offer. Do not invent a lead magnet or change supplied messaging without agreement.

Save ideas and briefs with their source scope and version, then validate before activation. For the Agent Teams campaign flow, follow its task skill: source preview, brief table, pilot, ICP canary, rendered sequence touches, and final prepared launch. Pilot acceptance, scaling, and final launch are separate approvals. Revisions need fresh previews and checks, not reuse of a stale launch snapshot.

Sourcing and LinkedIn data

Use people or company sourcing tools for the requested capability. Inspect connected providers and filters first. Resolve LinkedIn search parameters with the dedicated tool. Sales Navigator source tools require the identified saved source and an eligible account.

Engagers and profile/company followers are source feeds. Select the requested post or profile and account. list-post-engagers paginates internally up to its limit; report truncation. Radar has a separate provider-specific path and balance, distinct from connected-account scraping. Do not invent a Pipeline credit requirement.

Deduplicate person profiles, exclude company pages from person imports, normalize person URLs to www.linkedin.com/in/..., and retain source evidence. Hydrate sparse identities with current role and verified company data before qualification or personalization. Missing company information is not a score or a verified fact.

Tables and enrichment

Inspect table capabilities, playbooks, schema, and connected providers before adding rows or columns. Reuse an identified table. Validate structured blueprints before applying them.

Preserve separate People Data and Company Data source columns as complete provider evidence. Follow the table skill's flattening and raw-payload rules. Keep provider labels as provenance, not company names. Do not overwrite valid values with blanks.

Write external-agent reasoning with update-table-rows. Executable AI columns and provider enrichment require the chosen execution mode and credentials. Pilot a small set, inspect saved results and enrichment jobs, then ask before scaling. Export or send reviewed rows to campaigns with explicit field mappings only when requested.

Agent Teams and handoffs

Public roles: Strategist, GTM Engineer, Reply Agent, SDR Agent, GTM Lead, and Content Agent. Scout, Researcher, ICP Gate, Writer, Closer, and Coach are internal stages or keys. Native LinkedIn sending belongs to campaign workflows.

Inspect chat context, settings, loadouts, runs, work orders, and handoffs. External work uses the supported claim, validate, submit, or release lifecycle. Preserve IDs and versions; do not fabricate artifacts or claim another worker's task. External chat turns likewise have claim and completion tools; delegation is separate.

Starting roles, running skills, or sending agent chat messages can invoke hosted AI. Inspect execution classification and consent first. Read run results, spend, and failures instead of treating a trigger response as completed work.

Repeatable workflows

Agent Workflows orchestrate sourcing, enrichment, tables, agents, and destinations. They are distinct from campaign delivery graphs. Inspect plays and existing workflows, then create or update the requested graph. Plain-English compilation is a hosted operation and needs consent. Saved graphs containing Agent Task, AI Transform or hosted play nodes also require explicit allowHostedAi=true from a hosted-enabled client before manual execution. External-only clients cannot run those graphs. Deterministic graphs need no hosted-AI consent.

Review providers, branches, triggers, destinations, and approval gates before running. Manual, scheduled, webhook, and signal behavior depends on supported saved configuration. Never add a schedule because the user merely asked to build a workflow. Inspect workflow runs and evidence. Use provision-brief-table with executionMode: external_agent to compile a saved table design or create held factory columns without inference. Automatic processing remains off for this mode. Workflow trust and gate approvals that require a human are not MCP tools; use the app instead of bypassing them.

Campaigns and leads

Read the campaign guide for exact graph examples, CSV imports, variables, and launch checks.

Machine creation requires an explicit workflow_definition. Save a draft, import the requested leads, and verify graph and sender. Optional ICP scoring must precede every sending path. Connection acceptance and no-response branches must be explicit. Reply branches end the sequence. Withdrawal must never follow acceptance. InMail requires Sales Navigator eligibility and appropriate open-profile or credit checks.

Render nested custom-field variables before importing. Verify final copy and required values. Draft graph edits need the latest expectedUpdatedAt. Respect account working hours and limits.

Use add-prospects-bulk to add fresh prospects to an active campaign. Eligible new prospects are automatically enrolled in that campaign, without cloning or restarting it. Inspect the enrollment result for queued, skipped, and failed rows. Account capacity and working hours still control when queued prospects send; duplicate imports do not create another execution.

For Agent Teams prepared launches, use the exact preparation approval with launch-prepared-campaign; do not substitute the direct start tool. Direct campaigns also need explicit launch permission. Pause, resume, clone, settings, and subsequence operations must follow their current schemas and the requested scope.

Intent, signals, and engagement

Track requested sources, topics, competitors, or champions. Read the evidence behind a signal before qualification and audience preparation. Engagement indicates attention, not proven buying intent.

