Check an Agent's credentials
For each remote MCP server and each HTTP tool with a credential that Agent agentId's manifest version declares (its own, its agents used as tools' and a flow's), the credential its sessions would send: the Agent's secret bound to the URL (covered), or none (missing). No secret is read and no server is called.
managementKeyAuthorizationBearer <token>A management key of the Tenant (role management): it reaches the Management API (/v1/tenant/*) and /v1/me, as itself, never for a subject. Issued only on the Tenant's machine (nylorun-operate keys put <id> --role management) or from NYLORUN_MANAGEMENT_KEY_FILE. Never accepted from a browser (Origin).
Nylorun-Protocol*stringThe protocol version, 18
application/json- body
requestId?string1 <= lengthagentId*stringAn Agent id, such as triage or users/alice/triage
One entry per declared URL
application/json- response
agentId*stringcomplete*booleanentries*array<>import { createAdmin } from "@nylorun/admin";const admin = createAdmin();const coverage = await admin.coverage({ agentId: "users/alice/support" });{ "agentId": "string", "complete": true, "entries": [ { "kind": "mcp", "agentId": "string", "stage": "string", "name": "string", "serverName": "string", "url": "string", "required": true, "status": "covered", "credential": { "agentId": "string", "name": "string", "via": "string" }, "message": "string" } ]}Set the Tenant's tool policy PUT
Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). A `tool` with `__` in it, a model-facing `server__tool` name, is refused (`400`): name an MCP tool by `server` and `tool`. A stored policy with such a rule refuses every call until it is set again. Sandbox tools never cross the gate. An empty list allows every call.
Preview an MCP server's tools POST
Connects to the remote MCP server at `url` with the credential for that URL in the vault of the Agent `agentId`, if given (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.