Inspect tracked influencers and posts. Use save-comment-draft to save caller-written comments for review. The approve, reject, edit, and send actions of review-comment-draft do not invoke hosted AI and work in external-only mode. Only regenerate invokes Pipeline hosted AI and requires explicit consent. Sending is a live LinkedIn action and still needs authorization; drafting does not authorize posting. CLI users should install pipeline-gtm@1.3.1 or newer for this behavior.

Conversations, inbox, replies, and CRM

Read actual threads through conversation list, search, and detail tools. Reply Agent handles immediate inbound classification and drafts. SDR Agent handles warm threads that went quiet and stands down on a new reply.

analyze-sentiment and generate-reply-draft are hosted AI operations. Explicit external Reply Agent drafting uses your coding-agent subscription and saves a pending native Inbox draft plus an internal CRM review task. Read approval details before resolving them; approving a reply can send it. Direct message and connection tools are live actions requiring authorization, not a way around campaign or approval checks.

External Reply Agent pickup requires deployed queue/completion support and a running authenticated external worker. A paused team or saved configuration does not prove a worker is running. A real Inbox reply has passed one-time local scheduled Codex pickup; fresh production webhook delivery and permanent pickup remain rollout gates. No AI API key or AI API credits are required, but connected providers and Pipeline authentication retain their normal credentials.

External Reply Agent configuration must scope the Inbox owner, connected account and authorized conversation IDs. Campaign-linked conversations are the default. Personal threads require explicit selected_threads scope and native CRM linkage; never expand the allowlist or invent campaign linkage to bypass readiness. Read get-agent-setup in external-agent mode, approved knowledge and the Reply Agent skill loadout before drafting.

On a compatible deployment, discover jobs with list-agent-chats and externalInbox: true (native API: GET /api/agents/conversations?workspaceId=WORKSPACE_ID&externalInbox=true). Claim the exact turn with claim-agent-chat-turn and obey its draftOnly and completionInstructions. Complete Reply Agent work with text, model, provider, the claim token and replyInterpretation. Interpretation contains stage, sentiment, confidence (0..1), keyTopics, detectedIntents, urgencyLevel, nextBestAction (review_reply or needs_human) and grounded reasoning. Escalate unsupported claims or personal endorsements with needs_human; never infer a won deal. Completion does not authorize sending, approval, scheduling, booking or external CRM mutation. Honor stale-source, human-takeover and configuration failures. Reuse returned recovery completions instead of generating again. Discover the deployed schema before passing newly added fields; installed CLI snapshots and SDK types need a release to include them.

For external SDR drafting, first inspect get-agent-setup with executionMode: "external_agent", approved Reply/SDR knowledge, and the SDR configuration. External drafting must explicitly name its Inbox owner, connected account and authorized conversation IDs; the caller must be that configured owner. Do not enable it, invent knowledge, or add conversations just to bypass a readiness failure.

Call trigger-agent-role with role: "sdr", executionMode: "external_agent" and externalSdrMode: "queued" to retrieve existing Pipeline-scheduled drafting jobs. Use externalSdrMode: "detect" only when authorized to check the configured quiet threads now. Detection checks actual delivered-message history and cadence; an unsent draft does not start the follow-up clock.

Claim the returned turn through claim-agent-chat-turn, follow its draftOnly and completionInstructions, then submit the follow-up text with the claim token through complete-agent-chat-turn. This saves a pending native Inbox draft and CRM review task, without sending, approving or scheduling delivery. A new inbound reply or human takeover can invalidate the work; honor that result rather than retrying around it.

Use the existing Inbox draft review flow for edits, rejection, manual-delivery confirmation and requested follow-ups. Rejecting an external draft queues external revision instead of invoking hosted AI. Review the replacement draft, not a superseded one. Manual-delivery confirmation records what a human already sent; it must not send the same text again. Requested follow-ups still require real conversation evidence and approval before live delivery. These review tasks are Pipeline CRM records, not authorization to mutate an external CRM.

Connection acceptance can arrive through Unipile's delayed new_relation webhook or Pipeline's scheduled first-degree relation polling. Polling runs every 15 minutes and records the same deduplicated acceptance evidence; analytics refreshes every five minutes. A sent request is not an accepted connection, and a queued execution is not proof of delivery. Verify provider facts and persisted actions before reporting success. LinkedIn sending hours, daily caps and campaign authorization remain authoritative.

Inspect CRM stages, notes, activities, tags, and tasks before changes. Confirm the destination and authorized mutation. A reply does not automatically authorize an external CRM update.

Content research, planning, and publishing

Read author context, strategy, voices, inspiration, watches, recommendations, existing posts, and performance. Preserve source evidence. Do not invent the author's experiences, results, or quotes.

Use preparation/submission tools for external-agent authoring where supported. Save strategy and posts or follow structured content work's prepare/run/submit lifecycle. Hosted generation and analysis have separate consent and configuration. Inspect outputs before promoting or exporting them.

For author setup, reuse GTM context and confirm expertise pillars through update-content-work. Keep company case studies distinct from the author's personal role and achievements. Creator guidance belongs to the selected voice: use list-content-creator-inspirations with voiceId, search-content-creator-profiles for a name or LinkedIn profile URL, and save-content-creator-inspiration for server-resolved identity and guidance. Pass the existing creator ID when editing and legacyId only when explicitly assigning an unassigned creator. import-content-creator-posts imports up to five recent examples into Library, requires a stable UUID operationKey for retries, and does not certify virality. Read saved state after a partial failure before retrying.

Use saved inspiration and collections as evidence. Caller-supplied analysis supports external-agent execution; hosted analysis requires explicit consent. Pass the chosen referenceId when preparing a brief rather than silently selecting the first source. Creator patterns can guide structure and expression, but never establish the author's claims, experiences or results.

Publishing and scheduling require separate authorization. Verify author/account, final copy, media, timezone, and time. Saving does not authorize scheduling or publication. Read the resulting post and analytics rather than assuming downstream success.

Analytics and improvement

Inspect campaign, account, reply, ICP, brief, and content metrics for the requested period. Check pending and failed actions and execution progress. Compare equivalent audiences and periods; do not infer meetings, revenue, or deliveries from drafts.

Use GTM Lead briefing and performance reviews to identify list, offer, copy, or timing issues. Propose a clear experiment. Preview revisions and refresh required canary and approval checks before applying or launching them. Accepting a coach action can trigger work; inspect consequences first.

Blocklists, async jobs, and webhooks

Check exclusions before preparing audiences. Scope blocklist changes correctly. Poll jobs with their returned ID and cancel only the intended job.

Discover outbound webhook event types before subscribing. Configure the user's endpoint and selected events, then inspect tests and deliveries. Outbound subscription signing secrets differ from inbound provider webhook configuration. Tests, redeliveries, and outbound events call external systems; they are not read-only checks. Secret rotation and endpoint deletion need authorization.

Complete tool index

The following index includes every tool in the current catalog, including advanced operations. For complete arguments, nested fields, output shapes, and examples, open the linked operation or inspect its discovered schema. The index is discovery guidance, not blanket authorization. If a requested app action has no discovered tool, say so and use the supported app flow rather than inventing an endpoint.

Catalog snapshot: 250 tools across 24 categories. Discover current tools before use.

Campaigns

Prospects

Analytics

LinkedIn Accounts

Conversations

Enrichment Tables

Signals

Raw Data

Content

| discover-content-creators | Find up to ten evidence-linked creator candidates from one bounded LinkedIn topic search. Follower size remains unknown when unavailable. | | submit-content-reference-analysis | Validate and save caller-authored reference analysis using the source SHA-256 hash. No hosted AI call. Extract an unchanged opening hook; do not infer spoken hooks. | | update-content-inspiration | Edit saved status or optional save rationale without changing source facts or invoking AI. | | list-content-collections | Read workspace inspiration collections and their reference memberships. | | create-content-collection | Create an optional named inspiration collection. Returns a stable collection ID. | | update-content-collection | Rename a collection or add/remove up to twenty saved references. Membership retries are idempotent. | | delete-content-collection | Delete a collection and its memberships, preserving saved source posts and drafts. | | list-content-creator-inspirations | Read creator guidance assigned to a selected author, with unassigned legacy records for explicit review. | | save-content-creator-inspiration | Resolve and save a LinkedIn creator and structural guidance for the selected author. No following, publishing or automatic post import. | | search-content-creator-profiles | Search a creator name or resolve an exact LinkedIn profile URL through a selected connected account. Returns at most eight people. | | import-content-creator-posts | Explicitly import up to five recent authored posts for a saved creator into Library. Replay-safe, no following or publishing. |

Engagement

Inbox

Search

Workspaces

Webhooks

CRM / Pipeline

ICP / GTM

Blocklist

Async Jobs

Messaging

Agents

Approvals

Strategy

Campaign Briefs

Workflows v2 (Plays)

For review-only influencer QA, call track-influencer with status: "paused" and shouldFollow: false, then discover-tracked-posts with an explicit limit (maximum 5). Read the saved post before authoring save-comment-draft. These operations do not authorize posting or scheduled polling.